Easy Access Rules for Acceptable Means of Compliance for Airworthiness of Products, Parts and Appliances (AMC-20) Amdt 23

Easy Access Rules for Acceptable Means Disclaimer of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20)

D ISCLAIMER

This document is issued by the European Union Aviation Safety Agency ( referred to as both ‘EASA’ and ‘the Agency’ ) to provide its stakeholders with an updated , consolidated, and easy - to - read publication.

It has been prepared by putting together the officially published acceptable means of compliance (AMC) and guidance material (GM) ( including the ir amendments ) adopted so far . However, this document is not an official publication , and EASA accepts no liability for damage of any kind resulting from the risks inherent in its use.

Powered by EASA eRules Page 3 of 605 | Jun 2023

Easy Access Rules for Acceptable Means Note from the editor of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20)

N OTE FROM THE EDITOR

The content of this document is arranged as follows: the acceptable means of compliance ( AMC) are followed by the related guidance material ( GM ).

All elements (i.e. AMC and GM ) are colour - coded and can be identified according to the illustration below. The EASA Executive Director (ED) decision through which the AMC or GM was introduced or last amended is indicated below the AMC or GM in italics .

Acceptable means of compliance

ED decision

Guidance material

ED decision This document will be updated regularly to incorporate further amendments.

The format of this document has been adjusted to make it user - friendly and for reference purposes.

Any comments should be sent to erules@easa.europa.eu .

Powered by EASA eRules Page 4 of 605 | Jun 2023

Easy Access Rules for Acceptable Means Incorporated amendments of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20)

I NCORPORA TED A MENDMENTS

AMC /GM ( ED DECISIONS )

Incorporated ED Decision AMC /GM Issue No, Amendment No Applicability date ED Decision 2003/12/RM AMC - 20/ Initial i ssue 5 /11 /200 3 ED Decision 2006/012/R AMC - 20/ Amendment 1 29/12/2006 ED Decision 2007/019/R AMC - 20/ Amendment 2 26/12/2007 ED Decision 2008/004/R AMC - 20/ Amendment 3 2/5/2008 ED Decision 2008/007/R AMC - 20/ Amendment 4 5/9/2008 ED Decision 2009/019/R AMC - 20/ Amendment 5 23/12/2009 ED Decision 2010/003/R AMC - 20/ Amendment 6 26/07/2010 ED Decision 2010/012/R AMC - 20/ Amendment 7 23/12/2010 ED Decision 2011/001/R AMC - 20/ Amendment 8 30/3/2011 ED Decision 2012/014/R AMC - 20/ Amendment 9 24/9/2012 ED Decision 2013/026/R AMC - 20/ Amendment 10 1/1/2014 ED Decision 2013/030/R AMC - 20/ Amendment 1 1 1/1/2014 ED Decision 2014/001/R AMC - 20/ Amendment 1 2 8/2/2014 ED Decision 2015/017/R AMC - 20/ Amendment 1 3 16/7/2015 ED Decision 2017/020/R AMC - 20/ Amendment 1 4 25/10/2017 ED Decision 2018/008/R AMC - 20/ Amendment 1 5 28/8/2018 ED Decision 2019/008/R AMC - 20/ Amendment 1 6 9/7/2019 ED Decision 2019/011/R AMC - 20/ Amendment 1 7 1/5/2019 ED Decision 2020/006/R AMC - 20/ Amendment 1 8 1/1/2021 ED Decision 2020/010/R AMC - 20/ Amendment 1 9 1/1/2021 ED Decision 2020/023/R AMC - 20/ Amendment 20 18/12/2020 AMC - 20/ Amendment 21 ED Decision 2021/006/R 24/4/2021 ED Decision 2021/007/R AMC - 20/ Amendment 22 29/5/2021 ED Decision 2022/001/R AMC - 20/ Amendment 2 3 27/1/2022 Note: To access the official versions , please click on the hyper links provided above.

This is the main applicability date defined in the ED Decision. However, the ED Decision allowed that this AMC was not applied to applications received until 30 June 2014, if so requested by the applicant and providing that in such a case the applicant co uld demonstrate that the process of development of the relevant part or applia nce started before the entry into force of the ED Decision (1 January 2014), in accordance with the specifications applicable at that time.

Powered by EASA eRules Page 5 of 605 | Jun 2023

Easy Access Rules for Acceptable Means Table of contents of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20)

T ABLE OF CONTENTS

AMC 20 - 1A Certification of Aircraft Propulsion Systems Equipped with Electronic AMC 20 - 2B Certification of Essential Auxiliary Power Units (APUs) Equipped with AMC 20 - 3B Certification of Engines Equipped with Electronic Engine Control AMC 20 - 6B Extended - range operation with two - engine aeroplanes ETOPS Powered by EASA eRules Page 6 of 605 | Jun 2023 Easy Access Rules for Acceptable Means Table of contents of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 9 Acceptable Means of Compliance for the Approval of Departure AMC 20 - 10 Acceptable Means of Compliance for the Approval of Digital ATIS via AMC 20 - 15 Airworthiness Certification Considerations for the Airborne Collision Appendix 1 to AMC 20 - 15 – ACAS II/Mode S Transponder Ground Testing Precautions AMC 20 - 20B Continuing structural integrity programme ................................ .. 168 Appendix 1 to AMC 20 - 20B Guidelines for the development of a supplementary Appendix 2 to AMC 20 - 20B Guidelines for the development of a programme to preclude Appendix 3 to AMC 20 - 20B Guidelines for establishing instructions for continued Annex 3 to Appendix 3 to AMC 20 - 20B Repairs and modifications to removable Annex 5 to Appendix 3 to AMC 20 - 20B List of major changes and STCs that may adversely affect fatigue - critical structure ................................ ................................ . 255 Annex 6 to Appendix 3 to AMC 20 - 20B Background to the need for damage - tolerance - Appendix 4 to AMC 20 - 20B Guidelines for the development of a corr osion prevention Appendix 5 to AMC 20 - 20B — Guidelines for ensuring the validity of continuing AMC 20 - 21 Programme to enhance aeroplane Electrical Wiring Interconnection Powered by EASA eRules Page 7 of 605 | Jun 2023 Easy Access Rules for Acceptable Means Table of contents of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20) Appendix C to AMC 20 - 21 Determination if a major change to an aircraft should be AMC 20 - 22 Aeroplane Electrical Wiring Interconnection System Training Appendix A to AMC 20 - 22 – EWIS Minimum Initial Training Programme for Group 1 and Appendix B to AMC 20 - 22 – EWIS Minimum Initial Training Programme for Group 3 AMC 20 - 23 Development of Electrical Standard Wiring Practices documentation Appendix A: Groups, Major Topics, Standardised Sequence and Description of Minimum Content ................................ ................................ ................................ . 345 AMC 20 - 24 Certification Considerations for the Enhanced ATS in Non - Radar Areas using ADS - B Surveillance (ADS - B - NRA) Applicati on via 1090 MHZ Extended Appendix 2 to AMC 20 - 29 – Definitions ................................ ................................ .. 406 AMC 20 - 115D Airborne Software Development Assurance Using EUROCAE ED - 12 Powered by EASA eRules Page 8 of 605 | Jun 2023 Easy Access Rules for Acceptable Means Table of contents of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 128A Design Considerations for Minimizing Hazards Caused by Appendix 2 to AMC 20 - 136A — Examples of lightning safety assessment considerations — Level A systems on large aeroplanes ................................ ................................ .. 492 AMC 20 - 152A Development Assurance for Airborne Electronic Hardware (AEH) AMC 20 - 158A Aircraft electrical and electronic sy stem high - intensity radiated Appendix 3 to AMC 20 - 158A — Examples of HIRF safety assessment considerations — Powered by EASA eRules Page 9 of 605 | Jun 2023

Easy Access Rules for Acceptable Means Preamble of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20)

P REAMBLE

ED Decision 2022/001/R Amendment 23 The following is a list of paragr aphs affected by this amendment: AMC 20 - 136A Amended ( NPA 2020 - 09 ) AMC 20 - 158A Amended ( NPA 2020 - 09 ) AMC 20 - 193 Created ( NPA 2020 - 09 ) SUBPART B — LIST OF AMC - 20 ITEMS Amended ( NPA 2020 - 09 ) ED Decision 2021/007 /R Amendment 2 2 The following is a list of paragr aphs affected by this amendment: AMC 20 - 20 B Amended ( NPA 2013 - 07 ) Appendix 1 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Appendix 2 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Anne x 1 to Appendix 2 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Anne x 2 to Appendix 2 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Appendix 3 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Anne x 1 to Appendix 3 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Anne x 2 to Appendix 3 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Anne x 3 to Appendix 3 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Anne x 4 to Appendix 3 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Anne x 5 to Appendix 3 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Anne x 6 to Appendix 3 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Appendix 4 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) Appendix 5 to AMC 20 - 20B Amended ( NPA 2013 - 07 ) ED decision 2021/006/R Amendment 21 The following is a list of paragr aphs affected by this amendment: AMC 20 - 6B Amended ( NPA 2017 - 15 ) Appendix 1 to AMC 20 - 6B Amended ( NPA 2017 - 15 ) Appendix 2 to AMC 20 - 6B Amended ( NPA 2017 - 15 ) Appendix 3 to AMC 20 - 6B Amended ( NPA 2017 - 15 ) Appendix 4 to AMC 20 - 6B Amended ( NPA 2017 - 15 ) Appendix 5 to AMC 20 - 6B Amended ( NPA 2017 - 15 ) Appendix 6 to AMC 20 - 6B Amended ( NPA 2017 - 15 ) Appendix 7 to AMC 20 - 6B Amended ( NPA 2017 - 15 ) Appendix 8 to AMC 20 - 6B Amended ( NPA 2017 - 15 ) Powered by EASA eRules Page 10 of 605 | Jun 2023 Easy Access Rules for Acceptable Means Preamble of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20) ED Decision 2020/023/R Amendment 20 The following is a list of paragr aphs affected by this amendment: AMC 20 - 20A Amended ( NPA 2013 - 07 ) Appendix 1 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) Appe ndix 2 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) Annex 1 to Appe ndix 2 to AMC 20 - 20A Created ( NPA 2013 - 07 ) Annex 2 to Appe ndix 2 to AMC 20 - 20A Created ( NPA 2013 - 07 ) Appe ndix 3 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) Annex 1 to Appendix 3 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) Annex 2 to Appendix 3 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) Annex 3 to Appendix 3 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) Annex 4 to Appendix 3 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) Annex 5 to Appendix 3 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) Annex 6 to Appendix 3 to AMC 20 - 20A Created ( NPA 2013 - 07 ) Appe ndix 4 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) Appe ndix 5 to AMC 20 - 20A Amended ( NPA 2013 - 07 ) ED Decision 2020/010/R Amendment 19 The following is a list of paragr aphs affected by this amendment: SUBPART A — GENERAL Created AMC 20 - 1 Amended ( NPA 2017 - 09 ) AMC 20 - 2 Amended ( NPA 2017 - 09 ) AMC 20 - 3 Amended ( NPA 2017 - 09 ) AMC 20 - 8 Amended ( NPA 2016 - 19 ) AMC 20 - 19 Created ( NPA 2017 - 09 ) AMC 20 - 152A Created ( NPA 2018 - 19 ) AMC 20 - 189 Created ( NPA 2018 - 19 ) SUBPART B — LIST OF AMC - 20 ITEMS Created ED Decision 2020/006/R Amendment 18 The following is a list of paragr aphs affected by this amendment: AMC 20 - 42 Created ( NPA 2019 - 01 ) ED Decision 2019/011/R Amendment 17 The following is a list of paragr aphs affected by this amendment: AMC 20 - 4A Cancelled ( NPA 2018 - 02 ) AMC 20 - 5 Cancelled ( NPA 2018 - 02 ) AMC 20 - 12 Cancelled ( NPA 2018 - 02 ) Powered by EASA eRules Page 11 of 605 | Jun 2023 Easy Access Rules for Acceptable Means Preamble of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 26 Cancelled ( NPA 2018 - 02 ) AMC 20 - 27A Cancelled ( NPA 2018 - 02 ) AMC 20 - 28 Cancelled ( NPA 2018 - 02 ) ED Decision 2019/008/ R Amendment 16 The following is a list of paragr aphs affected by this amendment: AMC 20 - 25 Amended ( NPA 2016 - 12 ) ED Decision 2018/008/R Amendment 15 The following is a list of paragr aphs affected by this amendment: AMC 20 - 1 70 Created ( NPA 2017 - 11 ) ED Decision 2017/020/R Amendment 14 The following is a list of paragr aphs a ffected by this amendment: AMC 20 - 115 Amended ( NPA 2017 - 02 ) ED Decision 2015/017/R Amendment 13 The following is a list of paragr aphs affected by this amendment: AMC 20 - 136 Created ( NPA 2014 - 16 ) AMC 20 - 158 Created ( NPA 2014 - 16 ) ED Decision 2014/001/R Amendment 12 The following is a list of paragr aphs affected by this amendment: AMC 20 - 2 5 Created ( NPA 2012 - 02 ) ED Decision 2013/030/R Amendment 11 The following is a list of paragr aphs affected by this amendment: AMC 20 - 11 Cancelled ( NPA 2013 - 06 ) AMC 20 - 13 Cancelled ( NPA 2012 - 19 ) Powered by EASA eRules Page 12 of 605 | Jun 2023 Easy Access Rules for Acceptable Means Preamble of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20) ED Decision 2013/026/R Amendment 10 The following is a list of paragr aphs affected by this amendment: AMC 20 - 2 A mended ( NPA 2012 - 11 ) AMC 20 - 3 A mended ( NPA 2012 - 11 ) AMC 20 - 4 A mended ( NPA 2012 - 11 ) AMC 20 - 27 A mended ( NPA 2012 - 11 ) AMC 20 - 115 A mended ( NPA 2012 - 11 ) ED Decision 2012/014/R Amendment 9 The following is a list of paragr aphs affected by this amendment: AMC 20 - 28 Created ( NPA 2009 - 04 ) ED Decision 2011/001/R Amendment 8 The following is a list of paragr aphs affected by this amendment: AMC 20 - 15 Created ( NPA 2010 - 03 ) ED Decision 2010/012/R Amendment 7 The following is a list of paragr aphs af fected by this amendment: AMC 20 - 6 rev. 2 Created ( NPA 2008 - 01 ) AMC 20 - 6 adopted on the 05/11/2003 by means of ED Decision 2003/12/RM is replaced by AMC 20 - 6 rev. 2.

ED Decision 2010/003/R Amendment 6 The following is a list of paragr aphs affected by this amendment: AMC 20 - 29 Created ( NPA 2009 - 06 ) ED Decision 2009/019/R Amendment 5 The following is a list of paragr aphs affected by this amend ment: AMC 20 - 26 Created ( NPA 2008 - 14 ) AMC 20 - 27 Created ( NPA 2008 - 14 ) Powered by EASA eRules Page 13 of 605 | Jun 2023 Easy Access Rules for Acceptable Means Preamble of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20) ED Decision 2008/007/R Amendment 4 The following is a list of paragr aphs affected by this amendment: AMC 20 - 21 Created ( NPA 2007 - 01 ) AMC 20 - 22 Created ( NPA 2007 - 01 ) AMC 20 - 23 Created ( NPA 2007 - 01 ) ED Decision 2008/004/R Amendment 3 The following is a list of paragr aphs affected by this amendment: AMC 20 - 24 Created ( NPA 2007/05 ) ED Decision 2007/019 /R Amendment 2 The following is a list of paragr aphs affected by this amendment: AMC 20 - 1 Amended ( NPA 04/2005 ) AMC 20 - 3 Created ( NPA 04/2005 ) AMC 20 - 11 Created ( NPA 11/2005 ) AMC 20 - 20 Created ( NPA 05/2006 ) E D Decision 2006/012 /R Amendment 1 The followin g is a list of paragr aphs affected by this amendment: AMC 20 - 9 Created AMC 20 - 10 Created AMC 20 - 12 Created AMC 20 - 13 Created Powered by EASA eRules Page 14 of 605 | Jun 2023

Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 1A Products, Parts and Appliances (AMC - 20)

SUBPART A — GENERAL

ED Decision 2020/010/R

AMC 20 - 1A

AMC 20 - 1 A Certification of Aircraft Propulsion Systems Equipped

with Electronic Control Systems

ED Decision 2020/010 /R 1 GENERAL The existing certification specifications (CSs) for Engine, Propeller and aircraft certification may require special interpretation for Engines and Propellers equipped with electronic control systems. Because of the nature of this technology and because of the greater interdependence of Engine, P ropeller and aircraft systems, it has been found necessary to prepare acceptable means of compl iance (AMC) specifically addressing the certification of these electronic control systems.

AMC 20 - 1 () addresses the compliance tasks relating to the certification of the installation of propulsion systems equipped with electronic control systems. AMC 20 - 3 is dedicated to the certification of Engine control systems but identifies some Engine - installation - related issues that should b e read in conjunction with AMC 20 - 1 () .

Like any AMC , it is issued to outline issues to be considered during demonstration of compliance with the CSs.

2 RELEVANT SPECIFICATIONS For aircraft certification, some of the related CS s are: — for aeroplanes in CS - 25 (and, where applicable, CS - 23) : — paragraphs 33, 581, 631, 899, 901, 903, 905, 933, 937, 939, 961, 994, 995, 1103(d), 1143 (except (d)), 1149, 1153, 1155, 1163, 1181, 1183, 1189, 1301, 1305, 1307(c), 1309, 1337, 1351(b) and (d), 1353(a) and (b), 1355(c), 1357, 1431, 1461, 1521(a), 1527; — f o r rotorcraft: equivalent specifications in CS - 27 and CS - 29.

3 SCOPE This AMC is relevant to the CSs for aircraft installation of Engines or Propellers with electronic control systems, whether using electrical or electronic (analogue or digital) technology.

It gives guidance on the precautions to be taken for the use of electrical and electronic technology for Engine and Propeller control, protection and monitoring, and, where applicable, for integration of functions specific to the aircraft.

Precautions hav e to be adapted to the criticality of the functions. These precautions may be affected by the degree of authority of the system, the phase of flight, and the availability of a backup system.

This document also discusses the division of compliance tasks bet ween the applicants for Engine, Propeller (when applicable) , and aircraft type certificates. This guidance relates to issues to be considered during aircraft certification.

Powered by EASA eRules Page 15 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 1A Products, Parts and Appliances (AMC - 20) It does not cover APU control systems ; APU s, which are not used as ‘propulsion syst ems’ , are addressed in the dedicated AMC 20 - 2() .

4 PRECAUTIONS (a) General The introduction of electrical and electronic technology can entail the following: — greater dependence of the Engine or Propeller and the aircraft owing to the exchange of electri cal power and/or data between them; — increased integration of the control an d related indication functions; — a risk of significant F ailures that are common to more than one Engine or Propeller of the aircraft which might, for example, occur as a result of: — i nsufficient protection from electromagnetic disturbance ( e.g. lightning, internal or external radiation effects); — i nsufficient integrity of the a ircraft electrical power supply; — i nsufficient integrity of data supplied from the aircraft; — h idden des ign faults or discrepancies contained within the design of the propulsion system control software or airborne electronic hardware (AEH); or — o missions or errors in the system/software /AEH specification.

Appropriate design and integration precautions shoul d therefore be taken to minimise these risks.

(b) Objective The introduction of electronic control systems should provide for the aircraft at least the equivalent level of safety, and the related reliability level, as achieved in aircraft equipped with Eng ine and Propellers using hydromechanical control and protection systems.

When possible, early co ordination between the Engine, Propeller and aircraft applicants is recommended in association with EASA as discussed in Section 5 of this AMC.

(c) Precautions relating to electrical power supply and data from the aircraft When considering the objectives of Section 4 (a) or (b), due consideration should be given to the reliability of electrical power and data supplied to the electronic control systems and peripher al components. The potential adverse effects on Engine and Propeller operation of any loss of electrical power supply from the aircraft or failure of data coming from the aircraft are assessed during the Engine and Propeller certification.

During aircraft certification, the assumptions made as part of the Engine and Propeller certification on reliability of aircraft power and data should be checked for consistency with the actual aircraft design.

Aircraft should be protected from unacceptable effects of fau lts due to a single cause, simultaneously affecting more than one Engine or Propeller. In particular, the following cases should be considered: — e rroneous data received from the aircraft by the Engine/Propeller control system if the data source is common to more than one Engine/Propeller (e.g. air data sourc es, autothrottle synchronising); and Powered by EASA eRules Page 16 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 1A Products, Parts and Appliances (AMC - 20) — c ontrol system operating faults propagating via data links between Engine/Propellers (e.g. maintenance recording, common bus, cross - talk, autofeathering, automatic res erve power system).

Any precautions needed may be taken either through the aircraft system architecture or by logic internal to the electronic control system.

(d) Local events For Engine and Propeller certification, effects of local events should be assess ed.

Whatever the local event, the behaviour of the electronic control system should not cause a hazard to the aircraft. This will require consideration of effects such as the control of the thrus t reverser deployment, the over speed of the Engine, transien t effects or inadvertent Propeller pitch change under any flight condition.

When the demonstration that there is no hazard to the aircraft is based on the assumption that there exists another function to afford the necessary protection, it should be shown that this function is not rendered inoperative by the same local event (including destruction of wires, ducts, power supplies).

Such assessment should be reviewed during aircraft certification.

(e) Software and airborne electronic hardware (AEH) The acceptability of the criticality levels and methods used for the development and verification of software and AEH which are part of the Engine and Propeller type designs should have be en agreed between the aircraft, Engine and Propeller designers prior to the certification activity.

Note: In this AMC, the ‘criticality level’ is used to reflect either the software level of a software item or the AEH design assurance level (or DAL) of an AEH item.

(f) Environmental effects The validated protection levels for the Engine and Propeller electronic control systems as well as their emissions of radio frequency energy are established during the Engine and Propeller certification and are contained in the instructions for installatio n. For the aircraft certification, it should be substantiated that these levels are appropriate .

5 INTER RELATION BETWEEN ENGINE, PROPELLER AND AIRCRAFT CERTIFICATION (a) Objective To satisfy the aircraft certification specifications, such as CS 25.901, CS 25.903 and CS 25.1309, an analysis of the consequences of failures of the system on the aircraft has to be made. It shou ld be ensured that the software/AEH criticality levels and the safety and reliability objectives for the electronic control system are c onsistent with these requirements.

(b) Interface Definition The interface has to be identified for the AEH and software aspects between the Engine, Propeller and the aircraft systems in the appropriate documents.

The Engine/Propeller/aircraft docume nts sho uld cover in particular: — t he software /AEH criticality level (per function if necessary); Powered by EASA eRules Page 17 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 1A Products, Parts and Appliances (AMC - 20) — t he reliability objectives for a loss of Engine/Propeller control or significant change in thrust (including an IFSD due to a control system mal function), or for t he transmission of faulty parameters; — t he degree of protection against lightning or other electromagnetic effects (e.g. the level of induced voltages that can be supported at the interfaces); — Engine, Propeller and aircraft interface data and c haracteristics; and — the a ircraft power supply and its characteristics (if relevant).

(c) Distribution of Compliance Demonstration The certification tasks of the aircraft propulsion system equipped with electronic control systems may be shared between the Engine, Propeller and aircraft certification. The distribution between the different certification activities should be identified and agreed with EASA and/or the a ppropriate Engine and aircraft a uthorities (an example is given in Section 6 ‘TABLE’ ).

Appr opriate evidence provided for Engine and Propeller certification should be used for aircraft certification. For example, the quality of any aircraft function software /AEH and aircraft/Engine/Propeller interface logic already demonstrated for Engine or Prop eller certification should need no additional substantiation for aircraft certification.

Aircraft certification should deal with the specific precautions taken in respect of the physical and functional interfaces with the Engine/Propeller.

6. TABLE The fol lowing is an example of the distribution of the tasks between the Engine certification and the aircraft certification. (When necessary, a similar approach should be taken for Propeller applications .)

SUBSTANTIATION UNDER CS - 25 SUBSTANTIATION TASK UNDER CS - E with E ngine data with aircraft data ENGINE CONTROL — Safety objective — Consideration of AND PROTECTION common mode — Software / AEH effects (including criticality level software and AEH ) — Reliability — Software/AEH criticality level MONITORING — Independence of — Monitoring — Indication system control and parameter reliability reliability monitoring — Independence parameters Engine/E ngine AIRCRAFT DATA — Protection of E ngine — Aircraft data reliability from aircraft data — Independence failures Engine/E ngine — Software/ AEH criticality level Powered by EASA eRules Page 18 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 1A Products, Parts and Appliances (AMC - 20) SUBSTANTIATION UNDER CS - 25 SUBSTANTIATION TASK UNDER CS - E with E ngine data with aircraft data THRUST REVERSER — Software/ AEH — System reliability — Safety objectives CONTROL/ criticality level — Architecture MONITORING — Consideration of common mode effects (including software and AEH ) CONTROL SYSTEM — Reliability or quality — Reliability of quality of ELECTRICAL SUPPLY Requirement of aircraft supply, if used aircraft supply, if — Independence used Engine/E ngine ENVIRONMENTAL — Equipment — Declared capability — Aircraft design CONDITIONS protection LIGHTNING AND — Equipment — Declared capability — Aircraft wiring OTHER protection protection and — Declared emissions ELECTROMAGNETIC Electromagnetic electromagnetic EFFECTS emissions compatibil ity FIRE PROTECTION — Equipment — Declared capability — Aircraft design protection [Amdt 20/2] [Amdt 20/19 ] Powered by EASA eRules Page 19 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 2B Products, Parts and Appliances (AMC - 20)

AMC 20 - 2B

AMC 20 - 2 B Certification of Essential Auxiliary Power Units (APUs)

Equipped with Electronic Controls

ED Decision 20 20 / 010 /R 1. GENERAL The existing certi fication specifications (CSs) for APU and aircraft certification may require special interpretation for essential APU equipped with electronic control systems. Because of the nature of this technology , it has been found necessary to prepare acceptable means of compliance (AMC) specifically addressing the certification of these electronic control systems.

Like any AMC , the content of this document is not mandatory. It is issued for guidance purposes, and to outline a method of compl iance with the CSs . In lieu of following this method, an alternative method may be followed, provided that this is agreed by EASA as an acceptable method of compliance with the CSs .

This document discusses the compliance tasks relating to both the APU and the aircraft certification.

2 RELEVANT SPECIFICATIONS 2.1 APU c ertification CS - APU — Book 1, paragraph 2(c) ; — Book 1, Section A, paragraphs 10(b), 20 , 80, 90, 210, 220, 280 and 530; — Book 2, Section A, AMC CS - APU 20 .

2.2 Aircraft c ertification Aeroplane s: CS - 25 — paragraphs 581, 899, 901, 903, 939, 1141, 1163, 1181, 1183, 1189, 1301, 1305, 1307(c), 1309, 1337, 1351(b) and (d), 1353(a) and (b), 1355(c), 1357, 1431, 1461, 1521, 1524, 1527 3 SCOPE This AMC provides guidance on electron ic (analogue and digital) essential APU control systems, on the interpretation and means of compliance with the relevant APU and aircraft certification requirements.

It gives guidance on the precautions to be taken for the use of electronic technology for APU control, protection and monitoring and, where applicable, for integration of functions specific to the aircraft.

Precautions have to be adapted to the criticality of the functions. These precautions may be affected by: — d eg ree of authority of the system ; — phase of flight; — availability of back up system.

Powered by EASA eRules Page 20 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 2B Products, Parts and Appliances (AMC - 20) This document also discusses the division of compliance tasks between the APU and the aircraft certification.

4 PRECAUTIONS 4.1 General The introduction of electronic technology can entail the following: (a) greater inter dependence of the APU and the aircraft owing to the exchange of electrical power and/or data between them; (b) a r isk of significant failures which might, for example, occur as a result of: (i) i nsufficient protection from electromagnetic disturbance ( e.g. lightning, internal or external radiation effects); (ii) i nsufficient integrity of the a ircraft electrical power supply; (iii) i nsufficient integrity of data supplied from the aircraft; (iv) h idden design faults or discrep ancies contained within the des ign of the APU control software/airborne electronic hardware (AEH); or (v) o missions or errors in the system specification.

Appropriate design and integration precautions must therefore be taken to minimise these risks.

4.2 O bjective The introduction of electronic control systems should provide for the aircraft at least the equivalent level of safety, and the related reliability level, as achieved by an essential APU equipped with hydromechanical control and protection systems .

This objective, when defined during the aircraft/APU certification for a specific application, will be agreed with EASA .

4.3 Precautions related to APU control, protection and monitoring The software and AEH associated with the APU control, protection an d monitoring functions must have a criticality level and a rchitecture appropriate to the criticality of the functions performed .

For digital systems, any residual errors not detec ted during the software /AEH development and certification process could cause an unacceptable failure. The latest edition of AMC 20 - 115 / AMC 20 - 152 constitutes an acceptable means of compliance for software /AEH development , verification and software /AEH aspects of certification. The APU sof tware /AEH criticality level should be determined by the APU and aircraft/system safety assessment process; ED - 79A/ARP4754A and ARP4761 provide guidelines on how to conduct an aircraft/APU/system safety assessment process .

I t should be noted that the software /AEH development assurance methods and disciplines described in the latest edition of AMC 20 - 115 / AMC 20 - 152 may not, in themselves, be sufficient to ensure that the overall system safety and reliability targets have been achieved. This is particularly true for certain critical systems, such as ful l authority digital engine control (FADEC) syste ms. In such cases , it is accepted that other measures, usually within the system, in addition to a high level of software /AEH development assurance, may be necessary to achieve these safety objectives and demonstrate that they have been met.

Powered by EASA eRules Page 21 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 2B Products, Parts and Appliances (AMC - 20) It is outside the scope of the latest edition of AMC 20 - 115 / AMC 20 - 152 to suggest or specify these measures, but in accepting that they may be necessary, it is also the intention to encourage the development of software /AEH techniques which could support meeting th e ov erall system safety objectives.

Note: In this AMC, the ‘criticality level’ is used to reflect either the software level of a software item and the AEH design assurance level (or DAL) of an AEH item.

4.4 Precautions related to APU independence from the aircraft 4.4.1 Precautions related to electrical power supply and data from the aircraft When considering the objectives of Section 4.2, due consideration must be given to the reliability of electrical power and data supplied to the electronic controls and peripheral components. Therefore , the potential adverse effects on APU operation of any loss of electrical power supply from the aircraft or failure of data coming from the aircraft must be assessed during the APU certification.

(a) Electrical power The u se of either the aircraft electrical power network or electrical power sources specific to the APU, or the combination of both, may meet the objectives.

If the aircraft electrical system supplies power to the APU control system at any time, the power suppl y quality, including transients or failures, must not lead to a situation identified during the APU certification which is considered during the aircraft certification to be a hazard to the aircraft.

(b) Data The following cases should be considered: (i) e rroneous data received from the air craft by the APU control system; and (ii) c ontrol system operating faults propagating via data links.

In certain cases, defects of aircraft input data may be overcome by other data references specific to the APU in order to meet the objectives.

4.4.2 Local e vents (a) In designing an electronic control system to meet the objectives of Section 4.2, special consideration needs to be given to local events.

Examples of local events include fluid leaks, mechanic al disruptions, electrical problems, fires or overheat conditions. An overheat condition results when the temperature of the electronic control unit is greater than the maximum safe design operating temperature declared during the APU certification. This s ituation can increase the failure rate of the electronic control system.

(b) Whatever the local event, the behaviour of the electronic control system must not cause a hazard to the aircraft. This will require consideration of effects such as the overspeed of the APU.

When the demonstration that there is no hazard to the aircraft is based on the assumption that there exists another function to afford the necessary protection, it must be shown that this function is not rendered inoperative Powered by EASA eRules Page 22 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBP ART A — GENERAL of Compliance for Airworthiness of AMC 20 - 2B Products, Parts and Appliances (AMC - 20) by the same local e vent (including destruction of wires, ducts, power supplies).

(c) Specific design features or analysis methods may be used to show compliance with respect to hazardous effects. Where this is not possible, for example due to the variability or the complexit y of the failure sequence, then testing may be required. These tests must be agreed with EASA .

4.4.3 Lightning and other electromagnetic effects Electronic control systems are sensitive to lightning and other electromagnetic interference. The system desig n must incorporate sufficient protection in order to ensure the functional integrity of the control system when subjected to designated levels of electric or electromagnetic inductions, including external radiation effects.

The validated protection levels for the APU electronic control system must be detailed during the APU certification in an approved document. For aircraft certification, it must be substantiated that these levels are adequate.

4.5 Other functions integrated into the electronic control sys tem If functions other than those directly associated with the control of the APU are integrated into the electronic control system, the APU certification should take into account the applicable aircraft requirements.

5 INTER RELATION BETWEEN APU CERTIFICATION AND AIRCRAFT CERTIFICATION 5.1 Objective To satisfy the certification requirements, such as CS 25.901, CS 25.903 and CS 25.1309 , an analysis of the consequences of failures of the system on the aircraft has to be made.

It should be ensured that the software /AEH criticality levels and the safety and reliability objectives fo r the electronic control system are consistent with these requirements.

5.2 Interface definition The interface has to be identified for the AEH and soft ware aspects between the APU and the aircraft systems in the appropriate documents.

The APU docume nts should cover in particular: (a) t he software /AEH criticality le vel (per function if necessary); (b) t he reliability objectives for : — an APU shutdown in flight; — a l oss of APU control or a sig nificant change in performance; and — the t r ansmission of faulty parameters; (c) t he degree of protection against ligh tning or other electromagnetic effects (e.g. the level of induced voltages that can be sup ported at the interfaces); (d) the APU and aircraft interface data and its characteristics; and (e) the a ircraft power supply and its characteristics (if relevant).

Powered by EASA eRules Page 23 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 2B Products, Parts and Appliances (AMC - 20) 5.3 Distribution of compliance demonstrations The certification of the APU equipped with electronic controls and of the aircraft may be shared between the APU certification and the aircraft certification. The distribution between the APU certification and the aircraft certification must be identified and agreed with EASA and/or the appropriate APU and aircraft a uthorities (an example is given in the appendix).

Appropriate evidence provided for the APU certificat ion should be used for the aircraft certification. For example, the quality of any aircraft function software /AEH and aircraft/APU interface logic already demonstrated for the APU certification should need no additional substantiation for the aircraft certification.

Aircraft certification must deal with the specific precautions t aken in respect o f the physical and functional interfaces with the APU.

[Amdt 20/10] [Amdt 20/19]

Appendix to AMC 20 - 2 B

ED Decision 2020/010/R The following is an example of the distribution of the tasks between the APU certification and the aircraft certification.

FUNCT IONS OR SUBSTANTIATION UNDER INSTALLATION SUBSTANTIATION UNDER CS - 25 CS - APU CONDITIONS — Safety objective — Reliability APU CONTROL AND — Software /AEH — Softwar e /AEH PROTECTION criticality level criticality level — Independence of — Monitoring — Indication system control and monitoring parameter reliability reliability MONITORING parameters — Protection of APU — Aircraft data from aircraft data reliability failures AIRCRAFT DATA — Software /AEH criticality level — Reliability and CONTROL SYSTEM quality of aircraft ELECTRICAL SUPPLY supply if used ENVIRONMENTAL — Equipment protection — Declared capability — Aircraft design CONDITIONS, LIGHTNING — Aircraft wiring AND OTHER protection ELECTROMAGNETIC EFFECTS [Amdt 20/19] Powered by EASA eRules Page 24 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20)

AMC 20 - 3B

AMC 20 - 3 B Certification of Engines Equipped with El ectronic Engine

Control Systems

ED Decision 2 0 20 / 0 10 /R (1) PURPOSE The existing certification specifications of CS - E for Engine certification may require specific interpretation for Engines equip ped with Electronic Engine Control Systems (EECS), with special regard to interface with the certification of the aircraft and/or Propeller when applicable.

Because of the nature of this technology, it has been considered useful to prepare acceptable means of compliance (AMC) specifically addressing the certification of these control systems.

Like any AMC , it is issued to outline issues to be considered during the demonstration of compliance with CS - E .

(2) SCOPE This AMC is relevant to Engine certification specifications for EECS, whether they us e electrical or electronic (analogue or digital) technology. This is in addition to other AMC such as AMC E 50 or AMC E 80.

It gives guidance on the precautions to be taken for th e use of electrical and electronic technology for Engine control, protection, limiting and monitoring functions, and, where applicable, for the integration of aircraft or Propeller functions. In the latter case , this document is applicable to such function s integrated into the EECS, but only to the extent that these functions affect compliance with CS - E specifications.

The text deals mainly with the thrust and power functions of an EECS, since this is the prime function of the Engine. However, there are man y other functions, such as bleed valve control, that may be integrated into the system for operability reasons. The principles outlined in this AMC apply to the whole EECS .

This document also discusses the division of compliance tasks for certification bet ween the applicants for Engine, Propeller (when applicable) , and aircraft type certificates. This guidance relates to issue s to be considered during E ngine certification. AMC 20 - 1 () addres ses issues associated with the E ngin e installation in the aircraft.

The introduction of electrical and electronic technology can entail the following: — greater dependence of the Engine on the aircraft owing to the i ncreased use of electrical power or data supplied from the aircraft; — increased integration of control and related indication functions; — increased risk of significant Failures that are common to more than one Engine of the aircraft which might, for example, occur as a result of: — i nsufficient protection from electromagnetic disturbance ( e.g. lightning, internal or external r adiation effects ) ( see CS - E 50(a)(1), CS E - 80 and CS - E 170 ); — insufficient integrity of the aircraft electrical power supply (see CS - E 50 ( h)); — i nsufficient integrity of data supplied from the aircraft (see CS - E 50 (g)); Powered by EASA eRules Page 25 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) — h idden design Faults or discrepancies contained within the design of the propulsion system control software or airborne e lectronic hardware (AEH) (see CS - E 50 (f)); or — o mission s or errors in the system/soft ware /AEH specification (see CS - E 50 (f)).

Appropriate design and integration precautions should therefore be taken to minimise any adverse effects from the above.

(3) RELEVANT SPECIFICATIONS AND REFERENCE DOCUMENTS Although compliance with many CS - E specifications might be affected by the Engine Control System, the main paragraphs relevant to the certification of the Engin e Control System itself are the following: CS - E Specification Turbine Engines Piston Engines ✓ ✓ CS - E 20 (Engine configuration and interfaces) CS - E 25 (Instructio ns for Continued Airworthiness) ✓ ✓ ✓ ✓ CS - E 30 (Assumptions) ✓ ✓ CS - E 50 (Engine Control System) ✓ ✓ CS - E 60 (Provision for instruments) ✓ ✓ CS - E 80 (Equipment) CS - E 110 (Drawing and marking of parts — Assembly of parts) ✓ ✓ ✓ ✓ CS - E 130 (Fire prevention) CS - E 140 (Tests - Engine configuration) ✓ ✓ ✓ ✓ CS - E 170 (Engine systems and component verification) CS - E 210 (Failure analysis) ✓ ✓ CS - E 250 (Fuel System) CS - E 390 (Acceleration tests) ✓ ✓ CS - E 500 (Functioning) CS - E - 510 (Safety analysis) ✓ ✓ CS - E 560 (Fuel system) CS - E 745 (Engine Acceleration) ✓ ✓ ✓ CS - E 1030 (Time - limited dispatch) The following d ocuments are referenced in AMC 20 - 3 B : — International Electrotechnical Commission (IEC), Central Office, 3, rue de Varembé, P.O.

Box 131, CH - 1211 GENEVA 20, Switzerland — IEC/PAS 62239, Electronic Component Management Plans , edition 1.0, dated April — IEC/PAS 62240, Use of Semiconductor Devices Outside Manufacturers’ Specified Temperature Ranges, edition 1.0, dated April 2001 — RTCA, Inc. 1828 L Street, NW, Suite 805, Washington, DC 20036 or EUROCAE, 17, rue Hamelin, 75116 Paris, France — RTCA DO - 254/ EUROC AE ED - 80, Design Assurance Guidance for Airborne Electronic Hardware, dated April 19, 2000 — RTCA DO - 160/EUROCAE ED 14, Environmental Conditions and Test Pr ocedures for Airborne Equipment Powered by EASA eRules Page 26 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) — AMC 20 - 115 on software considerations for certification of airborne systems and equipment — Aeronautical Systems Center, ASC/ENOI, Bldg 560, 2530 Loop Road West, Wright - Patterson AFB, OH, USA, 45433 - 7101 — MIL - STD - 461E, Requirements fo r the Control of Electromagnetic Interference Characteristics, dated August 20, 1999 — MIL - STD - 810 E or F, Test Method Standard for Environmental Engineering, E dated July 14 , 1989, F dated January 1, 2000 — U.S. Department of Transportation, Subsequent Distri bution, Office Ardmore East th Business Center, 3341 Q 75 Ave, Landover, MD, USA, 20785 — AC 20 - 136, Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning, dated March 5, 1990 — Society of Automotive Engineers (SAE), 400 Commonwealth Drive, Warrendale, PA 15096 - 0001 USA or EUROCAE, 17, rue Hamelin, 75116 Paris, France — SAE ARP 5412 / EUROCAE ED - 84, with Amendment 1 & 2, Aircraft Lightning Environment and Related Test Waveforms, Febr uary 2005/May 2001 respectively — SAE ARP 5 413 / EUROCAE ED - 81, with Amendment 1, Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning, Novembe r 1999/August 1999 respectively — SAE ARP 5414 / EUROCAE ED - 91, with Amendment 1, Aircraft Lightning Zoning, Febru ary 2005/June 1999 respectively — S AE ARP 5416 / EUROCAE ED - 105, Aircraft Lightning Test Methods, March 2005/April 2005 respectively (4) DEFINITIONS The words defined in CS - Definitions and in CS - E 15 are identified by capital letter s .

The following figure and a ssociated definitions are provided to facilitate a clear understanding of the terms used in this AMC.

Powered by EASA eRules Page 27 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) DEFINITIONS VISUALISED MODES SYSTEMS ENGINE CONTROL SYSTEM PRIMARY MODE / P rimary s ystem NORMAL MODE ALTERNATE MODES May be one or more lanes (c hannels) ALTERNATE MODE 1 Lanes typically have ALTERNATE MODE 2 equal functionality B acku p s ystem BACK UP MODE 1 May be h ydrome chanical control or less capable lane BACK UP MODE 2 (5) GENERAL It is recognised that the determination of compliance of the Engine Control System with the applicable aircraft certification specifications will only be made during the aircraft certification.

In the case where the installation is unknown at the time of Engine certification, the applicant for Engine certification should make reasonable installation and operational assumptions for the target installation. Any installation limitations or operation al issues will be noted in the instructions for installation or operation, and/or the Type Certificate Data Sheet (TCDS) (see CS - E 30 Assumptions ).

When possible, early co ordination between the Engine and the aircraft applicants is recommended in associati on with the relevant authorities as discussed under Section 15 of this AMC.

(6) SYSTEM DESIGN AND VALIDATION (a) Control Modes — General Under CS - E 50 (a) , the applicant should perform all necessary testing and analysis to ensure that all Control Modes, in cluding those which occur as a result of control Fault Accommodation strategies, are implemented as required.

The need to provide pro tective functions, such as over speed protection, for all Control Modes, including any Alternate Modes, should be reviewed unde r the specifications of CS - E 50 (c), (d) and (e), and CS - E 210 or CS - E 510.

Any limitations on operations in Alternate Modes should be clearly stated in the Engine instructions for installation and operation.

Powered by EASA eRules Page 28 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) Descriptions of the functioning of the Engine Control System operating in its Primary and any Alternate Modes should be provided in the Engine instructions for installation and operation.

Analyses and/or testing are necessary to substantiate that operating in the Alternate Modes has no unac ceptable effect on Engine durability or endurance. Demonstration of the durability and reliability of the control system in all modes is primarily addressed by the component testing of CS - E 170. Performing some portion of the Engine certification testing i n the Alternate Mode(s) and during transition between modes can be used as part of the system va lidation required under CS - E 50 (a).

(i) Engine Test Considerations If the Engine certification tests defined in CS - E are performed using only the Engine Control System’s Primary Mode in the Full - up Configuration and if approval for dispatch in the Alternate Mode is requested by the applicant under CS - E 1030, it should be demonstrated, by analysis and/or test, that the Engine can meet the defined test - success crit eria w hen operating in any Alternate M ode that is proposed as a dispatchable configuration as required by CS - E 1030.

Some capabilities, such as operability, blade - off, rain, hail, bird ingestion, etc . , may be lost in some control modes that are not dispatc hable. These modes do not require engine test demonstration as long as the installation and operating instructions reflect this loss of capability.

(ii) Availability Availability of any Back - up Mode should be established by routine testing or monitoring to ensure that the Back - up Mode will be available when needed. The frequency of establishing its availabili ty should be documented in the I n structions for C ontinued Airworthiness (ICA).

(b) Crew Training Modes This AMC is not specifically intended to apply t o any crew training modes. These modes are usually installation - , and possibly operator - , specific and need to be negotiated on a case - by - case basis. As an example, one common application of crew training modes is for simulation of the ‘failed - fixed’ mode on a twin - engine rotorcraft. Training modes should be described in the Engine instructions for installation and operation as appropriate. Also, precautions should be taken in the design of the Engine Control System and its crew interfaces to prevent inadve rtent entry into any training modes. Crew training modes, including lock - out systems, should be assessed as part of the System Safety Analysis (SSA) of CS - E 50 (d).

(c) Non - Dispatchable Configurations and Modes For control configurations which are not dispa tchable, but for which the applicant seeks to take credit in the system Loss of Thrust (or Power) Control ( LOTC/LOPC) analysis, it may be acceptable to have specific operating limitations. In ad dition, compliance with CS - E 50 (a) does not imply strict compl iance with the operability specifications of CS - E 390, CS - E 500 and CS - E 745 in these non - dispatchable configurations, if it can be demonstrated that, in the intended installation, no likely pilot control system inputs will result in Engine surge, stall, f lame - out or unmanageable delay in power recovery. For example, in a twin - engine rotorcraft, a rudimentary Back up System may be adequate since frequent and rapid changes in power setting with the Back up System may not be necessary.

Powered by EASA eRules Page 29 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) In addition to these oper ability considerations, other factors which should be considered in assessing the acceptability of such reduced - capability Back up Modes include: — t he installed operating characteristics of the Back - up Mode and the di fferences from the Primary Mode; — t he like ly impact of the Back - up Mode operations on pilot workload, if the aircraft installation is known; — t he frequency of transfer from the Primary Mode to the Back - up Mode (i.e. the r eliability of the Primary Mode); f requencies of transfer of less than 1 per 20 000 engine flight hours h ave been considered acceptable.

(d) Control Transitions The intent of CS - E 50 (b) is to ensure that any control transitions, which occur as a result of Fault Accommodation, occur in an acceptable manner.

In general, transition to Alternate Modes should be accomplished automatically by the Engine Control System. However, systems for which pilot action is required to engage the Backup Mode may also be acceptable. For instance, a Fault in the Primary System m ay result in a ‘failed - fixed’ fuel flow and some action is required by the pilot to engage the Back up System in order to modulate Engine power. Care should be taken to ensure that any reliance on manual transition is not expected to pose an unacceptable op erating characteristic, unacceptable crew workload or require exceptional skill.

The transient change in power or thrust associated with transfer to Alternate Modes should be reviewed for compliance with CS - E 50 (b). If available, input from the installer s hould be considered. Although this is not to be considered a complete list, some of the items that should be considered when reviewing the acceptability of Control Mode transitions are: — The frequency of occurrence of transfers to any Alternate Mode and the capability of the Alternate Mode. Computed frequency - of - transfer rates should be supported with data from endurance or reliability testing, in - service experience on similar equipment, or other appropriate data.

— The magnitude of the power, thrust, rotor or Propeller speed transients.

— Successful demonstration, by simulation or other means, of the ability of the Engine Control System to control the Engine safely during the transition. In some cases, particularly those involving rotorcraft, it may not be possi ble to make a determination that the mode transition provides a safe system based solely on analytical or simulation data. Therefore, a flight test programme to support this data will normally be expected.

— An analysis should be provided to identify those F aults that cause Control Mode transitions either automatically or through pilot action.

— For turboprop or turboshaft engines, the transition should not result in excessive over speed or under speed of the rotor or Propeller which could cause emergency shutdow n, loss of electrical generator power or the setting - off of warning devices.

Powered by EASA eRules Page 30 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) The thrust or power change associated with the transition should be declared in the instructions for installing the Engine.

(i) Time Delays Any observable time delays associated with Control Mode, channel or system transitions or in re - establishing the pilot’s ability to modulate Engine thrust or power should be identified in the Engine instructions for installation and operat ion (see CS - E 50 (b)). These delays should be assessed during aircraft certification.

(ii) Annunciation to the Flight Crew If annunciation is necessary to comply with CS - E 50(b)(3), the type of annunciation to the flight crew should be commensurate with the nature of the transition. For instance, reversion to an Alternate Mode of control where the transition is automatic and the only observable changes in operation of the Engine are different thrust control schedules, would require a very different form of annunciation to that required if timely action by the p ilot is required in order to ma intain control of the aircraft.

The intent and purpose of the cockpit annunciation should be clearly stated in the Engine instructions for installation and operation, as appropriate.

(e) Environmental conditions Environmental conditions include electromagnetic interference (EMI), high - intensity radiated fields (HIRF) and lightning . The environmental co nditions are addressed under CS - E 80 and CS - E 170. The following provides additional guidance for EMI, HIRF and lightning.

(i) Declared levels When the installation is known during the Engine type - certification programme, the Engine Control System should be tested at levels that have been determined and agreed by the Engine and aircraft applicants. It is assumed that, by this agre ement, the installation can meet the aircraft certification specifications.

Successful completion of the testing to the agreed levels would be accepted for Engine type certification. This, however, may make the possibility of installing the Engine dependen t on a specific aircraft.

If the aircraft installation is not known or defined at the time of the Engine certification, in order to determine the levels to be declared for the Engine certification, the Engine applicant may use the external threat level def ined at the aircraft level and use assumptions on installation attenuation effects.

If none of the options defined above are available, it is recommended that the procedures and minimum default levels for HIRF testing should be agreed with EASA .

(ii) Test procedures (A) General The installed Engine Control System, including representative Engine – aircraft interface cables, should be the b asis for certification testing.

EMI test procedures and test levels conducted in accordance with MIL - STD - 461 or EUROCAE ED 14/DO - 160 have been considered acceptable.

Powered by EASA eRules Page 31 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) The applicant should use the HIRF test guidelines provided in EUROCAE ED 14/RTCA DO - 160 or equivalent. However, it should be recognised that the tests defined in EUROCAE ED 14/RTCA DO - 160 are applicable at a component test level, requiring the applicant to adapt these test procedures to a system level HIRF test to demonstrate compliance with CS - E 80 and CS - E 170.

For lightning tests, the guidelines of SAE ARP 54 12, 5413, 5414 and 5416 , and EUROCAE ED 14/ RTCA DO - 160 would be applicable.

Pin Injection Tests (PIT) are normally conducted as component tests on the EECS unit and other system components as required. PIT levels are selected as appropriate from the tables of EUROCAE ED 14/DO - 160.

Environmental tes ts , such as MIL - STD - 810 , may be accepted in lieu of EUROCAE ED - 14/DO - 160 tests where these tests are equal to or more rigorous than those defined in EUROCAE ED 14/DO - 160.

(B) Open - loop and Closed - loop Testing HIRF and lightning tests should be cond ucted as system tests on closed - loop or open - loop laboratory set - ups.

The closed - loop set - up is usually provided with hydraulic pressure to move actuators to close the inner actuating loops. A simplified Engine simulation may be used to close the outer Engine loop .

Testing should be conducted with the Engine Control System controlling at the most sensitive operating point, as selected and detailed in the test plans by the applicant. The system should be exposed to the HIRF and lightning environmental threats while operating at the selected condition. There may be a different operating point for HIRF and lightning environmental threats.

For tests in open - and closed - loop set - ups, the following factors should also be con sidered: — If a special EECS test software is used , that software should be developed at the criticality level determined by the Engine safety assessment process .

— The Engine Control System should be tested at the criticality levels that have been determined and agreed by the Engine and aircraft applicants . It is assumed that by this agreement, the installation meets the aircraft certification specifications. In some cases, the application code is modified to include the required test code features.

— The system test set - up should be capable of monitoring bot h the output signals and the input signals.

— Anomalies observed during open - loop testing on inputs or outputs should be duplicated on the Engine simulation to determine whether the resulting power or thrust per turbations comply with the pass – fail criteria.

(iii) Pass – Fail Criteria The pass – fail criteria of CS - E 170 for HIRF and lightning should be interprete d as ‘no adverse effect’ on t he functionality of the system.

Powered by EASA eRules Page 32 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) The following are considered adverse effects: — a greater than 3 % change of Take - off Power or Thrust for a period of more than 2 seconds; — t ransfers to Alternate Channels, Back up Systems, or A lternate Modes; — component damage; — f alse annunciation to the flight crew , which could cause unnecessa ry or inappropriate flight crew action; — e rroneous operation of p rotection systems, such as over speed or thrust reverser circuits.

AEH or s oftware design changes implemented after the initial environmental testing should be evaluated for their effects with respect to the EMI, HIRF and lightning environment .

(iv) Maintenance Actions CS - E 25 requires that the applicant prepare Instructions for Continued Airworthiness (ICA). These include a maintenance plan. Therefore, for any protection system that is part of the type design of the Engine Control System and i s required by the system to meet the qualified levels of EMI, HIRF and lightning, a maintenance plan should be provided to ensure the continued airworthiness for the parts of the installed system which are supplied by the Engine type - certificate holder.

Th e maintenance actions to be considered include periodic inspections or tests for required structural shielding, wire shields, connectors, and equipment protection components. Inspections or tests when the part is exposed may also be considered.

The applica nt should provide the engineering validation and substantiation of these maintenance actions.

(v) Time - Limited Dispatch (TLD) Environmental Tests Although TLD is only an optional requirement for certification (see CS - E 1000 and CS - E 1030), EMI, HIRF and li ghtning tests for TLD are usually conducted together with tests conducted for certification. Acceptable means of compliance are provided in AMC E 1030.

(7) INTEGRITY OF THE ENGINE CONTROL SYSTEM (a) Objective The intent of CS - E 50 (c) is to establish Engin e Control System integrity requirements consistent with operational requirements of the various installations. (See also paragraph (4) of AMC E 50).

(b) Definition of an LOTC/LOPC event (i) For turbine Engines intended for CS - 25 installations An LOTC/LOPC event is defined as an event where the Engine Control System: — has lost the capability of modulating thrust or power between idle and 90% of maximum rated power or thrust, or — suffers a Fault which results in a thrust or power oscillation greater than the le vels given in paragraph (7)(c) of this AMC, or Powered by EASA eRules Page 33 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) — has lost the capability to govern the Engine in a manner which allows compliance with the operability s pecifications given in CS - E 500 (a) and CS - E 745.

(ii) For turbine Engines intended for rotorcraft An LOPC event is defined as an event where the Engine Control System: — has lost the capability of modulating power between idle and 90% of maximum rated power at the flight condition, except OEI power ratings, or — suffers a Fault which results in a power oscillation greater than the levels given in paragraph (7)(c) of this AMC, or — has lost the capability to govern the Engine in a manner which allows compliance with the operability specification s given in CS - E 500 (a) and CS - E 745, with the exception that the inability to meet the operability specifications in the Alternate Modes may not be included as LOPC events.

— Single Engine rotorcraft will be required to meet the operability specifications in the Alternate Mode(s), unless the lack of this capability is demonstrated to be acceptable at the aircraft level. Engine operability in the Alternate Mode(s ) is considered a necessity if: — the control transitions to the Alternate Mode more frequently th an the acceptable LOPC rate, or — normal flight crew activity requires rapid changes in power to safely fly the aircraft.

— For multi - Engine rotorcraft, the LOPC definition may not need to include the inability to meet the operability specifications in the Alternate Mode(s). This may be considered acceptable because when one Engine control transitions to an Alternate Mode, which may not have robust operability, that Engine can be left at reasonably fixed power conditions. The Engine(s) with the normally operating control(s) can change power – as necessary – to complete aircraf t manoeuvres and safely land the aircraft. Demonstration of the acceptability of this type of operation may be required at aircraft certification.

(iii) For turbine Engines intended for other installations A LOTC/LOPC event is defined as an event where the Engine Control System: — has lost the capability of modulating thrust or power between idle and 90% of maximum rated power or thrust, or — suffers a Fault which results in a thrust or power oscillation that would impact controllability in the intended install ation, or — has lost the capability to govern the Engine in a manner which allows compliance with the operability s pecifications given in CS - E 500 (a) and CS - E 745, as appropriate.

(iv) For piston Engines An LOPC event is defined as an event where the Engine Control System: — has lost the capability of modulating power between idle and 85% of maximum rated power at all operating conditions, or Powered by EASA eRules Page 34 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) — suffers a Fault which results in a power oscillation greater than the levels given in paragraph (7)(c) of this AMC, or — has lost the capability to govern the Engine in a manner which allows compliance with the operability specifications given in CS - E 390.

(v) For engines incorporating functions for Propeller control integrated in the EECS The following Faults or Failures s hould be considered as additional LOPC events: — inability to command a change in pitch, — uncommanded change in pitch, — uncontrollable Propeller torque or speed fluctuation.

(c) Uncommanded thrust or power oscillations Any uncommanded thrust or power oscilla tions should be of such a magnitude as not to impact aircraft controllability in the intended installation. Thrust or power oscillations less than 10% peak to peak of Take - off Power and/or Thrust have been considered acceptable in some installations, where the failure affects one engine only. Regardless of the levels discussed herein, if the flight crew has to shut down an Engine because of unacceptable thrust or power oscillations caused by the control system, such an event would be deemed an in - service LO TC/LOPC event.

(d) Acceptable LOTC/LOPC rate The applicant may propose an LOTC/LOPC rate other than those below. Such a proposal should be substantiated in relation to the criticality of the Engine and control system relative to the intended installation. The intent is to show equivalence of the LOTC/LOPC rate to existing systems in comparable installations.

(i) For turbine Engines The EECS should not cause more than one LOTC/LOPC event p er 100 000 engine flight hours.

(ii) For piston Engines An LOPC rate of 45 per million engine flight hours (or 1 per 22,222 engine flight hours) has been shown to represent an acceptable level for the most complex EECS. As a result of the architectures used in many of the EECS for these engines, the functions are imple mented in independent system elements. These system elements or sub - systems can be fuel control, or ignition control, or others. If a system were to contain only one element such as fuel control, then the appropriate total system level would be 15 LOPC eve nts per million engine flight hours. So the system elements are then additive up to a max of 45 LOPC events per million hours.

For example, an EEC system comprised of fuel, ignition, and wastegate control functions should meet a total system reliability of 15+15+15 = 45 LOPC events per million engine flight hours. This criterion is then applied to the entire system and not allocated to each of the subsystems. Note that a maximum of 45 LOPC events per million engine flight hours are allowed, regardless of th e number of subsystems. For example, if the EEC system includes more than three subsystems, the sum of the LOPC rates for the total system should not exceed 45 LOPC events per million engine flight hours for all of the elect rical and electronic elements.

Powered by EASA eRules Page 35 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) (e) LOTC/LOPC Analysis A system reliability analysis should be submitted to substantiate the agreed LOTC/LOPC rate for the Engine Control System. A numerical analysis such as a Markov model analysis, fault tree analysis or equivalent analytical approach i s expected.

The analysis should address all components in the system that can contribute to LOTC/LOPC events. This includes all electrical, mechanical, hydromechanical, and pneumatic elements of the Engine Control System. This LOTC/LOPC analysis should be done in conjunction with the System Safety As sessment required under CS - E 50 (d).

Paragraph (8) of this AMC provides additional guidance material.

The engine fuel pump is generally not included in the definition of the Engine Control System. It is usually c onsidered part of the fuel delivery system.

The LOTC/LOPC analysis should include those sensors or elements which may not be part of the Engine type design, but which may contribute to LOTC/LOPC events. An example of this is the throttle or power lever tra nsducer, which is usually supplied by the installer.

The effects of loss, corruption or Failure of Aircraft - Supplied Data should be included in the Engine Control System’s LOTC/LOPC analysis. The reliability and interface requirements for these non - Engine type design elements should be contained in the Engine instructions for installation. It needs to be ensured that there is no double counting of the rate of Failure of non - engine parts within the aircraft system safety analyses.

The LOTC/LOPC analysis shou ld consider all Faults, both detected and undetected. Any periodic maintenance actions needed to find and repair both Covered and Uncovered Faults, in order to meet the LOTC/LOPC rate, should be contained in the Engine instructions for continued airworthin ess.

(f) Commercial or Industrial Grade Electronic Parts When the Engine type design specifies commercial or industrial grade electronic components, which are parts not manufactured to military standards, the applicant should have the following data availa ble for review, as applicable: — Reliability data that substantiates the Failure rate for each component used in the LOTC/LOPC analysis and the SSA for each commercial and industrial grade electrical component specified in the design.

— The applicant’s procure ment, quality assurance, and process control plans for the vendor - supplied commercial and industrial grade parts. These plans should ensure that the parts will be able to maintain the reliability level specified in the approved Engine type design.

— Unique databases for similar components obtained from different vendors, because commercial and industrial grade parts may not all be manufactured to the same accepted industry standard, such as military component standards.

— Commercial and industrial grade parts have typical operating ranges of 0 degrees to +70 degrees Celsius and - 40 degrees to +85 degrees Celsius, respectively.

Military grade parts are typically rated at - 54 degrees to 125 degrees Celsius.

Commercial and industrial grade parts are typically defi ned in these temperature ranges in vendor parts catalogues. If the declared temperature environment for the Engine Control System exceeds the stated capability of the commercial or industrial grade electronic components, the applicant should substantiate t hat the Powered by EASA eRules Page 36 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) proposed extended range of the specified components is suitable for the installation and that the Failure rates used for those components in the SSA and LOTC/LOPC analyses is appropriately adjusted for the extended temperature environment. Addition ally, if commercial or industrial parts are used in an environment beyond their specified rating and cooling provisions are required in the design of the EECS, the applicant should specify these provisions in the instructions for installation to ensure tha t the provisions for cooling are not compromised. Failure modes of the cooling provisions included in the EECS design that cause these limits to be exceeded should be considered in determining the probability of Failure.

— Two examples of industry published documents which provide guidance on the application of commercial or industrial grade components are: — IEC/PAS 62239, Electronic Component Management Plans — IEC/PAS 62240, Use of Semiconductor Devices Outside Manufacturer s’ Specified Temperature Ranges When any electrical or electronic components are changed, the SSA and LOTC/LOPC analyses should be reviewed with regard to the impact of any changes in component reliability. Component, subassembly or assembly level testing may be required by the Agency to subs tantiate a change that introduces a commercial or industrial part(s).

However, such a change would not be classified as ‘significant’ with respect to Part 21 . A.101(b)1.

(g) Single Fault Accommodation Compliance with the single Fault specifications of CS - E 50 (c)(2) and (3) may be substantiated by a combination of tests and analyses. The intent is that single Failures or malfunctions in the Engine Control System’s components, in its fully operational condition, do not result in a Hazardous Engine Effect. In a ddition, in its full - up configuration the control system should be essentially single Fault tolerant of electrical/electronic component Failures with respect to LOTC/LOPC events. For dispatchable configurations refer to CS - E 1030 and AMC E 1030.

It is reco gnised that to achieve true single Fault tolerance for LOTC/LOPC events could require a triplicated design approach or a design approach with 100% Fault detection.

Currently, systems have been designed with dual, redundant channels or with Back - up Systems that provide what has been called an "essentially single Fault tolerant" system.

Although these systems may have some Faults that are not Covered Faults, they have demonstrated excellent in - service safety and reliability, an d have proven to be acceptable.

The objective, of course, is to have all the Faults addressed as Covered Faults. Indeed, the dual channel or Back - up system configurations do cover the vast majority of potential electrical and electronic Faults. However, on a case - by - case basis, it may be appropriate for the applicant to omit some coverage because detection or accommodation of some electrical/electronic Faults may not be practical. In these cases, it is recognised that single, simple electrical or electronic components or circuits can be e mployed in a reliable manner, and that requiring redundancy in some situations may not be appropriate. In these circumstances, Failures in some single electrical or electronic components, elements or circuits may result in an LOTC/LOPC event. This is what is meant by the use of the term “essentially”, and such a system may be acceptable.

Powered by EASA eRules Page 37 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) (h) Local Events Examples of local events to be considered under CS - E 50 (c)(4) include: — Overheat conditions, for example, those resu lting from hot air duct bursts, — Fires, and — Fluid leaks or mechanical disruptions which could lead to damage to control system electrical harnesses, connectors, or the control unit(s).

These local events would normally be limited to one Engine. Therefore, a local event is not usually cons idered to be a common mode event, and common mode threats, such as HIRF, lightning and rain, are not considered local events.

When demonstration that there is no Hazardous Engine Effect is based on the assumption that another function exists to afford the necessary protection, it should be shown that this function is not rendered inoperative by the same local event on the Engine (including destruction of wires, ducts, power supplies).

It is considered that an overheat condition exists when the temperature o f the system components is greater than the maximum safe design operating temperature for the components, as declared by the Engine applicant in the Engine instructions for installation. The Engine Control System should not cause a Hazardous Engine Effect when the components or units of the system are exposed to an overheat or over - temperature condition. Specific design features or analysis methods may be used to show compliance with respect to the prevention of Hazardous Engine Effects. Where this is not p ossible, for example, due to the variability or the complexity of the Failure sequence, then testing may be required.

The Engine Control System, including the electrical, electronic and mechanical parts of the system, should comply with the fire specificat ions of CS - E 130 and the interpretative material of AMC E 130 is relevant. This rule applies to the elements of the Engine Control System which are installed in designated fire zones.

There is no prob ability associated with CS - E 50 (c)(4). Hence, all forese eable local events should be considered. It is recognised, however, that it is difficult to address all possible local events in the intended aircraft installation at the time of Engine certification.

Therefore, sound Engineering judgement should be applie d in order to identify the reasonably foreseeable local events. Compliance with this specification may be shown by considering the end result of the local event on the Engine Control System. The local events analysed should be well documented to aid in cer tification of the Engine installation.

The following guidance applies to Engine Control System wiring: — Each wire or combination of wires interfacing with the EECS that could be affected by a local event should be tested or analysed with respect to local ev ents. The assessment should include opens, shorts to ground and shorts to power (when appropriate) and the results should show that Faults result in identified responses and do not resu lt in Hazardous Engine Effects.

— Engine control unit aircraft interface wiring should be tested or analysed for shorts to aircraft power, and these “hot” shorts should result in an identified and non - Hazardous Engine Effect. Where aircraft interface wiring is involved, the installer should be informed of the potential effects of interface wiring Faults by means of information provided in the Engine instructions for installation. It is the installer’s Powered by EASA eRules Page 38 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) responsibility to ensure that there are no wiring Faults which could affect more than one Engine. Where practical, wiring Faults should not affect more than one channel. Any assumptions made by the Engine applicant regarding channel separation should be included in the LOTC/LOPC analysis.

— Where physical separation of conductors is not practical, co - ordination between the Engine appl icant and the installer should ensure that the potential for common mode Faults between Engine Control Systems is eliminated, and between channels on one Engine is minimised.

The applicant should assess by analysis or test the effects of fluid leaks imping ing on components of the Electronic Engine Control System. Such conditions should not result in a Hazardous Engine Effect, nor should the fluids be allowed to impinge on circuitry or printed circuit boards and result in a potential latent Failure condition .

(8) SYSTEM SAFETY ASSESSMENT (a) Scope of the assessment The system safety assessme nt (SSA) required under CS - E 50 (d) should address all operating modes, and the data used in the SSA should be substantiated.

The LOTC/LOPC analysis described in Section 7 is a subset of the SSA. The LOTC/LOPC analysis and SSA may be separate or combined as a single analysis.

The SSA should consider all Faults, both detected and undetected, and their effects on the Engine Control System and the Engine itself. The i ntent is primarily to address the Faults or malfunctions which only affect one Engine Control System, and therefore only one Engine. However, Faults or malfunctions in aircraft signals, including those in a multi - engine installation that could affect more than one Engine, should also be included in the SSA; these types of Fau lts are addressed under CS - E 50 (g).

The Engine Control System SSA and LOTC/LOPC analysis, or combined analyses, should identify the applicable assumptions and installation requirements and establish any limitations relating to Engine Control System operation. These assumptions, requirements, and limitations should be stated in the Engine instructions for installation and operation as appropriate. If necessary, the limitations should be c ontained in the airworthiness limitations section of the instructions for continued airworthi ness in accordance with CS - E 25 (b)(1).

The SSA should address all Failure effects identified under CS - E 510 or CS - E 210, as appropriate. A summary should be provid ed, listing the malfunctions or Failures and their effects caused by the Engine Control System, such as: — Failures affecting power or thrust resulting in LOTC/LOPC events.

— Failures which result in the Engine’s inability to meet the operability specification s.

If these Failure cases are not considered as LOPC events according to paragraph (7)(b)(ii) of this AMC, the expected frequency of occurrence for these events should be documented.

— Transmission of erroneous parameters which could lead to thrust or power changes greater than 3% of Take - off Power or Thrust (10% for piston engines installations) (e.g., false high indication of the thrust or power setting parameter) or to Engine shutdown (e.g., high EGT or turbine temperatures or low oil pressure).

Powered by EASA eRules Page 39 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) — Failures a ffecting functions included in the Engine Control System, which may be considered aircraft functions (e.g. Propeller control, thrust reverser control, control of cooling air, control of fuel recirculation) — Failures resulting in Major Engine Effects and Haz ardous Engine Effects.

The SSA should also consider all signals used by the Engine Control System, in particular any cross - Engine control signals and air signals as described in CS - E 50 (i).

The criticality of functions included in the Engine Control System for aircraft level fun ctions needs to be defined by the aircraft applicant.

(b) Criteria The SSA should demonstrate or provide the following: (i) Compliance with CS - E 510 or CS - E 210, as appropriate.

(ii) For Failures leading to LOTC/LOPC events, compliance with the agreed LOTC /LOPC rate for the intended installation (see paragraph (7)(d) of this AMC).

(iii) For Failures affecting Engine operability but not leading to LOPC events, compliance with the expected total frequency of occurrence of Failures that result in Engine respon se that is non - co mpliant with CS - E 390, CS - E 500 (a) and CS - E 745 specifications (as appropriate). The acceptability of the frequency of occurrence for these events - along with any aircraft flight deck indications deemed necessary to inform the flight crew of such a condition - will be determined at aircraft certification.

(iv) The consequence of the transmission of a faulty parameter The consequence of the transmission of a faulty parameter by the Engine Control System should be identified and included, as appropriate, in the LOTC/LOPC analysis. Any information necessary to mitigate the consequence of a faulty parameter transmission should be contained in the Engine operating instructions.

For example, the Engine operating instructions may indicate that a d isplay of zero oil pressure be ignored in - flight if the oil quantity and temperature displays appear normal. In this situation, Failure to transmit oil pressure or transmitting a zero oil pressure signal should not lead to an Engine shutdown or LOTC/LOPC e vent.

Admittedly, flight crew initiated shutdowns have occurred in - service during such conditions. In this regard, if the Engine operating instructions provide information to mitigate the condition, then control system Faults or malfunctions leading to the condition do not have to be included in the LOTC/LOPC analysis. In such a situation, the loss of multiple functions should be included in the LOTC/LOPC analysis. If the display of zero oil pressure and zero oil quantity (or high oil temperature) would res ult in a crew initiated shutdown, then those conditions should be included in the systems LOTC/LOPC analysis.

(c) Malfunctions or Faults affecting thrust or power In multi - engine aeroplanes, Faults that result in thrust or power changes of less than approx imately 10% of Take - off Power or Thrust may be undetectable by the flight crew.

This level is based on pilot assessment and has been in use for a number of years. The pilots indicated that flight crews will note the Engine operating differences when the di fference is greater than 10% in asymmetric thrust or power.

Powered by EASA eRules Page 40 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of A MC 20 - 3B Products, Parts and Appliances (AMC - 20) The detectable difference level for Engines for other installations shoul d be agreed with the installer.

When operating in the take - off envelope, Uncovered Faults in the Engine Control System whic h result in a thrust or power change of less than 3% (10% for piston engines installations), are generally considered acceptable. However, this does not detract from the applicant’s obligation to ensure that the full - up system is capable of providing the d eclared minimum rated thrust or power. In this regard, Faults which could result in small thrust changes should be random in nature and detectable and correctable during routine inspections, overhauls or power - checks.

The frequency of occurrence of Uncover ed Faults that result in a thrust or power change greater than 3% of Take - off Power or Thrust , but less than the change defined as an LOTC/LOPC event, should be contained in the SSA documentation. There are no firm specifications relating to this class of Faults for Engine certification; however the rate of - 4 occurrence of these types of Faults should be reasonably low, in the order of 10 events per Engine flight hour or less. These Faults may be required to be included in aircraft certification analysis.

S ignals sent from one Engine Control System to another in an aeroplane installation, such as signals used for an Automatic Take - off Thrust Control System (ATTCS), synchrophasing, et c., are addressed under CS - E 50 (g). They should be limited in authority by t he receiving Engine Control System, so that undetected Faults do not result in an unacceptable change in thrust or power on the Engine using those signals. The maximum thrust or power loss on the Engine using a cross - Engine signal should generally be limit ed to 3% absolute difference of t he current operating condition.

Note: It is recognised that ATTCS, when activated, may command a thrust or power increase of 10% or more on the remaining Engine(s). It is also recognised that signals sent from one Engine co ntrol to another in a rotorcraft installation, such as load sharing and One Engine Inoperative (OEI), can have a much greater impact on Engine power when those signals fail. Data of these Failure modes should be contained in the SSA.

When operating in the take - off envelope, detected Faults in the Engine Control System, which result in a thrust or power change of up to 10% (15% for piston engines) may be acceptable if the total frequency of occurrence for these types of Failures is relatively low. The predic ted frequency of occurrence for this category of Faults should be contained in SSA documentation. It should be noted that requirements for the allowable frequency of occurrence for this category of Faults and any need for a flight deck indication of these conditions would be reviewed during aircraft certification. A total – 4 frequency of occurrence in excess of 10 events per Engine flight hour would not normally be acceptable.

Detected Faults in signals exchanged between Engine Control Systems should be acco mmodated so as not to result in greater than a 3% thrust or power change on the Engine using the cross - Engine signals.

(9) PROTECTIVE FUNCTIONS (a) Rotor Over - speed Protection.

Rotor over - speed protection is usually achieved by providing an independent over - speed protection system, such that it requires two independent Faults or malfunctions (as described below) to result in an uncontrolled over - speed.

Powered by EASA eRules Page 41 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) The following guidance applies if the rotor over - speed protection is provided solely by an Engine Control System protective function.

For dispatchable configurations, refer to CS - E 1030 and AMC E 1030.

The SSA should show that the probability per Engine flight hour of an uncontrolled over - speed condition from any cause in combination with a Fail ure of the over - speed protection system to function is less than one event per hundred million hours (a Failure rate of 10 – 8 events per Engine flight hour).

The over - speed protection system would be expected to have a Failure rate of less than 10 – 4 Failure s per engine flight hour to ensure the integrity of the protected function.

A self - test of the over - speed protection system to ensure its functionality prior to each flight is normally necessary for achieving the objectives. Verifying the functionality of the over - speed protection system at Engine shutdown and/or start - up is considered adequate for compliance with this requirement. It is recognised that some Engines may routinely not be shut down between flight cycles. In this case this sho uld be accounted for in the analyses.

Because in some over - speed protection systems there are multiple protection paths, there will always be uncertainty that all paths are functional at any given time. Where multiple paths can invoke the over - speed protec tion system, a test of a different path may be performed each Engine cycle. The objective is that a complete test of the over - speed system, including electro - mechanical parts, is achieved in the minimum number of - 4 Engine cycles. This is acceptable so long a s the system meets a 10 Failure rate.

The applicant may provide data that demonstrates that the mechanical parts (this does not include the electro - mechanical parts) of the over - speed protection system can operate without Failure between stated periods, and a periodic inspection may be established for those parts. This data is acceptable in lieu of testing the mechanical parts of th e sub - system each Engine cycle.

(b) Other protective functions The Engine Control System may perform other protective functio ns. Some of these may be Engine functions, but others may be aircraft or Propeller functions. Engine functions should be considered under the guidelines of this AMC. The integrity of other protective functions provided by the Engine Control System should b e consistent with a safety analysis associated with those functions, but if those functions are not Engine functions, they may not be a part of Engine certification.

As Engine Control Systems become increasingly integrated into the aircraft and Propeller s ystems, they are incorporating protective functions that were previously provided by the aircraft or Propeller systems. Examples are reducing the Engine to idle thrust if a thrust reverser deploys and providing the auto - feather function for the Propeller w hen an Engine fails.

The reliability and availability associated with these functions should be consistent with the top level hazard assessment of conditions involving these functions. This will be completed during aircraft certification.

For example, if a n Engine Failure with loss of the auto - feather function is catastrophic at the aircraft level - and the auto - feather function is incorporated into the Engine Control System - the applicant will have to show for CS - 25 installations (or CS - 23 installations c ertified to CS - 25 specifications) that an Engine Failure with loss of the auto - feather Powered by EASA eRules Page 42 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) function cannot result from a single control system Failure, and that combinations of control system Failures, or Engine and control system Failures, which lead to a sig nificant Engine loss of thrust or power with an associated loss of the autofeather function may be required to have an extremely improbable event rate (i.e., 10 - 9 events per Engine flight hour).

Although these functions await evaluation at the aircraft lev el, it is strongly recommended that, if practicable, the aircraft level hazard assessment involving these functions be available at the time of the Engine Control System certification. This will facilitate discussions and co - ordination between the Engine a nd aircraft certification teams under the conditions outlined in paragraph (15) of this AMC. It is recognised that this co - ordination may not occur for various reasons. Because of this, the applicant should recognise that although the Engine may be certifi ed, it may not be installable at the aircraft level.

The overall requirement is that the safety assessment of the Engine Control System should include all Failure modes of all functions incorporated in the system. This includes those functions which are ad ded to support aircraft certification, so that the information of those Failure modes will get properly addressed and passed on to the installer for inclusion in the airframe SSA. Information concerning the frequencies of occurrence of those Failure modes may be needed as well.

(10) SOFTWARE AND AIRBORNE ELECTRONIC HARDWARE (AEH) DESIGN AND IMPLEMENTATION (a) Objective For Engine Control Systems that use sof tware /AEH , the objective of CS - E 50 (f) is to prevent as far as possible software /AEH errors that woul d result in an unacceptable effect on power or thrust, or any unsafe condition.

In multiple Engine installations, the possibility of software /AEH errors that are common to more than one Engine Control System may determine the criticality level of the softw are /AEH .

(b) Approved Methods Methods for developing software /AEH that are compliant with the guidelines contain ed in the latest edition of AMC 20 - 115 / AMC 20 - 152 are acceptable methods. Alternative methods for developing software /AEH may be proposed by the applicant and are subject to approval by EASA .

Software /AEH which was not developed using the version s of ED - 12 /ED - 80 referenced in the latest edition of AMC 20 - 115 / AMC 20 - 152 is referred to as legacy software /AEH . In general, changes made to legacy software /AEH applicable to its original installation are assured in the same manner as the original certification. When legacy software /AEH is use d in a new aircraft installation that requires the latest edition of AMC 20 - 115 / AMC 20 - 152 , the original approval of the legacy software /AEH is still valid, assuming equivalence to the required software /AEH criticality level can be ascertained.

If the software /AEH development method equivalence is acceptable t o EASA, taking into account the conditions defined in the latest edition of AMC 20 - 115 / AMC 20 - 152 , the legacy software /AEH can be used in the new installation. If equivalence cannot be substantiated, all the software changes should be assured through the use of the latest edition of AMC 20 - 115 for software or of AMC 20 - 152 for AEH .

Note: In this AMC, the ‘criticality level’ is used to reflect either the software level of a software item or the AEH design as surance level (or DAL) of an AEH item.

Powered by EASA eRules Page 43 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) (c) Software/AEH criticality level The software/AEH criticality level is determined by the Engine safety assessment process.

ED - 79A/ARP4754A and ARP4761 provide guidelines on how to conduct an aircraft/Engine/system safety assessment process. The Engine software/AEH should be developed at the criticality levels that have been determined and agreed by the Engine and aircraft applicants. It is assumed that by this agreement, the aircraft certifica tion specifications are met.

Determination of the appropriate software /AEH criticality level may depend on the Failure modes and consequences of those Failures. For example, it is possible that Failures resulting in significant thrust or power increases or oscillations may be more severe than an Engine shutdown and , therefore, the possibility of these types of Failures should be considered when selecting a given software /AEH criticality level.

(d) On - Board or Field Software Loading and Part Number Marking T he following guidelines should be followed when on - board or field loading of Electronic Engine Control software and associated Electronic Part Marking (EPM) is implemented.

For software changes, the software to be loaded should have been documented by an a pproved design change and re leased with a service bulletin.

For an EECS unit having separate part numbers for hardware and software, the software part number(s) need not be displayed on the unit as long as the software part number(s) is(are) embedded in th e loaded software and can be verified by electronic means. When new software is loaded into the unit, the same verification requirement applies and the proper software part number should be verified before the unit is returned to service.

For an EECS unit having only one part number, which represents a combination of a software and hardware build, the unit part number on the nameplate should be changed or updated when the new software is loaded. The software build or version number should be verified before the unit is returned to service.

The configuration control system for an EECS that will be onboard/field loaded and using electronic part marking should be approved. The drawing system should provide a compatibility table that tabulates the combinations o f hardware part numbers and software versions that have been approved by the Agency. The top - level compatibility table should be under configuration control, and it should be updated for each change that affects hardware/software combinations. The applicab le service bulletin should define the hardware configurations with which the new software version is compatible.

The loading system should be in compliance with the guidelines of the latest edition of AMC 20 - 115 .

If the applicant proposes more than one source for loading, (e.g., diskette, mass storage, Secure Disk card, USB stick flash, etc.), all sources should comply with these guidelines.

The service bulletin should require verification that the correct software version has been loaded afte r installation on the aircraft.

(e) Software Change Category The processes and methods used to c hange software should not affect the software level of that software. For classification of software changes, refer to §4 in Appendix A of GM 21 . A.91.

Powered by EASA eRules Page 44 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) (f) Software Changes by Others than the TC Holder There are two types of potential software changes tha t could be implemented by someone other than the orig inal TC holder: — option - selectable software, or — user - modifiable software (UMS).

Option - selectable changes would have to be pre - certified utilising a method of selection which has been shown not to be capa ble of causing a control malfunction.

UMS is software intended for modification by the aircraft operator without review by the certification authority, the aircraft applicant, or the equipment vendor. For Engine Control Systems, UMS has generally not been applicable. However, approval of UMS, if required, would be addressed on a case - by - case basis.

In principle, persons other than the TC holder may modify the software within the modification constraints defined by the TC holder, if the system has been certi fied with the provision for software user modifications. To certify an Electronic Engine Control System with the provision for software modification by others than the TC holder, the TC holder should (1) provide the necessary information for approval of th e design and implementation of a software change, and (2) demonstrate that the necessary precautions have been taken to prevent the user modification from affecting Engine airworthiness, especially if the user modification is in correctly implemented.

In the case where the software is changed in a manner not pre - allowed by the TC holder as “user modifiable”, the “non - TC holder” applicant will have to comply with the requirements given in Part 21, subpart E.

(11) RESERVED (12) AIRCRAFT - SUPPL IED DATA (a) Objective As required by CS - E 50 (g), in case of loss, interruption, or corruption of Aircraft - Supplied Data, the Engine should continue to function in a safe and acceptable manner, without unacceptable effects on thrust or power, Hazardous Eng ine Effects, or loss of ability to comply with the operating speci fications of CS - E 390, CS - E 500 (a ) and CS - E 745, as appropriate.

(b) Background Historically, regulatory practice was to preserve the Engine independence from the aircraft. Hence even with v ery reliable architecture, such as triply redundant air data computer (ADC) systems, it was required that the Engine Control System provided an independent control means that could be used to safely fly the aircraft shou ld all the ADC signals be lost.

Howe ver, with the increased Engine - aircraft integration that is currently occurring in the aviation industry and with the improvement in reliability and implementation of Aircraft - Supplied Data, the regulatory intent is being revised to require that Fault Acco mmodation be provided against single Failures of Aircraft - Supplied Data. This may include Fault Accommodation by transition into another Control Mode that is independent of Aircraft - Supplied D ata.

Powered by EASA eRules Page 45 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) The Engine Control System’s LOTC/LOPC analysis should conta in the effects of air data system Failures in all allowable Engine Control System and air data system dispatch configurations.

When Aircraft - Supplied Data can affect Engine Control System operation, the applicant should address the following items, as appl icable, in the SSA or other appropriate documents: — Software in the data path to the EECS should be at a level consistent with that defined for the EECS. The data path may include other aircraft equipment, such as aircraft thrust management computer s, or ot her avionics equipment.

— The applicant should state in the instructions for installation that the aircraft applicant is responsible for ensuring that changes to aircraft equipment, including software, in the data path to the Engine do not affect the integri ty of the data provided to the Engine as defined by the Engine instructions for installation.

— The applicant should supply the effects of faulty and corrupted Aircraft - Supplied Data on the EECS in the Engine instructions for installation.

— The instructions for installation should state that the installer should ensure that those sensors and equipment involved in delivering information to the EECS are capable of operating in the EMI, HIRF and lightning environm ents, as defined in the certification basis for the aircraft, without affecting their proper and continued operation.

— The applicant should state the reliability level for the Aircraft - Supplied Data that was used as part of the SSA and LOTC/LOPC analysis as an “assumed value” in the instructions for installation.

As stated in CS - E 50 (g), thrust and power command signals sent from the aircraft are not subject t o the specifications of CS - E 50 (g)(2). If the aircraft thrust or power command system is configured to move the Engine thrust or power levers or transmit an electronic signal to command a thrust or power change, the Engine Control System merely responds to the command and changes Engine thrust or power as appropriate. The Engine Control System may have n o way of knowing that the sensed throttle or power lever movement was correct or erroneous.

In both the moving throttle (or power lever) and non - moving throttle (or power lever) configurations, it is the installer’s responsibility to show that a proper fun ctional hazard analysis is performed on the aircraft system involved in generating Engine thrust or power commands, and that the system meets the appropriate aircraft’s functional hazard assessment safety related specifications. This task is an aircraft ce rtification issue, however Failures of the system should be included in t he Engine’s LOTC/LOPC analysis.

(c) Design assessment The applicant should prepare a Fault Accommodation chart that defines the Fault Accommodation architecture for the Aircraft - Suppl ied Data.

There may be elements of the Engine Control System that are mounted in the aircraft and are not part of the Engine type design, but which are dedicated to the Engine Control System and powered by it, such as a throttle position resolver. In these instances, such elements are considered to be an integral component of the Electronic Engine Control System and ar e not considered aircraft data.

Powered by EASA eRules Page 46 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) In the case where the particular Failure modes of the aircraft air data may be unknown, the typical Failure m odes of loss of data and erroneous data should be assumed. The term “erroneous data” is used herein to describe a condition where the data appear s to be valid but is incorrect.

Such assumptions and the results of the evaluation of erroneous aircraft data s hould be provided to the installer.

The following are examples of possible means of accommodation: — Provision of an Alternate Mode that is independent of Aircraft - Supplied Data.

— Dual sources of aircraft - supplied sensor data with local Engine sensors provide d as voters and alternate data sources.

— Use of synthesised Engine parameters to control or as voters. When synthesised parameters are used for control or voting purposes, the analysis should consider the impact of temperature and other environmental effect s on those sensors whose data are used in the synthesis. The variability of any data or information necessary to relate the data from the sensors used in the synthesis to the parameters being synthesised should also be assessed.

— Triple redundant ADC systems that provide the required data.

If for aircraft certification it is intended to show that the complete loss of the aircraft air data system itself is extremely improbable, then it should be shown that the aircraft air data system is unaffected by a complete loss of aircraft generated power, for example, backed up by battery power. (See AMC 20 - 1 ) (d) Effects on the Engine CS - E 510 defines the Hazardous Engi ne Effects for tur bine Engines.

CS - E 50 (g) is primarily intended to address the effects of aircraft signals, such as aircraft air data information, or other signals which could be common to all Engine Control Systems in a multi - Engine installation. The control system design should ensure that the full - up system is capable of providing the declared minimum rated thrust or power throughout the Engine operating envelope.

CS - E 50 (g) requires the applicant to provide an analysis of the effect of loss or corruption of aircraft dat a on Engine thrust or power. The effects of Failures in Aircraft - Supplied Data should be documented in the SSA as described in Section (8) above. Where appropriate, aircraft data Failures or malfunctions that contribute to LOTC/LOPC events should be includ ed in the LOTC/LOPC analysis.

(e) Validation Functionality of the Fault Accommodation logic should be demonstrated by test, analysis, or combination thereof. In the case where the aircraft air data system is not functional because of the loss of all aircra ft generated power, the Engine Control System should include validated Fault Accommodation logic which allows the Engine to operate acceptably with the loss of all aircraft - supplied air data. Engine operation in this system configuration should be demonstr ated by test.

For all dispatchable Control Modes, see CS - E 1030 and AMC E 1030.

If an Alternate Mode, independent of Aircraft - Supplied Data, has been provided to accommodate the loss of all data, sufficient testing should be conducted to demonstrate Powered by EASA eRules Page 47 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) that t he operability specifications have been met when operating in this mode.

Characteristics of operation in this mode should be included in the instructions for installation and operation as appropriate. This Alternate Mode need not be dispatchable.

(13) AIR C RAFT SUPPLIED ELECTRICAL POWER (a) Objective The objective is to provide an electrical power source that is single Fault tolerant (including common cause or mode) in order to allow the EECS to comply with CS - E 50 (c)(2). The most common practice for achieving this objective has been to provide a dedic ated electrical power source for the EECS. When aircraft electrical power is used, the assumed quality and reliability levels of this aircraft power should be contained in the instructions for installation.

(b) Electrical power sources An Engine dedicated power source is defined herein as an electric power source providing electrical power generated and supplied solely for use by a single Engine Control System.

Such a source is usually provided by an alternator(s), mechanically driven by the Engine or the t ransmission system of rotorcraft. However, with the increased integration of the Engine - aircraft systems and with the application of EECS to small Engines, both piston and turbine, use of an Engine - mounted alternator may not necessarily be the only design approach for meeting the objective.

Batteries are considered an Aircraft - Supplied Power source except in the case of piston Engines. For piston Engines, a battery source dedicated solely to the Engine Control System may be accepted as an Engine dedicated p ower source. In such applications, appropriate information for the installer should be provided including, for example, health status and maintenance requirements for the dedicated battery system.

(c) Analysis of the design architecture An analysis and a r eview of the design architecture should identify the requirements for Engine dedicated power sources and Aircraft - Supplied Power sources. The analysis should include the effects of losing these sources. If the Engine is dependent on Aircraft - Supplied Power for any operational functions, the analysis should result in a definition of the requiremen ts for Aircraft - Supplied Power.

The following configurations have been used: — EECS dependent on Aircraft - Supplied Power — EECS independent of Aircraft - Supplied Power ( Engine dedicated power source) — Aircraft - Supplied Power used for functions, switched by the EECS — Aircraft - Supplied Power directly used for Engine functions, independently from the EECS — Aircraft - Supplied Power used to back up the Engine dedicated power sourc e The capacity of any Engine dedicated power source, required to comply with CS - E 50 (h)(2), should provide sufficient margin to maintain confidence that the Engine Control System will continue to function in all anticipated Engine operating conditions where the control system is designed and expected to recover Engine operation automatica lly in - flight. The autonomy of the Engine Control System should be sufficient to ensure its functioning in the case of immediate automatic relight after unintended shutdown.

Powered by EASA eRules Page 48 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) Conversely, the autonomy of the Engine Control System in the whole envelope of res tart in windmilling conditions is not always required. This margin should account for any other anticipated variations in the output of the dedicated power source such as those due to temperature variations, manufacturing tolerances and idle speed variatio ns. The design margin should be substantiated by test and/or analysis and should also take into account any deterioration over the life of the Engine.

(d) Aircraft - Supplied Power Reliability Any Aircraft - Supplied Power reliability values used in system ana lyses, whether supplied by the aircraft manufacturer or assumed, should be contained in the instructions for installation.

When Aircraft - Supplied Power is used in any architecture, if aircraft power Faults or Failures can contribute to LOTC/LOPC or Hazardo us Engine Effects, these events should be included in the Engine SSA and LOTC/LOPC analyses.

When compliance with CS - E 50 (h)(1) imposes an Engine dedicated power source, Failure of this source should be addressed in the LOTC/LOPC analysis required under CS - E 50 (c).

While no credit is normally necessary to be given in the LOTC/LOPC analysis for the use of Aircraft - Supplied Power as a back - up power source, Aircraft - Supplied Power has typically been provided for the purpose of accommodating the loss of the En gine dedicated power source. However, LOTC/LOPC allowance and any impact on the SSA for the use of Aircraft - Supplied Power as the sole power source for an Engine control Back - up System or as a back - up power source would be reviewed on a case - by - case basis.

In some system architectures, an Engine dedicated power source may not be required and Aircraft - Supplied Power may be acceptab le as the sole source of power.

An example is a system that consists of a primary electronic single channel and a full capability hydromechanical Back - up System that is independent of electrical power (a full capability hydromechanical control system is one that meets all CS - E specifications and is not dependent on aircraft power). In this type of architecture, loss or interruption of Aircraft - Supplied Power is accommodated by transferring control to the hydromechanical system. Transition from the electronic to the hydromechanical control sy stem is addressed under CS - E 50 (b).

Another example is an EECS powered by an aircraft power sy stem that could support a critical fly - by - wire flight control system. Such a power system may be acceptable as the sole source of power for an EECS. In this example, it should be stated in the instructions for installation that a detailed design review and safety analysis is to be conducted to identify latent failures and common cause failures that could result in the loss of all electrical power. The instructions should also state that any emergency power sources must be known to be operational at the begi nning of the flight. Any emergency power sources must be isolated from the normal electrical power system in such a way that the emergency power system will be available no matter what happens to the normal generated power system. If batteries are the sour ce of emergency power, there must be a means of determining their condition prior to flight, and their capacity must be shown to be sufficient to assure exhaustion will not occur before getting the airc raft safely back on the ground.

This will satisfy that appropriate reliability assumptions a re provided to the installer.

Powered by EASA eRules Page 49 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) (e) Aircraft - Supplied Power Quality When Aircraft - Supplied Power is necessary for operation of the Engine Control System, CS - E 50 (h)(3) specifies that the Engine instructions for install ation contain the Engine Control System’s electrical power supply quality requirements. This applies to any of the configurations listed in paragraph (13)(c) or any new configurations or novel approach not listed that use Aircraft - Supplied Power. These qua lity requirements should include steady state and transient under - voltage and over - voltage limits for the equipment. The power input standards of RTCA DO - 160/EUROCAE ED - 14 are considered to provide an acceptable definition of such requirements. If RTCA DO - 160/EUROCAE ED - 14 is used, any exceptions to the power quality standards cited for the particular category of equipment specified should be stated.

It is recognised that the electrical or electronic components of the Engine Control System when operated on Aircraft - Supplied Power may cease to operate during some low voltage aircraft power supply conditions beyond those required to sustain normal operation, but in no case should the operation of the Engine control result in a Hazardous Engine Effect. In addit ion, low voltage transients outside the control system’s declared capability should not cause permanent loss of function of the control system, or result in inappropriate control system operation which could cause the Engine to exceed any operational limit s, or cause the transmission of unacceptable erroneous data.

When aircraft power recovers from a low - voltage condition to a condition within which the control system is expected to operate normally, the Engine Control System should resume normal operation. The time interval associated with this recovery should be contained in the Engine instructions for installation. It is recognised that Aircraft - Supplied Power conditions may lead to an Engine shutdown or Engine condition which is not recoverable automatically. In these cases the Engine should be capable of being restarted, and any special flight crew procedures for executing an Engine restart during such conditions should be contained in the Engine instructions for operation. The acceptability of any non - recoverable Engine operating conditions - as a result of these Aircraft - Supplied Power conditions - will be determined at aircraft certification.

If Aircraft - Supplied Power supplied by a battery is required to meet an "all Engines out" restart req uirement, the analysis according to paragraph 13(c) should result in a definition of the requirements for this Aircraft - Supplied Power. In any installation where aircraft electrical power is used to operate the Engine Control System, such as low Engine spe ed in - flight re - starting conditions, the effects of any aircraft electrical bus - switching transients or power transients associated with application of electrical loads, which could cause an interruption in voltage or a decay in voltage below that level re quired for proper control fun ctioning, should be considered.

(f) Effects on the Engine Where loss of aircraft power results in a change in Engine Control Mode, the Control Mode transition should mee t the specifications of CS - E 50 (b).

For some Engine contro l functions that rely exclusively upon Aircraft - Supplied Power, the loss of electrical power may still be acceptable. Acceptability is based on evaluation of the change in Engine operating characteristics, experience with similar designs, or the accommodat ion designed into the control system.

Powered by EASA eRules Page 50 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) Examples of such Engine control functions that have traditionally been reliant on aircraft power include: — Engine start and ignition — Thrust Reverser deployment — Anti - Icing (Engine probe heat) — Fuel Shut - Off — Over - speed P rotection Systems — Non - critical functions that are primarily performance enhancement functions which, if inoperative, do not affect the safe operation of the Engine.

(g) Validation The applicant should demonstrate the effects of loss of Aircraft - Supplied Power by Engine test, system validation test or bench test or combination thereof.

(14) PISTON ENGINES Piston Engines are addressed by the sections above; no additional specific guidance is necessary.

CS - E 50 specifications are applicable to these Engines but, when interpretation is necessary, the conditions which would be acceptable for the aircraft ins tallation should be considered.

(15) ENGINE, PROPELLER AND AIRCRAFT SYSTEMS INTEGRATION AND THE INTER RELATION BETWEEN ENGINE, PROPELLER AND AIRCRAFT CERTIFICATION ACTIVITIES (a) Aircraft or Propeller Functions Integrated into the Engine Control System This involves the integration of aircraft or Propeller functions (i.e., those that have traditionally not been considered Engine control functions), into the Electronic Engine Control System’s hardware and software.

Examples of this include thrust reverser control systems, Propeller speed governors, which govern speed by varying pitch, and ATTCS. When this type of integration activity is pursued, the EECS becomes part of - and should be included in the aircraft’s SSA, and although the aircraft functions incorporated into the EECS may receive review at Engine certification, the acceptability of the safety analysis involving these functions should be determin ed at aircraft certification.

The EECS may be configured to contain only part of the aircraft system’s functionality, or it may contain virtually all of it. Thrust reverser control systems are an example where only part of the functionality is included in the EECS. In such cases, the aircraft is configured to have separate switches and logic (i.e., independent from the EECS) as part of the thrust reverser control system. This separation of reverser control system elements and logic provides an a rchitectural means to limit the criticality of the functions provided by the EECS.

However, in some cases the EECS may be configured to incorporate virtually all of a critical aircraft function. Examples of this “virtual completeness” in aircraft functiona lity are EECS which contain full authority to govern Propeller speed in turboprop powered aircraft and ATTCS in turbofan power aircraft.

The first of these examples is considered critical because, if an Engine fails, the logic in the Engine Control System should be configured to feather the Propeller on that Engine.

Powered by EASA eRules Page 51 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) Failure to rapidly feather the Propeller following an Engine Failure results in excessive drag on the aircraft, and such a condition can be critical to the aircraft. When functions like these ar e integrated into the Engine control such that they render an EECS critical, special attention should be paid to assuring that no single (including common cause/mode) Failures could cause the critical Failure condition, e.g. exposure of the EECS to overhea t should not cause both an Engine shutdown and Failure of the Propeller to feather.

The second example, that of an ATTCS, is considered critical because the system is required to increase the thrust of the remaining Engine(s) following an Engine Failure du ring takeoff, and the increased thrust on the remaining Engines is necessary to achieve the required aircraft performance.

All of the above examples of integration involve aircraft functionality that would receive significant review during aircraft certifi cation.

(b) Integration of Engine Control Functions into Aircraft Systems The trend toward systems integration may lead to aircraft systems performing functions traditionally considered part of the Engine Control System. Some designs may use aircraft syste ms to implement a significant number of the Engine Control System functions. An example would be the complex integrated flight and Engine Control Systems – integrated in aircraft avionics units - which govern Engine speed, rotor speed, rotor pitch angle an d rotor tilt angle in tilt - rotor aircraft.

In these designs, aircraft systems may be required to be used during Engine certification.

In such cases, the Engine applicant is responsible for specifying the requirements for the EECS in the instructions for in stallation and substantiating the adequacy of those requirements.

An example of limited integration would be an Engine control which receives a torque output demand signal from the aircraft and responds by changing the Engine’s fuel flow and other variable s to meet that demand. However, the EECS itself, which is part of the type design, provides all the functionality required to safely operate the Engine in accordance with CS - E or other applicable specifications.

(c) Certification activities (i) Objective T o satisfy the aircraft specifications, such as CS 25.901, CS 25.903 and CS 25.1309, an analysis of the consequences of Failures of the Engine Control System on the aircraft has to be made. The Engine applicant should, together with the aircraft applicant, ensure that the software /AEH criticality levels and the safety and reliability objectives for the Engine electronic control system are consistent with these specifications.

(ii) Interface Definition and System Responsibilities System responsibilities as we ll as interface definitions should be identified for the functional as well as hardware and software aspects between the Engine, Propeller and the aircraft systems in the appropriate documents.

Powered by EASA eRules Page 52 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) The Engine/Propeller/aircraft documents should cover in part icular: — Functional requirements and criticality (which may be based on Engine, Propeller and aircraft considerations) ; — Fault Accommodation strategies ; — Maintenance strategies ; — The software /AEH criticality le vel (per function if necessary); — The reliability o bjectives for: — LOTC/LOPC events , — Transmission of faulty parameters ; — The environmental requirements including the degree of protection against lightning or other electromagnetic effects (e.g. level of induced voltages that can be supported at the interfaces) ; — Engine, Propeller and aircraft interface data and characteristics ; — Aircraft power supply requirements and characteristics (if relevant).

(iii) Distribution of Compliance Tasks The tasks for the certification of the aircraft propulsion system equipped with Electronic Engine Control Systems (EECSs) may be shared between the Engine, Propeller and aircraft applicants. The distribution of these tasks between the applicants should be identified and agreed with the appropriate Engine, Propeller and aircraft authorities. For further information refer to AMC 20 - 1 () .

The aircraft certification should deal with the overall integration of the Engine and Propeller in compliance with the applicable aircraft specifications.

The Engine certification will address the functional aspects of the Engine Control System in compliance with the applicable Engine specifications.

A ppropriate evidence provided for Engine certification should be used for aircraft certification. For example, the quality of any aircraft function software /AEH and aircraft – Engine interface logic already demonstrated for Engine certification should need no additional substantiation for aircraft certification.

Two examples are given below to illustrate this principle.

(A) Case of an EECS performing the functions for the control of the Engine and the functions for the control of the Propeller.

The Engine cert ification would address all general requirements such as software /AEH development assurance procedures, EMI, HIRF and lightning protection levels, effects of loss of aircraft - supplied power.

The Engine certification would address the functional aspects for the Engine functions (safety analysis, rate of LOTC/LOPC events, effect of loss of aircraft - supplied d ata, etc.). The Fault Accommodation logic affecting the control of the Engine, for example, will be reviewed at that time.

The Propeller certification wi ll similarly address the functional aspects for the Propeller functions. The Fault Accommodation logic affecting the control of the Propeller, for example, will be reviewed at that time.

Powered by EASA eRules Page 53 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 3B Products, Parts and Appliances (AMC - 20) In this example, the Propeller functions and characteristics defined by the Propeller applicant, which are to be provided by the Engine Control System, would normally need to be refined by flight test. The Propeller applicant is responsible for ensuring that these functions and characteristics, which are provided for use du ring the Engine certification programme, define an airworthy Propeller configuration, even if they have not y et been refined by flight test.

With regard to changes in design, agreement by all parties involved should be reached so that changes to the Engine Control System that affect the Propeller system, or vice versa, do not lead to any inadvertent effects on the other system.

(B) Case of an aircraft computer performing the functions for the control of the Engine.

The aircraft certification will address al l general requirements such as software /AEH development assurance procedures, EMI, HIRF and lightning protection levels.

The aircraft certification will address the functional aspects for the aircraft functions.

The Engine certification will address the fu nctional aspects for the Engine functions (safety analysis, rate of LOTC/ LOPC events, effect of loss of aircraft - supplied d ata, etc.) The Fault Accommodation logic affecting the control of the Engine, for example, will be reviewed at that time.

[Amdt 20/2] [Amdt 20/10] [Amdt 20/19] Powered by EASA eRules Page 54 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBP ART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20)

AMC 20 - 6B

AMC 20 - 6B Extended - range operation with two - engine aeroplanes

ETOPS certification and operation

ED Decision 2021/006/R Chapter I GENERAL CONSIDERATIONS SECTION 1: PURPOSE This AMC states an acceptable means but not the only means for obtaining approval for two - engine aeroplanes intended to be used in extended - range operations and for the performance of such operations.

An applicant may elect to use another means of compliance which should be acceptable to EASA o r the competent authority. Compliance with this AMC is not mandatory. Use of the terms shall and must apply only to an applicant who elects to comply with this AMC in order to obtain airworthiness approval or to demonstrate compliance with the operational criteria.

This AMC is structured in 3 chapters which contain the following information: — Chapter I of this AMC provides general guidance and definitions related to extended - range operations.

— Chapter II of this AMC provides guidance to (S)TC holders that see k ETOPS type design approval of an engine or a particular a eroplane - engine combination. These a eroplanes may be used in extended - range operations.

— Chapter III of this AMC provides guidance to operators that seek ETOPS operational approval to conduct extended - range operations under the requirements of the applicable operational regulations.

The purpose of this revision No. 3 of AMC 20 - 6 is to remove: (a) the airworthiness criteria applicable to non - ETOPS operations between 120 minutes and 180 minutes; and (b) the weight discriminant for the non - ETOPS operations.

ETOPS type design approvals and operational approvals obtained before the issue of this rev ision remain valid. Extension of existing ETOPS type design approvals or operational approvals beyond 180 min utes should be issued in accordance with this revision.

New ETOPS type design approvals and operational approvals should be issued in accordance wi th this revision.

SECTION 2: RELATED REFERENCES CS - Definitions: ED Decision No. 2003/011/RM as last amended.

CS - E: ED Decision No. 2003/9/RM, as last amended (CS - E 1040).

CS - 25: ED Decision No. 2003/2/RM, as last amended, (CS 25.901, 25.903, 25.1309, 25.1 351(d), 25.1419, 25.1535, CS - 25 Subpart J).

Part - 21: Annex to Commission Regulation ( EU ) No 748 /20 12 , as last amended.

Part - M: Annex I to Commission Regulation (E U ) No 1321 /20 14 , as last amended.

Powered by EASA eRules Page 55 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) Part - 145: Annex II to Commission Regulation (E U ) No 1321 /20 14 , as last amended.

SECTION 3: ABBREVIATIONS AFM : a ero plane flight manual ATS : air traffic services CAME : continuing airworthiness management exposition CAMO : continuing airworthiness management organisation approved pursuant to P art - M S ubpart - G CG : centre of gravity IFSD : in - flight shut - down MCT : maximum continuous thrust MMEL : master minimum equipment list MEL : minimum equipment list RFFS rescue and fire fight ing services (S)TC : ( supplemental) type certificate SECTION 4: T ERMINOLOGY a. Approved One - Engine - Inoperative Cruise Speed (1) The approved one - engine - inoperative cruise speed for the intended area of operation must be a speed, within the certified limits of the aeroplane, selected by the operator and approved by the competent authority.

(2) The operator must use this speed in (i) establishing the outer limit of the area of operation and any dispatch limitation, (ii) calculation of single - e ngine fuel requirements under Appendix 4 S ection 4 t o this AMC and, (iii) establishing the level off altitude (net performance) data. This level off altitude (net performance) must clear any obstacle en route by margins as specified in the operational requirements.

A speed other than the approved one - engine - inoperative - speed may be used as the basis for compliance with en - route altitude requirements.

The fuel requir ed with that speed or the critical fuel scenario associated with the applicable ETOPS equal - time point, whichever is higher has to be uplifted.

(3) As permitted in Appendix 4 to t his AMC, based on evaluation of the actual situation, the pilot - in - command may deviate from the planned one - engine - inoperative cruise speed.

Note: The diversion distance based on the approved one - engine - inoperative cruise speed may take into account the va riation of the True Air Speed.

b. Dispatch Dispatch is when the aircraft first moves under its own power for the purpose of taking off.

Powered by EASA eRules Page 56 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) c. ETOPS Configuration, Maintenance and Procedures (CMP) The ETOPS CMP document contains the particular airframe - engin e combination configuration minimum requirements, including any special inspection, hardware life limits, master minimum equipment list (MMEL) constraints, operating and maintenance procedures found necessary by EASA to establish the suitability of an airf rame/engine combination for extended - range operation.

d. ETOPS significant system ETOPS Significant System means the aeroplane propulsion system and any other aeroplane system whose failure could adversely affect the safety of an ETOPS flight, or whose functioning is important to continued safe flight and landing during an aeroplane diversion.

Each ETOPS significant system is either a Group 1 or Group 2 system based on the following criteria: (1) ETOPS Group 1 Systems: Group 1 Systems are ETOPS sig nificant systems that, related to the number of engines on the aeroplane or the consequences of an engine failure, make the capability of the systems important for an ETOPS flight. The following provides additional discriminating definitions of an ETOPS Gr oup 1 Significant System: (i) A system for which the fail - safe redundancy characteristics are directly linked to the number of engines (e.g. hydraulic system, pneumatic system, electrical system).

(ii) A system that may affect the proper functioning of th e engines to the extent that it could result in an in - flight shutdown or uncommanded loss of thrust (e.g. fuel system, thrust reverser or engine control or indicating system, engine fire detection system).

(iii) A system which contributes significantly to the safety of an engine inoperative ETOPS diversion and is intended to provide additional redundancy to accommodate the system(s) lost by the inoperative engine. These include back - up systems such as an emergency generator, APU, etc.

(iv) A system essentia l for prolonged operation at engine inoperative altitudes such as anti - icing systems for a two - engine aeroplane if single engine performance results in the aeroplane operating in the icing envelope.

(2) ETOPS Group 2 Systems: Group 2 Systems are ETOPS sign ificant systems that do not relate to the number of engines on the aeroplane but are important to the safe operation of the aeroplane on an ETOPS flight. The following provides additional discriminating definitions of an ETOPS Group 2 Significant System: ( i) A system for which certain failure conditions would reduce the capability of the aeroplane or the ability of the crew to cope with an ETOPS diversion (e.g.

long - range navigation or communication, equipment cooling, or systems important to safe operation on a ETOPS diversion after a decompression such as anti - icing systems).

(ii) Time - limited systems including cargo fire suppression and oxygen if the ETOPS diversion is oxygen - system - duration - dependent.

Powered by EASA eRules Page 57 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (iii) Systems whose failure would result in excessive crew workload or have operational implications or significant detrimental impact on the flight crew’s or passengers’ physiological well - being for an ETOPS diversion (e.g. flight control forces that would be exhausting for a maximum ETOPS diversion, or sys tem failures that would require continuous fuel balancing to ensure proper CG, or a cabin environmental control failure that could cause extreme heat or cold to the extent it could incapacitate the crew or cause physical harm to the passengers).

(iv) A system specifically installed to enhance the safety of ETOPS operations and an ETOPS diversion regardless of the applicability of paragraphs (2)(i), (2)(ii) and (2)(iii) above (e.g. communication means).

e. Extended - Range Entry Point The extended - range ent ry point is the first point on the aeroplane’s route which is: — For two - engine aeroplanes with a maximum approved passenger seating configuration of 20 or more, at 60 minutes flying time at the approved one - engine - inoperative cruise speed (under standard co nditions in still air) from an adequate aerodrome.

— For two - engine aeroplanes with a maximum approved passenger seating configuration of 19 or less, at 180 minutes flying time at the approved one - engine - inoperative speed (in still air) from an adequate aero drome.

f. In - flight Shutdown (IFSD) In - flight shutdown (IFSD) occurs when an engine ceases to function and is shut down, whether self - induced, flight crew initiated or caused by an external influence. For ETOPS, all IFSDs occurring from take - off decision speed until touch - down shall be counted.

EASA considers IFSD for all causes, for example: flameout, internal failur e, flight - crew - initiated shutdown, foreign object ingestion, icing, inability to obtain or control desired thrust or power, and cycling of the start control, however briefly, even if the engine operates normally for the remainder of the flight.

This defini tion excludes the cessation of the functioning of an engine when immediately followed by an automatic engine relight and when an engine does not achieve desired thrust or power but is not shut down. These events as well as engine failures occurring before take - off decision speed or after touchdown, although not counted as IFSD s , shall be reported to the competent authority in the frame of continued airworthiness for ETOPS.

g. Maximum Approved Diversion Time A maximum approved diversion time(s) for the airfr ame/engine combination or the engine, established in accordance with the type design criteria in this AMC and Appendices 1 and 2 to this AMC. This maximum approved diversion time (s) is reflected in the aeroplane and engine type certificate data sheets or ( S)TC and in the AFM or AFM - supplement.

Any proposed increase in the maximum approved diversion time (s), or changes to the aircraft or engine, should be re - assessed by the (S)TC holder in accordance with Part 21 . A.101 to establish if any of the type design criteria in this AMC should be applied.

h. Operator’s Approved Diversion Time Operator’s approved diversion time is the maximum time authorised by the c ompetent a uthority that the operator can operate a type of aeroplane at the approved one - engine - inopera tive cruise speed (under standard conditions in still air) from an adequate aerodrome for the area of operation.

Powered by EASA eRules Page 58 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) i. System: A system includes all elements of equipment necessary for the control and performance of a particular function. It includes both the equipment specifically provided for the function in question and other basic equipment such as that necessary to supply power for the equipment operation.

(1) Airframe System. Any system on the aeroplane that is not part of the propulsion system.

(2) Prop ulsion System. The aeroplane propulsion system includes the engine and each component that is necessary for propulsion; components that affect the control of the propulsion units; and components that affect the safe operation of the propulsion units.

SECT ION 5: CONCEPTS Although it is self - evident that the overall safety of an extended - range operation cannot be better than that provided by the reliability of the propulsion systems, some of the factors related to extended - range operation are not necessarily obvious.

For example, cargo compartment fire suppression/containment capability could be a significant factor, or operational/maintenance practices may invalidate certain determinations made during the aeroplane type design certification or the probabilit y of system failures could be a more significant problem than the probability of propulsion system failures. Although propulsion system reliability is a critical factor, it is not the only factor which should be seriously considered in evaluating extended - range operation. Any decision relating to extended - range operation with two - engine aeroplanes should also consider the probability of occurrence of any conditions which would reduce the capability of the aeroplane or the ability of the crew to cope with ad verse operating conditions.

The following is provided to define the concepts for evaluating extended - range operation with two - engine aeroplanes. This approach ensures that the level of safety of extended - range operation with two - engine aeroplanes is consis tent with the level of safety required for current extended - range operation with three and four - engine turbine powered aeroplanes without unnecessarily restricting operation.

a. Airframe Systems A number of airframe systems have an effect on the safety of extended range operation; therefore, the type design certification of the aeroplane should be reviewed to ensure that the design of these systems is acceptable for the safe conduct of the intended operation.

b. Propulsion Systems In order to main tain a level of safety consistent with the overall safety level achieved by modern aeroplanes, it is necessary for two - engine aeroplanes used in extended - range operation to have an acceptably low risk of significant loss of power/thrust for all design - and operation - related causes (see Appendix 1 ).

c. Maintenance and Reliability Programme Definition Since the quality of maintenance and reliability programmes can have an appreciable effect on the reliability of the propulsion system and the airframe systems required for extended - range operation, an assessment should be made of the proposed maintenance and reliability programme's ability to maintain a satisfactory level of propulsion a nd airframe system reliability for the particular airframe/engine combination.

Powered by EASA eRules Page 59 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) d. Maintenance and Reliability Programme Implementation Following a determination that the airframe systems and propulsion systems are designed to be suitable for extended - range operation, an in - depth review of the applicant's training programmes, operations and maintenance and reliability programmes should be accomplished to show ability to achieve and maintain an acceptable level of systems reliability to safely conduct these o perations.

e. Human Factors System failures or malfunctions occurring during extended - range operation could affect flight crew workload and procedures. Since the demands on the flight crew may increase, an assessment should be made to ensure that more than average piloting skills or crew co - ordination is not required.

Chapter II TYPE DESIGN APPROVAL CONSIDERATIONS SECTION 1: APPLICABILITY This chapter is applicable to (S)TC applicants or holders that seek ETOPS type design approval for an engine or a particular a ero plane - engine combination.

SECTION 2: COMPETENT AUTHORITY The c ompetent a uthority for the issue of an ETOPS type design approval is EASA .

SECTION 3: G ENERAL When a two - engine aeroplane is intended to be used in extended - range operations, a determination should be made that the design features are suitable for the intended operation. The ETOPS significant system for the particular airframe/engine combination should be shown to be designed to fail - safe criteria and it should be determined that it can achieve a level of reliability suitable for the intended operation. In some cases , modifications to systems may be necessary to achieve the desired reliability.

SECTION 4: ELEGIBILITY To be eligible for extended - range operations, the specified air frame/engine combination, should have been certified according to the airworthiness standards of large aeroplanes and engines.

The process to obtain a type design ETOPS approval requires the applicant to show that in accordance with the criteria establishe d in this C hapter II and Appendices 1 and 2: — the design features of the particular airframe/engine combination are suitable for the intended operations; and, — the particular airframe/engine combination, having been recognised eligible for ETOPS, can achieve a sufficiently high level of reliability.

The required level of reliability of the airframe/engine combination can be validated by the following methods: (1) METHOD 1: in - service experience for ETOPS type design approval defined in S ection 6.1 of and Appendices 1 and 2 to this AMC, or Powered by EASA eRules Page 60 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (2) METHOD 2: a programme of design, test and analysis agreed between the applicant and EASA , (i.e. a pproval p lan) for Early ETOPS type design approval defined in Appendices 1 and 2 to this AMC.

SECTION 5: REQUEST FOR APPROVAL An applicant for, and holders of a (S)TC requesting a determination that a particular airframe/engine combination is a suitable type design for extended - range operation, should apply to EASA . EASA will then initiate an assessment of the engine and airframe/engine combination in accordance with the criteria laid down in this C hapter II and in Appendices 1 & 2 to this AMC.

SECTION 6: VALIDATION METHODS OF THE LEVEL OF RELIABLITY This chapter together with Appendices 1 and 2 to this AMC should be followed to assess the reliability level of the propulsion system and airframe systems for which ETOPS type design a pproval is sought.

Appendices 1 and 2 describe both the in - service experience method and the early ETOPS method.

6.1 METHOD 1: IN - SERVICE EXPERIENCE FOR ETOPS TYPE DESIGN APPROVAL Prior to the ETOPS type design approval, it should be shown that the world fleet of the particular airframe/engine combination for which approval is sought can achieve or has achi eved, as determined by EASA (see Appendices 1 and 2 ), an acceptable and reasonably stable level of propulsion system in - flight shutdown (IFSD) rate and airframe system reliability.

Engineeri ng and operational judgement applied in accordance with the guidance provided in Appendix 1 will then be used to determine that the IFSD rate objective for all independent causes c an be or has been achieved. This assessment is an integral part of the determination in S ection 7 paragraph (2) for type design approval. This determination of propulsion system reliability is derived from a world fleet database containing, in accordance w ith requirements of Appendix 1 , all in - flight shutdown events, all significant engine reliability problems, design and test data and available data on cases of significant loss of thrust, including those where the propulsion system failed or the engine was throttled back or shut down by the pilot. This determination will take due account of the approved maximum diversion time, proposed rectification of all identified propulsion and ETOPS significant systems problems, as well as events where in - flight starting capability may be degraded.

6.2 METHOD 2: EARLY ETOPS ETOPS approval is considered feasible at the introduction to service of an airframe/engine combination as long as EASA is totally satisfied that all aspects of the approval plan have been completed. EASA must be satisfied that the approval plan achieves the level of safety intended in this AMC and in the aeroplane and engine certification bases. Any non - compliance with the ap proval plan can result in a lesser approval than sought for.

(S)TC holders will be required to respond to any incident or occurrence in the most expeditious manner. A serious single event or series of related events could result in immediate revocation of ETOPS type design approval. Any isolated problem not justifying immediate withdrawal of approval, should be addressed within 30 days in a resolution plan approved by EASA . (S)TC holders will be reliant on operators to supply incident and occurrence data.

SECTION 7: EVALUATION CRITERIA of the ETOPS type design The applicant should conduct an evaluation of failures and failure combinations based on engineering and operational consideration as well as acceptable fail - safe methodology. The evaluation should Powered by EASA eRules Page 61 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) co nsider effects of operations with a single engine, including allowance for additional stress that could result from failure of the first propulsion system. Unless it can be shown that equivalent safety levels are provided or the effects of failure are mino r, failure and reliability analysis should be used as guidance in verifying that the proper level of fail - safe design has been provided. Excluding failures of the engine, any system or equipment failure condition, or combination of failures that affects th e aeroplane or engine and that would result in a need for a diversion, should be considered a Major event (CS 25.1309) and therefore the probability of such should be compatible with that safety objective. The following criteria are applicable to the extended - range operation of aeroplanes with two engines: (1) Airframe systems should be shown to comply with CS 25.1309 in accordance with S ection s 7 and 8 of C hapter II and with Appendix 2 to this AMC.

(2) The propulsion systems should be shown to comply with CS 25.901.

(i) Engineering and operational judgement , applied in accordance with the guidance provided in S ection 6 and Appendix 1 , should be used to show that the propulsion system can achieve the desired level of reliability.

(ii) Contained engine failure, cascading failures, consequential damage or failure of remaining systems or equipment should be assessed in accordance with CS 25.901.

(iii) It should be shown during the type design evaluation that the approved engine limits at all approved power settings will not be exceeded when conducting an extended duration single - engine operation during the di version in all expected environmental conditions.

The assessment should account for the effects of additional engine loading demands (e.g.

anti - icing, electrical, etc.) which may be required during the single - engine flight phase associated with the diversi on .

(3) The safety impact of an uncontained engine failure should be assessed in accordance with CS 25.903.

(4) The APU installation, if required for extended - range operations, should meet the applicable CS - 25 provisions (Subpart J, APU) and any additional requirements necessary to demonstrate its ability to perform the intended function as specified by EASA following a review of the applicant's data. If certain extended - range operation may necessitate in - fli ght start and run of the APU, it must be substantiated that the APU has adequate capability and reliability for that operation.

The APU should demonstrate the required in - flight start reliability throughout the flight envelope (compatible with overall safe ty objective but not less than 95%) taking account of all approved fuel types and temperatures. An acceptable procedure for starting and running the APU (e.g. descent to allow start) may be defined in order to demonstrate compliance with the required in - fl ight start reliability. If this reliability cannot be demonstrated, it may be necessary to require continuous operation of the APU.

(5) Extended duration, single - engine operations should not require exceptional piloting skills and/or crew co - ordination. C onsidering the degradation of the performance of the aeroplane type with an engine inoperative, the increased flight crew workload, and the malfunction of remaining systems and equipment, the impact on flight crew procedures should be minimised.

Consideration should also be given to the effects on the crew ’ s and passengers ’ physiological needs (e.g. cabin temperature control), when continuing the flight with an inoperative engine or one or more inoperative airframe system(s).

Powered by EASA eRules Page 62 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) The provision of esse ntial services to ensure the continued safety of the aeroplane and safety of the passengers and crew, particularly during very long diversion times with depleted/degraded systems, should be assessed. The applicant should provide a list of aircraft system f unctions considered to be necessary to perform a safe ETOPS flight. The applicants should consider the following examples: (i) Flight deck and cabin environmental systems integrity and reliability (ii) The avionics/cooling and consequent integrity of the a vionic systems (iii) Cargo hold fire suppression capacity and integrity of any smoke/fire alerting system (iv) Brake accumulator or emergency braking system capacity/integrity (v) Adequate capacity of all - time dependent functions (vi) Pressurisation s ystem integrity/reliability (vii) Oxygen s ystem integrity/reliability/capacity, if the Maximum Approved Diversion Time is based on the oxygen system capability (viii) Integrity/reliability/capacity of back - up systems (e.g. electrical, hydraulic) (ix) Fuel syste m integrity and fuel accessibility. Fuel consumption with engine failure and/or other system failures (see paragraph (11)) (x) Fuel quantity and fuel used, indications and alerts (see paragraph (10)).

(6) It should be demonstrated for extended duration sin gle - engine operation, that the remaining power (electrical, hydraulic, pneumatic) will continue to be available at levels necessary to permit continued safe flight and landing, and to provide those services necessary for the overall safety of the passenger s and crew.

Unless it can be shown that cabin pressure can be maintained on single - engine operation at the altitude necessary for continued flight to an ETOPS en - route alternate aerodrome, oxygen should be available to sustain the passengers and crew for t he maximum diversion time.

(7) In the event of any single failure, or any combination of failures not shown to be Extremely Improbable, it should be shown that electrical power is provided for essential flight instruments, warning systems, avionics, commun ications, navigation, required route or destination guidance equipment, supportive systems and/or hardware and any other equipment deemed necessary for extended - range operation to continue safe flight and landing at an ETOPS en - route alternate aerodrome. I nformation provided to the flight crew should be of sufficient accuracy for the intended operation.

Functions to be provided may differ between aeroplanes and should be agreed with EASA .

These should normally include: (i) attitude information; (ii) adequat e radio communication (including the route specific long - range communication equipment as required by the applicable operational regulations) and intercommunication capability; (iii) adequate navigation capability (including route specific long - range navig ation equipment as required by the applicable operational regulations and weather radar); (iv) adequate cockpit and instrument lighting, emergency lighting and landing lights; (v) sufficient captain and first officer instruments, provided cross - reading has been evaluated; Powered by EASA eRules Page 63 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (vi) heading, airspeed and altitude including appropriate pitot/static heating; (vii) adequate flight controls including auto - pilot; (viii) adequate engine controls, and restart capability with critical type fuel (from the stand - point of f lame out and restart capability) and with the aeroplane initially at the maximum relight altitude; (ix) adequate fuel supply system capability including such fuel boost and fuel transfer functions that may be necessary; (x) adequate engine instrumentation; (xi) such warning, cautions, and indications as are required for continued safe flight and landing; (xii) fire protection (cargo, APU and engines); (xiii) adequate ice protection including windshield de - icing; (xiv) adequate control of coc kpit and cabin environment including heating and pressurisation; and, (xv) ATC t ransponder.

Note: For 90 minutes or less ETOPS operations, the functions to be provided must satisfy the requirements of CS 25.1351(d)(2) as interpreted by AMC 25.1351(d).

(8) Three or more reliable and independent electrical power sources should be available. As a minimum, following failure of any two sources, the remaining source should be capable of powering the items specified in paragraph (7). If one or more of the required electrical power sources are provided by an APU, hydraulic system, or ram air turbine, the following criteria apply as appropriate: (i) The APU, when installed, should meet the criteria in paragraph (4).

(ii) The hydraulic power source sho uld be reliable. To achieve this reliability, it may be necessary to provide two or more independent energy sources (e.g. bleed air from two or more pneumatic sources).

(iii) The ram air turbine (RAT) should be demonstrated to be sufficiently reliable in d eployment and use. The RAT should not require engine - dependent power for deployment.

If one of the required electrical power sources is provided by batteries, the following criteria apply: (iv) When one of the three independent electrical power sources is time - limited (e.g.

batteries), such power source should have a capability to enable the items required in paragraph (7) to be powered for continued flight and landing to an ETOPS en - route alternate aerodrome and it will be considered to be a time - limited s ystem in accordance with paragraph (12).

(9) For ETOPS approvals above 180 minutes, in addition to the criteria for electrical power sources specified in paragraph (8) above, the following criteria should also be applied: (i) Unless it can be shown that th e failure of all three independent power sources required by paragraph (8) above is extremely improbable, following failure of these three independent power sources, a fourth independent power source should be available that Powered by EASA eRules Page 64 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) is capable of providing power t o the essential functions referred to in paragraph (7) for continued safe flight and landing to an adequate ETOPS en - route alternate aerodrome (ii) If the additional power source is provided by an APU, it should meet the criteria in paragraph (4).

(iii) If the additional power source is provided by a hydraulic system or ram air turbine, the provisions of paragraph (8) apply.

(10) It should be shown that adequate status monitoring information and procedures on all ETOPS significant systems are available for the flight crew to make pre - flight, in - flight go/no - go and diversion decisions.

Adequate fuel quantity information should be available to the flight crew, including alerts, and advisories, that consider the fuel required to complete the flight, abnormal fu el management or transfer between tanks, and possible fuel leaks in the tanks, the fuel lines and other fuel system components and the engines.

(11) Fuel system (i) The aeroplane fuel system should provide fuel pressure and flow to the engine(s) in accorda nce with CS 25.951 and 25.955 for any fuel pump power supply failure condition not shown to be extremely improbable.

(ii) The fuel necessary to complete the ETOPS mission or during a diversion should be available to the operating engine(s) under any failur e condition, other th a n fuel boost pump failures, not shown to be extremely improbable (e.g. cross - feed valve failures, automatic fuel management system failures).

(12) Time - limited system In addition to the maximum approved diversion time , diversion tim e may also be limited by the capacity of the cargo hold fire suppression system or other ETOPS significant time - limited systems determined by considering other relevant failures, such as an engine inoperative, and combinations of failures not shown to be e xtremely improbable.

Time - limited system capability, if any, must be defined and stated in the Aeroplane Flight Manual or AFM - supplement and CMP document.

(13) Operation in icing conditions Airframe and propulsion ice protection should be shown to provide adequate capability (aeroplane controllability, etc.) for the intended operation. This should account for prolonged exposure to lower altitudes associated with the single engine diversion, cruise, holding, approach and landing.

(i) The aeroplane sh ould be certified for operation in icing conditions in accordance with CS 25.1419.

(ii) The aeroplane should be capable of continued safe flight and landing in icing conditions at depressurisation altitudes or engine inoperative altitudes.

The extent of ic e accumulation on unprotected surfaces should consider the maximum super cooled liquid water catch at one - engine inoperative and depressurisation cruise altitudes.

Substantiated icing scenario(s) should be assumed to occur during the period of time when ic ing conditions are forecast. The icing episode(s) assumed should be agreed with EASA . The Extremely improbable is defined in CS 25.1309 and AMC to CS 25.1309.

Powered by EASA eRules Page 65 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) probability of icing longer than that assumed, and agreed for the icing episode(s), in combination with the probability of the aeroplane having to operate in icing co nditions (e.g.

engine in - flight shutdown or decompression) should be shown to be extremely improbable.

(14) Solutions to achieve required reliability The permanent solution to a problem should be, as far as possible, a hardware/design solution.

However, if scheduled maintenance, replacement, and/or inspection are utilised to obtain type design approval for extended - range operation, and therefore are required in the CMP standard document, the specific maintenance information should be easily retrievable and clearly referenced and identified in an appropriate maintenance document.

(15) Engine condition monitoring Procedures for an engine condition monitoring process should be defined and validated for ETOPS. The engine condition monitoring proc ess should be able to determine, if an engine is no longer capable of providing, within certified engine operating limits, the maximum thrust required for a single engine diversion. The effects of additional engine loading demands (e.g.

anti - ice, electrica l), which may be required during an engine inoperative diversion, should be accounted for.

SECTION 8: ANALYSIS OF FAILURE EFFECTS AND RELIABILITY 8.1 General The analysis and demonstrations of airframe and propulsion system level of reliability and failur e effects required by S ection 6 and S ection 7 should be based on the expected longest diversion time for extended - range routes likely to be flown with the aeroplane. However, in certain failure scenarios, it may be necessary to consider a shorter diversion time due to the time - limited systems.

8.2 Propulsion systems (i) An assessment of the propulsion system ’ s reliability for particular airframe/engine combinations should be made in accordance with S ection 6 and Appe ndix 1 .

(ii) The analysis should consider: (A) Effects of operation with a single - propulsion system (i.e. high - power demands including extended use of MCT and bleed requirements, etc.) and include possible damage that cou ld result from failure of the first propulsion system.

(B) Effects of the availability and management of fuel for propulsion system operation (i.e. cross - feed valve failures, fuel mismanagement, ability to detect and isolate leaks, etc.).

(C) Effects of ot her failures, external conditions, maintenance and crew errors, that could jeopardise the operation of the remaining propulsion system, should be examined.

(D) Effect of inadvertent thrust reverser deployment, if not shown to be extremely improbable (inclu des design and maintenance).

8.3 Airframe systems An assessment of the airframe system ’ s reliability for particular airframe/engine combinations should be made in accordance with S ection 7 and Appendix 2 .

Powered by EASA eRules Page 66 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) The analysis should consider: (i) Hydraulic Power and Flight Control An analysis should be carried out taking into account the criteria detailed in S ection 7 paragraph (6).

Consideration of these systems may be combined, since many commercial aeroplanes have full hydraulically powered controls. For aeroplanes with all flight controls being hydraulically powered, evaluation of hydraulic system redundancy should show that single failures or failure combinations, not shown to be extremely improbable, do not preclude continued safe flight and landing at an ETOPS en - route alternate aerodrome. As part of this evaluation, the loss of any parts of the hydraulic systems and any engine should be assumed to occur unless it is establis hed during failure evaluation that there are no sources of damage or the location of the damage sources are such that this failure condition will not occur.

Note: For 75 minutes or less ETOPS approval, additional analysis to show compliance with S ection 7 will not be required for airframe systems, where for basic (non - ETOPS) Type Design Approval compliance with CS 25.1309, or its equivalent, has already been shown.

(ii) Services Provided by Electrical Power An analysis should show that the criteria detailed in S ection 7 paragraphs (6), (7) and (8) are satisfied taking into account the exposure times established in paragraph (1).

Note1: For 75 minutes or less ETOPS approval, additional analysis to show compliance with S ection 7 will not be required for airfra me systems, where for basic (non - ETOPS) Type Design Approval (TDA), compliance with CS 25.1309, or its equivalent, has already been shown.

Note 2: For ETOPS approval above 180 minutes, the analysis should also show that the criteria detailed in S ection 7 p aragraph (9) are satisfied.

(iii) Equipment Cooling An analysis should establish that the equipment (including avionics) necessary for extended - range operation has the ability to operate acceptably following failure modes in the cooling system not shown to be extremely improbable. Adequate indication of the proper functioning of the cooling system should be demonstrated to ensure system operation prior to dispatch and during flight.

Note: For 75 minutes or less ETOPS approval, additional analysis to show co mpliance with S ection 7 will not be required for airframe systems, where for basic (non - ETOPS) type design approval (TDA), compliance with CS 25.1309, or its equivalent, has already been shown.

(iv) Cargo Compartment It should be shown that the cargo compa rtment design and fire protection system capability (where applicable) is consistent with the following: (A) Design The cargo compartment fire protection system integrity and reliability should be suitable for the intended operation considering fire detect ion sensors, liner materials, etc.

Powered by EASA eRules Page 67 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (B) Fire Protection The capacity/endurance of the cargo compartment fire suppression system should be established.

(v) Cabin Pressurisation Authority/ EASA - approved aeroplane performance data should be available to verify the ability to continue safe flight and landing after loss of pressure and subsequent operation at a lower altitude (see also S ection 7 paragraph (6)).

(vi) Cockpit and Cabin Environment The analysis should show that an adequate cockpit and cabin environment is preserved following all combinations of propulsion and electrical system failures which are not shown to be extremely improbable, e.g. when the aeroplane is operating on standby electr ical power only.

Note: For 75 minutes or less ETOPS approval, additional analysis to show compliance with S ection 7 will not be required for airframe systems, where for basic (non - ETOPS) type design approval (TDA), compliance with CS 25.1309, or its equiva lent, has already been shown.

SECTION 9: ASSESSMENT OF FAILURE CONDITIONS In assessing the fail - safe features and effects of failure conditions, account should be taken of: (1) The variations in the performance of the system, the probability of the failure(s), the complexity of the crew action.

(2) Factors alleviating or aggravating the direct effects of the initial failure condition, including consequential or related conditions existing within the aeroplane which may affect the ability of the crew to deal with direct effects, such as the presence of smoke, aeroplane accelerations, interruption of air - to - ground communication, cabin pressurisation problems, etc.

(3) A flight test should be conducted by the (S)TC holders and witnessed by EASA to valida te expected aeroplane flying qualities and performance considering propulsion system failure, electrical power losses, etc. The adequacy of remaining aeroplane systems and performance and flight crew ability to deal with the emergency, considering remainin g flight deck information, will be assessed in all phases of flight and anticipated operating conditions.

Depending on the scope, content, and review by EASA of the (S)TC holders database, this flight test could also be used as a means for approving the ba sic aerodynamic and engine performance data used to establish the aeroplane performance identified in C hapter III.

(4) Safety assessments should consider the flight consequences of single or multiple system failures leading to a diversion, and the probabil ity and consequences of subsequent failures or exhaustion of the capacity of time - limited systems that might occur during the diversion.

Safety assessments should determine: (i) The effect of the initial failure condition on the capability of the aeroplane to cope with adverse conditions at the diversion airport, and (ii) The means available to the crew to assess the extent and evolution of the situation during a prolonged diversion.

Powered by EASA eRules Page 68 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) The aeroplane flight manual and the flight crew warning and alerting and d isplay systems should provide clear information to enable the flight crew to determine when failure conditions are such that a diversion is necessary.

The assessment of the reliability of propulsion and airframe systems for a particular airframe/engine com bination will be contained in EASA - approved Aeroplane Assessment Report. In the case EASA is validating the approval issued by a third - country certification authority, the report may incorporate the assessment report established by the latter.

Following ap proval of the report, the propulsion and airframe system recommendations will be included in an EASA - approved CMP document that establishes the CMP standard requirements for the candidate engine or airframe/engine combination. This document will then be re ferenced in the Operation Specification and the Aircraft Flight Manual or AFM - Supplement.

SECTION 10: ISSUE OF THE ETOPS TYPE DESIGN APPROVAL Upon satisfactory completion of the aeroplane evaluation through an engineering inspection and test programme consistent with the type certification procedures of EASA and sufficient in - service experience data (see Appendices 1 and 2 ): (1) The type design approval, the maximum approved diversion time and demonstrated capability of any time - limited systems wi ll be reflected in the approved AFM or AFM - Supplement, and the aeroplane and engine type certification data sheet or supplemental type certificate which contain directly or by reference the following pertinent information, as applicable: (i) special limita tions (if necessary), including any limitations associated with a maximum diversion time established in accordance with S ection 8 paragraph (1) and time - limited systems (for example, the endurance of cargo hold fire suppression systems); (ii) additional ma rkings or placards (if required); (iii) revision to the performance section of the AFM to include the data required by Appendix 4 paragraph 10; (iv) the airborne equipment, install ation, and flight crew procedures required for extended - range operations; (v) description or reference to the CMP document containing the approved aeroplane standards for extended - range operations; (vi) a statement to the effect that: ‘ The Type design, systems reliability and performance of the considered a erop lane/engine models combinations have been evaluated by EASA in accordance with CS - 25, CS - E and AMC 20 - 6 and have been found suitable for ETOPS operations when configured, maintained and ope rated in accordance with this document. This finding does not constitute an approval to conduct ETOPS operations. ’ (2) The engine ETOPS type design approval and maximum approved diversion time will be reflected in the engine type certification data sheet o r supplemental type certificate which contain directly or by referencing the following pertinent information, as applicable: (i) special limitations (if necessary), including any limitations associated with the maximum approved diversion time should be established; (ii ) additional markings or placards (if required); (iii) description or reference to a document containing the approve d engine configuration.

Powered by EASA eRules Page 69 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) SECTION 11: CONTINUED AIRWORTHINESS OF THE ETOPS TYPE DESIGN APPROVAL (1) EASA will include the consideration of extended - range operation in its normal surveillance and design change approval functions.

(2) The (S)TC holders whose a pproval includes a type design ETOPS approval, as well as EASA, should periodically and individually review the in - service reliability of the airframe/engine combination and of the engine. Further to these reviews and each time that an urgent problem makes it necessary, in order to achieve and maintain the desired level of reliability and therefore the safety of ETOPS, EASA may: — require that the type design standard be revised ; for example , by the issuance of an airworthiness directive , or, — issue an emergency conformity information .

(3) The Reliability Tracking Board will periodically check that the airframe/propulsion system reliability requirements for extended - range operation are achieved or maintained. For mature ETOPS products , the RTB may be replaced by the process to monitor their reliability as defined in Appendix 1 , S ection 6.b and Appendix 2 , S ection 5.c.

Note: Periodically means in this context 2 years.

(4) Any significant problems which adversely affect extended - range operation will be corrected.

Modifications or maintenance actions to achieve or maintain the reliability objective of extended - range operations for the airframe/engine combination will be incorporated into the CMP document. EASA will co - ordinate this action with the affected (S)TC holder.

(5) The CMP document which establishes the suitability of an engine or airframe/e ngine combination for extended - range operation defines the minimum standards for the operation.

Chapter III OPERATIONAL APPROVAL CONSIDERATIONS S ECTION 1: APPLICABILITY This acceptable means of compliance is for operators seeking an ETOPS operational approval to operate: (1) Two - engine aeroplanes with a maximum passenger seating configuration of 20 or more, in excess of 60 minutes at the approved one - engine - inoperative speed (under standard conditions in still air) from an adequate aerodrom e; (2) or Two - engine aeroplanes with a maximum passenger seating configuration of 19 or less, in excess of 180 minutes at the approved one - engine - inoperative speed (in still air) from an adequate aerodrome.

SECTION 2: COMPETENT AUTHORITY The c ompetent a ut hority for the issue of an ETOPS operational approval to an operator is the authority that has issued its Air Operator Certificate.

Nevertheless, as the operational approval requires the operator to comply with the continuing airworthiness requirements of Appendix 8 to this AMC, the operator has to ensure that the specific See EASA Airworthiness Directive Policy ref erence C.Y001 - 01 (28.07.08).

Powered by EASA eRules Page 70 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) ETOPS elements related to continuing airworthiness are approved by the c ompetent a uthority designated in Annex I (Part - M) to Regulation (EU) 1321/2014 .

SECTION 3: APPLICABLE OPERATIONAL REQUIREMENTS This chapter details the approval process required for ETOPS in accordance with the operational requirements.

SECTION 4: ME THODS FOR OBTAINING ETOPS O PERATIONS APPROVAL There are two methods for obtaining an ETOPS approval, depending on the availability and amount of prior experi ence with the candidate airframe/engine combination: — ‘ Accelerated ETOPS approval ’ that does not require prior in - service experience with the candidate airframe/engine combination; — ‘ In - service ETOPS Approval ’ , based on a prerequisite amount of prior in - service experience with the candidate airframe/engine combination. Elements from the ‘ accelerated ETOPS approval ’ method may be used to reduce the amount of prior in - service experience.

SECTION 5: ACCELERATED E TOPS APPROVAL The criteria defined in this section permit approval of ETOPS operations up to 180 minutes, when the operator has established that those processes that are necessary for successful ETOPS are in place and are proven to be reliable. The basis o f the accelerated approval is that the operator will meet equivalent levels of safety and satisfy the objectives of this AMC.

The accelerated ETOPS approval process includes the following phases: — Application phase — Validation of the operator’s ETOPS process es — Validation of operator ETOPS continuing airworthiness and operations capability — Issue of ETOPS operations approval by the competent authority 5.1 Application phase The operator should submit an accelerated ETOPS operations approval plan to the authority 6 months before the proposed start of ETOPS. This time will permit the competent authority to review the documented plans and ensure adequate ETOPS processes are in place.

(A) Accelerated ETOPS operations approval plan: The accelerated ETOPS operations ap proval plan should define: 1. T he proposed routes and the ETOPS diversion time necessary to support those routes; 2. The proposed one - engine - inoperative cruise speed, which may be area - specific depending upon anticipated aeroplane loading and likely fuel penalties associated with the planned procedures; 3. How to comply with the ETOPS Processes listed in paragraph (B); 4. The resources allocated to each ETOPS process to initiate and sustain ETOPS operations in a manner that demonstrates commitment by management and all personnel involved in ETOPS continuing airworthiness and operational support; Powered by EASA eRules Page 71 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) 5. How to establish compliance with the build standard required for type design approval, e.g. CMP document compliance; 6. Review gates : A review gate is a milestone of the tracking plan to allow for the orderly tracking and documentation of specific provisions of this section. Normally, the review gate process will start 6 months before the proposed start of ETOPS and should continue unt il at least 6 months after the start of ETOPS. The review gate process will help ensure that the proven processes comply with the provisions of this AMC and are capable of continued ETOPS operations.

(B) Operator ETOPS process elements The operator that se ek s Accelerated ETOPS operations approval should also demonstrate to the competent authority that it has established an ETOPS process that includes the following ETOPS elements: 1. Airframe/engine combination and engine compliance with ETOPS Type Design Bu ild Standard (CMP); 2. Compliance with the continuing airworthiness requirements as defined in Appendix 8 , which should include: a. A maintenance programme ; b. A proven ETOPS reliability programme ; c. A proven oil consumption monitoring programme ; d. A proven engine condition monitoring and reporting system; e. A propulsion system monitoring programme; f. An ETOPS parts control programme; g. A proven plan for res olution of aeroplane discrepancies.

3. ETOPS O perations M anual supplement or its equivalent in the Operations Manual; 4. The operator should establish a programme that results in a high degree of confidence that the propulsion system reliability that is ap propriate to the ETOPS diversion time would be maintained; 5. Initial and recurrent training and qualification programmes in place for ETOPS related personnel, including flight crew and all other operations personnel; 6. Compliance with the Flight Operatio ns Programme as defined in this AMC; 7. Proven flight planning and dispatch programmes that are appropriate to ETOPS; 8. Procedures to ensure the availability of meteorological information and MEL that are appropriate to ETOPS; and 9. Flight crew and dispa tch personnel familiar with the ETOPS routes to be flown; in particular , the requirements for, and selection of ETOPS en - route alternate aerodromes.

Powered by EASA eRules Page 72 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of A MC 20 - 6B Products, Parts and Appliances (AMC - 20) (C) Process elements documentation : Documentation should be provided for the following elements: 1. Technology that is new to the operator and significant differences in ETOPS significant systems (engines, electrical, hydraulic and pneumatic), compared to the aeroplanes currently operated and the aeroplane for which the operator is seeking Accelerated ET OPS operations approval ; 2. The plan to train the flight and continuing airworthiness personnel to the different ETOPS process elements; 3. The plan to use proven or manufacturer - validated training and maintenance and operations manua l procedures relevant to ETOPS for the aeroplane for which the operator is seeking accelerated ETOPS operations approval ; 4. Changes to any previously proven or manufacturer - validated training, maintenance or operations manual procedures described above. Depending on the nature of any changes, the operator may be required to provide a plan for validating such changes; 5. The validation plan for any additional operator unique training and procedures relevant to ETOPS, if any; 6. Details of any ETOPS support programme from the airframe/engine combination or engine (S)TC holder, other operators or any third - country authority or other competent authority; and 7. The control procedures when a contracted maintenance organisation or fl ight dispatch organisation is used.

5.2 Validation of the operator’ s ETOPS processes This section identifies process elements that need to be validated and approved prior to the start of accelerated ETOPS. For a process to be considered proven, the process should first be described, including a flow chart of process elements. The roles and responsibilities of the personnel that manag e the process should be defined including any training requirement. The operator should demonstrate that the process is in pla ce and functions as intended. This may be accomplished by providing data, documentation and analysis results and/or by demonstrating in practise that the process works and consistently provides the intended results. The operator should also demonstrate tha t a feedback loop exists to facilitate the surveillance of the process, based on in - service experience.

If any operator is currently approved for conducting ETOPS with a different engine and/or airframe/engine combination, it may be able to document proven ETOPS processes. In this case , only minimal further validation may be necessary. It will be necessary to demonstrate that processes are in place to assure equivalent results on the engine and/or airframe/engine combination being proposed for Accelerated E TOPS Operations Approval.

(A) Reduction in the validation requirements: The following elements will be useful or beneficial in justifying a reduction by the competent authority in the validation requirements of ETOPS processes: 1. Experience with other air frames and/or engines; 2. Previous ETOPS experience; Powered by EASA eRules Page 73 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) 3. Experience with long - range, over - water operations with two, three or four engine aeroplanes; 4. Any experience gained by flight crews, continuing airworthiness personnel and flight dispatch personnel, while working with other ETOPS approved operators, particularly when such experience is with the same airframe or airframe/engine combination.

Process validation may be done on the airframe/engine combination, which will be used in Accelerated E TOPS operation or on a different aeroplane type than that for which approval is being sought.

(B) Validation programme: A process could be validated by demonstrating that it produces equivalent results on a different aeroplane type or airframe/engine combi nation. In this case, the validation programme should address the following: 1. The operator should show that the ETOPS validation programme can be executed in a safe manner; 2. The operator should state in its application any policy guidance to personnel involved in the ETOPS process validation programme. Such guidance should clearly state that ETOPS process validation exercises should not be allowed to adversely impact the safety of actual operations, especially during periods of abnormal, emergency, or h igh cockpit workload operations. It should emphasise that during periods of abnormal or emergency operation or high cockpit workload ETOPS process validation exercises may be terminated; 3. The validation scenario should be of sufficient frequency and oper ational exposure to validate maintenance and operational support systems not validated by other means; 4. A means should be established to monitor and report performance with respect to accomplishment of tasks associated with ETOPS process elements. Any re commended changes that result from the validation programme to ETOPS continuing airworthiness and/or operational process elements should be defined.

(C) Documentation requirements for the process validation The operator should: 1. d ocument how each element of the ETOPS process was utilised during the validation; 2. d ocument any shortcomings with the process elements and measures in place to correct such shortcomings; 3. d ocument any changes to ETOPS processes, which were required after an in - flight shutdown (IFSD), unscheduled engine removals, or any other significant operational events; 4. p rovide periodic process validation reports to the competent authority (this may be addressed during review gates ).

Powered by EASA eRules Page 74 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (D) Validation programme information Prior to the start of the validation process, the following information should be submitted to the competent authority: 1. Validation periods, including start dates and proposed completion dates; 2. Definition of aeroplane to be used in the validation ( the l ist should include registration numbers, manufacturer and serial number and model of the airframe and engines); 3. Description of the areas of operation (if relevant to validation) proposed for validation and actual operations; 4. Definition of designated ETOPS validation routes. The routes should be of duration required to ensure necessary process validation occurs; 5. Process validation reporting. The operator should compile results of ETOPS process validation.

5.3 Validation of operator ETOPS continuing airwor thiness and operations capability The operator should demonstrate competence to safely conduct and adequately support the intended operation. Prior to ETOPS approval, the operator should demonstrate that the ETOPS continuing airworthiness processes are bei ng properly conducted.

The operator should also demonstrate that ETOPS flight dispatch and release practices, policies, and procedures are established for operations.

An operational validation flight may be required so that the operator can demonstrate dis patch and normal in - flight procedures. The content of this validation flight will be determined by the c ompetent a uthority based on the previous experience of the operator.

Upon successful completion of the validation flight, when required, the operator sh ould modify the operational manuals to include approval for ETOPS as applicable 5.4 ETOPS operations approval issued by the competent authority Operations approvals granted with reduced in - service experience may be limited to those areas determined by the competent authority at time of issue. An application for a change is required for new areas to be added.

The approval issued by the c ompetent a uthority for ETOPS up to 180 minutes should be based on the information required in Appendix 3 S ection 3.

SECTION 6: IN - SERVICE ETOPS APPROVAL Approval based on in - service experience on the particular airframe/engine combination.

6.1 Application Any operator applying for ETOPS approval shoul d submit a request, with the required supporting data, to the competent authority at least 3 months prior to the proposed start of ETOPS with the specific airframe/engine combination.

6.2 Operator experience Each operator seeking approval via the in - service route should provide a report to the competent authority, indicating the operator’s capability to maintain and operate the specific airframe/engine combination for the intended extended - range operation. This report should Powered by EASA eRules Page 75 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) include experience with the engine type or related engine types, experience with the aeroplane systems or related aeroplane systems, or experience with the particular airframe/engine combination on non - extended range routes. Approval would be based on a review of this informatio n.

Each operator that request s Approval to conduct ETOPS beyond 180 minutes should already have ETOPS experience and hold a 180 - minute ETOPS approval.

Note 1: The operator’s authorised maximum diversion time may be progressively increased by the competent authority as the operator gains experience on the particular airframe/engine combination. Not less than 12 consecutive months experience will normally be required before authorisation of ETOPS up to 180 minutes maximum diversion time, unless the operator can demonstrate compensating factors. The factors to consider may include duration of experience, total number of flights, operator’s diversion events, record of the airframe/engine combination with other operators, quality of operator’s programmes and route structure. However, the operator will still need, in the latter case, to demonstrate the capability to maintain and operate the new airframe/engine c ombination at a similar level of reliability.

In considering an application from an operator to conduct extended - range operations, an assessment should be made of the operator’s overall safety record, past performance, flight crew training and experience, and maintenance programme. The data provided with the request should substantiate the operator’s ability and competence to safely conduct and support these operations and should include the means used to satisfy the considerations outlined in this paragrap h. (Any reliability assessment obtained, either through analysis or service experience, should be used as guidance in support of operational judgements regarding the suitability of the intended operation.)

6.3 Assessment of the operator's propulsion system reliability Following the accumulation of adequate operating experience by the world fleet of the specified airframe/engine combination and the establishment of an IFSD rate objective in accordance with Appendix 1 for use in ensuring the propulsion system reliability necessary for extended - range operations, an assessment should be made of the applicant’s ability to achieve and maintain this level of propulsion system reliability.

This assessment should include trend comparisons of the operator’s data with other operators as well as the world fleet average values, and the application of a qualitative judgement that considers all the relevant factors. The operator’s past record of pr opulsion system reliability with related types of power units should also be reviewed, as well as its record of achieved systems reliability with the airframe/engine combination for which authorisation is sought to conduct extended - range operations.

Note: Where statistical assessment alone may not be applicable, e.g. when the fleet size is small, the applicant’s experience will be reviewed on a case - by - case basis.

6.4 Validation of operator ETOPS continuing airworthiness and operations capability The operat or should demonstrate competence to safely conduct and adequately support the intended operation. Prior to ETOPS approval, the operator should demonstrate that the ETOPS continuing airworthiness processes are being properly conducted.

The operator should also demonstrate that ETOPS flight dispatch and release practices, policies, and procedures are established for operations.

Powered by EASA eRules Page 76 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) An operational validation flight may be required so that the operator can demonstrate dispatch and normal in - flight procedures. The content of this validation flight will be determined by the competent a uthority based on the previous experience of the operator.

Upon successful completion of a validation flight, where required, the operational specifications and manuals should be modifi ed accordingly to include approval for ETOPS as applicable.

6.5 ETOPS operations approval issued by the competent authority Operations approvals based on in - service experience are limited to those areas agreed by the competent a uthority at time of issue. Additional approval is required for new areas to be added.

The approval issued by the c ompetent a uthority for ETOPS should s pecifically include provisions as described in Appendix 3 S ection 4.

SECTION 7: ETOPS APPROVAL CATEGORIES There are four approval categories: — Approval for 90 minutes or less diver sion time — Approval for diversion time above 90 minutes up to 180 minutes — Approval for diversion time above 180 minutes — Approval for diversion times above 180 minutes of operators of two - engine aeroplanes with a maximum passenger seating configuration of 19 or less An operator that seek s ETOPS approval in one of the above categories should comply with the requirements that are common to all categories and the specific requirements of the particular category for which approval is sought.

7.1 REQUIREMENTS CO MMON TO ALL ETOPS APPROVAL CATEGORIES: (i) Continuing Airworthiness The operator should comply with the continuing airworthiness considerations of Appendix 8 .

(ii ) Release Considerations (A) Minimum equipment list ( MEL) Aeroplanes should only be operated in accordance with the provisions of the approved minimum equipment list (MEL).

(B) Weather To forecast terminal and en - rou te weather, an operator should only use weather information systems that are sufficient ly reliable and accurate in the proposed area of operation.

(C) Fuel Fuel should be sufficient to comply with the critical fuel scenario as described in Appendix 4 to this AMC.

(ii i) Flight Planning The effects of wind and temperature at the one - engine - inoperative cruise altitude should be accounted for in the calculation of equal - time point. In addition to the nominated ETOPS en - route alternates, the operator should provide flight crews with information on Powered by EASA eRules Page 77 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) adequate aerodromes on the route to be flown which are not forecast to meet the ETOPS en - route alternate weather minima. Aerodrome facility in formation and other appropriate planning data concerning these aerodromes should be provided before commencement of the flight to flight crews for use when executing a diversion.

(iv ) Flight Crew Training The operator’s ETOPS training programme should provide initial and recurrent training for flight crew in accordance with Appendix 6 .

(v) En - route Alternate Appendix 5 to this AMC should be implemented when establishing the company operational procedures for ETOPS.

(vi ) Communications Equipment (VHF/HF, Data Link, Satellite Communications) For all routes whe re voice communication facilities are available, the communication equipment required by operational requirements should include at least one voice - based system.

7.2 SPECIFIC REQUIREMENTS: 7.2.1 APPROVAL FOR 90 MINUTES OR LESS DIVERSION TIME The operator’s approved diversion time is an operational limit that should not exceed either: — the maximum approved diversion time , or — the time - limited system capability minus 15 minutes.

If the airframe/engine combination does not yet have a type design approval for at least 90 minutes diversion time, the aircraft should satisfy the relevant ETOPS design requirements.

Consideration may be given to the approval of ETOPS up to 90 minutes for operators with minimal or no in - service experience with the airframe/engine combination. This determination considers such factors as the proposed area of operations, the operator's demonstrated ability to successfully introduce aeroplanes into operations and the quality of the proposed continuing airworthiness and operations programmes.

Minimum equipment list (MEL) restrictions for 120 minutes ETOPS should be used unless there are specific restrictions for 90 minutes or less.

7.2.2 APPROVAL FOR DIVERSION TIME ABOVE 90 MINUTES UP TO 180 MINUTES Prior to approval, the operator’s capability to conduct operations and implement effective ETOPS programmes, in accordance with the criteria detailed in this AMC and the relevant appendices, will be examined.

The operator’s approved diversion time is an operational limit that should not exceed either: — the maximum approved diversion time , or — the time - limited system capability minus 15 minutes.

Powered by EASA eRules Page 78 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) i) Additional Considerations for aircraft with 120 minutes Maximum Approved Diversion Time In the case of an aircraft approved for 120 minutes maximum approved diversion time , an operator may request an increase in the operator’s approved diversion time for specific routes provided: 1. The requested operator’s approved di version time does not exceed either: — 115% of the maximum approved diversion time or, — the time - limited system capability minus 15 minutes.

2. The aeroplane fuel carriage supports the requested operator’s approved diversion time.

3. It can be shown that the resulting routing will not reduce the overall safety of the operation.

Such increases will require: (A) EASA to assess overall type design including time - limited systems, demonstrated reliability; and (B) the development of an appropriate MEL related to th e diversion time required.

ii) Additional Considerations for aircraft with 180 minutes Maximum Approved Diversion Time In the case of an aircraft certified for 180 minutes maximum approved diversion time , an operator may request an increase in the operator ’s approved diversion time for specific routes provided: 1. The requested operator’s approved diversion time does not exceed either: — 115% of the maximum approved diversion time or, — the time - limited system capability minus 15 minutes 2. The aeroplane fuel carriage supports the requested operator’s approved diversion time diversion tim e .

3. It can be shown that the resulting routing will not reduce the overall safety of the operation.

Such increases will require: (A) EASA to assess overall type design including time - limited systems, demonstrated reliability; and (B) the development of an appropriate MEL related to the diversion time required.

7.2.3 APPROVAL FOR DIVERSION TIME ABOVE 180 MINUTES Approval to conduct operation s with diversion times exceeding 180 minutes may be granted to operators with previous ETOPS experience on the particular engine/airframe combination and an existing 180 - minute ETOPS approval on the airframe/engine combination listed in their application.

Powered by EASA eRules Page 79 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) Operators should minimise diversion time along the preferred track. Increases in diversion time by disregarding ETOPS adequate aerodromes along the route should only be planned in the interest of the overall safety of the operation.

The approval to operate more than 180 minutes from an adequate aerodrome shall be area - specific, based on the availability of adequate ETOPS en - route alternate aerodromes.

(i) Operating limitations In view of the long diversion time involved (above 180 minutes), the operator is responsible for ensur ing at flight planning stage, that on any given day in the forecast conditions, such as prevailing winds, temperature and applicable diversion procedures, a diversion to an ETOPS en - route alternate aerodrome will not exceed the: (A) En gine - related time - limited systems capability minus 15 minutes at the approved one - engine - inoperative cruise speed; and (B) Non - engine - related time - limited system capability minus 15 minutes, such as cargo fire suppression, or other non - engine - related syste m capability at the all - engine - operative cruise speed.

(ii ) Communications Equipment (VHF/HF, Data Link and Satellite - based communications) Operators should use any or all these forms of communications to ensure communications capability when operating ETO PS in excess of 180 minutes.

7.2.4 APPROVAL FOR DIVERSION TIMES ABOVE 180 MINUTES OF OPERATORS OF TWO - ENGINE AEROPLANES WITH A MAXIMUM PASSENGER SEATING CONFIGURATION OF 19 OR LESS AND A MAXIMUM TAKE - OFF MASS LESS THAN 45 360 KG (i) Type Design The airframe/engine combination should have the appropriate type design approval for the requested maximum diversion times in accordance with the criteria in CS 25.1535 and C hapter II ‘Type Design Approval Considerations’ of this AMC.

(ii ) Operations Appro val Approval to conduct operations with diversion times exceeding 180 minutes may be granted to operators with experience on the particular airframe/engine combination or existing ETOPS approval on a different airframe/engine combination, or equivalent exp erience. Operators should minimise diversion time along the preferred track to 180 minutes or less whenever possible. The approval to operate more than 180 minutes from an adequate aerodrome shall be area - specific, based on the availability of alternate ae rodromes, the diversion to which would not compromise safety.

Note: Exceptionally for this type of aeroplanes, operators may use the accelerated ETOPS approval method to gain ETOPS approval. This me thod is described in S ection 5.

Powered by EASA eRules Page 80 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) SECTION 8: ETOPS OPERATI ONS MANUAL SUPPLEMENT The ETOPS O perations M anual supplement or its equivalent material in the O perations M anual, and any subsequent amendments, are subject to approval by the c ompetent a uthority.

The a uthority will review the actual ETOPS in - service opera tion. Amendments to the Operations Manual may be required as a result. Operators should provide information for and participate in such reviews, with reference to the (S)TC holder where necessary. The information resulting from these reviews should be used to modify or update flight crew training programmes, operations manuals and checklists, as necessary.

An example outline of ETOPS Operations Manual Supplement content is provided in Appendix 7 to this AMC.

SECTION 9: FLIGHT PREPARATION AND IN - FLIGHT PROCEDURES The operator should establish pre - flight planning and dispatch procedures for ETOPS and they should be listed in the Operations Manual. These procedure s should include, but not be limited to, the gathering and dissemination of forecast and actual weather information, both along the route and at the proposed ETOPS alternate aerodromes. Procedures should also be established to ensure that the requirements of the critical fuel scenario are included in the fuel planning for the flight.

The procedures and manual should require that sufficient information is available for the aeroplane pilot - in - command, to satisfy him or her that the status of the aeroplane an d relevant airborne systems is appropriate for the intended operation. The manual should also include guidance on diversion decision - making and en - route weather monitoring.

Additional guidance on the content of the ‘ Flight preparation and in - flight procedu res ’ section of the O perations M anual is provided in Appendix 4 to this AMC.

SECTION 10: OPERATIONAL LIMITATIONS The operational limitations to the area of operations and the Oper ator’s approved diversion time are detailed in Appendix 3 to this A MC – ‘ Operational Limitations ’ .

SECTION 11: ETOPS EN - ROUTE ALTERNATE AERODROMES An operator should select ETOPS en - route alternate aerodromes in accordance with the applicable operational requirements and Appendix 5 to this AMC – En - r oute a lternate.

SECTION 12: INITIAL/RECURRENT TRAINING An operator should ensure that prior to conducting ETOPS, each crew member has completed successfull y ETOPS training and checking in accordance with a syllabus compliant with Appendix 7 to this AMC, approved by the c ompetent a uthority and detailed in the Operations Manual.

This training should be type - and area - specific in accordance with the applicable operational requirements.

The operator should ensu re that crew members are not assigned to operate ETOPS routes for which they have not successfully passed the training.

Powered by EASA eRules Page 81 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) SECTION 13: CONTINUING SURVEILLANCE The fleet - average IFSD rate for the specified airframe/engine combination will continue to be moni tored in accordance with Appendices 1 , 2 and 8 . As with all other operations, the c ompetent a uthority should also monitor all aspects of the extended - range operations that it has authorised to ensure that the levels of reliability achieved in extended - range operations remain at the necessary levels as provided in Appendix 1 , and that the operation continues to be conducted safely. In the event that an acceptable level of reliability is not maintained, if significant adverse trends exist, or if significant deficiencies are detected in the ty pe design or the conduct of the ETOPS operation, then the appropriate c ompetent a uthority should initiate a special evaluation, impose operational restrictions if necessary, and stipulate corrective action for the operator to adopt in order to resolve the problems in a timely manner. The appropriate a uthority should alert the c ertification a uthority when a special evaluation is initiated and make provisions for their participation.

[Amdt 20/7] [Amdt 20/21]

Appendix 1 to AMC 2 0 - 6 B – P ropulsion system reliabi lity

assessment

ED Decision 2021/006/R 1. ASSESSMENT PROCESS To establish , by utilising service experience , whether a particular airframe/engine combination has satisfied the propulsion systems reliability requirements for ETOPS, an engineering assessment will be made by EASA , using all pertinent propulsion system data. To accomplish the assessment, EASA will n eed world fleet data (where available), and data from various sources (the operator, the engine and aeroplane (S)TC holder) which should be extensive enough and of sufficient maturity to enable EASA to assess with a high level of confidence, using engineer ing and operational judgement and standard statistical methods where appropriate, that the risk of total power loss from independent causes is sufficiently low. EASA will state whether or not the current propulsion system reliability of a particular airfra me/engine combination satisfies the relevant criteria. Included in the statement, if the operation is approved, will be the engine build standard, propulsion system configuration, operating condition and limitations required to qualify the propulsion syste m as suitable for ETOPS.

Alternatively, where type design approval for Early ETOPS is sought at entry into service, the engineering assessment can be based on substantiation by analysis, test, in - service experience or other means, to show that the propulsi on system will minimise failures and malfunctions and will achieve an IFSD rate that is compatible with the specified safety target associated with total loss of thrust.

If an approved engine CMP is maintained by the responsible engine a uthority and is dul y referenced on the engine Type Certificate Data Sheet or STC, then this shall be made available to EASA conducting the aeroplane propulsion system reliability assessment. Such a CMP shall be produced taking into account all the requirements of C hapter II and should be incorporated or referenced in the aeroplane CMP.

2. RELIABILITY VALIDATION METHODS There are two extremes in the ETOPS process with respect to maturity; one is the demonstration of stable reliability by the accumulation of in - service experien ce and the other is by a programme of design, test and analysis, agreed between the (S)TC holders and EASA . The extent to which a propulsion system is a derivative of previous propulsion systems used on an Powered by EASA eRules Page 82 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) ETOPS approved a ero plane is also a factor of the l evel of maturity. When considering the acceptability of a propulsion system, maturity should be assessed not only in terms of total fleet hours but also taking account of fleet leader time over a calendar time and the extent to which test data and design e xperience can be used as an alternative.

a. Service Experience There is justification for the view that modern propulsion systems achieve a stable reliability level by 100 000 engine hours for new types and 50 000 engine hours for derivatives. 3 000 to 4 0 00 engine hours are considered to be the necessary time in service for a specific unit to indicate problem areas.

Normally, the in - service experience will be: (1) For new propulsion systems: 100 000 engine hours and 12 months service. Where experience on a nother aeroplane is applicable, a significant portion of the 100 000 engine hours should normally be obtained on the candidate aeroplane .

On a case - by - case basis, relevant test and design experience, and maximum diversion time requested, could be taken int o account when arriving at the in - service experience required .

(2) For derivative propulsion systems: 50 000 engine hours and 12 months service.

These values may vary according to the degree of commonality. To this end , in determining the derivative status of a propulsion system, consideration should be given to technical criteria referring to the commonality with the previous propulsion system used on an ETOPS approved aeroplane. Prime areas of concern include: (i) Turbomachinery; (ii ) Controls and accessories and control logic; (ii i) Configuration hardware (piping, cables , etc.); (iv) Aeroplane to engine interfaces and interaction: (A) Fire; (B) Thrust reverser; (C) Avionics; (D) etc.

The extent to which the in - service experience might be reduced wo uld depend upon the degree of commonality with the previous propulsion system used on an ETOPS approved aeroplane using the above criteria and would be decided on a case - by - case basis.

Also on a case - by - case basis, relevant test and design experience and m aximum diversion time requested could be taken into account when arriving at the in - service experience required.

Thus, the required experience to demonstrate propulsion system reliability should be determined by: (i) The extent to which previous service ex perience with a common propulsion system used on an ETOPS approved aeroplane system can be considered; Powered by EASA eRules Page 83 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (ii ) The extent to which compensating factors, such as design similarity and test evidence, can be used .

The two preceding considerations would then determine the amount of service experience needed for a particular propulsion system proposed for ETOPS.

These considerations would be made on a case - by - case basis and would need to provide a demonstrated level of propulsion system reliability in terms of IFSD rate.

See paragraph 3 ‘Risk Management and Risk Model’.

(3) Data required for the assessment (i) A list of all engine shutdown events for all causes (excluding normal training events). The list should provide the following for each event: (A) date; (B ) airline; (C) aeroplane and engine identification (model and serial number); (D) power - unit configuration and modification history; (E) engine position; (F) symptoms leading up to the event, phase of flight or ground operation; (G) weather/environmental c onditions and reason for shutdown and any comment regarding engine restart potential; (ii ) All occurrences where the intended thrust level was not achieved, or where crew action was taken to reduce thrust below the normal level (for whatever reason) ; (iii) Unscheduled engine removals/shop visit rates; (iv) Total engine hours and aeroplane cycles; (v) All events should be considered to determine their effects on ETOPS operations; (vi) Additional data as required; (vii) EASA will also consider relevant design and test data.

b. Early ETOPS (1) Acceptable early ETOPS certification plan Where type design approval for Early ETOPS is sought at the first entry into service, the engineering assessment can be based on substantiation by analysis, test, in - service experience, CS - E 1040 compliance or other means to show that the propulsion system will minimise failures and malfunctions, and will achieve an IFSD rate that is compatible with the specified safety target associated with catastrophic loss of thrus t. An approval plan, defining the early ETOPS reliability validation tests and processes, must be submitted by the applicant to EASA for agreement. This plan must be implemented and completed to the satisfaction of EASA before an ETOPS type design approval will be granted for a propulsion system.

Powered by EASA eRules Page 84 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (2) Propulsion system validation test The propulsion system for which approval is being sought should be tested in accordance with the following schedule. The propulsion system for this test should be configured with the aeroplane installation nacelle and engine build - up hardware representative of the type certificate standards.

Tests of simulated ETOPS service operation and vibration endurance should consist of 3 000 representative service start - stop cycles (take - off, climb, cruise, descent, approach, landing and thrust reverse), plus three simulated diversions at maximum continuous thrust for the maximum approved diversion time for which ETOPS eligibility is sought. These diversions are to be approximately evenly distributed over the cyclic duration of the test, with the last diversion to be conducted within 100 cycles of the completion of the test.

This test must be run with the high speed and low speed main engine rotors unbalanced to generate at least 90 % of the applicant’s recommended maintenance vibration levels. Additionally, for engines with three main engine rotors, the intermediate speed rotor must be unbalanced to generate at least 90 % of the applicant’s recommended acceptance vibration level. The vibration level shall be defined as the peak level seen during a slow acceleration/deceleration of the engine across the operating speed range. Conduct the vibration survey at periodic intervals throughout the 3000 - cycle test. The average value of the peak vibration level observed in the vibration surveys must meet the 90 % minimum requirement. Minor adjustments in the rotor unbalance (up or down) may be necessary as the test progresses in order to meet the required average vibration level requirement. Alte rnatively , to a method acceptable to EASA , an applicant may modify their test to accommodate a vibration level marginally less than 90 % or greater than 100 % of the vibration level required in lieu of adjusting rotor unbalance as the test progresses.

Each one hertz (60 rpm) bandwidth of the high - speed rotor service start - stop cycle speed range (take - off, climb, cruise, descent, approach, landing and thrust reverse) must be subjected to 3x10 vibration cycles. An applicant may conduct the test in any rotor speed step increment up to 200 rpm as long as the service start - stop cycle speed range is covered. For a 200 - rpm step , the corresponding vibration cycle count is to be 10 million cycles. In addition, each one hertz bandwidth of the high - speed rotor transie nt operational speed range between flight idle and cruise must be subjected to 3x10 vibration cycles. An applicant may conduct the test in any rotor speed step increment up to 200 rpm as long as the transient service speed range is covered. For a 200 - rpm step , the corresponding vibration cycle count is to be 1 million cycles.

At the conclusion of the test, the propulsion system must be: (i) Visually inspected according to the applicant’s on - wing inspection recommendations and limits.

(ii ) Completely disassembled and the propulsion system hardware must be inspected in accordance with the service limits submitted in compliance with relevant instructions for continued airworthiness. Any potential sources of in - flight shutdown, loss of thrust c ontrol, or other power loss encountered during this inspection must be tracked and resolved in accordance with paragraph 5 of this Appendix 1.

Powered by EASA eRules Page 85 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) 3. RISK MANAGEMENT AND RISK MODEL Propulsion systems approved for ETOPS must be sufficiently reliable to assure t hat defined safety targets are achieved.

a. For ETOPS with a maximum approved diversion time of 180 minutes or less An early review of information for modern fixed - wing jet - powered aircraft shows that the - 6 rate of fatal accidents for all causes is in the or der of 0·3 x 10 per flying hour. The reliability of aeroplane types approved for extended - range operation should be such that they achieve at least as good an accident record as equivalent technology equipment.

- 6 The overall target of 0 · 3 x 10 per flyin g hour has therefore been chosen as the safety target for ETOPS approvals up to 180 minutes.

When considering safety targets, an accepted practice is to allocate appropriate portions of the total to the various potential contributing factors. By applying t his practice to the - 6 overall target of 0·3 x 10 per flying hour, in the proportions previously considered appropriate, the probability of a catastrophic accident due to complete loss of thrust from - 8 independent causes must be no worse than 0·3 x 10 per f lying hour.

Propulsion system related accidents may result from independent cause events but, based on historical evidence, result primarily from events such as uncontained engine failure events, common cause events, engine failure plus crew error events, human error related events and other. The majority of these factors are not specifically exclusive to ETOPS.

Using an expression developed by ICAO (ref. AN - WP/5593 dated 15/2/84) , for the calculation of engine in - flight shutdown rate, together with the abo ve safety objective and accident statistics, a relationship between target engine in - flight shutdown rate for all independent causes and maximum diversion time has been derived. This is shown in Figure 1.

In order that type design approval may be granted f or extended operation range, it will be necessary to satisfy EASA that after application of the corrective actions identified during the engineering assessment (see Appendix 1, S ection 4: ENGINEERING ASSESSMENT. CRITERIA FOR ACCEPTABLE RELIABILITY VALIDATI ON METHODS), the target engine in - flight shutdown rates will be achieved. This will provide assurance that the probability objective for loss of all thrust due to independent causes will be met.

Powered by EASA eRules Page 86 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBP ART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) Target IFSD Rates vs Diversion Time 2 - engined aeroplane Diversion Times 180 minutes or less 0.040 0.030 IFSD rate/1000 engine hours 0.020 60 90 120 150 180 Diversion Time (minutes ) Figure 1 b. For ETOPS with a maximum approved diversion time of longer than 180 minutes The propulsion systems IFSD rate target should be compatible with the objective that the catastrophic loss of thrust from independent causes is no worse than extremely improbable, based on maximum ETOPS flight duration and maximum ETOPS rule time.

For ETOPS with Maximum Approved Diversion Times longer than 180 minutes, to meet this objective ; the powerplant installations must comply with the safety objectives of CS 25.1309 ; the goal should be that t he catastrophic loss of thrust from independent causes should be extremely improbable (see AMC 25.1309). The defined target for ETOPS approvals with diversion times of 180 minutes or less, for catastrophic loss of thrust from - 8 independent causes, is 0.3x10 /hr (see paragraph 3 of this Appendix). This target was based on engine IFSD rates that were higher than can be and are being achieved by modern ETOPS airframes/engines. To achieve the same level of safety for ETOPS approvals beyond 180 minutes as has bee n achieved for ETOPS approvals of 180 minutes or less, the propulsion system reliability IFSD rate target needs to be set and maintained at a level that is compatible with an Extremely Improbable safety objective - 9 (i.e. 1.0x10 /flight hr).

For example, a target overall IFSD rate of 0.01/1000 hr (engine hours) that is maintained would result in the loss of all thrust on two engine aeroplanes being extremely improbable even assuming the longest time envisaged. The risk model formula summarised for a two - engi ne aeroplane is: p/flight hour = [2(Cr x{T - t}) x Mr(t)] divided by T (1) p is the probability of a dual independent propulsion unit failure on a twin, (2) 2 is the number of opportunities for an engine failure on a twin (2), Powered by EASA eRules Page 87 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (3) Cr is cruise IFSD rate (0.5x overall rate), Mr is max continuous IFSD rate (2x overall rate), T is planned max flight duration in hours (departure to planned arrival airport), and t is the diversion or flight time in hours to a safe landing. IFSD rates, ba sed on engine manufacturers’ historical data from the last 10 years of modern large turbofan engines, presented to the JAA/EASA and ARAC ETOPS working groups, have shown cruise IFSD rates to be of the order of 0.5x overall rate, and the max continuous IFSD rate (estimated from engine fleet analysis) to be 2x overall rate. Then, for an IFSD goal of .010/1000EFH overall, the cruise IFSD rate is .005/1000EFH, and the max continuous rate is .020/1000EFH.

(4) Sample calculation (max flight case scenario): assume T = 20 hour max flight duration, an engine failure after 10 hours, then continued flight time required is t = 10 hours, using the ETOPS IFSD goal of .010/1000EFH or less, results in a probability of p=1 E - 9/hour (i.e. meets extremely improbable safety obj ective from independent causes).

(5) A relationship between target IFSD rate and diversion times for two - engine aeroplanes is shown in Figure 2.

Figure 2 Powered by EASA eRules Page 88 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) 4. ENGINEERING ASSESSMENT CRITERIA FOR ACCEPTABLE RELIABILITY VALIDATION METHODS The following criteria identify some areas to be considered during the engineering assessment required for either reliability validation method.

a. There are maintenance programmes, engine on - wing health monitoring programmes, and the promptness and completene ss in incorporating engine service bulletins, etc. that influence an operator’s ability to maintain a level of reliability. The data and information required will form a basis from which a world fleet engine shutdown rate will be established, for use in de termining whether a particular airframe/engine combination complies with criteria for extended - range operation.

b. An analysis will be made on a case - by - case basis, of all significant failures, defects and malfunctions experienced in service or during test ing, including reliability validation testing, for the particular airframe/engine combination. Significant failures are principally those causing or resulting in in - flight shutdown or flameout of the engine(s), but may also include unusual ground failures and/or unscheduled removal of engines. In making the assessment, consideration should be given to the following: (1) The type of propulsion system, previous experience, whether the power - unit is new or a derivative of an existing model, and the operating t hrust level to be used after one engine shutdown; (2) The trends in the cumulative 12 - month rolling average, updated quarterly, of in - flight shutdown rates versus propulsion system flight hours and cycles; (3) The demonstrated effect of corrective modifica tions, maintenance, etc. on the possible future reliability of the propulsion system; (4) Maintenance actions recommended and performance and their effect on propulsion system and APU failure rates; (5) The accumulation of operational experience which cove rs the range of environmental conditions likely to be encountered; (6) Intended maximum flight duration and maximum diversion in the ETOPS segment, used in the extended - range operation under consideration.

c. Engineering judgement will be used in the analy sis of paragraph b. above, such that the potential improvement in reliability, following the introduction of corrective actions identified during the analysis, can be quantified.

d. The resultant predicted reliability level and the criteria developed in ac cordance with S ection 3 (RISK MANAGEMENT AND RISK MODEL) should be used together to determine the maximum diversion time for which the particular airframe/engine combination qualifies.

e. The type design standard for type approval of the airframe/engine co mbination, and the engine, for ETOPS will include all modifications and maintenance actions for which full or partial credit is taken by the (S)TC holder and other actions required by EASA to enhance reliability. The schedule for incorporation of type desi gn standard items should normally be established in the Configuration, Maintenance and Procedures (CMP) document, for example in terms of calendar time, hours or cycles.

f. When third - country (S)TC holders’ and/or third - country operators ’ data is evaluated , the respective foreign a uthorities will be offered to participate in the assessment.

Powered by EASA eRules Page 89 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) g. ETOPS r eliability t racking b oard (RTB)’s f indings.

Once an assessment has been completed and the RTB has documented its findings, EASA will declare whether or not the particular airframe/engine combination and engine satisfy the relevant considerations of this AMC. Items recommended qualifying the propulsion system, such as maintenance requirements and limitations will be included in the Assessment Report ( C hapter II S ection 10 of this AMC).

h. In order to establish that the predicted propulsion system reliability level is achieved and subsequently maintained, the (S) TC holder should submit to EASA an assessment of the reliability of the propulsion system on a quarterly basis. The assessment sho uld concentrate on the ETOPS configured fleet and should include ETOPS - related events from the non - configured fleet of the subject airframe/engine combination and from other combinations utilising a related engine model.

5. EARLY ETOPS OCCURRENCES REPORTIN G & TRACKING a. The holder of a (supplemental) type certificate of an engine, which has been approved for ETOPS without service experience in accordance with this AMC, should establish a system to address problems and occurrences encountered on the engine that could affect the safety of operations and timely resolution.

b. The system should contain a means for: the prompt identification of ETOPS related events, the timely notification of the event to EASA , proposing a resolution of the event and obtaining E ASA ’s approval. The implementation of the problem resolution can be accomplished by way of EASA - approved change(s) to the type design, the manufacturing process, or an operating or maintenance procedure.

c. The reporting system should be in place for at le ast the first 100 000 fleet engine hours.

The reporting requirement remains in place until the fleet has demonstrated a stable in - flight shutdown rate in accordance with the targets defined in this Appendix 1.

d. For the early ETOPS service period, an appl icant must define the sources and content of the service data that will be made available to them in support of their occurrence reporting and tracking system. The content of this data should be adequate to evaluate the specific cause of all service incide nts reportable under Part 21A.3 A ( b ), in addition to the occurrences that could affect the safety of operations, and should be reported, including: (1) i n - flight shutdown events and rates; (2) i nability to control the engine or obtain desired power; (3) p re cautionary thrust reductions (except for normal troubleshooting as allowed in the aircraft flight manual); (4) d egraded propulsion in - flight start capability; (5) un - commanded power changes or surges ; (6) diversion or turn - back ; (7) failures or malfunction s of ETOPS significant systems ; (8) u nscheduled engine removals for conditions that could result in one of the reportable items listed above.

Powered by EASA eRules Page 90 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) 6. CONTINUED AIRWORTHINESS OF TYPE DESIGN For ETOPS, EASA will periodically review its original findings by means of a Reliability Tracking Board. In addition, EASA document containing the CMP standard will be revised as necessary.

Note: The Reliability Tracking Board will usually comprise specialists from aerop lane and engine disciplines (see also Appendix 2 ).

Periodic meetings of the ETOPS Reliability Tracking Board are normally frequent at the start of the assessment of a new product. The periodicity is adjusted by EASA upon accumulation of substantial service experience if there is evidence that the reliability of the product is sufficiently stable. The periodic meetings of the board are discontinued once an ETOPS product, or family o f products, has been declared mature by EASA .

Note: The overall engine IFSD rate should be viewed as a world fleet average target figure of engine reliability (representative of the airframe/engine combination being considered) and if exceeded, may not, in itself, trigger action in the form of a change to the ETOPS design standard or a reduction in the ETOPS approval status of the engine. The actual IFSD rate and its causes should be assessed with considerable engineering judgement. For example, a high IFSD rate early after the commencement of the operation may be due to the limited number of hours contributing to the high rate. There may have been only one shutdown. The underlying causes have to be considered carefully. Conversely, a particular single event may warrant corrective action implementation, even though the overall IFSD rate objective is being achieved.

a. Mature ETOPS products A family of ETOPS products with a high degree of similarity is considered to be mature ones if: (1) The product family ha s accumulated at least 250 000 flight hours for an aeroplane family or 500 000 operating hours for an engine family; (2) The product family has accumulated service experience covering a comprehensive spectrum of operating conditions (e.g. cold, hot, high, and humid); (3) Each ETOPS approved model or variant in the family has achieved the reliability objectives for ETOPS and has remained stable at or below the objectives fleet - wide for at least 2 years; New models or significant design changes may not be considered mature until they have individually satisfied the condition of paragraph 6.a above.

EASA makes the determination of when a product or a product family is considered mature.

b. Surveillance of mature ETOPS products The (S)TC holder of an ETOPS pr oduct which EASA has found mature, should institute a process to monitor the reliability of the product in accordance with the objectives defined in this Appendix 1. In case of occurrence of an event or series of events or a statistical trend that implies a deviation of t he reliability of the ETOPS fleet, or a portion of the ETOPS fleet (e.g. one model or a range of serial numbers), above the limits specified for ETOPS in this AMC, the (S)TC holder should: (1) Inform EASA and define a means to restore the reliability throu gh a m inor r evision of the CMP document, with a compliance schedule to be agreed with EASA if the situation has no immediate safety impact; Powered by EASA eRules Page 91 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (2) Inform EASA and propose an ad hoc follow - up by EASA until the concern has been alleviated or confirmed if the si tuation requires further assessment; (3) Inform EASA and propose the necessary corrective action(s) to be mandated by EASA through an AD if a direct safety concern exists.

In the absence of a specific event or trend requiring action, the (S)TC holder shoul d provide EASA with the basic statistical indicators prescribed in this Appendix 1 on a yearly basis.

c. Minor Revision of the ETOPS CMP Document A Minor Revision of the ETOPS CMP document is one that contains only editorial adjustments, configurations, ma intenance and procedures equivalent to those already approved by EASA or new reliability improvements which have no immediate impact on the safety of ETOPS flights and which are introduced as a means to control the continued compliance with the reliability objectives of ETOPS.

Minor revisions of the ETOPS CMP document should be approved by authorised signatories personnel of the (S)TC holder under the provisions of its approved Design Organisation Handbook.

7. DESIGN ORGANISATION APPROVALS (S) TC holders of products approved for ETOPS should hold a design organisation approval (DOA) conforming to Part 21, with the appropriate terms of approval and privileges. Their approved design organisation handbook (DOH) must contain an appropriate description of the orga nisation and procedures covering all applicable tasks and responsibilities of Part 21 and this AMC.

[Amdt 20/7] [Amdt 20/21]

Appendix 2 to AMC 20 - 6 B – A ircraft systems reliability assessment

ED Decision 2021/006/R 1. ASSESSMENT PROCESS The intent of this Appendix is to provide additional clarification to S ections 7 and 8 of C hapter II of this AMC. Airframe systems are required to show compliance with CS 25.1309. To establish whether a particular airframe/engine combination has satisfied the reliability requirements concerning the aircraft systems for extended - range operations, an assessment will be made by EASA , using all pertinent systems data provided by the applicant. To accomplish this assessment, EASA will need world - fleet data (wher e available) and data from various sources (operators, (S)TC holder, original equipment manufacturers (OEM s )). This data should be extensive enough and of sufficient maturity to enable EASA to assess with a high level of confidence, using engineering and o perational judgement, that the risk of systems failures during a normal ETOPS flight or a diversion, is sufficiently low in direct relationship with the consequence of such failure conditions, under the operational environment of ETOPS missions.

EASA will declare whether or not the current system reliability of a particular airframe/engine combination satisfies the relevant criteria.

Included in the declaration, if the airframe/engine combination satisf ies the relevant criteria, will be the airframe build s tandard, systems configuration, operating conditions and limitations, Powered by EASA eRules Page 92 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) that are required to qualify the ETOPS significant systems as suitable for extended - range operations.

Alternatively, where type design approval for Early ETOPS is sought at first entry i nto service, the engineering assessment can be based on substantiation by analysis, test, in - service experience or other means to show that the airframe significant systems will minimise failures and malfunctions, and will achieve a failure rate that is co mpatible with the specified safety target.

2. SYSTEM SAFETY ASSESSMENT ‘SSA’ (including reliability analysis) The system safety assessment (SSA) which should be conducted in accordance with CS 25.1309 for all ETOPS significant systems should follow the ste ps below: a. Conduct a (supplemental) functional hazard assessment (FHA) considering the ETOPS missions. In determining the effect of a failure condition during an ETOPS mission, the following should also be reviewed: (1) Crew workload over a prolonged period of time; (2) Operating conditions at single engine altitude; (3) Lesser crew familiarity with the procedures and conditions to fly to and land at diversion aerodromes.

b. Introduce any additional failure scenario/objectives necessary to co mply with this AMC.

c. For compliance demonstration of ETOPS significant system reliability to CS 25.1309 there will be no distinction made between ETOPS group 1 and group 2 systems. For qualitative analysis (FHA), the maximum flight time and the maximum E TOPS diversion time should be considered. For quantitative analysis (SSA), the average ETOPS mission time and maximum ETOPS diversion time should be considered. Consideration should be given to how the particular airframe/engine combination is to be utilis ed, and analyse the potential route structure and city pairs available, based upon the range of the aeroplane.

d. Consider effects of prolonged time and at single engine altitude in terms of continued operation of remaining systems following failures.

e. S pecific ETOPS maintenance tasks, intervals and specific ETOPS flight procedures necessary to attain the safety objectives, shall be included in the appropriate approved documents (e.g. CMP document, MMEL).

f. Safety assessments should consider the flight c onsequences of single or multiple system failures leading to a diversion and the probability and consequences of subsequent failures or exhaustion of the capacity of time critical systems, which might occur during the diversion.

Safety assessments should d etermine whether a diversion should be conducted to the nearest aerodrome or to an aerodrome presenting better operating conditions, considering: (1) The effect of the initial failure condition on the capability of the aeroplane to cope with adverse condit ions at the diversion aerodrome, and (2) The means available to the crew to assess the extent and evolution of the situation during a prolonged diversion.

Powered by EASA eRules Page 93 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) The aircraft flight manual and the flight crew warning and alerting and display systems should provid e clear information to enable the flight crew to determine when failure conditions are such that a diversion is necessary.

3. RELIABILITY VALIDATION METHODS There are two extremes in the ETOPS process with respect to maturity; one is the demonstration of s table reliability by the accumulation of in - service experience and the other is by a design, analysis and test programmes, agreed between the (S)TC holders and the EASA / the a uthority.

a. In - service experience/systems safety assessment (SSA) In - service expe rience should generally be in accordance with that identified in Appendix 1 for each airframe/engine combination. When considering the acceptability of airframe systems for ETOPS, maturity should be assessed in terms of used technology and the particular design under review.

In performing the SSA, defined in paragraph 2 of this Appendix 2, particular account will be taken of the following: (1) For identical or similar equipment to t hose used on other aeroplanes, the SSA failure rates should be validated by in - service experience: (i) The amount of in - service experience (either direct or related) should be indicated for each equipment of an ETOPS significant system.

(ii) Where related experience is used to validate failure modes and rates, an analysis should be produced to show the validity of the in - service experience.

(iii) In particular, if the same equipment is used on a different airframe/engine combination, it should be sh own that there is no difference in operating conditions (e.g. vibrations, pressure, temperature) or that these differences do not adversely affect the failure modes and rates.

(iv) If in - service experience with similar equipment on other aeroplanes is clai med to be applicable, an analysis should be produced substantiating the reliability figures used on the quantitative analysis. This substantiation analysis should include details of the differences between the similar and new equipment, details of the in - s ervice experience of the similar equipment and details of any ‘ lessons learnt ’ from modifications introduced and included in the new equipment.

(v) For certain equipment (e.g. IDGs, TRUs, bleeds and emergency generators) , this analysis may have to be backe d up by tests. This should be agreed with EASA .

(2) For new or substantially modified equipment, account should be taken in the SSA for the lack of validation of the failure rates by service experience.

A study should be conducted to determine the sensitivity of the assumed SSA failure condition probabilities to the failure rates of the subject equipment.

Should a failure case probability be sensitive to this equipment failure rate and close to the required safety objective, particular provision pre cautions should be applied (e.g. temporary dispatch restrictions, inspections, maintenance Powered by EASA eRules Page 94 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) procedures, crew procedures) to account for the uncertainty, until the failure rate has been appropriately validated by in - service experience.

b. Early ETOPS Where t ype design approval for Early ETOPS is sought at the first entry into service of the airframe/engine combination, the engineering assessment can be based on substantiation by analysis, test, in - service experience (the same engine or airframe with different engines) or other means, to show that the ETOPS significant systems will achieve a failure rate that is compatible with the specified safety objective. An approval plan, defining the early ETOPS reliability validation tests and processes, should be submit ted by the (S)TC holders to EASA for agreement. This certification plan should be completed and implemented to the satisfaction of EASA before an ETOPS type design approval will be granted.

(1) Acceptable e arly ETOPS approval plan In addition to the above considerations, the following should be complied with for an e arly ETOPS approval: (i) Aeroplane t esting For each airframe/engine combination that has not yet accumulated at least 15 000 engine hours in service, to be approved for ETOPS, one or more aeropl anes should conduct flight testing which demonstrates that the airframe/engine combination, its components and equipment are capable for, and function properly during , ETOPS flights and ETOPS diversions. These flight tests may be coordinated with, but they are not in place of flight testing required in Part 21 .A .35(b)(2).

The flight test programme should include: (A) Flights simulating actual ETOPS operation, including normal cruise altitude, step climbs and APU operation if required for ETOPS; (B) Demonstr ation of the maximum normal flight duration with the maximum diversion time for which eligibility is sought; (C) Engine inoperative maximum time diversions to demonstrate the aeroplane and propulsion system’s capability to safely conduct an ETOPS diversion , including a repeat of a n MCT diversion on the same engine; (D) Non - normal conditions to demonstrate the aeroplane’s capability to safely conduct an ETOPS diversion under worst - case probable system failure conditions; (E) Diversions into representative op erational diversionary airports; (F) Repeated exposure to humid and inclement weather on the ground followed by long - range operations at normal cruise altitude; (G) V alidat ion of the adequacy of the aeroplane’s flying qualities, performance and flight crew ’s ability to deal with the conditions of paragraphs (C) , (D) and (E) above.

(H) E ngine - inoperative diversions evenly distributed among the number of engines except as required by paragraph (C) above.

Powered by EASA eRules Page 95 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (I) Provisions for t he test aeroplane(s) to be operated and maintained using the recommended operations and maintenance manual procedures during the aeroplane demonstration test.

(J) At the completion of the aeroplane(s) demonstration testing, an operational or functional che ck of the ETOPS significant systems must undergo as per the Instructions for Continued Airworthiness of CS 25.1529. The engines must also undergo a gas path inspection.

These inspections are intended to identify any abnormal conditions that could result in an in - flight shutdown or diversion. Any abnormal conditions must be identified, tracked and resolved in accordance with subpart (2) below. This inspection requirement can be relaxed for ETOPS significant systems similar in design to proven models.

(K) Mai ntenance and operational procedures . The applicant must validate all ETOPS significant systems maintenance and operational procedures. Any problems found as a result of the validation must be identified, tracked and resolved in accordance with subpart (2) below.

(ii ) APU t esting If an APU is required for ETOPS, one APU of the type to be certified with the aeroplane should complete a test consisting of 3 000 equivalent aeroplane operational cycles. Following completion of the demonstration test, the APU must be disassembled and inspected. Any potential sources of in - flight start and/or run events should be identified, tracked and resolved in accordance with subpart (2) below.

(2) Early ETOPS occurrence reporting & tracking (i) The holder of a (S)TC of an aero plane which has been approved for ETOPS without service experience in accordance with this AMC, should establish a system to address problems and occurrences encountered on the airframe and propulsion systems that could affect the safety of ETOPS operation s in order to timely resol ve these events .

(ii ) The system should contain a means for the prompt identification of ETOPS - related events, the timely notification of the event to EASA and for proposing to, and obtaining EASA ’s approval for the resolution of this event.

The implementation of the problem resolution can be accomplished by way of an EASA - approved change(s) to the type design, the manufacturing process, or an operating or maintenance procedure.

(iii) The reporting system should be in place for at least the first 100 000 flight hours. The reporting requirement remains in place until the airframe and propulsion systems have demonstrated stable reliability in accordance with the required safety objectives .

(iv) If the airframe/engine combination ce rtified is a derivative of a previously certified aeroplane, these criteria may be amended by EASA , to require reporting on only those changed systems.

(v) For the early ETOPS service period, an applicant must define the sources and content of in - service d ata that will be made available to them in support of their occurrence reporting and tracking system. The content of this data should be adequate to evaluate the specific cause of all service incidents Powered by EASA eRules Page 96 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) reportable under Part 21.A.3 A ( b ), in addition to the o ccurrences that could affect the safety of ETOPS operations and should be reported, including: (A) In - flight shutdown events; (B) Inability to control the engine or obtain desired power; (C) Precautionary thrust reductions (except for normal troubleshooting as allowed in the aircraft flight manual ); (D) Degraded propulsion in - flight start capability; (E) Inadvertent fuel loss or availability, or uncorrectable fuel imbalance in flight; (F) Tech nical air turn - backs or diversions associated with an ETOPS Group 1 system; (G) Inability of an ETOPS Group 1 system, designed to provide backup capability after failure of a primary system, to provide the required backup capability in - flight; (H) Any loss of electrical power or hydraulic power system, during a given operation of the aeroplane; (I) Any event that would jeopardise the safe flight and landing of the aeroplane during an ETOPS flight.

4. CONTINUING SURVEILLANCE In order to confirm that the pred icted system reliability level is achieved and maintained, the (S)TC holder should monitor the reliability of airframe ETOPS significant systems after entry into service. The (S)TC holder should submit a report to EASA , initially on a quarterly basis (for the first year of operation) and thereafter on a periodic basis and for a time to be agreed with EASA .

The monitoring task should include all events on ETOPS significant systems, from both the ETOPS and non - ETOPS fleet of the subject family of airframes. T his additional reliability monitoring is required only for ETOPS Group 1 systems.

5. CONTINUED AIRWORTHINESS a. Reliability Tracking Board EASA will periodically review its original findings by means of a reliability tracking board .

In addition, the EASA d ocument containing the CMP standard will be revised as necessary.

Note: The reliability tracking board will usually comprise specialists from aeroplane and engine disciplines. (See also Appendix 1 ).

Periodic meetings of the ETOPS reliability tracking board are normally frequent at the start of the assessment of a new product. The periodicity is adjusted by EASA upon accumulation of substantial in - service experience if there is evidence that the reliability of the product is sufficiently stable. The periodic meetings of the board are discontinued once an ETOPS product, or family of products, has been declared mat ure by EASA .

b. Mature ETOPS products A family of ETOPS products with a high degree of similarity is considered to be mature when: (1) The product family has accumulated at least 250 000 flight hours for an aeroplane family; Powered by EASA eRules Page 97 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (2) The product family has accu mulated service experience covering a comprehensive spectrum of operating conditions (e.g. cold, hot, high, humid); (3) Each ETOPS approved model or variant in the family has achieved the reliability objectives for ETOPS and has remained stable at or below the objectives fleet - wide for at least 2 years .

New models or significant design changes may not be considered mature until they have individually satisfied the conditions specified above.

EASA makes the determination of when a product or a product family is considered mature.

c. Surveillance of mature ETOPS products The (S)TC holder of an ETOPS product which EASA has found mature, should institute a process to monitor the reliability of the pro duct in accordance with the objectives defined in this Appendix. In case of occurrence of an event, a series of events or a statistical trend that implies a deviation of the reliability of the ETOPS fleet, or a portion of the ETOPS fleet (e.g. one model or a range of serial numbers), above the limits specified for ETOPS, the (S)TC should: (1) Inform EASA and define a means to restore the reliability through a Minor Revision of the CMP document, with a compliance schedule to be agreed with EASA if the situat ion has no immediate safety impact; (2) Inform EASA and propose an ad hoc follow - up by EASA until the concern has been alleviated, or confirmed if the situation requires further assessment; (3) Inform EASA and propose the necessary corrective action(s) to be mandated by EASA through an AD if a direct safety concern exists.

In the absence of a specific event or trend requiring action, the (S)TC holder should provide EASA with the basic statistical indicators prescribed in this Appendix 2 on a yearly basis.

d . Minor r evision of the ETOPS CMP Document A Minor Revision of the ETOPS CMP document is one that contains only editorial adjustments, configurations, maintenance and procedures equivalent to those already approved by EASA , or new reliability improvements which have no immediate impact on the safety of ETOPS flights and which are introduced as a means to control the continued compliance with the reliability objectives of ETOPS.

Minor revisions of the ETOPS CMP document should be approved by authorised signa tories of the Design Organisation and under the provisions of its approved Design Organisation Handbook.

6. DESIGN ORGANISATION APPROVAL (S) TC holders of products approved for ETOPS should hold a design organisation approval (DOA) conforming to Part 21, with the appropriate terms of approval and privileges. Their approved design organisation handbook (DOH) must contain an appropriate description of the organisation and procedures covering all applicable tasks and responsibilities of Part 21 and this A MC.

[Amd t 20/7] [Amdt 20/21] Powered by EASA eRules Page 98 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20)

Appendix 3 to AMC 20 - 6 B – O perational l imitations

ED Decision 2021/006/R 1. AREA OF OPERATION An operator is, when specifically approved, authorised to conduct ETOPS flights within an area where the diversion time, at any poi nt along the proposed route of flight, to an adequate ETOPS en - route alternate aerodrome is within the operator’s approved diversion time (under standard conditions in still air) at the approved one - engine - inoperative cruise speed.

2. OPERATOR’S APPROVED D IVERSION TIME The procedures established by the operator should ensure that ETOPS is only planned on routes where the operator’s approved diversion time to an adequate ETOPS en - route alternate aerodrome can be met.

3. ISSUE OF THE ETOPS OPERATIONS APPROVAL BY THE COMPETENT AUTHORITY The approval issued by the c ompetent a uthority for ETOPS operations should be based on the following information provided by the operator: a. Specification of the particular airframe/engine combinations, including the current approved CMP document required for ETOPS as normally identified in the AFM; b. Authorised area of operation; c. Minimum altitudes to be flown along planned and diversionary routes; d. Operator’s approved diversion time ; e. Aerodromes identified to be used, including alternates, and associated instrument approaches and operating minima; f. The approved maintenance and reliability programme for ETOPS; g. Identific ation of those aeroplanes designated for ETOPS by make and model as well as serial number and registration; h. Specification of routes and the ETOPS diversion time necessary to support those routes; i. The one - engine - inoperative cruise speed, which may be area - specific, depending upon anticipated aeroplane loading and likely fuel penalties associated with the planned procedures; j. Processes and related resources allocated to initiate and sustain ETOPS operations in a manner that demonstrates commitment by management and all personnel involved in ETOPS continued airworthiness and operational support; k. The plan for establishing compliance with the build standard required for type design approval , e.g. CMP document compliance.

[Amdt 20/7] [Amdt 20/21] Powered by EASA eRules Page 99 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20)

Appe ndix 4 to AMC 20 - 6 B – F light p reparation and i n - flight

p rocedures

ED Decision 2021/006/R 1. GENERAL The flight release considerations specified in this paragraph are in addition to the applicable operational requirements. They specifically apply to ETOPS. Although many of the considerations in this AMC are currently incorporated into approved programmes for other aeroplanes or route structures, the unique nature of ETOPS necessitates a re - examination of these operations to ensure that the approved pr ogrammes are adequate for this purpose.

2. MINIMUM EQUIPMENT LIST (MEL) The system redundancy levels appropriate to ETOPS should be reflected in the master minimum equipment list (MMEL). An operator’s MEL may be more restrictive than the MMEL considering t he kind of ETOPS operation proposed, equipment and in - service problems unique to the operator. Systems and equipment considered to have a fundamental influence on safety may include, but are not limited to, the following: a. electrical; b. hydraulic; c. pn eumatic; d. flight instrumentation, including warning and caution systems; e. fuel; f. flight control; g. ice protection; h. engine start and ignition; i. propulsion system instruments; j. navigation and communications, including any route specific long - range navigation and communication equipment; k. auxiliary power - unit; l. air conditioning and pressurisation; m. cargo fire suppression; n. engine fire protection; o. emergency equipment; p. systems and equipment required for engine condition monitoring.

In addition, the following systems are required to be operative for dispatch for ETOPS with diversion times above 180 minutes: q. Fuel quantity indicating system (FQIS); r. APU (including electrical and pneumatic supply to its design ed capability), if necessary to comply with ETOPS requirements; s. Automatic engine or propeller control system; Powered by EASA eRules Page 100 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) t. Communication system(s) relied on by the flight crew to comply with the requirement for communication capability.

3. COMMUNICATION AND NAVIG ATION FACILITIES For releasing an aeroplane on an ETOPS flight, the operators should ensure that: a. Communications facilities are available to provide under normal conditions of propagation at all planned altitudes of the intended flight and the diversion scenarios, reliable two - way voice and/or data link communications; b. Visual and non - visual aids are available at the specified alternates for the anticipated types of approaches and operating minima.

4. FUEL SUPPLY a. General For releasing an aeroplane on an ETOPS flight, the operators should ensure that it carries sufficient fuel and oil to meet the applicable operational requirements and any additional fuel that may be determined in accordance with this Appendix.

b. Critical f uel r eserve In establishin g the critical fuel reserves, the applicant is to determine the fuel necessary to fly to the most critical point (at normal cruise speed and altitude, taking into account the anticipated meteorological conditions for the flight) and execute a diversion to an ETOPS en - route alternate under the conditions outlined in this Appendix, the ‘Critical Fuel Scenario’ (paragraph c. below).

These critical fuel reserves should be compared to the normal applicable operational requirements for the flight. If it is determ ined by this comparison that the fuel to complete the critical fuel scenario exceeds the fuel that would be on board at the most critical point, as determined by applicable operational requirements, additional fuel should be included to the extent necessar y to safely complete the Critical Fuel Scenario.

When considering the potential diversion distance flown , account should be taken of the anticipated routing and approach procedures, in particular any constraints caused by airspace restrictions or terrain.

c. Critical fuel scenario The following describes a scenario for a diversion at the most critical point. The applicant should confirm compliance with this scenario when calculating the critical fuel reserve necessary.

Note 1: If an APU is one of the requi red power sources, then its fuel consumption should be accounted for during the appropriate phases of flight.

Note 2: Additional fuel consumptions due to any MEL or CDL items should be accounted for during the appropriate phases of flight, when applicable.

The aeroplane is required to carry sufficient fuel taking into account the forecast wind and weather to fly to an ETOPS route alternate assuming the greater of: (1) A rapid decompression at the most critical point followed by descent to a 10 000 ft or a h igher altitude if sufficient oxygen is provided in accordance with the applicable operational requirements.

(2) A f light at the approved one - engine - inoperative cruise speed assuming a rapid decompression and a simultaneous engine failure at the most critic al point Powered by EASA eRules Page 101 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) followed by descent to a 10 000 ft or a higher altitude if sufficient oxygen is provided in accordance with the applicable operational requirements.

(3) A f light at the approved one - engine - inoperative cruise speed assuming an engine failure at the most critical point followed by descent to the one - engine - inoperative cruise altitude.

Upon reaching the alternate, hold at 1 500 ft above field elevation for 15 minutes and then conduct an instrument approach and landing.

Add a 5 % wind speed factor ( i.e. an increment to headwind or a decrement to tailwind) on the actual forecast wind used to calculate fuel in the greater of (1), (2) or (3) above to account for any potential errors in wind forecasting. If an operator is not using the actual forecast wi nd based on wind model acceptable to the competent authority, allow 5% of the fuel required for (1), (2) or (3) above, as reserve fuel to allow for errors in wind data. A wind aloft forecasting distributed worldwide by the World Area Forecast System (WAFS) is an example of a wind model acceptable to the competent authority.

d. Icing Correct the amount of fuel obtained in paragraph c. above taking into account the greater of: (1) the effect of airframe icing during 10 % of the time during which icing is fore cast (including ice accumulation on unprotected surfaces, and the fuel used by engine and wing anti - ice during this period) ; (2) fuel for engine anti - ice, and if appropriate wing anti - ice for the entire time during which icing is forecast.

Note: Unless a r eliable icing forecast is available, icing may be presumed to occur when the total air temperature (TAT) at the approved one - engine - inoperative cruise speed is less than +10 ° C, or if the outside air temperature is between 0 ° C and - 20 ° C with a relative humi dity (RH) of 55 % or greater.

The operator should have a programme established to monitor aeroplane in - service deterioration in cruise fuel burn performance and including in the fuel supply calculations sufficient fuel to compensate for any such deteriorat ion. If there is no data available for such a programme , the fuel supply should be increased by 5 % to account for deterioration in cruise fuel burn performance.

5. ALTERNATE AERODROMES To conduct an ETOPS flight, the ETOPS en - route alternate aerodromes sh ould meet the weather requirements of planning minima for an ETOPS en - route alternate aerodrome contained in the applicable operational requirements. ETOPS planning minima apply until dispatch. The planned en - route alternates for using in the event of prop ulsion system failure or aeroplane system failure(s) which require a diversion should be identified and listed in the cockpit documentation (e.g. computerised flight plan) for all cases where the planned route to be flown contains an ETOPS point See also Appendix 5 to this AMC ‘ETOPS En - route Alternate Aerodromes’.

6. IN - FLIGHT RE - PLANNING AND POST - DISPATCH WEATHER MINIMA An aeroplane whether or not dispatched as an ETOPS flight m ay not re - route post dispatch without meeting the applicable operational requirements and without satisfy ing by a procedure Powered by EASA eRules Page 102 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) that dispatch criteria have been met. The operator should have a system in place to facilitate such re - routes.

Post - dispatch, weather conditions at the ETOPS en - route alternates should be equal to or better than the normal landing minima for the available instrument approach.

7. DELAYED DISPATCH If the dispatch of a flight is delayed by more than one hour, pilots a nd/or operations personnel should monitor weather forecasts and airport status at the nominated en - route alternates to ensure that they stay within the specified planning minima requirements until dispatch.

8. DIVERSION DECISION - MAKING Operators shall esta blish procedures for flight crew, outlining the criteria that indicate when a diversion or change of routing is recommended whilst conducting an ETOPS flight. For an ETOPS flight, in the event of the shutdown of an engine, these procedures should include t he shutdown of an engine, fly to and land at the nearest aerodrome appropriate for landing.

Factors to be considered when deciding upon the appropriate course of action and suitability of an aerodrome for diversion may include but are not limited to: a. Aircraft configuration/weight/systems status; b. Wind and weather conditions en route at the diversion altitude; c. Minimum altitudes en route to the diversion aerodrome; d. Fuel required for the diversion; e. Aerodrome condition, terrain, weather and wind ; f. Runways available and runway surface condition; g. Approach aids and lighting; h. RFFS* capability at the diversion aerodrome; i. Facilities for aircraft occupants - disembarkation & shelter; j. Medical facilities; k. Pilot’s familiarity with the aero drome; l. Information about the aerodrome available to the flight crew.

Contingency procedures should not be interpreted in any way that prejudices the final authority and responsibility of the pilot - in - command for the safe operation of the aeroplane.

Note : F or an ETOPS en - route alternate aerodrome, a published RFFS category equivalent to ICAO category 4, available at 30 minutes ’ notice, is acceptable.

9. IN - FLIGHT MONITORING During the flight, the flight crew should remain informed of any significant changes in conditions at designated ETOPS en - route alternate aerodromes. Prior to the ETOPS Entry Point, the forecast weather, established aeroplane status, fuel remaining, and wh ere possible field conditions and aerodrome services and facilities at designated ETOPS en - route alternates are to be evaluated. If any conditions are identified which could preclude safe approach and landing on a designated en - route alternate aerodrome, t hen the flight crew should take appropriate action, such as re - routing as necessary, to remain within the operator’s approved diversion time of an en - route alternate aerodrome with forecast weather to be at or above landing minima. In Powered by EASA eRules Page 103 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) the event this is not possible, the next nearest en - route alternate aerodrome should be selected provided the diversion time does not exceed the maximum approved diversion time. This does not override the pilot ’ s - in - command authority to select the safest course of action.

10. AEROPLANE PERFORMANCE DATA The operator should ensure that the Operations Manual contains sufficient data to support the critical fuel reserve and area of operations calculation.

The following data should be based on the information provided by the (S)TC h older. The requirements for one - engine - inoperative performance en - route can be found in the applicable operational requirements.

Detailed one - engine - inoperative performance data including fuel flow for standard and non - standard atmospheric conditions and a s a function of airspeed and power setting, where appropriate, covering: a. drift down (includes net performance); b. cruise altitude coverage including 10 000 feet; c. holding; d. altitude capability (includes net performance); e. missed approach.

Detaile d all - engine - operating performance data, including nominal fuel flow data, for standard and non - standard atmospheric conditions and as a function of airspeed and power setting, where appropriate, covering: a. c ruise (altitude coverage including 10 000 feet ); and b. h olding.

It should also contain details of any other conditions relevant to extended - range operations which can cause significant deterioration of performance, such as ice accumulation on the unprotected surfaces of the aeroplane, ram air turbine (RAT) deployment, thrust reverser deployment, etc.

The altitudes, airspeeds, thrust settings, and fuel flow used in establishing the ETOPS area of operations for each airframe/engine combination should be used in showing the corresponding terrain and obstruction clearances in accordance with the applicable operational requirements.

11. OPERATIONAL FLIGHT PLAN The type of operation (i.e. ETOPS, including the diversion time used to establish the plan) should be listed on the operational flight plan as required by the applicable operational requirements.

[Amdt 20/7] [Amdt 20/21] Powered by EASA eRules Page 104 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of A MC 20 - 6B Products, Parts and Appliances (AMC - 20)

Appendix 5 to AMC 20 - 6B – ETOPS en - route alternate aerodrome s

ED Decision 2021/006/R 1. SELECTION OF EN - ROUTE ALTERNATE AERODROMES For an aerodrome to be nominated as an ETOPS en - route alternate for the purpose of this AMC, it should be anticipated that at the expecte d times of possible use it is an adequate ETOPS aerodrome that meets the weather and field conditions defined in the paragraph below titled ‘Dispatch minima – en - route alternate aerodrome s’ or the applicable operational requirements.

To list an aerodrome a s an ETOPS en - route alternate, the following criteria should be met: a. The landing distances required as specified in the AFM for the altitude of the aerodrome, for the runway expected to be used, taking into account wind conditions, runway surface condit ions, and aeroplane handling characteristics, permit the aeroplane to be stopped within the landing distance available as declared by the aerodrome authorities and computed in accordance with the applicable operational requirements.

b. The aerodrome servic es and facilities are adequate to permit an instrument approach procedure to the runway expected to be used while complying with the applicable aerodrome operating minima.

c. The latest available forecast weather conditions for a period commencing at the e arliest potential time of landing and ending 1 hour after the latest nominated time of use of that aerodrome, equals or exceeds the authorised weather minima for en - route alternate aerodromes as provided for by the increments listed in Table 1 of this Appe ndix. In addition, for the same period, the forecast crosswind component plus any gusts should be within operating limits and within the operator ’ s maximum crosswind limitations taking into account the runway condition (dry, wet or contaminated) plus any r educed visibility limits.

d. In addition, the operator’s programme should provide flight crews with information on adequate aerodromes appropriate to the route to be flown which are not forecast to meet en - route alternate weather minima. Aerodrome facility information and other appropriate planning data concerning these aerodromes should be provided to flight crews for use when executing a diversion.

2. DISPATCH MINIMA – EN - ROUTE ALTERNATE AERODROMES An aerodrome may be nominated as an ETOPS en - route altern ate for flight planning and release purposes if the available forecast weather conditions for a period commencing at the earliest potential time of landing and ending 1 hour after the latest nominated time of use of that aerodrome, equal or exceed the crit eria required by Table 1 below.

Table 1. Planning Minima Approach Facility Ceiling Visibility Precision approach Authorised DH/DA plus an Authorised visibility plus an increment of 200 ft increment of 800 metres Non - precision approach or Authorised MDH/MDA plus an Authorised visibility plus an circling approach increment of 400 ft increment of 1 500 metres The above criteria for precision approaches are only to be applied to Category 1 approaches.

When determining the usability of an instrument a pproach (IAP), forecast wind plus any gusts should be within operating limits, and within the operator ’ s maximum crosswind limitations taking into account the runway condition (dry, wet or contaminated) plus any reduced visibility Powered by EASA eRules Page 105 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) limits. Conditional forec ast elements need not be considered, except that a PROB 40 or TEMPO condition below the lowest applicable operating minima should be taken into account.

When dispatching under the provisions of the MEL, those MEL limitations affecting instrument approach m inima should be considered in determining ETOPS alternate minima.

3. EN - ROUTE ALTERNATE AERODROME PLANNING MINIMA – ADVANCED LANDING SYSTEMS The increments required by Table 1 are normally not applicable to Category II or III minima unless specifically app roved by the a uthority.

Approval will be based on the following criteria: a. Aircraft is capable of engine - inoperative Cat II/III landing; and b. Operator is approved for normal Cat II/III operations.

The competent authority may require additional data (such as safety assessment or in - service records) to support such an application. For example, it should be shown that the specific aeroplane type can maintain the capability to safely conduct and complete the Category II/III approach and l anding, in accordance with EASA CS - AWO, having encountered failure conditions in the airframe and/or propulsion systems associated with an inoperative engine that would result in the need for a diversion to the en - route alternate aerodrome.

Systems to supp ort one - engine inoperative Category II or III capability should be serviceable if required to take advantage of Category II or III landing minima at the planning stage.

[Amdt 20/7] [Amdt 20/21]

Appendix 6 to AMC 20 - 6 B – ETOPS t raining p rogramme

ED Decision 2021/006/R The operator’s ETOPS training programme should provide initial and recurrent training for flight crew as follows: 1. INTRODUCTION TO ETOPS REGULATIONS a. Brief overview of the history of ETOPS; b. ETOPS regulations; c. Definitions; d. Approve d one - engine - inoperative cruise speed ; e. ETOPS type design approval – a brief synopsis; f. Maximum approved diversion times and time - limited systems capability; g. Operator’s approved diversion Time; h. Routes and aerodromes intended to be used in the ETOPS area of operations; i. ETOPS operations approval ; j. ETOPS area and routes ; k. ETOPS en - route alternates aerodromes including all available let - down aids; l. Navigation systems accuracy, limitations and operating procedures; m. Meteorological facilit ies and availability of information; Powered by EASA eRules Page 106 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) n. In - flight monitoring procedures; o. Computerised flight plan ; p. Orientation charts, including low level planning charts and flight progress charts usage (including position plotting); q. Equal time point ; r. Critical fuel.

2. NORMAL OPERATIONS a. Flight planning and Dispatch (1) ETOPS fuel requirements (2) Route alternate selection - weather minima (3) Minimum equipment list – ETOPS specific (4) ETOPS service check and Tech log (5) Pre - flight FMS s et - up b. Flight performance progress monitoring (1) Flight management, navigation and communication systems (2) Aeroplane system monitoring (3) Weather monitoring (4) In - flight fuel management – to include independent cross checking of fuel quantity 3. ABNORMAL AND CONTINGENCY PROCEDURES a. Diversion Procedures and Diversion ‘decision - making’.

Initial and recurrent training to prepare flight crews to evaluate potential significant system failures. The goal of this training should be to estab lish crew competency in dealing with the most probable contingencies. The discussion should include the factors that may require medical, passenger - related or non - technical diversions.

b. Navigation and communication systems, including appropriate flight m anagement devices in degraded modes.

c. Fuel management with degraded systems.

d. Initial and recurrent training which emphasises abnormal and emergency procedures to be followed in the event of foreseeable failures for each area of operation, including: ( 1) Procedures for single and multiple failures in flight affecting ETOPS sector entry and diversion decisions. If standby sources of electrical power significantly degrade the cockpit instrumentation to the pilots, then training for approaches with the sta ndby generator as the sole power source should be conducted during initial and recurrent training.

(2) Operational restrictions associated with these system failures including any applicable MEL considerations.

Powered by EASA eRules Page 107 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) 4. ETOPS LINE FLYING UNDER SUPERVISION (LFU S) During the introduction into service of a new ETOPS type, or conversion of pilots not previously ETOPS qualified where ETOPS approval is sought, a minimum of two ETOPS sectors should be completed including an ETOPS line check.

ETOPS subjects should also be included in annual refresher training as part of the normal process.

5. FLIGHT OPERATIONS PERSONNEL OTHER THAN FLIGHT CREW The operator’s training programme in respect to ETOPS should provide training where applicable for operations personne l other than flight crew (e.g. dispatchers), in addition to refresher training in the following areas: a. ETOPS regulations/operations approval b. Aeroplane performance/ diversion procedures c. Area of operation d. Fuel requirements e. Dispatch considerations MEL, CDL, weather minima, and alternate airports f. Documentation [Amdt 20/7] [Amdt 20/21]

Appendix 7 to AMC 20 - 6B – Typical ETOPS operations manual

supplement

ED Decision 2021/006/R The ETOPS O perations M anual can take the form of a suppl ement or a dedicated manual, and it could be divided under these headings as follows: PART A. GENERAL/BASIC a. Introduction (1) Brief description of ETOPS (2) Definitions b. Operations approval (1) Criteria (2) Assessment (3) Approved diversion time c. Tr aining and checking d. Operating procedures e. ETOPS operational procedures f. ETOPS flight preparation and planning (1) Aeroplane serviceability (2) ETOPS orientation charts Powered by EASA eRules Page 108 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) (3) ETOPS alternate aerodrome selection (4) En - route alternate weather requirements for planning (5) ETOPS computerised Flight Plans g. Flight crew procedures (1) Dispatch (2) Re - routing or diversion decision - making (3) ETOPS verification (following maintenance) flight requirements (4) En - route Monitoring PART B. AEROPLANE OP ERATING MATTERS This part should include type - related instructions and procedures needed for ETOPS.

a. Specific type - related ETOPS operations (1) ETOPS specific limitations (2) Types of ETOPS operations that are approved (3) Placards and limitations (4) OE I speed(s) (5) Identification of ETOPS aeroplanes b. Dispatch and flight planning, plus in - flight planning (1) Type - specific flight planning instructions for use during dispatch and post dispatch (2) Procedures for engine(s) - out operations, ETOPS (particul arly the one - engine - inoperative cruise speed and maximum distance to an adequate aerodrome should be included) c. ETOPS fuel planning d. Critical fuel scenario e. MEL/CDL considerations f. ETOPS specific minimum equipment list items g. Aeroplane systems (1) Aeroplane performance data including speed schedules and power settings (2) Aeroplane technical differences, special equipment (e.g. satellite communications) and modifications required for ETOPS PART C. ROUTE AND AERODROME INSTRUCTIONS This part should comprise all instructions and information needed for the area of operation, to include the following as necessary: a. ETOPS area and routes, approved area(s) of operations and associated limiting distances b. ETOPS an - route al ternates c. Meteorological facilities and availability of information for in - flight monitoring d. Specific ETOPS computerised flight plan information Powered by EASA eRules Page 109 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) e. Low altitude cruise information, minimum diversion altitude, minimum oxygen requirements and any additi onal oxygen required on specified routes if MSA restrictions apply f. Aerodrome characteristics (landing distance available, take off distance available) and weather minima for aerodromes that are designated as possible alternates PART D. TRAINING This par t should contain the route and aerodrome training for ETOPS operations. This training should have 12 months of validity or as required by the applicable operational requirements. Flight crew training records for ETOPS should be retained for 3 years or as r equired by the applicable requirement s.

The operator ’ s training programme in respect to ETOPS should include initial and recurrent training/checking as specified in this AMC.

[Amdt 20/7] [Amdt 20/21]

Appendix 8 to AMC 20 - 6B – Continuing airworthiness

consi derations

ED Decision 2021/006/R 1. APPLICABILITY The requirements of this Appendix apply to the continuing airworthiness management organisations (CAMO) managing the aircraft for which an ETOPS operational approval is sought, and they are to be complied with in addition to the applicable continuing airworthiness requirements of Part - M. They specifically affect: a. Occurrence reporting; b. Aircraft maintenance programme and reliability programme; c. Continuing airworthiness management exposition; d. Competence of continuing airworthiness and maintenance personnel.

2. OCURRENCE REPORTING In addition to the items generally required to be reported in accordance with AMC 20 - 8, the following items concerning ETOPS should be included: a. in - flight shutdowns; b. diversion or turn - back; c. un - commanded power changes or surges; d. inability to control the engine or obtain desired power; and e. failures or malfunctions of ETOPS significant systems having a detrimental effect to ETOPS flight.

N ote: S tatus messages, transient failures, intermittent indication of failure, messages tested satisfactorily on ground not duplicating the failure should only be reported after an assessment by the operator that an unacceptable trend has occurred on the sy stem .

Powered by EASA eRules Page 110 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) The report should identify as applicable the following: a. aircraft identification; b. engine, propeller or APU identification (make and serial number); c. total time, cycles and time since last shop visit; d. for systems, time since overhaul or la st inspection of the defective unit; e. phase of flight; and f. corrective action.

The c ompetent a uthority and the (S)TC holder should be notified within 72 hours of events that are reportable through this programme.

3. MAINTENANCE PROGRAMME AND RELIABILITY PROGRAMME The quality of maintenance and reliability programmes can have an appreciable effect on the reliability of the propulsion system and the ETOPS s ignificant s ystems. The c ompetent a uthority should assess the proposed maintenance and rel iability programme’s ability to maintain an acceptable level of safety for the propulsion system and the ETOPS s ignificant s ystems of the particular airframe/engine combination.

3.1 MAINTENANCE PROGRAMME The maintenance programme of an aircraft for which E TOPS operational approval is sought, should contain the standards, guidance and instructions necessary to support the intended operation. The specific ETOPS maintenance tasks identified by the (S)TC holder in the configuration, maintenance and procedures d ocument (CMP) or equivalent should be included in the maintenance programme and identified as ETOPS tasks.

An ETOPS maintenance task could be an ETOPS specific task or/and a maintenance task affecting an ETOPS significant system. An ETOPS specific task cou ld be either an existing task with a different interval for ETOPS, a task unique to ETOPS operations, or a task mandated by the CMP further to the in - service experience review (note that in the case ETOPS is considered as the baseline in the development of a maintenance program, no ‘ ETOPS specific ’ task may be identified in the MRB).

The maintenance programme should include tasks to maintain the integrity of cargo compartment and pressurisation features, including baggage hold liners, door seals and drain v alve condition. Processes should be implemented to monitor the effectiveness of the maintenance programme in this regard.

3.1.1 PRE - DEPARTURE SERVICE CHECK An ETOPS service check should be developed to verify the status of the aeroplane and the ETOPS signi ficant systems. This check should be accomplished by an authorised and trained person prior to an ETOPS flight. Such a person may be a member of the flight crew.

3.2 RELIABILITY PROGRAMME: 3.2.1 GENERAL The reliability programme of an ETOPS operated aircraft should be designed with early identification and prevention of failures or malfunctions of ETOPS significant systems as the primary goal. Therefore the reliability programme should include assessment of ETOPS s ignificant s ystems performance during scheduled Powered by EASA eRules Page 111 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) inspection/testing, to detect system failure trends in order to implement appropriate corrective action such as scheduled task adjustment.

The reliability programme should be event - orientated and in corporate: a. reporting procedures in accordance with S ection 2: Occurrence reporting b. operator’s assessment of propulsion systems reliability c. APU in - flight start programme d. Oil consumption programme e. Engine condition monitoring programme f. Verification programme 3.2.2 ASSESSMENT OF PROPULSION SYSTEMS RELIABILITY a. The operator’s assessment of propulsion systems reliability for the ETOPS fleet should be made available to the competent a uthority (with the sup porting data) on at least a monthly basis, to ensure that the approved maintenance programme continues to maintain a level of reliability necessary for ETOPS operations as established in C hapter II S ection 6.3.

b. The assessment should include, as a minimu m, engine hours flown in the period, in - flight shutdown rate for all causes and engine removal rate, both on a 12 - month moving average basis. Where the combined ETOPS fleet is part of a larger fleet of the same aircraft/engine combination, data from the to tal fleet will be acceptable.

c. Any adverse sustained trend to propulsion systems would require an immediate evaluation to be accomplished by the operator in consultation with the competent authority. The evaluation may result in corrective action or oper ational restrictions being applied.

d. A high engine in - flight shutdown rate for a small fleet may be due to the limited number of engine operating hours and may not be indicative for an unacceptable trend. The underlying causes for such an increase in the rate will have to be reviewed on a case - by - case basis in order to identify the root cause of events so that the appropriate corrective action is implemented.

e. If an operator has an unacceptable engine in - flight shutdown rate caused by maintenance or ope rational practices, then the appropriated corrective actions should be taken.

3.2.3 APU IN - FLIGHT START PROGRAMME a. Where an APU is required for ETOPS and the aircraft is not operated with this APU running prior to the ETOPS entry point, the operator shou ld initially implement a cold soak in - flight starting programme to verify that start reliability at cruise altitude is above 95 %.

Once the APU in - flight start reliability is proven, the APU in - flight start monitoring programme may be alleviated. The APU i n - flight start monitoring programme should be acceptable to the competent authority.

b. The Maintenance procedures should include the verification of in - flight start reliability following maintenance of the APU and APU components, as Powered by EASA eRules Page 112 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) defined by the OEM, wh ere start reliability at altitude may have been affected.

3.2.4 OIL CONSUMPTION MONITORING PROGRAMME The oil consumption monitoring programme should reflect the (S)TC holder’s recommendations and track oil consumption trends. The monitoring programme must be continuous and include all oil added at the departure station.

If oil analysis is recommended to the type of engine installed, it should be included in the programme.

If the APU is required for ETOPS dispatch, an APU oil consumption monitoring programme should be added to the oil consumption monitoring programme.

3.2.5 ENGINE CONDITION MONITORING PROGRAMME The engine condition monitoring programme should ensure that a one - engine - inoperative diversion may be conducted without exceeding approved engine limits (e.g. rotor speeds, exhaust gas temperature) at all approved power levels and expected environmental conditions. Engine limits established in the monitoring programme should account for the effects of additional engine loading demands (e.g. a nti - icing, electrical, etc.), which may be required during the one - engine - inoperative flight phase associated with the diversion.

The engine condition monitoring programme should describe the parameters to be monitored, method of data collection and correc tive action process. The programme should reflect manufacturer’s instructions and industry practice. This monitoring will be used to detect deterioration at an early stage to allow for corrective action before safe operation of the aircraft is affected.

3. 2.6 VERIFICATION PROGRAMME The operator should develop a verification programme to ensure that the corrective action required to be accomplished following an engine shutdown, any ETOPS significant system failure or adverse trends or any event which require a verification flight or o ther verification action are established. A clear description of who must initiate verification actions and the section or group responsible for the determination of what action is necessary should be identified in this verification programme. ETOPS signif icant systems or conditions requiring verification actions should be described in the continuing airworthiness management exposition (CAME). The CAMO may request the support of the (S)TC holder to identify when these actions are necessary. Nevertheless , th e CAMO may propose alternative operational procedures to ensure system integrity. This may be based on system monitoring in the period of flight prior to entering an ETOPS area.

4. CONTINUING AIRWORTHINESS MANAGEMENT EXPOSITION The CAMO should develop appr opriate procedures to be used by all personnel involved in the continuing airworthiness and maintenance of the aircraft, including supportive training programmes, duties, and responsibilities.

The CAMO should specify the procedures necessary to ensure the continuing airworthiness of the aircraft particularly related to ETOPS operations. It should address the following subjects as applicable: Powered by EASA eRules Page 113 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) a. General description of ETOPS procedures b. ETOPS maintenance programme development and amendment c. ETOPS reliab ility programme procedures (1) Engine/APU oil consumption monitoring (2) Engine/APU Oil analysis (3) Engine conditioning monitoring (4) APU in - flight start programme (5) Verification programme after maintenance (6) Failures, malfunctions and defect reporti ng (7) Propulsion system monitoring/reporting (8) ETOPS significant systems reliability d. Parts and configuration control programme e. Maintenance procedures that include procedures to preclude identical errors being applied to multiple similar elements i n any ETOPS significant system f. Interface procedures with the ETOPS maintenance contractor, including the operator ETOPS procedures that involve the maintenance organisation and the specific requirements of the contract g. Procedures to establish and con trol the competence of the personnel involved in the continuing airworthiness and maintenance of the ETOPS fleet 5. COMPETENCE OF CONTINUING AIRWORTHINESS AND MAINTENANCE PERSONNEL The CAMO should ensure that the personnel involved in the continuing airwor thiness management of the aircraft have knowledge of the ETOPS procedures of the operator.

The CAMO should ensure that maintenance personnel that are involved in ETOPS maintenance tasks: a. Have completed an ETOPS training programme reflecting the relevant ETOPS procedures of the operator, and, b. Have satisfactorily performed ETOPS tasks under supervision, within the framework of the Part - 145 approved procedures for Personnel Authorisation.

5.1. PROPOSED TRAINING PROGRAMME FOR PERSONNEL INVOLVED IN THE CONTINUING AIRWORTHINESS AND MAINTENANCE OF THE ETOPS FLEET The operator’s ETOPS training programme should provide initial and recurrent training for as follows: 1. INTRODUCTION TO ETOPS REGULATIONS a. Contents of AMC 20 - 6 b. ETOPS type des ign approval – a brief synopsis 2. ETOPS OPERATIONS APPROVAL a. Maximum approved diversion times and time - limited systems capability b. Operator’s approved diversion time Powered by EASA eRules Page 114 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 6B Products, Parts and Appliances (AMC - 20) c. ETOPS area and routes d. ETOPS MEL 3. ETOPS CONTINUING AIRWORTHINESS CONSIDERATION S a. ETOPS significant systems b. CMP and ETOPS aircraft maintenance programme c. ETOPS pre - departure service check d. ETOPS reliability programme procedures (1) Engine/ APU oil consumption monitoring (2) Engine/APU o il analysis (3) Engine conditioning mon itoring (4) APU in - flight start programme (5) Verification programme after maintenance (6) Failures, malfunctions and defect reporting (7) Propulsion system monitoring/reporting (8) ETOPS significant systems reliability e. Parts and configuration control p rogramme f. CAMO additional procedures for ETOPS g. Interface procedures between Part - 145 organisation and CAMO [Amdt 20/7] [Amdt 20/21] Powered by EASA eRules Page 115 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 8A Products, Parts and Appliances (AMC - 20)

AMC 20 - 8A

AMC 20 - 8 A Occurrence r eporting

ED Decision 2020 / 010 /R 1. INTENT This AMC is interpretative material and provides guidance in order to determine when occurrences should be reported to EASA , competent authorities and other organisations .

It also describes the obje ctive of the overall occurrence - reporting system , includin g internal and external functions .

2. APPLICABILITY (a) This AMC only applies to occurrence reporting by persons or organisations that are subject to Regulation (EU) No 748/2012 and Regulation (EU) No 1321/2014 .

(b) In most cases , the obligation to report is on the holders of a certificate or approval, which in most cases are organisations, but in some cases can be a natural person. In addition some reporting requirements are directed to persons. However, in order not to complicate the text, only the term ‘ organisation’ is used.

(c) The AMC does not specifically address dangerous goods reporting. This subject is covered in specific operational requirements and guidance , and i n Europ ean Union regulations and ICAO documents , namely: (i) Commission Regulation (EU) No 965/2012 of 5 October 2012 laying down technical requirements and administrative procedures related to air operations pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council; (ii) ICAO Annex 18 ‘ S afe Transpo rt of Dangerous Goods by Air ’ ; and (ii i ) ICAO Doc 9284 - AN/905, ‘ Technical Instructions for the Safe Transport of Dangerous Goods by Air ’ .

3. OBJECTIVE OF OCCURRENCE REPORTING (a) The occurrence - reporting system is an essential part of the overall monitorin g function.

The objective of the occurrence - reporting, collection, investigation and analysis systems described in the applicable requirements of Regulation (EU) 2018/1139, as well as of Regulation (EU) No 376/2014 and the delegated and implementing acts a dopted on the basis thereof is to use the reported information to contribute to the improvement of aviation safety and it should not be used to attribute blame or liability or to establish benchmarks for safety performance.

(b) The detail ed objectives of t he occurrence - reporting systems are to : (i) enable an assessment of the safety implications of each occurrence to be made, including previous similar occurrences, so that any n ecessary action can be initiate d ; t his includes determining what had occurred an d why , and what might prevent a similar occurrence from happening in the future; (ii) ensure that knowledge of occurrences is disseminated so that other persons and organisations may learn from them.

(c) The occurrence - reporting system is complementary to the normal day - to - day procedures and ‘ control ’ systems and is not intended to duplicate or supersede any of the m. The Powered by EASA eRules Page 116 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 8A Products, Parts and Appliances (AMC - 20) occurrence - reporting system is a tool to identify those occasions where routine procedures have failed.

(d) Occurrences should remain in the database when judged reportable by the person submitting the report as the significance of such reports may only become obvious at a later date.

4. REPORTING TO EASA AND COMPETENT AUTHORITIES (a) For organisations that have their principal pl ace of business in a Member State, Commission Implementing Regulation (EU) 2015/1018 provides a classification of the occurrences in civil aviation for which reporting is mandatory. This list should not be understood as being an exhaustive collection of al l the issues that may pose a significant risk to aviation safety, and therefore reporting should not be limited to the items listed therein and the additional items identified in points 21.A.129(f) and 21.A.165(f) of Part 21.

For organisations that do not have their principal place of business in a Member State, such a list is provided in Section 9.

(b) These lists are based on the following general airworthiness requirements: (i) The design rules for products , part s and appliances prescribe that an occ urrence that is defined as a failure, malfunction, defect or other occurrence related to a product or part, which has resulted or may result in an unsafe condition , must be reported to EASA .

(ii) The product and part production rules prescribe that product s or parts released from the production organisation with deviations from the applicable design data that could lead to a potential unsafe condition, as identified with the holder of the type certificate (TC) or design approval holder (DAH), must be report ed to the competent authority.

(i ii ) The continuing airworthiness rules stipulate that an occurrence that is defined as any safety - related event or condition of an aircraft or component identified by the organisation that endangers or, if not corrected or addressed, could endanger an aircraft, its occupants or any other person, must be reported to the competent authority.

( i v) In addition, the continuing airworthiness rules prescribe that any incident, malfunction, technical defect, exceedance of technical limitations, occurrence that would highlight inaccurate, incomplete or ambiguous information, contained in the Instructions for Continued Airworthiness (ICA) established in accordance with Regulation (EU) No 748/2012, or other irregular circumstance that h as or may have endangered an aircraft, its occupants or any other person, must be reported to the competent authority and to the organisation responsible for the design of the aircraft.

(c ) Reporting does not remove the responsibility of the reporter or th e organisation to initiate actions to prevent similar occurrences from happening in the future.

(d) A design or maintenance programme may include additional reporting requirements for failures or malfunctions associated with that approval or programme.

Powered by EASA eRules Page 117 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 8A Products, Parts and Appliances (AMC - 20) 5 . REPORTING TIME — MANDATORY REPORTING — INITIAL REPORT (a) The period of 72 hours is normally understood to start from when the person or organisation became aware of the occurrence. This means that there may be up to 72 hours maximum for a person to repo rt to the organisation or to directly report to the competent authority, plus 72 hours maximum for the organisation to report to the competent authority.

(b ) Within the overall limit of 72 hours for the submission of a report, the organisation should determine the degree of urgency based on the severity of consequence judged to have resulted from the occurrence: (i) Where an occurrence is judged to have resulte d in an immediate and particularly severe consequence, EASA and/or the competent authority expects to be notified immediately, and by the fastest possible means (e.g. telephone, fax, telex, e - mail) of whatever details are available at that time. This initi al notification should then be followed up by a report within 72 hours.

A typical example of severe consequences would be an uncontained Engine failure that results in damage to the aircraft primary structure.

(ii) Where the occurrence is judged to have re sulted in a less immediate and less significant risk , the report submission may be delayed up to the maximum of 72 hours in order to provide more details or more reliable information.

6 . CONTENT OF INITIAL REPORTS (a) For organisations that have their prin cipal place of business in a Member State, the content of mandatory reports and, where possible, voluntary reports, is defined in Annex I to Regulation (EU) No 376/2014.

(b) For organisations that do not have their principal place of business in a Member S tate, mandatory reports and, where possible, voluntary reports, should include the information below: (i) when: UTC date; (ii) where: State/area of occurrence — location of occurrence; (iii) aircraft - related information: aircraft identification, State of Registry, make - model series, aircraft category, propulsion type, mass group, aircraft serial number, and aircraft registration number; (iv) aircraft operation and history of flight: operator, type of operation, last departure point , planned destination, flight phase; (v) weather: the relevant weather; (vi) where relevant, air - navigation - services - (ANS) - related information: ATM contribution, service affected, ATS unit name; (vii) where relevant, aerodrome - related information: location indicator (ICAO airport code), location on the aerodrome; and (viii) aircraft - damage - or personal - injury - related information: severity in terms of the highest level of damage and injury, the number and type of injuries to persons on the ground and in the aircraft .

Powered by EASA eRules Page 118 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBP ART A — GENERAL of Compliance for Airworthiness of AMC 20 - 8A Products, Parts and Appliances (AMC - 20) 7. REPORTING TIME — FOLLOW - UP REPORTS (a) For organisations that have their principal place of business in a Member State, the reporting timelines for follow - up reports are those defined in A rticle 13 of Regulation (EU) No 376/2014.

(b) For org anisations that do not have their principal place of business in a Member State, the following applies: where the organisation identifies an actual or potential aviation safety risk as a result of their analysis of occurrences or groups of occurrences repo rted to EASA, it should: (i) transmit the following information to EASA within 30 days from the date of notification of the occurrence to EASA: (1) the preliminary results of the risk assessment performed; and (2) any preliminary mitigation action to be ta ken; (ii) where required, transmit the final results of the risk analysis to EASA as soon as they are available and, in principle, no later than 3 months from the date of the initial notification of the occurrence to EASA.

8 . REPORTING AMONG ORGANISATIONS (a) In addition to reporting occurrences to the competent authority or EASA, reporting among organisations should be considered. Such reporting will depend on the type of the organisation, its interfaces with other organisations, and their r espective safety policies and procedures, as well as the extent of contracting or subcontracting.

(b) Organisations may develop a customised list of occurrences to be reported among them, adapted to their particular aircraft, operations or products, and th e organisations with which they interface. Such a customised list of occurrences to be reported among organisations is usually included or referenced in the organisation’s expositions/handbooks/manuals. Any such lists should, however, not be considered to be definitive or exhaustive, and it is essential for the reporter to use their judgement of the degree of risk or potential hazard that is involved.

(c) T he following provides a non - exhaustive list of reporting lines that exist for the reporting of occurre nces among organisations relat ed to unsafe or non - airworthy conditions: (i) production o rganisation to the organisation responsible for the design; (ii) m aintenance organisation /continuing airworthiness management organisation (CAMO) to the organisation re sponsible for the design; (iii) m aintenance organisation /CAMO to the operator; (iv) o perator to the organisation responsible for the design; and (v) p roduction organisation to another production organisation.

(d ) The ‘design approval holder ’ is a general term, which can be any one or a combination of the following natural persons or organisations : (i) the holder of type certificate (TC) of an a ircraft, Engine or Propeller; (ii) the holder of a supplemental type certificate (STC) on an a ircra ft, Engine or Propeller; (iii) the holder of a European technical standard order (ETSO) a uthorisation; or Powered by EASA eRules Page 119 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 8A Products, Parts and Appliances (AMC - 20) (iv) the holder of a repair design approval or a change to a type design approval.

(e ) If it can be determined that the occurrence has an impact on or is related to an aircraft component which is covered by a separate design approval /authorisation (TC, STC or ETSO ), then the holder of such approval/authorisation should be informed. S uch information must be part of the reporting to the ‘main’ design approval holder. If an occurrence concerns a component which is covered by a TC, STC, repair or change design approval or an ETSO authorisation (e.g. during maintenance), then only that TC, STC, repair or change design approval holder or ETSO a uthorisation holder needs to be informed by the reporting person or organisation that first determined the impact of the TC, STC, repair or change design or ETSO authorisation .

(f) Any organisation tha t reports to the design approval holder should actively support any investigations that may be initiated by that organisation. Support should be provided by a timely response to information requests, and by making available the affected components, parts o r appliances for the purpose of the investigation, subject to an agreement with the respective component, part or appliance owners. Design approval holders are expected to provide feedback to the reporting organisations on the results of their investigatio ns.

(g ) To ensure that there is effective reporting among organisations, it is important that : (i) an interface is established between the organisations to ensure that there is an effective and timely exchange of information relat ed to occurrences; (ii) an y relevant safety issue is identified; and (iii) it is clearly established which party is responsible for taking further action, if required.

(h) Organisations should establish procedures to be used for reporting among them, which should include as a minim um: (i) a description of the applicable requirements for reporting; (ii) the scope of such reporting, considering the organisation’s interfaces with other organisations, including any contracting and subcontracting; (iii) a description of the reporting mec hanism, including reporting forms, means, and deadlines; (iv) safeguards to ensure the confidentiality of the reporter and protection of personal data; and (v) the responsibilities of the organisations and personnel involved in reporting, including for rep orting to the competent authority.

Such procedures should be included in the organisation’s expositions/handbooks/manuals.

Powered by EASA eRules Page 120 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 8A Products, Parts and Appliances (AMC - 20) Figure 1 below presents a simplified scheme of the reporting lines.

Figure 1 9. REPORTABLE OCCURRENCES — MANDATORY REPORTING For organisations that do not have their principal place of business in a Member State, the text below provides a classification of occurrences in civil aviation for which reporting is mandatory.

This list should not be understood as being an exh austive collection of all the issues that may pose a significant risk to aviation safety and, therefore, reporting should not be limited to the items listed therein and the additional items identified in points 21.A.129(f) and 21.A.165(f) of Part 21.

9.1. MANUFACTURING Products, parts or appliances released from the production organisation with deviations from the applicable design data that could lead to a potential unsafe condition as identified by the holder of the type certificate or design approva l.

9.2. DESIGN Any failure, malfunction, defect or other occurrence related to a product, part or appliance which has resulted, or may result, in an unsafe condition.

Remark: This list is applicable to occurrences that occur on a product, part or appliance covered by the type certificate (TC), restricted type certificate (RTC), supplemental type certificate (STC), ETSO authorisation, major repair design approval or any other relevant approval deemed to have been issued in line with Commission Regulation (EU ) No 748/2012.

Powered by EASA eRules Page 121 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 8A Products, Parts and Appliances (AMC - 20) 9.3. MAINTENANCE AND CONTINUING AIRWORTHINESS MANAGEMENT (a) Serious structural damage (for example, cracks, permanent deformation, delamination, debonding, burning, excessive wear, or corrosion) found during maintenance of the aircraft or component.

(b) Serious leakage or contamination of fluids (for example, hydraulic, fuel, oil, gas or other fluids).

(c) A failure or malfunction of any part of an Engine or power plant and/or transmission that results in either or both of the following: ( i) non - containment of components/debris; (ii) failure of the Engine mount structure.

(d) Damage to a Propeller, or a failure or defect of a Propeller, which could lead to in - flight separation of the Propeller or any major portion of the Propeller and/or ma lfunctions of the Propeller control.

(e) Damage to a main rotor gearbox/attachment, or a failure or defect of a main rotor gearbox/attachment, which could lead to an in - flight separation of the rotor assembly and/or malfunctions of the rotor control.

(f) A significant malfunction of a safety - critical system or equipment, including a malfunction of an emergency system or equipment during maintenance testing, or a failure to activate these systems after maintenance.

(g) The incorrect assembly or installation of components of the aircraft found during an inspection or test procedure that was not intended for that specific purpose.

(h) An incorrect assessment of a serious defect, or a serious non - compliance with the MEL or the technical logbook procedures.

(i) S erious damage to the electrical wiring interconnection system (EWIS).

(j) Any defect in a life - controlled critical part that causes its retirement before the completion of its full service life.

(k) The use of products, components or materials from an unkn own or suspect origin, or unserviceable critical components.

(l) Misleading, incorrect or insufficient applicable maintenance data or procedures, including language issues, which could lead to significant maintenance errors.

(m) The incorrect control or ap plication of aircraft maintenance limitations or scheduled maintenance.

(n) Releasing an aircraft to service from maintenance if there remains any non - compliance which endangers flight safety.

(o) Serious damage caused to an aircraft during maintenance act ivities due to incorrect maintenance or the use of inappropriate or unserviceable ground support equipment that requires additional maintenance actions.

(p) Identified occurrences of burning, melting, smoke, arcing, overheating or fire.

(q) Any occurrence in which human performance, including the fatigue of the personnel, has directly contributed, or could have contributed, to an accident or a serious incident.

Powered by EASA eRules Page 122 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 8A Products, Parts and Appliances (AMC - 20) (r) A significant malfunction, reliability issue, or recurrent recording quality issue that affects a flight recorder system (such as a flight data recorder system, a data link recording system or a cockpit voice recorder system) or a lack of the information needed to ensure the serviceability of a flight recorder system.

[Amdt 20/19] Powered by EASA eRules Page 123 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 9 Products, Parts and Appliances (AMC - 20)

AMC 20 - 9

AMC 20 - 9 Acceptable Means of Compliance for the Approval of

Departure Clearance via Data Communications over ACARS

ED Decision 2006/012/R 1 PREAMBLE 1.1 This AMC is issued in response to the EUROCONTROL Convergence and Implementation Plan that recommends an interim deployment of air - to - ground and ground - to - air data link applications based on the existing airline ACARS technology. One such application is Departure Clearance (DCL) data link now operational at various airports in Europe (as indica ted in AIPs). Aircraft operators, on a voluntary basis, may take advantage of DCL over ACARS where it is available, subject to any arrangements that may be required by their responsible operations authority.

1.2 The use of ACARS for data link purposes is a transitional step to data link applications that will use VDL Mode 2 and the Aeronautical Telecommunications Network (ATN), compliant with ICAO SARPS, as proposed in the EUROCONTROL LINK2000+ programme .

1.3 Described in EUROCAE document ED - 85A (hereafte r “ED - 85A”), Data Link Application System document (DLASD) for the “Departure Clearance” Data Link Service, DCL over ACARS is a control tower application providing direct communication between the flight crew and the air traffic controller. ED - 85A addresse s three domains: airborne, ground ATC, and communication service providers. It deals also with associated flight crew and controller procedures. ED - 85A takes account of EUROCAE document ED - 78 which describes the global processes including approval planning , co - ordinated requirements determination, development and qualification of a system element, entry into service, and operations.

2 PURPOSE 2.1 This AMC is intended for operators seeking to use Departure Clearance via data link over ACARS as described in E D - 85A. It may assist also other stakeholders such as airspace planners, air traffic service providers, ATS system manufacturers, communication service providers, aircraft and equipment manufacturers, and ATS regulatory authorities to advise them of the air borne requirements and procedures, and the related assumptions.

2.2 This AMC provides a method for evaluating compliance of a data link system to the requirements of ED - 85A, and the means by which an aircraft operator can satisfy an authority that operatio nal considerations have been addressed.

3 SCOPE 3.1 This AMC addresses DCL over ACARS using the ARINC 623 protocol as elaborated in EUROCAE document ED - 85A and promoted by the EUROCONTROL Convergence and Implementation Plan as an interim data link applicat ion pending maturity of the LINK2000+ programme. The AMC is not directly applicable to Pre - Departure Clearance (PDC) as used in the USA and some other states. For PDC approval, guidance may be found in FAA document Safety and Interoperability Requirements for Pre - Departure Information on LINK2000+ is available at web site www.eurocontrol.int/link2000 Powered by EASA eRules Page 124 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 9 Products, Parts and Appliances (AMC - 20) Clearance, issued by AIR - 100 on April 21, 1998. A comparison of PDC with DCL may be found in Appendix 1.

3.2 This AMC is not applicable to the phased implementation of data link services within the EUROCONTROL LINK2000+ programme, in par ticular, DCL over the Aeronautical Telecommunications Network via VHF Digital Data Link (VDL) Mode 2. In this case, the Safety and Performance Requirements (EUROCAE ED - 120) and the Interoperability Requirements (EUROCAE ED - 110) are established using EUROCA E document ED - 78A, Guidelines for Approval of the Provision and use of Air Traffic Services supported by Data Communications. Guidance for the implementation of DCL over ATN may be found in EASA document AMC 20 - 11.

3.3 The operational requirements for the DCL application are published in the EUROCONTROL document OPR/ET1/ST05/1000, Edition 2, October 15, 1996, Transition guidelines for initial air ground data communication services. The EUROCONTROL document includes the re - issued clearance capability, howeve r document ED - 85A does not address this capability and it is not included in the scope of this AMC.

3.4 For the remainder of this document, the acronym DCL should be interpreted to mean DCL over ACARS using the ARINC 623 protocol unless stated otherwise.

4 REFERENCE DOCUMENTS 4.1 Related Requirements CS/FAR 25.1301, 25.1307, 25.1309, 25.1322, 25.1431, 25.1581, or equivalent requirements of CS 23, 27 and 29 if applicable.

4.2 Related Standards and Guidance Material ICAO Doc 9694 AN/955 Manual of Air Traffic Services (ATS) Data Link Applications Doc 4444 Rules of the Air and Air Traffic Services Draft Proposal PANS - Air Traffic Management Annex 11 Air Traffic Services Doc 8585 Designators for Aircraft Operating agencies, Aeronautical Authorities and Services Doc 8643 Aircraft Type Designators EASA AMC 25 - 11 Electronic Display Systems EUROCONTROL CIP: COM. Implement Air/Ground Communication ET2.SO4; 2.1.5 Services - Interim step on non - ATN (ACARS) services.

OPR/ET1/ST05/1000 Transition guidelines for initial air ground data communication services ESARR 4 Risk assessment and mitigation in ATM FAA AC 25 - 11 Electronic Display Systems.

AC 120 - COM Initial Air Carrier Operational Approval for use of Digital Communication Systems AC 20 - 140 Guidelines for design approval of aircraft data communications systems 98 - Air - PDC Safety and Interoperability requirement for Pre - Departure - Clearance (PDC). (Air - 100, April 21,1998) Powered by EASA eRules Page 125 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 9 Products, Parts and Appliances (AMC - 20) EUROCAE ED 78 Guidance material for the establishment of data link supported ATS Services ED - 85A Data Link Application System document (DLASD) for the “ departure Clearance ” data link service ED - 112 Minimum operational performance specification for Crash protected airborne recorder systems RTCA DO 224 Minimum Aviation System Performance Standards (MASPS) for Advanced VHF Digital Data Communications Including Compatibility with Digital Voice Techniques.

SAE ARP 4791 Human Machine Interface on the flight deck 5 ASSUMPTIONS Applicants should note that this AMC is based on the assumptions stated in Chapter 3 of ED - 85A together with the following that concern the measures taken by the responsible airspace authorities to safeguard DCL operations.

5.1 ATS Provider 5.1.1 The data link service for DCL has been shown to satisfy applicable airspace safety regulations and the relevant ATS domain performance, safety and interoperability requirements of ED - 85A.

5.1.2 Procedures for the use of D CL take account of the performance limitations of ACARS and the airborne implementation capabilities meeting at least the provisions of this AMC.

Note: Some aircraft ACARS installations approved to earlier standards are classified as “Non Essential” witho ut guarantees of performance or integrity.

Consequently, procedures are necessary to compensate for any deficiency and to safeguard operations. ED - 85A addresses this issue.

5.1.3 Appropriate procedures are established to minimise the possibility of failure to detect inconsistency in the case of a complex clearance.

5.1.4 Each ATS provider has published a list of communication service providers that may be used by aircraft operators for the DCL application. The list should take account of internetworking arr angements between service providers.

5.1.5 The procedures of the ATS provider state the actions that should be taken in the event of an inadequate communication service from the communications service provider (CSP).

5.2 Communications Service Provider The communications service provider does not modify the operational information (content and format) exchanged between the ATS provider and the airborne equipment.

5.3 Aeronautical Information Service Each State offering a DCL service by data link publishes i n its AIP, or equivalent notification, availability of the service, relevant procedures, and confirmation of compliance with ED - 85A.

Powered by EASA eRules Page 126 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 9 Products, Parts and Appliances (AMC - 20) 5.4 Message Integrity The Cyclic Redundancy Check (CRC) is implemented as required by ED - 85A and is providing integrity o f the end - to - end data link transmission path. On this basis, Performance Technical Requirement PTR_3 of ED - 85A need not be demonstrated.

6 AIRWORTHINESS CONSIDERATIONS 6.1 General 6 .1.1 The installation will need to be shown compliant with the airborne domain requirements allocated as per ED - 85A (§7.1) covering the Interoperability Operational Requirements, the Interoperability Technical Requirements, the Performance Technical Requirements, the Safety Operational & Technical Requirements.

6.1.2 If multiple ATS data link applications are available to the aircraft, the crew interface and related crew procedures will need to be based on a common and compatible philosophy.

6.2 Required Functions An acceptable minimum airborne installation comprises t he following functions: (a) A means of data communication appropriate to the area of operation, e.g. plain old ACARS over AVLC (Aviation VHF Link Control) through VHF or SATCOM; Note: VDL Mode 2 equipment can be used provided that radio transceiver is comp liant with ED - 92A.

(b) A means to manage data communications and to control the data communications system; (c) A means to easily check and modify the parameters of the DCL request; (d) “Visual” alerting of an incoming message, visible to both pilots; (e) Means to display the text message, e.g. a single display readable by both crewmembers or a dedicated display for each pilot.

(f) A means to accept the DCL delivered by the ATS.

6.3 Recommended Functions (a) “Audible” alerting of an incoming message; (b) A means to print the messages; (c) Recording of DCL messages and flight crew responses on an accident flight recorder.

Note: Data Link recording may be required in accordance with OPS rules.

7 ACCEPTABLE MEANS OF AIRWORTHINESS COMPLIANCE 7.1 Airworthiness 7. 1.1 When demonstrating compliance with this AMC, the following specific points should be noted: (a) Compliance with the airworthiness requirements for intended function and safety may be demonstrated by equipment qualification, safety analysis of the interface between the communications management system and data Powered by EASA eRules Page 127 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AM C 20 - 9 Products, Parts and Appliances (AMC - 20) sources, structural analyses of new anten na installations, equipment cooling verification, and evidence of a suitable human to machine interface. The DCL function will need to be demonstrated by end - to - end ground testing that verifies system operation, either with an appropriate ATS unit, or by m eans of test equipment that has been shown to be representative of the actual ATS unit.

Note: This limited testing assumes that the communication systems (VHF or SATCOM) have been shown to satisfactorily perform their intended functions in the flight envir onment in accordance with applicable requirements.

(b) The safety analysis of the interface between the communications management system and its data sources should show that, under normal or fault conditions, no unwanted interaction which adversely affect s essential systems can occur.

7.1.2 To minimise the certification effort for follow - on installations credit may be granted for applicable certification and test data obtained from equivalent aircraft installations.

7.2 Performance The installation should be shown to meet the airborne domain performance requirements allocated by ED - 85A (§7.1). Demonstration of Performance Technical Requirement PTR_A1 may be difficult for some airborne installations. The applicant may choose an alternativ e acceptable means of compliance for PTR_A1 consisting in an end - to - end demonstration of PTR_5 & PTR - 6 of ED - 85A (§5.2) with an appropriate ATS unit and communication service provider.

7.3 Aircraft Flight Manual The Flight Manual should state the following limitation.

Note: This limited entry assumes that a detailed description of the installed system and related operating instructions are available in other operating or training manuals and that operating procedures take account of ED - 85A.

Limitation: The Departure Clearance (DCL) over ACARS application has been demonstrated with data link services declared compliant with EUROCAE document ED - 85A.

7.4 Existing installations The applicant will need to submit a compliance statement that shows how the criteria of this AMC have been satisfied for existing installations. Compliance may be established by inspection of the installed system to confirm the availability of required features and functionality.

Note: It is not intended that aircraft which have received airworthiness approval in compliance with ED - 85 requirement should be reinvestigated where the installation is compliant with Section 6, 7 and 8 of this AMC.

Powered by EASA eRules Page 128 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 9 Products, Parts and Appliances (AMC - 20) 8 OPERATIONAL CONSIDERATIONS 8.1 Flight Plan Information 8.1.1 The Aircraft Identification trans mitted by data link will need to conform to the ICAO format and correspond with the flight identity as entered in the applicable flight plan.

8.1.2 Aircraft type designator includes both Aircraft Type and Sub - type and shall be coded in accordance with the format described in ICAO document 8643 at its latest edition. However, certain ACARS equipment can be pre - programmed only with Aircraft Type with the possibility of manual insertion of Sub - type via the system control panel. Absence of the Sub - type informat ion may lead either to a rejected departure clearance request at some airports, or the issue of an inappropriate clearance where the aircraft performance capability is not taken into account.

Where, to obtain the DCL service, Sub - type needs to be entered m anually, the entry should be verified.

8.2 Operational Safety Aspects 8.2.1 Failure Conditions are presented in ED - 85A (§6) together with the resulting safety requirements and operational means of mitigation. Failure Condition FC3 (undetected erroneous SID ) is discussed further in the following paragraphs.

8.2.2 When a SID construct is simple and unambiguous (e.g. only one SID for one runway magnetic orientation (QFU) and one destination) so allowing the flight crew and the ATS controller to independently d etect any inconsistency in the DCL, then additional means of mitigation are not required.

8.2.3 For other, more complex cases where the SID construction prevents the flight crew and the controller from readily detecting any inconsistency, a specific flight crew to controller procedure will need to be implemented to verify the clearance. This may be stated in the AIP or other notification issued by the State where aircraft will operate and use DCL service.

Note (1): In some countries (e.g. United Kingdom, AI C 125/1999, France AIC A19/00), following the investigation of level violations, voice confirmation of cleared altitude or flight level and SID identification is already required even for voice delivered departure clearance on the first contact with the ap proach control/departure radar. In such cases, no additional confirmation procedure is required.

Note (2): The ATS may agree that voice confirmation is not required where the data link function is certificated with an integrity level corresponding to the E ssential category of CS25.1309.

8.2.4 In all cases, flight crews will need to comply with any mitigating procedures published by the States where aircraft will operate and use DCL service.

8.2.5 The assumptions of Section 5 need to be satisfied as a condit ion for operational use.

Powered by EASA eRules Page 129 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 9 Products, Parts and Appliances (AMC - 20) 8.3 Operations Manual and Training 8.3.1 The Operations Manual shall reflect the Flight Manual statement of paragraph 7.3 and define operating procedures for use of the DCL.

8.3.2 Flight crew training should address: (a) The different data link services available using the same airborne equipment (e.g. differences between DCL and PDC app lications as described in Annex 1); (b) ATS procedures for DCL; and (c) The required format for the flight identification input.

8.3.3 Subject to any arrangements that may be required by the responsible operations authority in respect of amendments to the Operations Manual, and the approval of training programmes, the aircraft operator may implement operations using DCL over ACARS.

8.4 Incident reporting Significant incidents associated with a departure clearance transmitted by data link that affects or could affect the safe operation of the aircraft will need to be reported in accordance with applicable operational rules, and to the authority re sponsible for the airport where the DCL service was provided.

AVAILABILITY OF DOCUMENTS EUROCAE documents may be purchased from EUROCAE, 17 rue Hamelin, 75783 Paris Cedex 16, France, (Fax: 33 1 45 05 72 30). Web site: www.eurocae.org .

JAA documents are available from the JAA publisher Information Handling Services (IHS). Information on prices, where and how to order is available on both the JAA web site www.jaa.nl and the IHS web site www.avdataworks.com .

EUROCONTROL documents may be requested from EUROCONTROL, Documentation Centre, GS4, Rue d e la Fusee, 96, B - 1130 Brussels, Belgium; (Fax: 32 2 729 9109 or web site www.eurocontrol.int ) .

ICAO documents may be purchased from Document Sales Unit, International Civil Aviati on Organisation, 999 University Street, Montreal, Quebec, Canada H3C 5H7, (Fax: 1 514 954 6769, e - mail: sales_unit@icao.org ) or through national agencies.

FAA documents may be obta ined from Department of Transportation, Subsequent Distribution Office SVC - 121.23, Ardmore East Business Centre, 3341 Q 75th Avenue, Landover, MD 20785, USA. Web site www.faa.gov/aviation.htm RTCA documents may be obtained from RTCA Inc, 1828 L Street, NW., Suite 805, Washington, DC 20036, USA., (Tel: 1 202 833 9339; Fax 1 202 833 9434). Web site: www.rtca.org .

SAE documents may be obtained from SAE World Headquarters, 400 Commonwealth Drive, Warrendale, PA 15096 - 0001, USA. Telephone 1 - 877 - 606 - 7323 (U.S. and Canada only) or 724/776 - 4970 (elsewhere). Web site www.sae.org .

[Amdt 20/1] Powered by EASA eRules Page 130 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 9 Products, Parts and Appliances (AMC - 20)

Appendix 1 to AMC 20 - 9 PDC versus DCL: A Comparison

ED Decision 2006/012/R The US Pre - Departure Clearance.

In the United States, the concept of Pre - departure Clearance is used w here PDC messages are delivered via the airlines own ACARS network and operational host computer. The airline host, or the flight crew, initiates the process for the generation of the PDC by submitting the flight plan information to the air traffic service , which in turn forwards the flight strip information to the appropriate airport control tower. Approximately 30 minutes before the aircraft is scheduled to depart, the approved PDC is transmitted from the tower via ground - ground data link to the airline h ost computer. The airline host responds with an acknowledgement that ultimately feeds back to the tower PDC workstation.

Depending upon the airline capabilities, the PDC may then be transmitted directly to the aircraft flight deck via the ACARS data link. If the aircraft is not equipped with ACARS, the approved PDC is sent to an airport gate printer for delivery by hand in printed format to the aircraft. For a clearance requested from the aircraft, the flight crew will initiate a PDC request via the ACARS d ata link network to the airline host computer. The host will then respond via the ACARS network with the approved PDC.

Thus, the airline is responsible for ensuring that the clearance is delivered to the flight crew. Without PDC, Instrument Flight Rule (IF R) clearances for departing aircraft are provided by the clearance - delivery controller via a tower voice channel.

The PDC is pre - formatted in an ARINC 620 free text message. The ARINC 623 standard also may be used but it is not required. All failures are classified Minor by the fact that flight crew has to follow a procedure to verify the information with the initial flight plan and, by voice communication, with departure control.

Guidance on the use of PDC may be found in FAA document Safety and Interoperability Requirements for Pre - Departure Clearance , issued by AIR - 100 on April 21, 1998.

The European Departure Clear ance.

In Europe, departure clearance over ACARS is a direct ATC to pilot data link communication based on the EUROCAE ED - 85A and ARINC 623 standards. The clearance delivered by data link is fully considered as an ATC departure clearance and it is not the r esponsibility of the airline to ensure delivery via its own facilities. ARINC 623 provides enhanced integrity of end - to - end communication, compared to ARINC 620 as used in the USA. However, flight crew verification procedures may still be required due to d eparture clearance options such as alternative SIDs, or to satisfy AIP require ments for local safety reasons.

Current operational implementation in Europe does not include a re - issued clearance capability, which is under study by some ATS providers.

[Amdt 20/1] Powered by EASA eRules Page 131 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 9 Products, Parts and Appliances (AMC - 20)

Appendix 2 to AMC 20 - 9 Common Terms

ED Decision 2006/ 0 12/R Reference should be made to EUROCAE document ED - 85A for definition of terms.

Abbreviations ACARS Aircraft Communication, Addressing and Reporting System AIP Aeronautical I nformation Publication ARINC Aeronautical Radio Inc.

ATS Air Traffic Services CPDLC Controller - Pilot Data Link Communication DCL Departure Clearance ESARR EUROCONTROL Safety Regulatory Requirement EUROCAE European Organisation for Civil Aircraft Equipment PDC Pre - departure Clearance (as used in USA) PTR Performance Technical Requirement RTCA RTCA Inc.

SAE Society of Automotive Engineers SARPS ICAO Standards and Recommended Practices SID Standard Instrument Departure VDL VHF Digital Link [Amdt 20/1] Powered by EASA eRules Page 132 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPAR T A — GENERAL of Compliance for Airworthiness of AMC 20 - 10 Products, Parts and Appliances (AMC - 20)

AMC 20 - 10

AMC 20 - 10 Acceptable Means of Compliance for the Approval of

Digital ATIS via Data Link over ACARS

ED Decision 2006/ 0 12/R 1 PREAMBLE 1.1 This AMC is issued in response to the EUROCONTROL Convergence and Implementation Plan that recommends an interim deployment of air - to - ground and ground - to - air data link applications based on the existing airline ACARS technology. One such application is Digital Automated Terminal Information Services (D - ATIS) now planned to be operational at various airports in Europe . Aircraft operators, on a voluntary basis, may take advantage of D - ATIS where it is available, provided the service is verified in accordance with operational procedures acceptable to the responsible operati ons authority.

1.2 The use of ACARS for data link purposes is a transitional step to data link applications that will use VHF Digital Link (VDL) Mode 2 and the Aeronautical Telecommunications Network (ATN), compliant with ICAO SARPS, as proposed in the EUR OCONTROL LINK2000+ programme .

1.3 Described in EUROCAE document ED - 89A, Data Link Application System document (DLASD) for the “ATIS” Data Link Service , D - ATIS is a control tower application providing direct communication of ATIS information to the flight crew and, optionally automatic updating of this information. The ED - 89A document addresses three domains: airborne, ground ATC, and communication service providers. It deals also with associated flight crew and air traffic service provider procedure s. ED - 89A incorporates the protocols and message formats formerly published in ARINC Specification 623, and takes account of EUROCAE document ED - 78 which describes the global processes including approval planning, co - ordinated requirements determination, d evelopment and qualification of a system element, entry into service, and operations.

2. PURPOSE 2.1 This AMC is intended for operators intending to use Digital ATIS over ACARS as described in document EUROCAE ED - 89A. It may assist also other stakeholders such as airspace planners, air traffic service providers (ATSP), ATS system manufacturers, communication service providers (CSP), aircraft and equipment manufacturers, and ATS regulatory authorities to advise them of the airborne requirements and procedur es, and the related assumptions.

2.2 This AMC provides a method for evaluating compliance of a data link system to the requirements of ED - 89A, and the means by which an aircraft operator can satisfy an authority that operational considerations have been ad dressed.

3 SCOPE 3.1 This AMC addresses D - ATIS over ACARS using the ARINC 623 protocol as elaborated in EUROCAE document ED - 89A and promoted by the EUROCONTROL Convergence and Implementation Plan as an interim data link application pending maturit y of the LINK 2000+ programme.

Information on LINK2000+ is available at web site www.eurocontrol.int/link2000 Powered by EASA eRules Page 133 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 10 Products, Parts and Appliances (AMC - 20) 3.2 Other implementation of D - ATIS service may exist in the world. They are not necessarily identical to the service defined within this AMC and EUROCAE document ED - 89A. For example, application message formats may differ. Similarly, the ATSP may send ATIS information to an ACARS communication service provider who then distributes it to subscriber operators. This should not be considered as an air traffic service offered directly by an ATSP. In the USA, guidance on ATIS data link appro val for use in the US airspace, may be found in FAA document 98 - AIR D - ATIS: Safety and Interoperability Requirements for ATIS .

3.3 This AMC is not applicable to the phased implementation of data link services within the EUROCONTROL LINK2000+ programme, in particular, D - ATIS over the Aeronautical Telecommunications Network via VHF Digital Link (VDL) Mode 2. In this case, the Safety and Performance Requirements (EUROCAE ED - 120) and the Interoperability Requirements (EUROCAE ED - 110) have been established using EUROCAE document ED - 78A, Guidelines for Approval of the Provision and use of Air Traffic Services supported by Data Communications . Guidance for the implementation of data link over ATN may be found in EASA document AMC 20 - 11.

3.4 The operational requirem ents for the D - ATIS application are published in EUROCONTROL document OPR/ET1/ST05/1000, Transition guidelines for initial air ground data communication services .

3.5 For the remainder of this document, the acronym D - ATIS should be interpreted to mean D - A TIS over ACARS using the ARINC 623 protocol in accordance with ED - 89A unless stated otherwise.

4 REFERENCE DOCUMENTS 4.1 Related Requirements CS/FAR 25.1301, 25.1307, 25.1309, 25.1322, 25.1431, 25.1581, or equivalent requirements of CS 23, 27 and 29, if ap plicable.

4.2 Related Standards and Guidance Material ICAO Doc 9694 AN/955 Manual of Air Traffic Services (ATS) Data Link Applications Doc 4444 Rules of the Air and Air Traffic Services Annex 11 Air Traffic Services Doc 8585 Designators for Aircraft Operating agencies, Aeronautical Authorities and Services.

EASA AMC 25 - 11 Electronic Display Systems EUROCONTROL CIP: COM. Implement Air/Ground Communication Services - ET2.SO4; 2.1.5 Interim step on non - ATN (ACARS) services.

OPR/ET1/ST05/1000 Transition guidelines for initial air ground data communication services ESARR 4 Risk assessment and mitigation in ATM FAA AC 25 - 11 Electronic Display Systems.

AC 120 - 70 Initial Air Carrier Operational Approval for use of Digital Communication Systems AC 20 - 140 Guidelines for design approval of aircraft data communications systems 98 - Air - D - ATIS Safety and Interoperability requirement for D - ATIS (Air - 100, April 21,1998) Powered by EASA eRules Page 134 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 10 Products, Parts and Appliances (AMC - 20) EUROCAE ED 78 Guidance material for the establishment of data link supported ATS Services ED - 89A Data Link Application System document (DLASD) for the “ATIS” data link service ED - 92A Minimum Operational Performance specification for an airborne VDL Mode 2 Transceiver ED - 112 Minimum operational performance specification for Crash protected airborne recorder systems Note: Includes criteria for recording of data link messages.

RTCA DO - 224 Minimum Aviation System Performance Standards (MASPS) for Advanced VHF Digital Data Communications Including Compatibility with Digital Voice Techniques.

SAE ARP 4791 Human Machine Interface on the flight deck 5 ASSUMPTIONS Applicants should note that this AMC is based on the assumptions stated in Chapter 3 of document ED - 89A together with the following that concern the measures taken by the responsible airspace authorities to safeguard operations affected by the transmission of D - ATIS.

5.1 ATS Provider 5.1.1 The data link service for ATIS has been shown to satisfy applicable airspace safety reg ulations and the relevant ATS domain performance, safety and interoperability requirements of ED - 89A.

5.1.2 The ATS Provider ensures that information provided through D - ATIS service is fully consistent with the voice information broadcast over VHF.

5.1.3 Appropriate procedures are established to minimise the possibility of failure to detect any inconsistency in ATIS information for approach, landing and take off.

5.1.4 Each ATS provider has published a list of communication service providers that may be us ed by aircraft operators for the D - ATIS application. The list should take account of internetworking arrangements between service providers.

5.1.5 The procedures of the ATS provider state the actions that should be taken in the event of an inadequate comm unication service from the communications service provider.

5.2 Communications Service Provider The communications service provider does not modify the operational information (content and format) exchanged between the ATS provider and the airborne equipment.

5.3 Aeronautical Information Service The availability of the D - ATIS service, a statement of compliance with ED - 89A, and additional relevant procedures are published in the AIP or other notification issued by the States where D - ATIS is offered.

5.4 Message Integrity The Cyclic Redundancy Check (CRC) is implemented as required by ED - 89A and is providing integrity of the end - to - end data link transmission path. On this basis, Performance Technical Objective PTO_3 of ED - 89A need no t be demonstrated by end Powered by EASA eRules Page 135 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 10 Products, Parts and Appliances (AMC - 20) systems. The PTO_3 requirement is applicable only to the Communication Service Provider and limits the amount of corrupted messages that would be detected and rejected by end - systems.

Note: The CRC is described in ARINC Specificati on 622 Chapter 5.

6 AIRWORTHINESS CONSIDERATIONS 6.1 General 6.1.1 The installation will need to meet the airborne domain requirements allocated as per ED - 89A (§7.1) covering the Interoperability Operational Requirements, the Interoperability Technical Re quirements, the Performance Technical Requirements, and the Safety Operational & Technical Requirements.

6.1.2 If multiple ATS data link applications are available to the aircraft, the crew interface and related crew procedures will need to be based on a c ommon and compatible philosophy.

6.2 Required Functions An acceptable minimum airborne installation comprises the following functions: (a) A means of data communication appropriate to the area of operation, e.g. plain old ACARS over AVLC (Aviation VHF Link Control) through VHF or SATCOM; Note: VDL Mode 2 equipment can be used provided that radio transceiver is compliant with ED - 92A.

(b) A means to manage data communications and to control the data communications system.

(c) A means to easily check and mod ify the D - ATIS request parameters.

(d) A means of attracting the attention of the flight crew to an incoming message.

Notes: (1) Activation of a printer may suffice to meet this need.

(2) The means used will need to be such as to avoid confusion with o ther, non - data link, flight deck alerting devices.

(3) The need for temporary suppression of the attention - getter during critical flight phases should be considered.

(e) Means to display the text message, e.g. a single display readable by both pilots or a dedicated display for each pilot. For the interim deployment of D - ATIS over ACARS, a printer may serve as the primary display for messages subject to compliance with paragraph 7.3 of this AMC.

6.3 Recommended Functions (a) A means to print the message.

( b) Recording of D - ATIS messages and flight crew requests on an accident flight recorder.

Note: Data Link recording may be required in accordance with OPS rules.

Powered by EASA eRules Page 136 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 10 Products, Parts and Appliances (AMC - 20) 7 ACCEPTABLE MEANS OF AIRWORTHINESS COMPLIANCE 7.1 Airworthiness 7.1.1 When demonstrating compliance with this AMC, the following should be noted: (a) Compliance with the airworthiness requirements for intended function and safety may be demonstrated by equipment qualification, safety analyses of the interfaces between components of the airborne communications equipment, structural analyses of new antenna installations, equipment cooling verification, and evidence of a suitable human to machine interface.

The D - ATIS function will need to be demonstrated by end - to - end ground testing that verifies system operation, either with an appropriate ATS unit, or by means of test equipment that has been shown to be representative of an actual ATS unit.

Note: This limited testing assumes that the communication systems (VHF or SATCOM) have been shown to satisfactorily perform their intended functions in the flight environment in accordance with applicable requirements.

(b) The safety analysis of the interface between the ACARS and other systems should show that, under normal or fault conditions, no unwanted interaction that adversely affects essential systems can occur.

(c) Where a printer is used as the primary display of the ATIS message, its readability should be shown to be adequate for this purpose, and that it does not present an unacceptab le risk of an erroneous display.

Note: This does not preclude the use of a printer classified as non - essential provided it has demonstrated a satisfactory in - service record that supports compliance with paragraph 7.3 of this AMC.

7.1.2 To minimise the certification effort for follow - on installations, the applicant may claim credit, from the responsible authority, for applicab le certification and test data obtained from equivalent aircraft installations.

7.2 Performance The installation will need to be shown compliant with the airborne domain performance requirements allocated by ED - 89A (§7.1). Demonstration of Performance Te chnical Requirement PTR_A1 may be difficult for some airborne installations. The applicant may choose an alternative acceptable means of compliance for PTR_A1 consisting in an end - to - end demonstration of PTR_5 & PTR_6 of ED - 89A (§5.2) with an appropriate A TS unit and communication service provider.

7.3 Safety Objectives 7.3.1 Failure Conditions are presented in ED - 89A (§6) together with the resulting safety objectives and operational means of mitigation. Failure Condition FC3 (Non - detected corrupted ATIS pr esented to an aircrew) requires that the occurrence of such a hazard at the aircraft level be demonstrated improbable.

Powered by EASA eRules Page 137 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 10 Products, Parts and Appliances (AMC - 20) 7.3.2 ED - 89A takes into account the possibility of using ACARS approved to earlier standards and classified as “non - essential” without gu arantees of performance or integrity. Consequently, additional procedures are necessary to compensate for any deficiency and to safeguard operations. (See §8 of this AMC) 7.4 Aircraft Flight Manual The Aircraft Flight Manual (AFM) or the Pilot’s Operating Handbook (POH), whichever is applicable, should identify the D - ATIS over ACARS application as having been demonstrated with data link services declared compliant with EUROCAE document ED - 89A.

If certification was not achieved at the level “essential”, the AFM or POH, whichever is applicable,shall remind the crew that they are responsible for checking the D - ATIS information received over ACARS is consistent with their request, or revert to a voice ATIS.

7.5 Existing installations The applicant will need to submit a compliance statement that shows how the criteria of this AMC have been satisfied for existing installations. Compliance may be established by inspection of the installed system to confirm the availability of required features and functionality.

Note: It is not intended that aircraft which have received airworthiness approval in compliance with ED 89 requirement should be reinvestig ated where the installation is compliant with Section 6, 7 and 8 of this AMC.

8 OPERATIONAL CONSIDERATIONS 8.1 Operat ional Safety Aspects 8.1.1 Failure Conditions are presented in ED - 89A (§6) together with the resulting safety requirements and operational means of mitigation. Failure Condition FC3 (Non - detected corrupted ATIS presented to an aircrew) is discussed further in the following paragraphs.

8.1.2 Applying existing ICAO operational procedures can independently verify the majority of ATIS parameters. Certain information may need to be verified by additional operational procedures. Examples include runway surface conditions, air and dew point temperatures, and other essential operational information.

8.1.3 If the aircraft system is classified and certified as “non - essential”, additional flight crew verification procedures will need to be defined to c ompensate for this deficiency.

8.1.4 When the airborne system is certified as “essential”, then integrity and performance can be considered as acceptable without a voice ATIS cross check unless otherwise required by the AIP.

8.1.5 It is important that cr ew are aware that they remain responsible for checking that received ATIS information corresponds to their request in terms of airfield name, date, type of ATIS (D or A) and type of contract. In case of inconsistency, reversion to voice ATIS is required.

N ote: ED - 89A (§6) SOR - A1 (check of name of airfield), SOR - A2 (ATIS letter acknowledgement at first contact) and SOR - A3 (check of global consistency of Powered by EASA eRules Page 138 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 10 Products, Parts and Appliances (AMC - 20) information) require checks irrespective of the level of classification of the data link system 8.1.6 Flig ht crews will need to comply with any additional mitigating procedures published by the States where aircraft will operate and use a D - ATIS service.

8.1.7 The assumptions of Section 5 of this AMC need to be satisfied as a condition for operational use.

8.2 Operations Manual and Training 8.2.1 The Operations Manual shall reflect the Flight Manual statement of paragraph 7.4, and to define operating procedures for the use of D - ATIS via ACARS taking into account the Operational Considerations discussed in parag raph 8 of this AMC.

8.2.2 Similarly, flight crew training shall address: (a) The different data link services available using the same airborne equipment (e.g. differences between ATIS provided through D - ATIS service that are declared to conform to ED - 89A requirements, and ATIS received through other means such as ACARS AOC).

(b) The procedures for safe use of D - ATIS over ACARS.

8.2.3 Subject to any arrangements that may be required by the responsible operations authority in respect of amendments to the O perations Manual, and the approval of training programmes, the aircraft operator may implement operations using D - ATIS over ACARS without the need for further formal operational approval.

8.3 Incident reporting Significant incidents associated with a D - AT IS transmitted by data link that affects or could affect the safe operation of the aircraft will need to be reported in accordance with applicable operational rules. The incident should be reported also to the ATS authority responsible for the airport wher e the D - ATIS service is provided.

AVAILABILITY OF DOCUMENTS EUROCAE documents may be purchased from EUROCAE, 17 rue Hamelin, 75783 Paris Cedex 16, France, (Fax: 33 1 45 05 72 30). Web site: www.eurocae.org JAA documents are available from the JAA publisher Information Handling Services (IHS). Information on prices, where and how to order is available on both the JAA web site: www.jaa.nl and the IHS web site: www.avdataworks.com . JAA documents transposed to publications of the European Aviation Safety Agency (EASA) are available on the EASA web site ww w.easa.eu.int EUROCONTROL documents may be requested from EUROCONTROL, Documentation Centre, GS4, Rue de la Fusee, 96, B - 1130 Brussels, Belgium; (Fax: 32 2 729 9109). Web site: ww w.eurocontrol.int ICAO documents may be purchased from Document Sales Unit, International Civil Aviation Organisation, 999 University Street, Montreal, Quebec, Canada H3C 5H7, (Fax: 1 514 954 6769, e - mail: sales_unit@icao.org ) or through national agencies.

FAA documents may be obtained from Department of Transportation, Subsequent Distribution Office th SVC - 121.23, Ardmore East Business Centre, 3341 Q 75 Avenue, Landover, MD 20785, USA .

RTCA documents may be obtained from RTCA Inc, 1828 L Street, NW. Suite 805, Washington, DC 20036, USA., (Tel: 1 202 833 9339; Fax 1 202 833 9434). Web site: www.rtca.org Powered by EASA eRules Page 139 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 10 Products, Parts and Appliances (AMC - 20) SAE documents may be obtained from SAE World Headquarters, 400 Commonwealth Drive, Warrendale, PA 15096 - 0001, USA . Telephone 1 - 877 - 606 - 7323 (U.S. and Canada only) or 724/776 - 4970 (elsewhere). Web site: www.sae.org [Amdt 20/1]

Appendix 1 to AMC 20 - 10 Common Terms

ED Decision 2006/ 0 12/R Reference should be made to EUROCAE document ED - 89A for definition of terms.

Abbreviations ACARS Aircraft Communication, Addressing and Reporting System AIP Aeronautical Information Publication ATIS Automatic Terminal Information Service ATSP Air Traffic Service Provider D - ATIS Digital ATIS ARINC Aeronautical Radio Inc.

ATS Air Traffic services CPDLC Controller - Pilot Data Link Communication ESARR EUROCONTROL Safety Regulatory Requirement EUROCAE European Organisation for Civil Aircraft Equipment NAS National Airspace System (USA) PTR Performance Technical Requirement PTO Performance Technical Objective RTCA RTCA Inc.

SAE Society of Automotive Engineers SARPS ICAO Standards and Recommended Practices VDL VHF Digital Link [Amdt 20/1] Powered by EASA eRules Page 140 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 15 Products, Parts and Appliances (AMC - 20)

AMC 20 - 15

AMC 20 - 15 Airworthiness Certification Considerations for the

Airborne Collision Avoidance System (ACAS II) with optional Hyb rid

Surveillance

ED Decision 2011/001/R 1 PREAMBLE This Acceptable Means of Compliance (AMC) provides a means that can be used to obtain an airworthiness approval for the installation of ACAS II equipment which may include optional hybrid surveillance. It is issued to support the operational requirement th at requires the carriage of ACAS II.

Hybrid Surveillance is an optional feature that allows ACAS II to use a combination of active surveillance, i.e. actively interrogating the Mode - S Transponders of surrounding aircraft, and passive surveillance, i.e. us e of ADS - B position and altitude data (extended squitter), to update an ACAS II track.

An applicant may elect to use an alternative means of compliance. However, those alternative means of compliance must meet the relevant requirements and ensure a safety objectives as defined in paragraph 5 are met. Compliance with this AMC is not mandatory .

2 RELEVANT REQUIREMENTS The provisions to which this AMC applies are: CS 25.1301, 1302, 1309, 1322, 1333, 1431, 1459, 1529 and 1581.

CS 23.1301, 1309, 1322, 1431, 1459, 1529 and 1581.

CS 27.1301, 1309, 1322, 1459, 1529 and 1581 CS 29.1301, 1309, 13 22, 1333, 1431, 1459, 1529 and 1581 3 REFERENCE MATERIAL EU OPS 1.160, 1.668, 1.1045, 1.398 AMC 25.1302, AMC 25.1309, AMC 25.1322 and AMC 25 - 11.

ETSO - C113 Airborne Multipurpose Electronic Displays ETSO - C119c Traffic Alert and Collision Avoidance S ystem (TCAS) Airborne Equipment, TCAS II.

ETSO - 2C112() Air Traffic Control Radar Beacon System/Mode Select (ATCRBS/Mode S) Airborne Equipment EUROCAE ED - 143 including change 1 Minimum Operational Performance Standards for Traffic Alert and Collision Avoi dance Systems (TCAS) Airborne Equipment.

EUROCAE ED - 112 Minimum Operational Performance Specification for Crash Protected Airborne Recorder Systems Council Regulation (EEC) No 3922/91 on the harmonisation of technical requirements and administrative procedures in the field of civil aviation. Regulation as last amended by Regulation (EC) No 1899/2006 of the Europe an Parliament and of the Council of 12 December 2006 (OJ L 377, 27.12.2006, p. 1).

Powered by EASA eRules Page 141 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GE NERAL of Compliance for Airworthiness of AMC 20 - 15 Products, Parts and Appliances (AMC - 20) RTCA DO - 300 including change 1 Minimum Operational Performance Standards (MOPS) for Traffic Alert and Collis ion Avoidance System II (TCAS II) Hybrid surveillance.

4 MINIMUM EQUIPMENT QUALIFICATION 4.1 An acceptable minimum certification standard for the ACAS II equipment including optional hybrid surveillance is EASA ETSO - C119c.

4.2 An acceptable minimum certification standard for the associated Mode S transponder is EASA ETSO - 2C112().

5 SAFETY OBJECTIVES The applicant should perform a Functional Hazard Assessment (FHA) and System Safety Assessment (SSA) for the proposed ACAS II installation. For the purposes of this AMC, a system includes all airborne devices contributing to the ACAS II function. Guidance is provided in AMC 25.1309 or FAA AC 23 - 1309 - 1() or AC 27 - 1B or AC 29 - 2C. Acceptable probability levels for functionality and alerts are given below: 5.1 The probability of failure of the installed system to perform its intended function from a - 3 reliability and availability perspective should be shown to be no greater than 1 x 10 per flight hour.

5.2 The probability of failure of the system to provide the required RA aural or visual alert, - 4 when required, without a failure indication should be shown to be no greater than 1 x 10 - 5 per flight hour in the terminal environment and 1 x 10 per flight hour in the en - route environment. See note 1.

5.3 The probability of a false or misleading RA aural and visual alert due to a failure of the - 4 system should be shown to be no greater than 1 x 10 per flight hour in the terminal - 5 environment and 1 x 10 per flight hour in the en - route environment. See note 1.

Note: The definition of a ‘misleading alert’ is when an RA condition exists, and an RA is issued, but the RA gives incorrect guidance. The definition of a ‘false alert’ is when an RA is issued, but an RA condition does not exist.

5.4 Failure of the installed ACAS II must not degrade the integrity of any essential or critical system which has an interface with the ACAS II.

The use of Hybrid Surveillance including transitions from active to passive surveillance and vice versa, using a system t hat complies with the requirements of RTCA DO - 300 including Change 1, is assumed not to compromise the safety of ACAS II.

Note 1: In terminal airspace the frequency of encounters, where another aircraft could be present, may be assumed to be once every 10 hours. In en - route airspace the frequency of encounters, where another aircraft could be present, may be assumed to be once every 200 hours. Different frequencies may be used if supported by operational data.

6 HARDWARE AND INSTALLATION 6.1 General Consid erations: The installation should include as a minimum a single ACAS II system and a single Mode S Transponder that meet the requirements of paragraph 4.

Powered by EASA eRules Page 142 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 15 Products, Parts and Appliances (AMC - 20) 6.2 Aural Alerts: (a) TA and RA aural alerts should be presented by the prescribed voice announcements via flight deck loudspeakers.

(b) Consideration should be given to presenting ACAS II voice announcements via headsets at a preset level.

(c) A means for the pilot to cancel active voice announcements and visual indicators is permitted but s hould not be necessary where voice announcements have a specific duration.

(d) The ACAS II voice announcements should be consistent with the general philosophy of other flight deck aural alerting systems. In particular, the prioritisation and compatibilit y of alerts and voice announcements from different warning systems should be consistent with each other. The alert priorities should be wind shear, TAWS and then ACAS II. Altitude callout advisories which occur simultaneously with ACAS II advisories are pe rmitted, but the audibility of each voice alert will need to be understandable.

(e) The adequacy of aural levels will need to be demonstrated.

Note: For rotorcraft, TA and RA aural alerts should be presented via headsets at a preset level 6.3 Displays & Indications (a) Warning and Caution alerts should comply with the guidance provided in AMC 25.1322 unless otherwise stated in this AMC.

(b) The display of Traffic and Resolution Advisory information should be consistent with the guidance provided in AMC 25.1322 and with paragraph 5.4 of AMC 25.1302.

(c) Resolution Advisory guidance should be presented at each pilot station in the pilot’s primary field of view.

Resolution Advisories may be presented on EFIS or IVSI displays provided their primary functions are not compromised.

(d) A discrete red warning Resolution Advisory enunciator or an Instantaneous Vertical Speed Indicator (IVSI) with a lighted red indication or Primary Flight Display (PFD) with a lighted red indication or an electronic attit ude display with an alphanumeric message should be located in each pilot’s primary field of view.

(e) A means to display traffic information to each flight crew member should be provided. Traffic information may be provided on weather radar (WXR), Electro nic Flight Instrument System (EFIS), Instantaneous Vertical Speed Indicator (IVSI) or other compatible display screen which has been demonstrated to meet the guidance of AMC 25 - 11, provided their primary functions are not compromised. A separate dedicated traffic display, readily visible to both pilots, is an acceptable alternative. In case a Multi Function Display is used, the display should meet the requirements of ETSO - C113.

(f) Discrete TA caution lights are optional.

(g) ACAS II Resolution and Traffi c Advisories which trigger the Master Warning System will not be accepted.

Powered by EASA eRules Page 143 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 15 Products, Parts and Appliances (AMC - 20) (h) An indication of ACAS II system and sensor failures which prevents correct operation should be provided.

(i) An indication that the ACAS II system is operating in TA mode shou ld be provided.

(j) ACAS II should be automatically switched to TA mode, if ACAS II and wind shear voice or ACAS II and TAWS voice announcements occur simultaneously.

(k) The adequacy of display visibility needs to be demonstrated.

(l) The flight crew s hould be aware, at all times, of the ope rational state of the ACAS II system. Any change of the operational state of the ACAS II system is to be enunciated to the flight crew via suitable means.

6.4 ACAS II Controls: (a) Control of the ACAS II should be readily accessible to the flight crew.

(b) A means to initiate the ACAS II Self Test function should be provided.

6.5 Antennas: (a) Either a directional antenna and an omni - directional antenna, or two directional antennas may be installed.

Note: when in stalling a directional antenna and an omni - directional antenna the omni - directional antenna should be the lower antenna.

(b) The physical locations of the transponder antennas and the ACAS II antennas will need to satisfy isolation and longitudinal separation limits. The physical location should also ensure that propellers or rotors do not interfere with system operation, if applicable. ACAS II antennas may be installed with an angular offset from the aircraft centreline not exceeding 5 degrees.

6.6 Interfaces: (a) Pressure altitude information will need to be obtained from the same sensor source that supplies the Mode S Transponder(s) and the flight deck altitude display(s). This source should be the most accurate source available on t he aircraft.

Altitude information should be provided via a digital data bus. ICAO Gray (Gillham) code should not be used.

(b) An interface to a radio altimeter sensor should be provided.

(c) Inhibit logic selected for input to the ACAS II to take account of the aircraft performance limitations will need to be evaluated and justified unless accepted for an earlier ACAS II standard.

(d) Other interfacing for discrete data should be provided, as required.

(e) The ACAS II installation should provide an inte rface with the flight recorder(s).

(f) Recording of ACAS II data should be accomplished in accordance with EUROCAE ED - 112.

Note: Information necessary to retrieve and convert the stored data into engineering units should be provided.

(g) Interfaces betwe en systems should be analysed to show no unwanted interaction under normal or fault conditions.

Powered by EASA eRules Page 144 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 15 Products, Parts and Appliances (AMC - 20) 7 CERTIFICATION TESTING Ground testing will need to be performed with due consideration of the possible risk of nuisance advisories in operating aircraft. The precautions provided in Appendix 1 should be followed.

7.1 The bulk of testing for a modification to install ACAS II can be achieved by ground testing that verifies system operation and interfaces with aircraft systems.

7.2 The ground tests should include: (a) verification check of the ICAO 24 bit airframe address.; (b) bearing accuracy check of intruder. A maximum error of ± 15 degrees in azimuth should be demonstrated for each quadrant. Larger errors may be acceptable in the tail area of the aircraft; (c) failure of sensors which are interfaced to ACAS II. A test should be performed to ensure that the effect on ACAS II agrees with the predicted results; (d) correct warning prioritisation. The alert priorities should be wind shear, TAWS and then ACAS II; (e) electromagnetic interference evaluation to ensure that ACAS II does not cause interference with other aircraft systems; (f) the correct operation of any aircraft configurations which result in, by design, the inhibition of RAs.

7.3 Flight testing of an initial installat ion should evaluate overall operation including: (a) surveillance range; Note: Surveillance range may vary depending on airspace conditions.

(b) target azimuth reasonableness.

(c) freedom from unwanted interference; (d) assessment, during adverse fligh t conditions, of instrument visibility, display lighting, sound levels and intelligibility of aural messages; (e) the effects of electrical transients; (f) validity and usability of Traffic information when the aircraft is subject to attitude changes of ± 15 degrees in pitch and ± 30 degrees in roll; (g) the correct operation of any aircraft configurations which result in, by design, the inhibition of RAs; Note: these tests may be considered to be a subset of the ground tests performed in paragraph 7.2 ( f). Only those aircraft configurations which are practical to perform in an airborne environment need to be assessed.

(h) electromagnetic interference evaluation to ensure that ACAS II does not cause interference with other aircraft systems.

7.4 Flight t esting to demonstrate RA performance in a planned encounter between aircraft will not normally be required for an ACAS II – Mode S equipment combination, previously demonstrated as performing correctly. Planned encounter flight testing should not be attemp ted without the agreement of the Agency.

Powered by EASA eRules Page 145 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 15 Products, Parts and Appliances (AMC - 20) 7.5 To minimise the certification effort for ACAS II for additional aircraft types listed in the type certificate, the applicant may claim credit, for applicable certification and flight test data obtained from equ ivalent aircraft installations, including testing performed for ACAS II version 6.04A or 7.0. Flight Testing of ACAS II will not normally be required where acceptable evidence exists relating to the previous certification standard of ACAS II. This assumes the introduction ACAS II involves equipment replacements only.

7.6 Equipment that meets the acceptable minimum certification standard for the ACAS II equipment (see paragraph 4.1) has demonstrated that hybrid surveillance function does not degrade the per formance of the ACAS II active surveillance. Therefore, when the optional hybrid surveillance function is enabled, specific installation testing of this function is not required.

8 MAINTENANCE The Instructions for Continued Airworthiness (ICA) should include the following: 8.1 Maintenance instructions for on aircraft ACAS II testing including the precautions of Appendix 1 .

8.2 Maintenance instructions for the removal a nd installation of any directional antenna should include instructions to verify the correct display of ACAS II traffic in all four quadrants.

9 AIRCRAFT FLIGHT MANUAL/PILOT OPERATING HANDBOOK The Aircraft Flight Manual (AFM) or the Pilots Operating Handb ook (POH) should provide at least the following limited set of information. This limited set assumes that a detailed description of the installed system and related operating instructions are available in other operating or training manuals.

Note: Aircraft malfunctions which would prevent the aircraft from following ACAS II climb indication, and which do not automatically inhibit the ACAS II climb indication, should be addressed (e.g. as a cautionary note) in the AFM/POH.

9.1 Limitations Section: The follo wing Limitations should to be included: (a) Deviation from the ATC assigned altitude is authorised only to the extent necessary to comply with an ACAS II Resolution Advisory (RA).

9.2 Emergency Procedures Section: none.

9.3 Normal Procedures Section: The ACAS II flight procedures should address the following: (a) For a non - crossing RA, to avoid negating the effectiveness of a coordinated manoeuvre by the intruder aircraft, advice that vertical speed should be accurately adjusted to comply wit h the RA.

(b) Non - compliance by one aircraft can result in reduced vertical separation with the need to achieve safe horizontal separation by visual means.

(c) A caution that under certain conditions, indicated manoeuvres may significantly reduce stall m argins with the need to respect the stall warnings.

(d) Advice that evasive manoeuvring should be limited to the minimum required to comply with the RA.

(e) When a Climb RA is given with the aircraft in landing configuration, a normal go - around procedure should be initiated.

Powered by EASA eRules Page 146 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 15 Products, Parts and Appliances (AMC - 20) 10 AVAILABILITY OF DOCUMENTS EASA documents may be obtained from EASA (European Aviation Safety Agency), 101253, D50452 Koln Germany or via the Website: http://www.ea sa.europa.eu/ws_prod/g/rg_certspecs.php .

EUROCAE documents may be purchased from EUROCAE, 102 rue Etienne Dolet, 92240 Malakoff, France, (Fax: +33 1 46 55 62 65), or website: www.euro cae.net .

RTCA documents may be obtained from RTCA Inc, 1828 L Street, NW., Suite 805, Washington, DC 20036, USA, (Tel.: +1 202 833 9339; Fax: +1 202 833 9434). Website: www.rtca.org .

FAA documents may be obtained from Superintendent of Documents, Government Printing Office, Washington DC, 20402 - 9325, USA. Website: www.faa.gov .

Appendix 1 to AMC 20 - 15 – ACAS II/Mode S Transponder Ground

Testing Precautions

ED Decision 2011/001/R Transponder/ACAS II system testing is a known source of ‘nuisance’ ACAS II warnings. The following information provides guidance which should be followed to minim ise this risk: — When not required, ensure all transponders are selected to ‘OFF’ or ‘Standby’.

— Before starting any test, contact the local Air Navigation Service Provider (ANSP) or Air Traffic Service (ATS) and advise them of your intention to conduct transponder testing. Advise of your start time and test duration. Also inform them of the altitude(s) at which you will be testing, your intended Aircraft Identification (Flight Id) and your intended Mode A code.

— Set the Mode A code to 7776 (or other Mode A code agreed with Air Traffic Control Unit).

Note: The Mode A code 7776 is assigned as a test code by the ORCAM Users Group, specifically for the testing of transponders.

— Set the Aircraft Identification (Flight Id) with the first 8 characters o f the company name. This is the name of the company conducting the tests.

— Where possible, perform the testing inside a hangar to take advantage of any shielding properties it may provide.

— As a precaution, where practicable, use antenna transmission covers whether or not testing is performed inside or outside.

— When testing the altitude (Mode C or S) parameter, radiate directly into the ramp test set via the prescribed attenuator.

— In between testing, i.e. to transition from one altitude to another, select the transponder to ‘standby’ mode.

— If testing transponder/ACAS II system parameters that do not requir e ‘altitude’, set altitude to – 1000 feet (minus 1000 feet) or greater than 60,000 feet. This will minimise the possibility of ACAS II warning to airfield an d over flying aircraft.

— When testing is complete select the transponder(s) to ‘OFF’ or ‘Standby’.

Powered by EASA eRules Page 147 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 15 Products, Parts and Appliances (AMC - 20)

Appendix 2 to AMC 20 - 15 – List of Acronyms

ED Decision 2011/001/R ACAS Airborne Collision Avoidance System AMC Acceptable Means of Compliance ANSP Air Navigation Service Provider ATC Air Traffic Control ATCRBS Air Traffic Control Radar Beacon System ATS Air Traffic Service CS Certification Specifications EASA European Aviation Safety Agency EFIS Electronic Flight Instrument System ETSO European Technical Standard Order EU European Union EUROCAE European Organisation for Civil Aviation Equipment FHA Failure Hazard Analysis ICA Instructions for Continued Airworthiness ICAO International Civil Aviation Organization IVSI Instantaneous Vertical Speed Indicator MEL Minimum Equipment List ORCAM Originating Region Code Allocation Method RA Resolution Advisory SSA System Safety Assessment TA Traffic Advisory TCAS Traffic Alert and Collision Avoidance System WXR Weather Radar [Amdt 20/8] Powered by EASA eRules Page 148 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20)

AMC 20 - 19

AMC 20 - 19 Passenger Service and In - Flight Entertainment (IFE)

Systems

ED Decision 2020/010/R 0 PREAMBLE This document provides acceptable means of compliance (AMC) to obtain approval for the installation of in - flight entertainment (IFE) systems. It has been developed on the basis of Joint Aviation Authorities Temporary Guidance Leaflet (JAA TGL) No 17, and addresses the following concerns: (a) the increase in the complexity of the IFE systems due to the additional cables, as well as the increase in the power needed for IFE systems; (b) the potential consequences on the aircraft or passengers of system/electrical faults, including t he risks of smoke, fire or interference with aircraft systems; these concerns are validated by adverse service experience wi th different types of aircraft; (c) the potential consequences for other aircraft systems due to the transmitting cap ability of the IFE systems; and (d) the lack of specific guidance on the installation of IFE systems, as these systems are categorised as non - essential services, even though these systems may affect compliance with the applicable provisions for seats and emergency evacua tion.

1 PURPOSE This AMC has been created to provide guidance to aircraft installers and equipment manufacturers on the airworthiness of IFE systems and equipment installed on civil aircraft. It does not constitute a regulation. It highlights safety concer ns about IFE systems, and contains acceptable means of compliance to address those concerns and obtain airworthiness approval of such systems. An applicant for such an approval may choose another means of compliance.

2 RELATED CERTIFICATION SPECIFICATIONS (C Ss) Some of the certification specifications for which this AMC can be used are listed below. This list is for reference only and should not be considered as comprehensive. Additional CS - 25 provisions are referenced where applicable. Provisions with the sa me number (e.g. CS 25.301) are generally read across to the other CSs (e.g. 27.301 and 29.301). However, please note that in some cases, the same topic is addressed by different provisions (e.g. for a specific CS - 25 provision, the corresponding CS - 23 provi sion may have a different number): — CS 25.301, 303, 305, 307, 333, 337, 341, 365(g), 471, 561, 562, 581, 601, 603, 605, 609, 611, 785, 787, 789, 791, 811, 831, 853, 863, 869, 899, 1301, 1309, 1319, 1327, 1351, 1353, 1357, 1360, 1423, 1431, 1441, 1703, 170 5, 1707, 1709, 1715, 1719, 1721, 1723; — for CS - 23: — AMC - 20 — Amendment 19 SUBPART A — GENERAL AMC 20 - 19 Annex to ED Decision 2020/010/R Page 149 of 581 — Amendments 1 to 4: CS 23.561, 562, 785, 787, 791, 811, 867, 1301, 1309, 1327, 1351, 1353, 1357, 1359 , 1431, 1441; — Amendment 5: CS 23.2265, 2270, 2315, 2320, 2325, 2330, 2335, 2500, 2505, 2510, 2525, 2605, 2615; — CS 27.561, 562, 610, 785, 787, 807, 853, 1301, 1309, 1319, 1327 , 1351, 1353, 1357, 1365; and Powered by EASA eRules Page 149 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) — CS 29.561, 562, 610, 785, 787, 807, 853, 1301, 1309, 1319, 1327, 1351, 1353, 1357, 1359, 1431.

3 REFERENCE DOCUMENTS The documents listed below are standards and guidance that w ere in force when this AMC (AMC 20 - 19) was adopted. Later or previous amendments may apply whenever the retained certificatio n basis allows for it.

(a) ED Decision 2017/020/R, AMC - 20 — Amendment 14, AMC 20 - 115D , Airborne software development assurance using EUROCAE ED - 12 and RTCA DO - 178, 19 October 2017 (b) ED Decision 2020/010/R, AMC 20 — Amendment 19, AMC 20 - 152A , Development Assurance for Airborne Electronic Hardware, July 2020 (c) ED Decision 2020/006/R, AMC 20 — Amendment 18, AMC 20 - 42 , Airworthiness information security ri sk assessment, 24 June 2020 (d) ED Decision 2014/029/R, AMC and GM to Part - CAT — Issue 2, Amendment 1, Portable electronic devices, AMC/GM to CAT.GEN.MPA.140, 24 September 2014, as amended by ED Decision 2019/008/R of 27 February 2019 (e) EASA Certificatio n Memorandum No CM - ES - 001, Certification of Power Supply Systems for Portable Electron ic Device, Issue 1, 7 June 2012 (f) EASA Certification Memorandum No CM - ES - 003, Guidance to Certify an Aircraft as PED to lerant, Issue 1, 23 August 2017 (g) International Civil Aviation Organization (ICAO) Doc 9284 - AN/905, Technical Instructions for the Safe Transport of Dangerous Goods by Air (Addendum No. 2), 30 June 2005 (h) Federal Aviation Administration (FAA) Advisory Circular (AC) 21 - 16G, RTCA Document DO - 160 versio ns D, E, F, and G, ‘Environmental Conditions Initiated by: AIR - 100 and Test Procedures for Airborne Equipment’, 22 June 2011 (i) FAA Policy Memorandum PS - ANM100 - 2000 - 00105 (also numbered 00 - 111 - 160), Interim Policy Guidance for Certification of In - Flight E ntertainment Systems on Title 14 CFR Part 25 Aircraft (Policy Number 00 - 111 - 160), 18 September 2011 (j) FAA AC 91.21 - 1D, Use of Portable Electronic Devices A board Aircraft, 27 October 2017 (k) FAA AC 20.168, Certification Guidance for Installation of Non - E ssential, Non - Required Aircraft Cabin Systems & Equipment (CS&E), 21 J uly 2010 (l) FAA AC 20.115D, Airborne Software Development Assurance Using EUROCAE ED - 12( ) and RTCA DO - 178( ), 21 July 2017 AMC - 20 — Amendment 19 SUBPART A — GENERAL AMC 20 - 19 Annex to ED Decision 2020/010/R Page 150 of 581 (m) FAA AC 21.49, Gaining Approval of Seats with Integrated Electronic Components, 9 February (n) EUROCAE ED - 14G, RTCA DO - 160G, Environmental Conditions and Test Procedures for Airborne Equ ipment, May 2011, Dece mber 2010 (o) RTCA DO - 313, Certification Guidance for Installation of Non - Essential, Non - Required Aircraft Cabin System s and Equipment, 2 October 2008 (p) Society of Automotive Engineers Aerospace Recommended Practice (SAE ARP) 5475, Abuse Load Testing for In - Seat Deployable Video Systems, 20 June 2005 (q) Aeronautical Radio, Incorporated (ARINC) 628, Cabin Equipme nt Interfaces, 27 December 1993 Powered by EASA eRules Page 150 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) (r) MIL - STD - 1472G, Human Engineering, 11 January 2012 3.1 Abbreviations The following abbreviations are used in this AMC: AC advisory circular AFM aircraft flight manual AMC acceptable means of compliance AMM aircraft maintenance manual ARP aerospace recommended practice CB circuit breaker CCOM cabin crew operations manua l COTS commercial off - the - shelf CRI c ertification review item CSs certification specifications DAH design approval holder DDP declaration of design and performance DBS direct - broadcast satellite EASA European Union Aviation Safety Agency ELA electrical - load analysis EMI electromagnetic interference ESD electrostatic discharge ETSO European technical standard order EWIS electrical - wiring interconnection system FCOM flight crew operations manual FDAL functional development assurance level FHA functional hazard assessment GM guidance material GSM global system for mobile communications GUI graphical user interface ICA Instructions for Continued Airworthiness ICAO International Civil Aviation Organization IDAL item development assurance leve l IEEE Institute of Electrical and Electronics Engineers IFE in - flight entertainment Powered by EASA eRules Page 151 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) LAN local area network MCA mobile communications on aircraft MMEL master minimum equipment list MoC means of compliance OEM original - equipment manufacturer PA public address PABX private automatic branch exchange PED portable electronic device PFIS passenger flight information system PSS power supply system RTCA Radio Technical Commission for Aeronautics R/T real time; real - time (as modifier) SAE ARP Society of Automotive Engineers Aerospace Recommended Practice SP special condition STC supplemental type certificate SWPM standard wiring practices manual TC type certificate T - PED transmitting portable electronic device USB universal serial bus VAC volts alternating - current VDC volts direct - current Wi - Fi wireless fidelity WLAN wireless local area network 3.2 Definitions The following definitions used in this AMC apply: Term Definition In - flight entertainment systems On - board systems that provide passengers with (safety) information, connectivity and entertainment Installer Type certificate (TC), supplemental type certificate (STC) or design approval holder (DAH) COTS equipment Equipme nt that is not designed or manufactured for use in aircraft, but is purchased by the installer for use in a particular aircraft system Powered by EASA eRules Page 152 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) 4 SCOPE Communication, information and entertainment systems are often provided for the convenience of aircraft passenge rs. As customer services improve, those systems are becoming more sophisticated and complex. Subsystem design features are often unique, based on the needs of operators, thus leading to many different possible IFE system configurations that depend both on the specific operator requirements and the cabin layout.

The following non - exhaustive list contains some examples of IFE systems: (a) systems that provide passengers with audio entertainment and the related controls; (b) systems that provide passengers with video entertainment and the related controls; (c) passenger flight information systems (PFISs); (d) systems that provide passengers with information, e.g. safety videos; (e) interfaces to, and functions of, systems for controlling some cabin environment parameters such as, for example, reading lights, general cabin illumination, crew call buttons, air vents, etc.; (f) systems that provide passengers with wired and/or wireless data distribution for entertainment connectivity including television (TV) and communication access (i.e. telephone, internet).

The aim of this AMC is to provide general criteria for the approval of such systems and equipment as they are installed in aircraft. The following aspects are addressed: mechanical installation, electrical installation, software /hardware aspects and electromagnetic compatibility, as well as the assessment of the potential hazards. In some cases, the application of this AMC, in conjunction with the certification basis for the product, is deemed to be sufficient.

For certain system s and equipment, additional certification material may be needed to address the aspects that are not covered by this AMC. Some examples are: — IFE systems with wireless - communication capabilities (e.g. wireless fidelity (Wi - Fi) access points, mobile - phone systems); — electrical outlets installed in the cabin for connecting portable electronic devices (PEDs); — lithium batteries; — data - loading systems; — data communication systems (e.g. satellite TV, radios, passenger telephone systems, etc.); and — large m onitors/displays.

5 APPROVAL CONSIDERATIONS (AT AIRCRAFT LEVEL) Section 6 below provides a summary of the issues that are pertinent to the safety of the aircraft, its occupants and maintenance personnel, which the equipment manufacturer and the installer s hould consider. Since IFE system installations are typical for commercially used large aeroplanes, it is expected that the approach to be followed for General Aviation (GA) aircraft will be different (for the purpose of this AMC, ‘General Aviation aircraft ’ are those aircraft that comply with the CS - 23 specifications). Section 6.7 below provides guidance in this regard. Some general considerations are presented below: (a) The applicant for the approval of an IFE system should demonstrate compliance with the applicable aircraft certification basis. The installed IFE system should function as intended, and no ‘credit’ should be given for its performance capability. Substantiation is required to demonstrate that the IFE system and equipment in their installatio ns and in operation do not Powered by EASA eRules Page 153 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) interfere with the operation of other aircraft systems, or do not cause any hazard to the aircraft, to its occupants, or to maintenance personnel.

(b) If part of an IFE system is designed to transmit the required safety informati on (e.g. the passenger briefing), the replacement system should also meet the safety objectives required for that function. The installer should identify these safety objectives, which depend on the type of function for which the IFE system is used.

(c) Th e applicant may use existing approvals for interfacing equipment (e.g. IFE system parts mounted in seats). However, the applicant should ensure that all the applicable airworthiness provisions are addressed. For example, European technical standard orders (ETSOs) on seats do not contain electrical provisions; therefore, the electrical aspects of the seats should be reviewed to ensure that the installation of IFE system equipment does not invalidate the original ETSO for the seats.

(d) If other aircraft syst em installations are affected by the installation of the equipment of the IFE system, then the applicable requirements for these affected systems should be taken into account.

(e) If an IFE system is designed to be available for the operating crew, EASA sh ould approve the related flight operation limitations.

(f) The applicant should demonstrate that any non - essential equipment (which includes equipment installed for the purpose of passenger entertainment), as installed: — is not a source of danger in itsel f; — does not prejudice the proper functioning of an essential service; and — does not in any way reduce the airworthiness of the aircraft to which it is fitted, even in the event of a failure to perform its intended functions.

For example, for large aeroplanes, compliance should be demonstrated with CS 25.1309. A functional hazard assessment (FHA) should be performed to identify the IFE system failure scenarios and the worst possible consequences (e.g. electrical shock) for the aircraft and its occupa nts. This assessment should take into account electrical, electronic, and component faults that may result in a short circuit and/or electrical arcing and/or the release of smoke.

Particular attention should be given to the likelihood of the following: — a ccidental damage due to exposure of wiring or components in the cabin, such as wires that are pinched in the seat track; — misuse of the equipment by passengers, such as the incorrect stowage of video screens, stepping on or kicking the seat electronic box , spilling liquids, etc.; — electronic - component breakdowns; and — wire chafing.

(g) The installer should demonstrate that the equipment of the IFE system has been installed in accordance with the equipment manufacturer’s declaration of design and performance (DDP) and their installation instructions. The demonstration may, in addition, involve the examination and testing of the equipment. Subpart O ‘EUROPEAN TECHNICAL STANDARD ORDERAUTHORISATIONS’ of Annex I (Part 21) to Regulation (EU) No 748/2012 and the rel ated AMC 21.A.608 provide guidance on drafting and formatting the DDP.

(h) If an operator allows passengers to use PEDs on board the aircraft, it should have procedures in place to control the use of those PEDs. Regulation (EU) No 965/2012 and the related ED Powered by EASA eRules Page 154 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) D ecisions contain, respectively, requirements and associated AMC and GM on PEDs. For commercial air transport (CAT) operations, the corresponding requirement is point CAT.GEN.MPA.140 of Annex IV (Part - CAT).

(i) If environmental testing of the IFE system equipme nt is required, EUROCAE ED - 14/RTCA DO 160 ‘Environmental Conditions and Test Procedures for Airborne Equipment’ may be followed. This is addressed in Section 0.1 below.

6 SYSTEMS INSTALLATION 6.1 Mechanical systems — aspects 6.1.1 Equipment location The equipment and its controls should be positioned in locations where they do not impede the movement or the duties of the flight crew or the cabin crew (including in crew rest areas), or the normal movement of passengers.

(a) In a light aircraft, for example , if audio entertainment is audible to the pilot, a means to control the sound level should be provided to the pilot. Visual - entertainment equipment should be located where it does not distract the crew.

(b) Equipment should be located and, where necessary , protected to minimise the risk of injury to the occupants of the aircraft during a normal flight or an emergency landing. For equipment AMC - 20 — Amendment 19 SUBPART A — GENERAL AMC 20 - 19 Annex to ED Decision 2020/010/R Page 156 of 581 with cords in larg e aeroplanes, for example, the lengths of the cords should be determined by their possible effects on the egress capability of the occupants.

The cords should not span across a main aisle such that they may become entangled in other features (such as armre sts), thus impeding egress. Means for proper and easy stowage should be provided.

(c) Equipment used for screens should not obscure any required notices or information signs (e.g.

‘Exit’, ‘No Smoking’, ‘Fasten Seat Belt’ signs, etc.). For video monitors in large - aeroplane installations, the following should apply: (1) For video monitors installed above the aisle: — all the installations should be such that the required ‘exit’ signs are still visible whether the monitors are fixed or retractable; if this is not possible, additional ‘EXIT’ signs are required; — fixed video monitors should be such that the minimum distance between the cabin floor and the lowest point of the monitor is 185 cm (73 in); and — retractable video monitors that do not meet the 185 - cm (73 - in) limit in the deployed position should not have sharp edges or should be padded, and they should be able to be stowed manually without requiring exceptional strength.

(2) For video monitors installed underneath overhead compartments: — all the installations should be such that the required signs (e.g. ‘No Smoking’, ‘Fasten Seat Belts’ signs, etc.) are visible whether the monitors are fixed or retractable; if this is not possible, additional signs are required; — fixed video monitors should be pa dded and should not be installed above or between the seat backs of seat rows that border the access to emergency exits; and Powered by EASA eRules Page 155 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) — retractable video monitors should be able to be stowed manually without requiring exceptional strength and should not be installe d above or between the seat backs of seat rows that border the access to emergency exits.

(d) Connecting units for wired on - board data exchange (e.g. USBs, local area networks (LANs), etc.)

should be designed so that their use is obvious to the crew and pa ssengers. Placards close to their outlet units should describe their capabilities and functions.

Units that are capable of supplying power with: — a voltage greater than or equal to 42 V; — power greater than 15 W; or — a current greater than 3 A, should b e treated as power outlets.

(e) For individual video monitors attached to the seats (e.g. to the seat armrests, seat backs, movable hinge arms), the protection of the seat occupants, as well as of the crew and passengers moving around the cabin, should be considered. Video monitor installations should be such that injuries due to contact with sharp edges/corners during normal operation and turbulence are avoided. The abuse loading of video monitors (e.g. if a passenger leans on the monitor when taking or le aving their seat) should be accounted for. The criteria of SAE ARP5475 ‘Abuse Load Testing for In - Seat Deployable Video Systems’ or alternatives, as agreed by EASA, may be used in assessing designs regarding this aspect.

6.1.2 Construction and attachment s trength (a) Any seat/monument installation, after modification, should continue to comply with the original certification basis.

(b) Equipment, attachments, supporting structures, and their constituent parts should be constructed such that they do not brea k loose when subjected to the loads (either for flight or for emergency ditching) that are prescribed in the relevant CSs. Some commercial off - the - shelf (COTS) equipment might not comply with these provisions and may need to be strengthened before being in stalled in an aircraft (see Section 6.6 below on COTS equipment).

(c) The design of IFE - system - related antennas, their location and manner of attachment should be such that there is no adverse effect on the aircraft systems and no danger to the aircraft un der any foreseeable operating conditions. Remark: If external antennas are installed, the applicant should address the corresponding certification aspects, for which specific guidance is available (i.e. antennas in pressurised areas, the installation of la rge and/or deployable antennas, etc.).

The certification approach for such external antenna installations should be agreed with EASA.

(d) As far as practicable, the equipment should be positioned so that if it breaks loose, it is unlikely to cause injury o r to nullify any of the escape facilities for use after an emergency landing or after ditching. When such positioning is not practicable, each such item of equipment should be restrained under any load up to the prescribed ultimate inertia forces for the e mergency landing conditions. Furthermore, for each item of equipment that is subject to frequent installation and removal, the local attachments of these items should be designed to withstand 1.33 times the specified loads (see CS 25.561(c)(2)). Compliance with CS 25.365(g) should also be considered.

Note 1: The structural provisions applicable to equipment can vary depending upon the type and size of the aircraft in which the equipment is installed; if the equipment is designed Powered by EASA eRules Page 156 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) to be installed in any aircr aft, then the applicant should consult all the relevant airworthiness CSs and create an envelope of conditions for design purposes.

Note 2: If an STC holder installs the equipment, they may need to consult the TC holder to obtain data on the vertical - accel eration factors (resulting from gusts and aircraft manoeuvres) that are applicable to a given aircraft type and to the proposed location of the equipment.

(e) If the IFE system is installed in a seat or in a monument adjacent to a seat, the installation ma y need to be reapproved for structural integrity and, if appropriate, for the emergency - landing dynamic conditions, including the occupant injury criteria. For large aeroplanes, for example, to avoid head injuries (CS 25.562(b) and CS 25.562(c), as referen ced in CS 25.785) caused by seat - back - mounted IFE equipment, compliance with CS 25.562(c)(5) should be shown for a fully equipped seat back in the take - off and landing position.

(f) Weight and stress assessments should be made in cases of already embodied shelves that need to be relocated.

(g) Glass surfaces may be part of IFE system components, e.g. in display units. The potential hazard for the occupants in case of breakage of large sheets of glass should be considered. The approach that the applicant sho uld follow should be agreed with EASA based on CS 25.788 (b).

Compliance with CS.25.365(g) should also be considered.

6.2 Electrical systems — aspects 6.2.1 Power supplies The IFE system equipment should be powered by an electrical busbar that does not supply power to the aircraft systems that are necessary for continued safe flight and landing.

The IFE system should be designed to provide circuit protection from overloads and short circuits by means of suitable protective devices.

(a) The method of connection of the equipment to the aircraft electrical system and the operation of the equipment should not adversely affect the reliability or integrity of the electrical system or any other electrical unit or system that is essential for the safe operati on of the aircraft.

(b) If applicable, the aircraft electrical system should be protected from any unacceptable EMI caused by a connected PED.

(c) The flight/cabin crew should be provided with a clearly labelled and conspicuous means to disconnect an IFE s ystem from its source of power at any time, and that means should be as close as practically possible to the source of power. The disabling/deactivating of component outputs should not be considered to be an acceptable means to cut off power, i.e. the disa bling/deactivating of the output of a power supply unit, seat electronic box, etc., as opposed to cutting off the input power of the system. Moreover, pulling system circuit breakers (CBs) as the sole means to cut off the IFE system power is not considered to be acceptable. This is because CBs are not normally designed to be used as switches. The pulling and resetting of CBs over a period of time may degrade their trip characteristics, and then the CBs might not trip when required.

(d) An electrical - load an alysis (ELA) should be carried out, taking into account the maximum load that the IFE system may utilise, to substantiate that the aircraft electrical - power generating system has sufficient capacity to safely provide the maximum amount of power required by the IFE system to operate properly. The applicant should base the IFE system ELA on an ELA that accurately reflects the aircraft’s electrical loads prior to the installation of the IFE system. If this Powered by EASA eRules Page 157 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) is not available, the applicant should make measuremen ts of the aircraft’s condition prior to the installation of the IFE system, and use these measurements for the ELA of the IFE system.

(e) The potential cumulative effect of the installation of multiple IFE units on the harmonic content of the electrical - po wer supply should be considered. There have been cases in which the installation of multiple IFE units with switched mode power supplies has changed the shape of the alternating current (AC) voltage waveform to the extent that the operation of the aircraft electrical power supply system (PSS) has been affected.

(f) Where batteries are used, consideration should be given to the stored energy, and provisions should be made for protection from short circuits and other potential failure modes.

The safety issue s associated with the use in the IFE system of batteries whose technology may pose hazards that are not covered by the current provisions should be addressed by additional provisions to be agreed with EASA (e.g. for lithium battery technology).

6.2.2 Bondi ng The electrical bonding, as well as the protection against static discharge of the installed system and equipment, should be such as to: (a) prevent a dangerous accumulation of electrostatic charge; and (b) minimise the risk of electrical shock to the cr ew, passengers and maintenance personnel.

The system bonding arrangements should be in accordance with the aircraft manufacturer’s standard practices, and suitable for conducting any current, including a fault current, which may need to be conducted. The d esigner should take into account bonding connections in the system design such that the loss of a single bond does not result in the loss of more than one essential circuit or in the dangerous inadvertent operation of any aircraft system.

Cabin equipment d esigners should adhere to the standard practices for bonding, grounding and shielding, as well as to other methods for eliminating or controlling electrostatic discharge.

All electrical and electronic equipment and/or components should be installed so as t o provide a continuous low - resistance path from their metallic enclosures and wiring to the aircraft bonding structure.

6.2.3 Interference 6.2.3.1 Magnetic effects Whether the installed IFE system equipment is operating or not, the aircraft compass systems should continue to meet the prescribed accuracy standards. Where other equipment approved as part of the aircraft is installed, the installer should take account of the declared compass safe distance when designing the installation.

Account should be take n of the compass safe distance in respect of both the compass and the flux detector. The installer should also consider potential interference of the installed IFE system equipment with the relatively low - level signal of the compass system interconnecting cables.

6.2.3.2 Electromagnetic interference (EMI) The levels of conducted and radiated interference generated by the equipment via power supply feeders, by system interfacing or by EMI should not cause an unacceptable degradation of the performance of oth er aircraft systems. If some equipment or functions are never used, the applicable system function should be properly disabled and/or terminated to prevent any interference with other aircraft systems.

Powered by EASA eRules Page 158 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) (a) Antennas Antennas for IFE systems should not be located where an unacceptable reduction in the performance of a mandatory radio system would result. In addition, the effects of a lightning strike on these antennas should be considered to ensure that essential services are not disrupted by electrical transients conducted to the aircraft via these antenna leads.

(b) Cumulative interference effects The actual interference effect on an aircraft receiver may be the cumulative effect of many potentially interfering signals. For this reason, a system consist ing of multiple units should be operable even in the worst - case orientation when interference tests/demonstrations are conducted. Tests/demonstrations should take into account the critical configurations of the use of the IFE system, including the critical configurations of passengers’ portable electronic devices (PEDs) connected to the IFE system. The test configuration should be agreed with EASA.

(c) Flight phases If the whole IFE system or parts of it are to be active during the critical flight phases (i .e. takeoff and landing), particular attention should be paid to the demonstration of non - interference during these critical flight phases.

6.2.4 Electrical shock Occupants should be protected against the hazard of electrical shock. Therefore, the applican t should demonstrate the means to minimise the risk of electrical shock as per CS 25.1360(a). Particular attention should be given to high - voltage equipment. If high - or low - voltage power outlets are available for passenger use, the aspects related to the use of PSSs for PEDs should be considered.

6.2.5 Wiring harness and routing The electrical - wiring interconnection system (EWIS) associated with the IFE system should be installed, as for all other electrical systems, in accordance with the provisions of CS - 25 Su bpart H, or any equivalent document accepted by EASA. In order to meet these provisions, the applicant should adhere to the following guidelines: — the wiring installation should be in accordance with the standard wiring practices manual (SWPM) of the airc raft or any equivalent standard accepted by EASA; — standard original - equipment manufacturer (OEM) wiring or compatible types of wiring should be used; — all the data necessary to define the design, in accordance with point 21.A.31 (Annex I (Part 21) to Regulation (EU) No 748/2012), including the installation drawings and wiring diagrams, shall be available; and — where the IFE system EWIS is routed through standard aircraft wiring looms, spacers or equivalent means of separation should be used to keep th e IFE EWIS at a minimum distance from any other electrical system in accordance with the SWPM of the aircraft.

In the absence of more specific guidelines in the SWPM of the aircraft, 230 VAC voltage power supply wires should not be routed through standard aircraft wiring looms. As the EWIS connected to the IFE system is present throughout the cabin (exposed in some cases), the potential for system faults is increased by the wide exposure to varying hazards (e.g. EWIS chafing in the seat tracks, passengers s tepping on or kicking the seat electronic box, spilled liquids, etc.). Since these systems are exposed to hazards, the potential to adversely affect other systems that are necessary for the safe operation of the aircraft significantly increases, as well as the possibility of shock hazards to occupants. Special consideration should be given to the protection against damage to the IFE EWIS components installed Powered by EASA eRules Page 159 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) in the seat itself: they should have appropriate protection means so that passengers cannot damage t hem with their feet or access them with their hands. The engineering data that controls the installation of IFE EWIS and equipment should contain specific and unambiguous provisions for the routing, support and protection of all IFE EWIS and equipment, and should specify all the parts that are necessary for those installations.

Care should be taken to ensure that any electrical IFE system equipment installed in aircraft seat assemblies does not invalidate the seat certification (e.g. the applicable ETSO). I n addition, it should be noted that compliance alone with any applicable ETSO for seats does not cover the electrical equipment installation aspects of the IFE system.

6.3 Aircraft interaction and interfaces If an IFE system is electrically interfaced with other aircraft systems, the performance and integrity of those aircraft systems should not be degraded. Appropriate means should be provided to isolate the IFE system from the aircraft systems.

(a) If an IFE system is connected to the aircraft avionics sy stem (or any other system that may have a safety - related function), the installer should demonstrate that no malfunction of the IFE system may affect the aircraft avionics system. The installer should conduct a safety analysis to substantiate this. Supplem entary to this safety analysis, special attention may be required due to cybersecurity issues. The installer should assess the information security aspects in accordance with AMC 20 - 42 .

(b) If an IFE system interfaces with the public address (PA) function, the use of this system should not impair the audibility of crew commands or instructions. A PA override feature should be considered to allow cabin announcements to be heard by p assengers.

(c) If an IFE system is available for the operating crew, the operation of this system should not interfere with, or adversely affect, the crew’s ability to operate other aircraft systems and respond to alerting systems. The aircraft flight man ual (AFM) should contain appropriate limitations and procedures.

The applicant should consider the following design interface features as acceptable means of compliance: (1) no access to any form of visual entertainment equipment; AMC - 20 — Amendment 19 SUBPART A — GENERAL AMC 20 - 19 Annex to ED Decision 2020/010/R Page 162 of 581 (2) automatic muting of the IFE systems when any cockpit aural caution or warning is sounding; there should be no perceptible delay between the muting of the IFE system and the activ ation of the caution/warning; (3) automatic muting of the IFE systems when any real - time (R/T) transmission or reception is in progress; there should be no perceptible delay between the muting of the IFE system and the activation of the R/T transmission or rec eption; and (4) readily available controls such that the volume of the IFE system is easily reduced.

(d) If an IFE system includes wireless capabilities (wireless local area network (WLAN), mobile phone, Bluetooth, etc.) to connect with other aircraft equipmen t and/or passenger or crew transmitting portable electronic devices (T - PEDs), the installer should address the electromagnetic compatibility of the aircraft with the intentional emissions of the IFE system, and the approach to be followed in that respect s hould be agreed with EASA.

Powered by EASA eRules Page 160 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) Note: The responsibility for establishing the suitability for use of a PED on a given aircraft model continues to rest with the operator, as required by point CAT.GEN.MPA.140 (Annex IV (Part - CAT) to Regulation (EU) No 965/2012).

The design interface features used to comply with the above should be designed with a development rigour that depends on the function that is being interfaced with or replaced by the IFE system.

6.4 Software/airborne electronic hardware (AEH) 6.4.1 Software arch itecture The software architecture of IFE system components should consider the following distinction between: — core software as part of the functional scope defined in the specification of the component (e.g.

operating systems, hardware drivers, function al applications such as PA), including all the required core software configuration data (the core software may be field loadable); and — content data, including content configuration data (it may be field loadable by the aircraft operator); for IFE system equipment, the aircraft operator is usually required to make some adjustments and/or changes in the short term; such changes may be related to the content data and/or content configuration data — some examples of the latter are the following: — the select ion of passenger - accessible graphical user interface (GUI) elements; — the activation of predefined GUI designs; and — the selection of regional information data (e.g. different country borderlines).

A change in the core software requires a component modif ication or redesign (change of part number) and, therefore, leads to a change in the aircraft configuration.

A change in the content data remains in the operational responsibility of the air craft operator (field - loadable software) and, therefore, does not lead to a change in the aircraft configuration.

6.4.2 Software development assurance The item development assurance level (IDAL) required for the IFE system software should be determined through the functional hazard assessment (FHA) that identifies the worst failure to which the software may contribute. If the IDAL is equal to IDAL D or g reater, AMC 20 - 115 , latest revision, provides guidance for the production of airborne systems and equipment software that performs its intended function with a level of confidence in its safety that is compliant with airworthiness provisions. This is an acceptable standard, and it should be taken into consideration for software in IFE systems, in particular those that replace or interface with the required functions of the aircraft .

6.4.3 Airborne electronic hardware (AEH) development assurance The functional development assurance levels (FDALs) identified through the FHA should be used, in conjunction with the system architecture considerations, in order to determine the IDAL to be used for the development of airborne electronic hardware (AEH), and to identify the rigour of the development processes used.

For the development assurance of AEH of IFE systems that replace or interface with the required functions of the aircraft, the pr ovisions of AMC 20 - 152 , latest revision, apply.

6.5 Other risks For the risks associated with hazards that may be caused by the IFE system equipment due to the operating environment of the aircraft, the standard environmental and operational test conditions Powered by EASA eRules Page 161 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) and test procedures of EUROCAE ED - 14/RTCA DO - 160 may be used i n combination with FAA AC 21 - 16G.

The responsibility for selecting the appropriate environmental and operational test conditions and test procedures lies with the installer. Section 6.5.1 below provides guidance on the selection of the test types. Sections 6.5.2, 6.5.3 and 6.5.4 below address other associated risks.

6.5.1 Environmental qualification If the IFE system equipment is not linked to any other aircraft systems and is only connected to a non - essential power busbar, the following is recommended as a minimum list of environmental tests: — temperature and altitude, — temperature variation, — operational shocks and crash safety, — vibration, — power input, — voltage spikes, and — emissions of radio frequency energy.

The installer is responsible for sele cting the appropriate test conditions and for agreeing them with EASA. The assessment of the installation may prove that some of the above test types are unnecessary or, contrarily, that additional tests should be performed.

6.5.2 Touch temperature In addi tion to CS 25.1360(b), the following should be considered: any hot surfaces of IFE system components that are accessible to the crew or passengers should not be exposed if inadvertent contact with those surfaces may pose a hazard.

The definition of MIL - STD - 1472G ‘HUMAN ENGINEERING’ applies: Equipment which, in normal operation, exposes personnel to surface temperatures greater than: — For momentary contact: 60°C for metal, 68°C for glass, 85°C for plastic or wood; — For prolonged contact: 49°C for metal, 5 9°C for glass, 69°C for plastic or wood; or less than 0°C should be appropriately guarded.

6.5.3 Fluid exposure If the equipment is mounted in a position where exposure to fluid is possible, for example on or under a passenger seat, or where catering opera tions take place or liquid cleaning agents are used regularly, it should be established that fluid spillage does not render the equipment hazardous. Where possible, installations in areas susceptible to moisture should be avoided. Otherwise, consideration should be given to minimise the hazard of liquid ingress, e.g. the inclusion of drip loops in wiring harnesses and the installation of drip trays.

If the approach described above is followed, the fluid susceptibility test may be disregarded.

6.5.4 Rapid decompression and high - altitude operation The installer should ensure that no arcing that causes a fire risk or unacceptable levels of interference will occur in the equipment when the equipment is subjected to an atmospheric pressure that corresponds to the maximum operating altitude of the aircr aft. Alternatively, means should be provided to automatically disconnect the electrical supply to the equipment when the cabin pressure Powered by EASA eRules Page 162 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) reduces to a level below which the safe operation of the equipment is not ensured (e.g. rapid decompression). The guidan ce of RTCA DO - 313 in this area may also be followed.

This section should be followed in addition to the test conditions of Section 6.5.1.

6.5.5 Explosion, fire, fumes and smoke (a) The installer should pay particular attention to the quality and design of components such as transformers, motors and composite connectors in order to minimise the risk of them overheating. The design of the mounting provisions for IFE system components installed in the passenger cabin (e.g. passenger seats, closet/cabin partiti on walls, overhead compartments, etc.) should fully reflect the cooling provisions for the equipment, including heat sinking, ventilation, proximity to other sources of heat, etc.

(b) All materials should meet the appropriate flammability provisions. Inadv ertent blockage (e.g.

by passengers’ coats, luggage or litter) of any cooling vents should be prevented either by the design or by operational procedures. Appropriate protection against overheating should be part of the design of such in - seat systems.

(c) For the installation of IFE system components in racks located in the equipment bay that are not accessible in flight, the installer should address the potential hazard to other essential or critical systems/equipment located in the equipment bay, in case of an IFE system malfunction.

The installer should substantiate that the worst - case scenario of a possible malfunction of the IFE system does not affect the components located in the equipment bay that are necessary for safe flight and landing. This demons tration should account for the risks of: — overheating, — smoke release, — electrical failure, and — fire propagation.

For large aeroplanes, for example, the following is considered an acceptable means of compliance in that respect: a hazard analysis to de monstrate that none of the potential ignition risks that originate from IFE system malfunctions pose a risk of a sustained fire in any area where IFE system components are located; this demonstration should account for: — the fire containment properties of the equipment, — the non - fire - propagating properties of the adjacent materials, and — the detectability of fire and smoke.

(d) The installer should consider protecting IFE system components that are located in the cabin to ensure that fault conditions wil l not result in the failure of components within a unit that may generate smoke or fumes (e.g. if using tantalum capacitors). In addition, power supplies should have current - limiting output protection at a suitable level (e.g. in - seat equipment). The IFE s ystem installation should comply with the applicable fire and smoke provisions of CS 25.831(c), CS 25.853(a), CS 25.863 and CS 25.869(a).

(e) Procedures should be established to terminate the operation of the IFE system at any time, in case of smoke/fire/e xplosion. The crew should maintain overall control over the IFE system. If control over the IFE system is possible via cabin controls only, appropriate procedures should address flight crew compartment – cabin coordination.

The guidance of RTCA DO - 313 in thi s area may also be followed.

Powered by EASA eRules Page 163 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) 6.6 Commercial off - the - shelf (COTS) equipment This section provides guidance for the cases in which the installer uses COTS equipment as part of an IFE system modification.

In principle, the installation of COTS equipment, as for all other IFE system equipment, should follow the guidance provided in this document. It is, nevertheless, recognised that COTS equipment is supplied from a market whose industry standards differ from the aviation ones. As a consequence, it may be dif ficult to follow some of the guidance of this document.

The main impediments are the following: — traceability and configuration control; and — it is burdensome to perform most of the testing in accordance with the state - of - the - art aviation standards (e.g. EUROCAE ED - 14/RTCA DO - 160).

In certain cases, the installer may directly follow the guidance provided in this document by using specific design features/adaptations and mitigations in terms of design or operational instructions.

The steps d escribed below compose a road map that the installer may follow to apply for the approval of COTS equipment as part of an IFE system: — The installer should perform a safety risk assessment of the potential hazards associated with the installation of the C OTS equipment, either during normal operation of the equipment or in case of its failure.

— Based on the identified hazards, some evidence of environmental qualification for the equipment may be required. This could be achieved either by testing or by prov iding alternative laboratory standards to which the equipment has been tested, or industry standards to which the equipment has been certified. The acceptability of these standards should be agreed with EASA.

— A design solution may be developed in some ca ses to provide means of compliance that are alternatives to testing, e.g.: — hosting of the COTS component in a ‘shelter case’ (an air - tight - sealed housing) with electrical isolation of all the needed interfaces; or — a declaration of ‘loose equipment’ that is temporarily brought on board and is permanently accessible and visible by the crew.

— It should be ensured that the design specifications of the COTS equipment manufacturer are followed (in terms of the operating environmental conditions , cooling, etc.).

— Configuration control: quality control criteria should be provided for those aspects of the COTS equipment whose malfunctions may create hazards. If detailed design data is not available for such aspects, the applicant should propose a process by which the configuration control of the design is maintained and should ensure that any changes in the design or any non - compliance introduced during manufacturing are identified. Critical characteristics of COTS equipment may include power, dime nsions, weight, electrical power, software and hardware parts, material flammability behaviour, etc. This should also encompass subsequent changes to those parts.

The above points should help the installer in the certification of the COTS equipment. RTCA DO - 313 Appendix D follows a similar approach and is considered to be an acceptable alternative.

Powered by EASA eRules Page 164 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPAR T A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) 6.7 Approach for General Aviation (GA) aircraft This section provides guidance for the installation of IFE system equipment in GA aircraft.

The installer may follow the approach described in Sections 6.1 to 6.6, or follow the approach described below: — Perform an assessment of the potential hazards associated with the installation of the IFE system equipment.

— Identify the list of hazards and possible safety issues created through either normal operation of the IFE system equipment or its failure.

— The hazards and issues described in Section 6 of this AMC may be used as a reference, but the applicant is not expected to demonstrate the same level of compliance as that required for large aircraft. Some evidence of environmental qualification (and/or testing) may be needed, but it is expected that in many cases, alternative compliance solutions may be provided. Some examples are the following: — specific - installati on solutions or the use of mitigations (via limitations and/or placards) may provide an adequate level of safety and circumvent the need for environmental testing; and — industry and/or laboratory standards may provide an acceptable alternative.

The acceptability of the above should be agreed with EASA.

— It should be ensured that the design specifications of the IFE system equipment manufacturer are followed (in terms of the operating environmental conditions, cooling, etc.).

— Configuration control: the configuration of the IFE system equipment should be identified, at least for those design features whose malfunctions may create hazards.

It is worth mentioning that in many cases, the IFE system equipment installed in GA aircraft is COTS equipment, t hus the described approach largely reflects the approach to COTS equipment in Section 6.6 above.

7 DOCUMENTATION This section provides guidance on the documentation that should be developed for IFE system installations.

7.1 Certification documentation The certification documentation may consist of but it is not limited to: — equipment specifications, — the system description, — analysis reports, — test reports, and — a DDP.

It should include references to the standards that are met.

The installer should dem onstrate that they have taken proper account of the equipment manufacturer’s DDP and installation instructions. This demonstration may, in addition, involve the examination and testing of the equipment. Point 21.A.608 (Subpart O of Annex I (Part 21) to Powered by EASA eRules Page 165 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) Reg ulation (EU) No 748/2012) and AMC 21.A.608 provide guidance on the drafting and formatting of the DDP.

Appropriate documentation should be provided to define the designer’s responsibilities for equipment installed in non - IFE system components of the cabin (e.g. IFE system equipment installed in seats or galleys, or in - seat wiring harnesses). A DDP should be provided to confirm that the installation of the IFE system equipment does not invalidate the approvals of existing equipment (e.g.

seat ETSOs, or the c ertification of the galley).

Wire routing should be specified in detail to minimise the variability in manufacture, installation and maintenance in order to avoid the risk of wire chafing and damage.

7.2 Operations and training manuals The design and installation of the IFE system should minimise its impact on the operational procedures. However, since flight or cabin crew procedures should comply with the applicable airworthiness provisions, these procedures should be included in the corresponding man ufacturer’s documentation to be provided to operators and, if appropriate, in the AFM.

7.3 Instructions for Continued Airworthiness (ICA) For IFE system installations on board an aircraft, the installer should draft appropriate ICA and submit them to EASA. The installer should accomplish this task not only at the aircraft level, but also at the equipment level.

7.3.1 Equipment level At the equipment level, the manufacturer should provide the installer with the necessary information for the safe operation an d maintenance of the component. In particular, it should be highlighted whether a component requires scheduled maintenance or contains life - limited parts or has any other limitation that affects its continued airworthiness.

Suitable means of providing ICA information at equipment level are the following (examples only): — operator’s guides, — CMMs, — illustrated parts catalogues, or — dedicated ICA manuals.

The documents that contain the ICA for the component/equipment should be referenced in the corresponding DDP and cross - referenced in the documentation at the aircraft level.

7.3.2 Aircraft level At the aircraft level, CS 25.1529, CS 25.1729 (or an equivalent SC if contained in the certification basis) and Appendix H of CS - 25, as applicable to th e installation under consideration, determine the format and the minimum content of the ICA. The ICA for an IFE system may include the following: — system descriptions and operating instructions such as (non - exhaustive list): — AFM supplements, — supplemen ts to the master minimum equipment list (MMEL), — supplements to the flight crew operations manual (FCOM), and — supplements to the cabin c rew operations manual (CCOM); Powered by EASA eRules Page 166 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 19 Products, Parts and Appliances (AMC - 20) — maintenance instructions (including information on testing, inspections, troubleshoot ing, servicing, the replacement of parts, lifetime limitations, tooling and software loading) via supplements to the following (non - exhaustive list): — the aircraft maintenance manual (AMM), — the wiring manual, — the illustrated parts catalogue, — the mai ntenance planning docu ment, and — the service manual.

The amount and content of the necessary ICA may vary depending on the kind of installation.

7.3.3 Scheduled maintenance tasks The installer should draft the ICA by following the method applied during th e certification process of the aircraft, including the development of scheduled maintenance tasks. However, some of these methods may not properly address the specific operational and technical conditions of the IFE system installations: — in - service occur rences have shown that failures in or damage to the IFE system installation may become a potential source of ignition and heat, creating a smoke hazard and/or a fire hazard; — particular attention should be given to in - seat equipment and wiring that is vul nerable to damage induced by passengers, servicing personnel, crew, changes to the cabin configuration or maintenance actions, which therefore may become potential sources of an electrical shock or other risks due to degraded or damaged electrical insulati on; and — contamination by dust, debris or spilled liquids in the cabin may cause overheating and a risk of smoke or fire.

These kinds of potential causes of failure, especially if the failure or damage is not easily detectable by the crew or the maintenance personnel while performing their normal duties, should also be considered when defining the scheduled maintenance tasks for IFE system installations.

The scheduled maintenance of IFE system installations may include but is not limited to the fo llowing tasks: — functional checks of latent systems (e.g. the power shutdown function and/or IFE - systemspecific smoke detection function); — inspections (e.g. of the condition of system cabling and/or seat - mounted components; the correct position of physi cal protection, such as insulation, ducting, covers and/or drip trays); — discarding/replacement of components (e.g. air filters and/or IFE system batteries); and — restoration tasks (e.g. the cleaning of cooling vents or filters, the removal of dust and debris).

8 OPERATIONAL PROCEDURES The regulatory requirements related to air operations are specified in Regulation (EU) No 965/2012 (see also the related AMC and GM). The operator should ensure that both the flight crew and the cabin crew are fully fa miliar with the operation of the IFE system, and that passengers are provided with appropriate information, including restrictions on the use of the IFE systems in normal, abnormal and emergency conditions.

[Amdt 20/19] Powered by EASA eRules Page 167 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20)

AMC 20 - 20B

AMC 20 - 20 B Continuing s tructural i ntegrity p rogramme

ED Decision 2021/007/R 1. PURPOSE ( a) This a cceptable m eans of c ompliance ( AMC) provides guidance to type certificate holders (TCHs), supplemental type certificate holders (STCHs) , repair approval holders, maintenance organisations, operators and competent authorities for developing continuing structural integrity programme s to ensure safe operation of ageing aircraft throughout their operational li v e s .

This AMC is primarily aimed at large aeroplanes ; h owever, this material is also applicable to other aircraft types for operators and TCHs wishing to develop robust continuing structural integrity programmes .

(b) It is particularly important for the TCHs of ageing aircraft to ensure t hat their continuing structural integrity programmes remain valid throughout the operational life of the aircraft.

( c) The means of compliance described in this document provides guidance to supplement the engineering and operational judgement that must fo rm the basis of any compliance findings relative to continuing structural integrity programmes.

( d) Like all acceptable means of compliance material, this AMC is not in itself mandatory, and does not constitute a requirement. It describes an acceptable mea ns, but not the only means, for showing compliance with the requirements. While these guidelines are not mandatory, they are derived from extensive industry experience in determining compliance with the relevant requirements.

(e) This AMC also supports com pliance with the ageing structural integrity requirements in Annex I (Part - 26) to Regulation (EU) 2015/640 , as introd uced by Regulation (EU) 2020/1159 (ref. points 26.300 through 26.370 and the associated CS - 26 paragraphs) including li mits of validity (LOVs), WFD evaluation, damage tolerance for repairs and modifications, and processes for ensuring the continued validity of the continuing structural integrity programme.

(f) This AMC also supports compliance with the ageing structural integrity requirements in point 21.A.65 of Part 21 as well as compliance with the certification basis established in accordance with points 21.A.101(h) and 21.A.433(a)(5) of Part 21.

2. RELATED REGULATIONS AND DOCUMENTS ( a) Implementing Rules an d Certification Specifications : P oint 21 . A.61 Instructions for continued airworthiness Point 21.A.65 Continuing structural integrity for aeroplane structures Point 21.A.101 Type - certification basis, operational suitability data certification basis and environmental protection requirements for a major change to a type - certificate P oint 21 .A.120 Instructions for continued airworthiness Points 26.300 through 26.334 applicable to DAHs Powered by EASA eRules Page 168 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) P oint 21 .A.433 Repair design Point 26.370 Rules applicable to operators P oint M.A.302 Maintenance programme CS 25.571 Damage tolerance and fatigue evaluation of structure CS 25.1529 Instructions for continued airworthiness CS 26.300 through 26.370 Means of compliance for Part - 26 ageing aeroplane structures requirements ( b) E ASA AMC and FAA Advisory Circulars AMC 25.571 Damage tolerance and fatigue evaluation of structure AMC1 21.A.65 Continuing structural integrity programme for aeroplane structures AMC1 21.A.101(h) Type - certification basis for changes to large aeroplanes subject to point 26.300 of Part - 26 AMC1 21.A.433(a)(5) Requirements for the approval of repairs to large aeroplanes subject to point 26.302 of Part - 26 AC 91 - 81 Management Programs for Airplanes with Demonstrated Risk of Catastrophic Failure Due to Fatigue, 29 April 2008, FAA AC 91 - 56 B Continuing Structural Integrity for Airplanes , 7 March 2008, FAA AC 120 - 73 Damage Tolerance Assessment of Repairs to Pressurised Fuselages, FAA , 14 December 2000 AC 120 - 93 Damage Tolerance Inspections for Repair s and Alterations AC 120 - 104 Establishing and Implementing Limit of Validity to Prevent Widespread Fatigue Damage AC 25.1529 - 1 A Instructions for C ontinued A irworthiness of Structural R epairs on Transport Airplanes, FAA , 20 November 2007 (c) Related d ocuments — ‘ Recommendations for Regulatory Action to Prevent Widespread Fatigue Damage in the Commercial Aeroplane Fleet ’ , Revision A, dated June 29, 1999 [A report of the Airworthiness Assurance Working Group for the Aviation Rulemaking Advisory Co mmittee Transport Aircraft and Engine Issues] .

— AAWG Final Report on Continued Airworthiness of Structural Repairs, Dec 1996.

— ATA report 51 - 93 - 01 structural maintenance programme guidelines for continuing airworthiness , May 1993.

— AAWG Report on Structures Task Group Guidelines, Rev 1 June 1996 .

— AAWG Report: Recommendations concerning ARAC taskings FR Doc 04 - 10816 Re f. : Aging Airplane safety final ru le. 14 CFR 121.370a and 129.16 .

— Federal Aviation Administration 14 CFR Parts 26, 121, and 129 [Dock et No FAA - 2005 - 21693; Amendment Nos 26 – 1, 121 – 337, 129 – 44] Damage Tolerance Data for Repairs and Alterations Final Rule.

Powered by EASA eRules Page 169 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) — Federal Aviation Administration 14 CFR Parts 25, 26, 121, and 129 [Docket No FAA - 2006 - 24281; Amendment Nos 25 – 132, 26 – 5, 121 – 351, 129 – 4 8] Aging Airplane Program: Widespread Fatigue Damage Final Rule.

3. BACKGROUND Service experience has shown there is a need to have continu ally updated knowledge on the structural integrity of aircraft, especially as they become older , to ensure they conti nue to meet the level of safety intended by the certification requirements. The continued structural integrity of aircraft is of concern because factors such as fatigue cracking and corrosion are time - dependent, and our knowledge about them can best be ass essed based on real - time operational experience and the use of the most modern tools of analysis and testing.

In April 1988, a high - cycle transport aeroplane en - route from Hilo to Honolulu, Hawaii, suffered major structural damage to its pressurised fusela ge during flight. This accident was attributed in part to the age of the aeroplane involved. The economic benefit of operating certain older technology aeroplanes resulted in the operation of many such aeroplanes beyond their previously expected retirement age. Because of the problems revealed by the accident in Hawaii and the continued operation of older aircraft, both the competent authorities and industry generally agreed that increased attention needed to be focused on the ageing fleet and on maintainin g its continued operational safety.

In June 1988, the FAA sponsored a conference on ageing aircraft. As a result of that conference, an ageing aircraft task force was established in August 1988 as a sub - group of the FAA ’ s Research, Engineering, and Develop ment Advisory Committee, representing the interests of the aircraft operators, aircraft manufacturers, regulatory authorities, and other aviation representatives. The task force, then known as the Airworthiness Assurance Task Force (AATF), set forth five m ajor elements of a programme for keeping the ageing fleet safe. For each aeroplane model in the ageing transport fleet , these elements consisted of the following: (a) Select service bulletins describing modifications and inspections necessary to maintain s tructural integrity; ( b) Develop inspection and prevention programmes to address corrosion; ( c) Develop generic structural maintenance programme guidelines for ageing aeroplanes; ( d) Review and update the s upplemental s tructural i nspection d ocuments (SSID s ) which describe inspection programmes to detect fatigue cracking; and ( e) Assess the damage tolerance of structural repairs.

Subsequent to these five major elements being identified, it was recognised that an additional factor in the Aloha accident was widespread fatigue cracking. Regulatory and i ndustry experts agreed that, as the transport aircraft fleet continues to age, eventually w idespread f atigu e d amage (WFD) is inevitable. Structures Task Groups sponsored by the Task Force were assigned the task of developing these elements into usable programmes. The Task Force was later re - established as the AAWG of the ARAC. Although there was JAA membership and European o perators and i ndustry representatives participated in the AAWG, recommendations for action focussed on FAA operational rules which are not applicable in Europe. It was therefore decided to establish the EAAWG on this subject to implement a gei ng a ircraft activities in Europe , not only for the initial ‘ AATF eleven ’ aeroplanes, but also other old aircraft and more recently certified ones. EAAWG recommendations followed, leading to the development of guidance material for TCHs and operators, and p roposals to develop Sub - part M of JAR OPS. The subsequent establishment of the Agency and new EU regulations led to the current format of Part - M for continuing airworthiness, the associated maintenance programme requirements Powered by EASA eRules Page 170 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) and to the inclusion of ageing aircraft structures programmes in AMC Part M (M.A.302).

AMC 20 - 20 supported this process and set out means by which TCHs and operators could develop and implement ageing aircraft structures programmes.

This AMC supports DAH and operator compliance with the requirements introduced by Commission Implementing Regulation (EU) 2020/1159 on ageing aeroplane structures, amending Regulation (EU) 2015/640 (Part - 26), and the associated CS - 26 specifications. The Regulation includes requirements for specific DAHs to perform damage tolerance and other evaluations of existing airframe structure, develop certain data and ICA if they have not already done so, and make it available to operators. Furthermore, operators, in addition to implementing these ne w ICA as envisaged under Part - M, are required by Part - 26 to ensure that approved damage - tolerance - based inspections are obtained and implemented on all repairs and modifications affecting the FCS on aeroplanes certified for 30 passengers or more or for 7 5 00 lb or more payload.

Points 26.300 through 26.370 of Part - 26 provide the requirements for a complete retroactively applicable continuing structural integrity programme for specific categories of large aeroplanes.

The principal means of compliance with th ose re quirements may be found in CS - 26, which, in turn, refers to this AMC.

Additionally, this AMC supports (R)TCH compliance with the requirements introduced by Commission Delegated Regulation (EU) 2021/699 of 21 December 2020 on continuing structural integrity of large aeroplanes , amending Annex I (Part 21) to Commission Regulation (EU) No 748/2012 .

4. DEFINITIONS AND ACRONYMS ( a) For the purpo ses of this AMC, the following definitions apply: — Airworthiness limitation section (ALS) means a section in the instructions for continued airworthiness, as required by points 21.A.61, 21.A.107 and 21.A.120A of Annex I (Part 21) to Regulatio n (EU) No 748/2012 , which contains airworthiness limitations that set out each mandatory replacement time, inspection interval and related inspection procedure.

— Baseline structure refers to the structure that is designed under the type certificate for that aeroplane model (that is, the ‘as delivered aeroplane model configuration’).

— Corrosion prevention and control programme (CPCP) is a document reflecting a systematic approach to prevent and to control corrosion in an aero plane’s primary structure, consisting of basic corrosion tasks, including inspections, areas subject to those tasks, defined corrosion levels and compliance times (implementation thresholds and repeat intervals). A baseline CPCP is established by the type certificate holder, which can be adapted by operators to create a CPCP in their maintenance programme specific to their operations.

— Damage tolerance (DT) is the attribute of the structure that permits it to retain its required residual strength without det rimental structural deformation for a period of use after the structure has sustained a given level of fatigue, corrosion, and accidental or discrete source damage.

— Design a pproval h older (DAH) is the holder of any design approval, including type certificate, supplemental type certificate or earlier equivalent, or repair approval.

— Damage tolerance data is the combination of DTE documentation and DTI.

Powered by EASA eRules Page 171 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) — Damage tolerance evaluation (DTE) is a process that leads to the determination of the maintenance actions necessary to detect or preclude fatigue cracking that could contribute to a catastrophic failure. When applied to repairs and changes, a DTE includes the evaluation of the repair or change and the fatig ue - critical structure affected by the repair or change.

— Damage tolerance inspection (DTI) is a documented inspection requirement or other maintenance action developed by holders of design approvals or third parties as a result of a damage tolerance evaluat ion. A DTI includes the areas to be inspected, the inspection method, the inspection procedures (including the sequential inspection steps and acceptance and rejection criteria), the inspection threshold and any repetitive intervals associated with those i nspections. DTIs may also specify maintenance actions such as replacement, repair or modification.

— Design s ervice g oal (DSG) is the period of time (in flight cycles or flight hours, or both ) established at design and/or certification during which the aerop lane structure is expected to be reasonably free from significant cracking.

— Existing design changes or repairs are changes and repairs which are to be approved before the date of entry into force of this rule.

— Fatigue - critical alteration structure (FCAS) i s equivalent to fatigue - critical modified structure.

— Fatigue - critical baseline structure (FCBS) is the baseline structure of an aeroplane that is classified by the type certificate holder as a fatigue - critical structure.

— Fatigue - critical modified structure (FCMS) means any fatigue - critical structure of an aeroplane introduced or affected by a change to its type design and that is not already listed as part of the fatigue - critical baseline structure.

— Fatigue - c ritical s tructure (FCS) is a structure of an aero plane that is susceptible to fatigue cracking that could lead to a catastrophic failure of the aircraft. For the purposes of this AMC, FCS refers to the same class of structure that would need to be assessed for compliance with JAR 25.571 Change 7 or 14CFR § 25.571(a) at Amendment 25 - 45, or late r. The term ‘ FCS ’ may refer to fatigue - critical baseline structure, fatigue - critical modified structure, or both.

— Inspection start point (ISP) is the point in time when special inspections of the fleet are initiated due to a specific probability of having an MSD/MED condition.

— Future design changes and repairs are changes and repairs which are to be approved on or after the date of entry into force of this rule.

— Limit of validity (LOV) (of the engineering data that supports the structural maintenance programme) means, in the context of the engineering data that supports the structural maintenance programme, a period of time, stated as a number of total accumulated flight cycles or flight hou rs or both, during which it is demonstrated that widespread fatigue damage will not occur in the aeroplane .

— Multiple - e lement d amage (MED) is a source of widespread fatigue damage characterised by the simultaneous presence of fatigue cracks in similar adjac ent structural elements.

— Multiple - s ite d amage (MSD) is a source of widespread fatigue damage characterised by the simultaneous presence of fatigue cracks in the same structural element.

Powered by EASA eRules Page 172 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) — Primary s tructure is structure that carries flight, ground, crash or p ressurisation loads.

— Published repair data are instructions for accomplishing repairs which are published for general use in structural repair manuals and service bulletins (or equivalent types of documents).

— Repair assessment guidelines (RAGs) provide a p rocess to establish damage tolerance inspections for repairs on the fuselage pressure boundary structure.

— Repair a ssessment p rogramme (RAP) is a programme to incorporate damage - tolerance - based inspections for repairs to the fuselage pressure boundary structure (fuselage skin, door skin, and bulkhead webs) into the operator’s maintenance and/or inspection programme.

— Repair e valuation g uidelines (REG s ) are established by the type certificate holder and guide operators to establish damage toleran ce inspections for repairs that affect fatigue - critical structure to ensure the continued structural integrity of all relevant repairs .

— Structural modification point (SMP) is the point in time when a structural area must be modified to preclude WFD.

— Widesp read f atigue d amage (WFD) means the simultaneous presence of cracks at multiple locations in the structure of an aeroplane that are of such size and number that the structure will no longer meet the fail - safe strength or residual strength used for the cert ification of that structure .

(b) The following list defines the acronyms that are used throughout this AMC: AAWG Airworthiness Assurance Working Group AC a dvisory c ircular AD a irworthiness d irective ALS a irworthiness l imitations s ection AMC a cceptable m eans of c ompliance ARAC Aviation Rulemaking Advisory Committee BZI b aseline z onal i nspection CAW continuing airworthiness CPCP c orrosion p revention and c ontrol p rogramme CS c ertification s pecification DAH d esign a pproval h older DSD d iscrete s ource d amage DSG d esign s ervice g oal DT damage tolerance DTE damage tolerance evaluation DTI damage tolerance inspection EAAWG European Ageing Aircraft Working Group EASA European Union Aviation Safety Agency ESG e xtended s ervice g oal FAA Federal Aviation Administration FAR Federal Aviation Regulation FCBS f atigue - c ritical b aseline s tructure FCS f atigue - c ritical s tructure Powered by EASA eRules Page 173 of 605 | Jun 2023 Easy Access Rules for Acceptable Means S UBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) ICA i nstructions for c ontinued a irworthiness ISP i nspection s tart p oint JAA Joint Aviation Authorities JAR j oint a viation r egulation LOV l imit of v alidity MED m ultiple - e lement d amage MRB Maintenance Review Board MSD m ultiple - s ite d amage MTOM maximum take - off mass MSG Maintenance Steering Group NAA n ational aviation a uthority NDI n on - d estructive i nspection NTSB National Transportation Safety Board PSE p rincipal s tructural e lement RAP r epairs a ssessment p rogramme REG s r epair e valuation g uidelines SB s ervice b ulletin SMP s tructural m odification p oint SRM s tructural r epair m anual SSID s upplemental s tructural i nspection d ocument SSIP s upplemental s tructural i nspection p rogramme STG s tructural t ask g roup STCH supplemental type certificate holder TCH t ype c ertificate h older WFD w idespread f atigue d amage 5. CONTINUING STRUCTURAL INTEGRITY PROGRAMME AND WAY OF WORKING (a) General The programmes and processes described in this and the subsequent paragraphs of this AMC are all part of an acceptable process to provide a continuing structural integrity programme t hat precludes unsafe levels of cracking.

DAHs and operators are expected to work together to ensure that their continuing structural integrity programmes remain valid.

Point 21.A.65 of Part 21 has been introduced in order to require that (R)TCHs establish a process to ensure that the continuing structural integrity programme for large aeroplanes remains valid throughout the operational life of the aeroplanes.

Points 26.300 through 26.309 of Part - 26 provide retroactive requirements for TCHs to establish a co ntinuing structural integrity programme for existing type design s of large aeroplanes. Furthermore, the level of safety achieved for these products is then ensured for future changes and repairs to these aeroplanes through compliance with points 21.A.101(h ) and 21.A.433(a)(5). Aeroplanes certified in accordance with CS - 25 Amendment 19 or later amendments have acceptable structural maintenance programmes. Nonetheless, in both cases, there is a need to ensure that the continuing structural integrity programme remains valid throughout the operational life of the aeroplane.

Powered by EASA eRules Page 174 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) (b) Maintaining the validity of the continuing structural integrity programme Points 21.A.65 of Part 21 and 26.305 of Part - 26 require (R) TCHs to establish a process that ensures that the cont inuing structural integrity programme remains valid throughout the operational life of the aeroplane, considering in - service experience and current operations. AMC1 21.A.65 and CS 26.305(a) and (c) describe the core content of the process required as the means of compliance with these point s , and further details are provided in Appendix 5 to this AMC.

The i ntent is for (R) TCHs for large transport aeroplanes to monitor the continued validity of the assumptions upon which the maintenance programme is based, and to ensure that unsafe levels of fatigue cracking or other structural deterioration will be precluded in service. It should be noted that this requirement applies to all structure s whose failure could contribute to a catastrophic failure, and it is not limited to metallic structures or fatigue cracking, but should also encompass composite and hybrid struc tures.

Typically, large aeroplanes are utilised in well - understood commercial transport scenarios for which conservative or more rational and well - bounded assumptions can be made at the time of certification or when the continuing structural integrity prog ramme is developed. Obvious changes to usage should be addressed for their impact on fatigue and damage tolerance when they occur. In particular, aeroplanes used for conducting surveys, VIP operations, firefighting or other special operations should be con sidered on a case - by - case basis.

Furthermore, as part of this process, the assumptions made for fatigue, accidental and environmental damage scenarios during certification should, on a regular basis, be validated against service experience to see whether t hey remain applicable.

The monitoring of operational usage is best achieved in cooperation with the operators, combined with fleet leader sampling inspection programmes. Where data does not correspond to the original certification assumptions, its potentia l impact on all ageing aeroplane structural programmes and CAW in general must be considered. The degree of impact that a change of usage may have is dependent on the level of conservatism in the selection of the original usage spectrum. It is recommended to review at regular intervals the operational usage data for which a change from the original assumptions would have an impact on the validity of the content of the programme. If this is not done, it might be necessary to investigate the operational usage on each occasion of a service finding in which operational usage could be a contributing factor.

(c) Way of working All the ageing aircraft programme elements discussed in this AMC benefit from cooperation between operators and TCHs. The use of structural task groups (STGs) has historically proved very successful in this regard, and is recommended.

On the initiative of the TCH and EASA , a n STG may be formed for each aircraft model for which it is decided to put in place an ageing aircraft program me. The STG shall consist of the TCH, selected operator members and EASA representative(s). The objective of the STG is to complete all tasks covered in this AMC in relation to their respective model types, including the following: — Develop model specific p rogrammes , — Define programme implementation , — Conduct recurrent programme reviews as necessary.

Powered by EASA eRules Page 175 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) It is recognised that it might not always be possible to form or to maintain an STG, due to a potential lack of resources with in the operators or TCH. Furthermore , for some mature products, the programmes and their implementation may be sufficiently mature to determine that an STG is not necessary, e.g. when large numbers of aeroplanes have already reached their expected retirement age and none are going to be oper ated beyond that point. This point could be determined by the LOV, provided that it is not extended.

In any case, the responsibilities for ensuring compliance with the applicable requirements are outlined in subparagraph (d) of this paragraph.

An acceptabl e way of working for STGs is described in the ‘ Report on Structures Task Group Guidelines ’ that was established by the AAWG with the additional clarifications provided in the following subparagraphs.

( 1 ) Meeting scheduling It is the responsibility of the T CH to schedule STG meetings.

( 2 ) Reporting The STG may make recommendations for actions via the TCH to EASA . Additionally, the STG should give periodic reports (for information only) to EASA as appropriate with the objective of maintaining a consistent approach.

( 3 ) Recommendations and decision - making The decision - making process described in the AAWG Report on Structures Task Group Guidelines paragraph 7 leads to recommendations for mandatory action from the TCH to EASA . In addition , it should be noted that EASA is entitled to mandate safety measures related to ageing aircraft structures, in addition to those recommended by the STG, if it finds it necessary.

( d ) Responsibilities (1) The TCH is responsible for developing the ageing aircraft stru ctures programme for each aircraft type, detailing the actions necessary to maintain airworthiness. Other DAH s should develop programmes or actions appropriate to the modification/repair for which they hold approval, unless addressed by the TCH. All the co ntinuing structural integrity programmes, including associated maintenance actions and DTIs, are changes to the ICA and, therefore, are subject to the Part 21 requirements for their promulgation. All DAHs will be responsible for monitoring the effectivenes s of their specific programme, and for amend ing the programme as necessary.

(2) The o perator is responsible for incorporating approved DAH actions necessary to maintain airworthiness into its aircraft - specific maintenance programmes, in accordance with Par t - M (point M.A.302) and point 26.370 .

(3) The competent authority of the S tate of registry , or the continuing airworthiness management organisation (CAMO) when it holds the approval privilege, is responsible for the approval of the aircraft maintenance pro gramme .

(4) EASA will approve elements of ageing aircraft structures programmes developed by DAHs and may issue ADs to support implementation, where necessary , e.g. to implement applicable inspections and maintenance actions necessary to support the LOV. H owever, it is intended that Part - M and, where necessary, Part - 26 requirements will be the usual means of implementation of ageing aircraft Powered by EASA eRules Page 176 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) programmes in European registered aircraft. EASA , in conjunction with the DAH, will monitor the overall effectiveness of ageing aircraft structures programmes.

(e) Continued airworthiness and management of cracks and other damage findings in service Point 26.305 of Part - 26 and point 21.A.65 of Part 21 require a process to be established that ensures that the continuing s tructural integrity programme remains valid throughout the operational life of the aeroplane, considering in - service experience and current operations. One of the elements of this process is the review of new occurrences, existing damage - tolerance - based in spections and service bulletins (SBs), which is established in order to determine the need for mandatory changes in cases where inspections alone would not be reliable enough, or to ensure that unsafe levels of cracking are precluded.

For a new type design, the regulations include the damage tolerance approach for preventing catastrophic failures due to fatigue. The damage tolerance approach depends on directed inspection programmes to detect fatigue cracks before they reach their critical sizes.

If a n inspection finds cracks in a damage - tolerant fleet, the approval holder, together with EASA, may determine that a demonstrated risk exists, and require additional airworthiness actions, including more rigorous inspection requirements or fleet - wide replac ement or modification of the structure.

Cracking is a continued airworthiness issue because cracking usually reduces the strength of the structure to less than its design ultimate strength level. Service history has shown that the reliability of directed inspections is never sufficient to detect all cracks. As the number of crack reports increases, the likelihood that a number of aeroplanes in the fleet have undetected fatigue cracks also increases. Therefore, for areas where fatigue cracks are re ported, the likelihood increases that a number of aeroplanes in the fleet will have strengths less than the design ultimate strength level. At some time during operation of the fleet, the likelihood that the strength of any given structure in a fleet is le ss than the design ultimate strength level may become unacceptably high. The loss of design ultimate strength capability should be a rare event, and EASA rarely knowingly allows the strength of aeroplanes to drop below the design ultimate strength level wi th any significant frequency.

Approval holders can use the damage tolerance approach to address an unsafe condition.

However, it should be understood that damage - tolerance - based inspections may not provide a permanent solution, as explained above, and in c ases where cracks are expected to continue to develop in the fleet, the approval holder should propose, and EASA may require, the fleet - wide replacement, modification, or removal from service of the structure.

Other than fatigue crack findings, significant environmental and accidental damage findings should also be taken into account. Initial and critical damage scenarios assumed for certification should be compared to those being reported and where there are differences, the potential airworthiness impact should be evaluated. Differences may include the pattern and extent of cracking, corrosion or accidental damage, the time at which it was discovered and the rate of growth.

More guidance on the continued airworthiness procedures for airframe structures to ensure the validity of the continuing structural integrity programme is provided in Appendix 5 .

Powered by EASA eRules Page 177 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 6 . DAMAGE - TOLERANCE - BASED INSPECTION PROGRAMME Aeroplanes certified to JAR 25 Chang e 10 or later or 14 CFR 25 Amdt 54 or later are provided with an airworthiness limitations section (ALS) that includes damage - tolerance - based inspections. Many aeroplanes certified to earlier amendments have also been provided with a DT - based ALS.

Point 26 .302 of Part - 26 requires TCHs for certain large transport aeroplanes to perform a damage tolerance evaluation (DTE) and establish the associated inspections and other procedures that ensure freedom from catastrophic failures due to fatigue throughout the o perational life of the aeroplane. An SSID or ALS developed according to the guidance of this AMC or an SSID mandated under a current EASA AD will satisfy the requirements of point 26.302 of Part - 26. In the absence of a n approved damage - tolerance - based stru ctural maintenance inspection programme , the TCH, in conjunction with operators, is expected to initiate the development of a n SSIP for each aeroplane model. The role of the operator is principally to comment on the practicality of the inspections and any other procedures defined by the TCH and to implement them effectively.

The SSID or ALS should include inspection threshold, repeat interval, inspection methods and procedures. The applicable modification status, associated life limitation and types of oper ations for which the SSID is valid should also be identified and stated.

For aeroplanes for which a DTE is necessary in accordance with CS 25.571 or point 26.302 of Part - 26, all inspections and other procedures must be provided that are anticipated to be n ecessary throughout the operational life of the aeroplane to prevent catastrophic failures due to fatigue. For an aircraft maintenance programme subject to an LOV under point 26.303 of Part - 26 or CS 25.571, the DTE need only provide the inspections and oth er procedures necessary to prevent catastrophic failures up to the LOV. For other aeroplanes, it is recommended that the ALS includes an LOV or similar limitation on the applicability of the maintenance programme , otherwise the programme should be shown to address the maximum potential usage of the aeroplane based on experience with similar products or a conservative assumption. For an SSIP newly developed to meet point 26.302 of Part - 26, the guidance of this AMC applies.

In addition, the inspection access, the type of damage being considered, likely damage sites and details of the resulting fatigue cracking scenario should be included as necessary to support the prescribed inspections.

As a result of a periodic review, the TCH should revise the SSID wheneve r additi onal information shows a need. The original SSID will normally be based on predictions or assumptions (from analyses, tests, and/or service experience) of failure modes, time to initial damage, frequency of damage, typically detectable damage, and the damage growth period. Consequently, a change in these factors sufficient to justify a revision would have to be substantiated by test data or additional service information. Any revision to SSID criteria and the basis for these revisions should be subm itted to EASA for review and approval of both engineering and maintenance aspects.

7. DAMAGE TOLERANCE EVALUATION OF REPAIRS AND MODIFICATIONS Early fatigue or fail - safe requirements (pre - JAR 25.571 Change 7 and 14 CFR §25.571 Amdt 45) did not necessarily provide for timely inspection of critical structure so that damaged or failed components could be dependably identified and repaired or replaced before a hazardous condition developed. This applies to modifications and repairs as well as baseline structure.

Furthermore, it is known that application of later fatigue and damage tolerance requirements to repairs was not always fully implemented according to the relevant certification bases.

Powered by EASA eRules Page 178 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) As such, repairs and modifications that h ave not been subject to a DTE and provided with any necessary DTI may have an adverse effect on the FCS and the safety level achieved by the damage - tolerance - based inspection programme of the baseline structure.

As a result of the above considerations, Par t - 26 requirements for existing repairs and changes to ageing aeroplane structure were introduced to include specific requirements applicable to certain DAHs and operators of large aeroplanes. Some further details and background are provided here, and Appendix 3 provides additional information on means of compliance with the Part - 26 requirements and the associated CS - 26 specifications for existing repairs and modifications.

For large aeroplanes with 30 pax or more or having a payload of 3 402 kg (7 500 lb) or more, TCHs must: (a) identify and list the FCS according to points 26.306 and 26.307 of Part - 26 for FCBS and FCMS respectively and make the list available to assist operators and STCHs needing to identify changes that may require DTE and DTI; (b) perform DTE of changes according to point 26.307 of Part - 26 and submit the damage tolerance data for approval to EASA; and (c) review published repair data and perform DTE in accordance w ith point 26.308 of Part - 26.

DTIs are ICA and need to be made available to operators according to Part 21. Published repair data includes structural repair manuals (SRMs) and SBs. The data in published repair documentation that needs to be updated includes non - reinforcing repairs such as blending out of scratches, etc. that could be implemented by operators in the future.

For large aeroplanes with 30 pax or more or having a payload of 3 402 kg (7 500 lb) or more, STCHs must: (a) identify changes that affect FCBSs and list FCMSs according to point 26.332 of Part - 26, and make lists of FCMSs available to assist operators and STCHs needing to identify changes that may require DTE and DTI; and (b) perform DTE of changes and published repairs to those changes acco rding to points 26.333 or 26.334 of Part - 26 for changes approved on or after 1 September 2003 or before that date respectively, and submit the damage tolerance data to EASA for approval.

CS - 26 specifies means of compliance for the DTE itself, and Appendix 3 to this AMC provides means of compliance for the identification of the FCS and implementation of DTI.

The repair evaluation guidelines (REGs) developed by the TCH are intended to assist the operator in addressing the adv erse effects of existing reinforcing repairs on the FCS, including the affected adjacent structure, based on damage tolerance principles, consistent with the safety level provided by the SSID or ALS as applied to the baseline structure. In this context, ad jacent structure means structure whose fatigue and damage tolerance behaviour and DTE are affected by the reinforcing repair. To achieve this, the REGs should be developed by the TCH and implemented by the operator to ensure that an evaluation is performed of all existing reinforcing repairs to structure that is susceptible to fatigue cracking and could contribute to a catastrophic failure.

Even the best maintained aircraft will accumulate structural repairs when being operated. The AAWG conducted two separate surveys of repairs placed on aircraft to collect data. The evaluation of these surveys revealed that 90 % of all repairs found were on the fuselage, hence these are a priority and repair assessment programmes ( RAPs ) have already been developed for Powered by EASA eRules Page 179 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) the fuselage pressure shell of many large transport aeroplanes not originally certified to damage tolerance requirements. 40 % of the repairs were classified as adequate and 60 % of the repairs required consideration for possible additional supplemental i nspection during service.

Nonetheless, following further studies by the AAWG working groups , it was agreed that repairs to all structure susceptible to fatigue and whose failure could contribute to catastrophic failure should be considered. (Ref. AAWG Repo rt: Recommendations concerning ARAC taskings FR Doc 04 - 10816 Re f. Aging Airplane safety final rule. 14 CFR 121.370a and 129.16.)

As aircraft operate into high cycles and high times the ageing repaired structure needs the same considerations as the original structure in respect of damage tolerance. Existing repairs may not have been assessed for damage tolerance and appropriate inspections or other actions implemented. Repairs are to be assessed, replaced if necessary or repeat inspections determined and car ried out as supplemental inspections or within the baseline zonal inspection programme. A damage - tolerance - based inspection programme for repairs will be required to detect damage which may develop in a repaired area before that damage degrades the load ca rrying capability of the structure to less than the levels required by the applicable airworthiness standards.

Point 26.309 of Part - 26 requires TCHs of aeroplanes with TCs issued prior to 11 January 2008, with 30 pax or more or having a payload of 3 402 kg (7 500 lb) or more, to develop REGs and submit them to EASA for approval.

The REG s should provide data for operators to address existing reinforcing repairs to all structure that is susceptible to fatigue cracking and could contribute to a catastrophic fa ilure.

The REG s may refer to the RAP, other existing approved data such as the SRM s and SBs or provide specific means for obtaining data for individual repairs.

This fatigue and damage tolerance evaluation of repairs will establish an appropriate inspection programme or a replacement schedule if the necessary inspection programme is too demanding or not possible. Details of the means by which the REGs and the maintenance programme may be developed are incorporated in Appendix 3 to this AMC .

Point 26.370 of Part - 26 directs the operator and organisations responsible for the continuing airworthiness of certain large aeroplanes to revise their maintenance programmes to address the potential adverse effects of repairs and modifications on fatigue - critical structures. The basis for achieving this for existing repairs is the implementation of the REGs supplied by the TCH and, for modifications, the data supplied by the original DAH or a third party contracted by the operator. All repairs and changes that affect the FCS and that are approved and implemented after the applicable date of point 26.370 of Part - 26 should be subj ect to DTE and provided with inspections and other procedures, as necessary. Further guidance on obtaining DTIs and the implementation of the ICA is provided in Appendix 3 to this AMC.

8 . LIMIT OF VALIDITY OF THE MAINTENANCE PROGRAMME AND WIDESPREAD FATIGUE DAMAGE (WFD) EVALUATION ( a) Initial WFD e valuation and LOV All fatigue and damage tolerance evaluations are finite in scope and also therefore in their long - term ability to ensur e continued airworthiness. The maintenance requirements that evolve from these evaluations have a finite period of validity defined by the extent of testing, analysis and service experience that make up the evaluation and the degree of associated uncertain ties. The l imit of validity (LOV) of the engineering data that supports the structural maintenance programme is defined as being not more than the period of time, stated as a number of total accumulated flight cycles or flight hours or both, for which it h as been demonstrated that widespread fatigue damage (WFD) is Powered by EASA eRules Page 180 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) unlikely to occur in the aeroplane structure. To support the establishment of the LOV, the DAH will demonstrate by test evidence, analysis, and, if available, service experience and teardown insp ection results of high - time aeroplanes, that WFD is unlikely to occur in that aeroplane up to the LOV. The LOV, in effect, is the operational life of the aeroplane consistent with the evaluations accomplished and the maintenance actions established to prev ent WFD.

Note : Although the LOV is established based on WFD considerations, it is intended that all maintenance actions required to address fatigue, corrosion, and accidental damage up to the LOV should be identified in the structural - maintenance programme . All the inspections and other procedures (e.g. modification times, replacement times) that are necessary to prevent a catastrophic failure due to fatigue, up to the LOV, should be included in the ALS of the instructions for continued airworthiness (ICA), as required by CS 25.1529, along with the LOV.

In some cases, the ALS may already contain an LOV which is approved in accordance with a regulation of another authority. There may also be other potentially more restrictive limitations on the validity of th e maintenance programme. For these cases, when the TCH needs to publish the LOV as required by point 26.303 of Part - 26, this LOV and its relationship with the existing or superseded limitation should be clearly described in order that no operator will exce ed the most restrictive applicable limit on the general validity of the maintenance programme.

The likelihood of the occurrence of fatigue damage in an aircraft’s structure increases with aircraft usage. The design process generally establishes a design se rvice goal (DSG) in terms of flight cycles/hours for the airframe. It was generally expected when fatigue and fail - safe rules were first developed that any cracking that occurs on an aircraft operated up to the DSG w ould occur in isolation (i.e. local cracking), originating from a single source, such as a random manufacturing flaw (e.g. a mis - drilled fastener hole) or a localised design detail. It wa s considered unlikely that cracks from manufacturing flaws or localised d esign issues w ould interact strongly as they grow. The SSIP s described in paragraph 6 of and Appendix 1 to this AMC were intended to find all forms of fatigue damage before they be come critical. Nonetheless, it has become apparent that as aircraft have approached and exceeded their DSG , only some SSIPs have correctly addressed WFD as described below.

It should be noted that the majority of aeroplanes in the European fleet are now da mage - tolerance - certified, and that JAR and CS damage tolerance requirements have always required the consideration of all forms of fatigue damage, including damage that would now be described as multiple - site damage (MSD) or multiple - element damage (MED).

JAR 25.571 at Change 7 stated: ‘(b) Damage tolerance (fail - safe) evaluation.

The evaluation must include a determination of the probable locations and modes of damage due to fatigue, corrosion, or accidental damage. The determination must be by analysis su pported by test evidence and (if available) service experience. Damage at multiple sites due to prior fatigue exposure must be included where the design is such that this type of damage can be expected to occur.’ Powered by EASA eRules Page 181 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) AMC 25.571(a), (b) and (e) stated in Sect ion 2.1.1.: ‘d. Provisions to limit the probability of concurrent multiple damage, particularly after long service, which could conceivably contribute to a common fracture path. The achievement of this would be facilitated by ensuring sufficient life to cr ack initiation.

Examples of such multiple damage are: i. A number of small cracks which might coalesce to form a single long crack; ii. Failures, or partial failures, in adjacent areas, due to the redistribution of loading following a failure of a single e lement; and iii. Simultaneous failure, or partial failure, of multiple load path discrete elements, working at similar stress levels.

In practice it may not be possible to guard against the effects of multiple damage and failsafe substantiation may be valid only up to a particular life which would preclude multiple damage.’ Nonetheless, it is not clear whether all applicants followed this guidance, hence the development of the Part - 26 ageing aeroplane structure requirements and the revision of CS 25.571 at Amendment 19 to include specific means to address WFD. The AMC to these requirements includes the establishment of maintenance actions to modify (or replace) WFD - susceptible structure prior to the LOV whenever necessary to preclude WFD.

In accordance with point 26.303 of Part - 26, TCHs of aeroplanes with MTOMs > 34 019 kg (75 000 lb) have to establish an LOV and the maintenance actions upon which the LOV is dependent, for all model variations and derivatives appr oved under the TC before 26 February 2021, and all structural changes and replacements to the structural configurations of those aeroplanes that are required by an airworthiness directive (AD) issued before 26 February 2021. Future changes by the TCH to th ese aeroplanes should also be subject to WFD evaluation. For aeroplane structure certified to CS 25.571 Amdt 19 or later amendment, the fatigue and damage tolerance evaluation requires specific consideration of WFD, see AMC 25.571 paragraph 10.

For a new D TE performed to comply with Part - 26 for existing changes or repairs or for new changes or repairs, according to CS 25.571 Amdt 18 or earlier, the evaluation should take into account cracking scenarios that could reasonably be expected to occur in the remai ning operational lifetime of the aeroplane in which the repair or modification is implemented. The inspections and other procedures established do not have to include modification and replacement, although the guidance of the applicable ACJ/AMC 25.571 as d escribed above should be considered.

WFD may originate in two basic forms, either as MSD or as MED. With extended usage, uniformly loaded structure may develop cracks in adjacent repetitive features such as fastener holes (MSD) , or in adjacent similar stru ctural details (MED) . The development of cracks at multiple locations (both MSD and MED) may also result in strong interactions that can affect subsequent crack growth, in which case the predictions for local cracking would no longer apply. An example of t his situation may occur at any skin joint where load transfer occurs. Simultaneous cracking at many fasteners along a common rivet line may reduce the residual strength of the joint to the less than the required levels before the cracks are detectable unde r the maintenance programme established at the time of certification.

Powered by EASA eRules Page 182 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Appendix 2 provides guidelines for development of a programme to preclude the occurrence of WFD. Such a progr amme must be implemented before analysis, tests, and/or service experience indicate that WFD may develop in the fleet. The operator’s role is to provide service experience, to help ensure the practicality of the programme and to ensure it is implemented ef fectively.

The proposed LOV and the results of the WFD evaluation should be presented for review and approval to EASA for the aeroplane model being considered.

Note : The LOV applies to aeroplanes, not to individual parts. Should there be any concerns about the service life of a removable component containing FCS or principal structural elements (PSEs), a modification or life limitation arising from the WFD evaluation can be mandated on that specific component, which would then need to be track ed.

EASA’s review of the WFD evaluation results will include both engineering and maintenance aspects of the proposal. Per Appendix I to AMC M.A.302, any actions necessary to preclude WFD, including the LOV, are to be incorporated in the maintenance progra mmes developed in compliance with Part - M. Any SBs or other service information publications revised or issued as a result of in - service MSD/MED findings resulting from implementation of these programmes may require separate AD action.

In the event an accep table WFD evaluation cannot be completed on a timely basis, EASA may impose service life, operational, or inspection limitations to assure structural integrity of the subject type design.

( b) Revision of WFD evaluation and LOV New in - service experience fin dings, improvements in the prediction methodology, better load spectrum data, a change in any of the factors upon which the WFD evaluation is based or economic considerations may dictate a revision to the evaluation. Accordingly, associated new recommendat ions for service action should be developed including a revised LOV, if appropriate, and submitted to EASA for review and approval of both engineering and maintenance aspects.

An LOV may be extended under the provisions of Part 21. In such cases, the appli cant must demonstrate that WFD will not occur in the aeroplane up to the proposed extended LOV. The applicant should consider the age (flight cycles or flight hours or both) of high - time aeroplanes relative to the existing LOV to determine when to begin de veloping data to extend it. Because the data is likely to include additional full - scale fatigue testing, the applicant should allow sufficient time to complete such testing and to submit the compliance data for approval. An extended LOV is a major change t o the type design of an aeroplane and according to point 21.A.101(h) the level of safety provided by the existing LOV must be maintained up to the extended LOV . An extended LOV may also include specified maintenance actions, which would be part of the new LOV approval.

Extended LOVs, along with any required maintenance actions for the extended LOV, would be incorporated into the ALS.

Note : Extending an LOV without a physical modification to the aeroplane is not considered a ‘significant’ design change in ac cordance with point 21.A.101 of Part - 21. However, if extending the LOV requires a physical design change to the aeroplane, the design change is to be evaluated in accordance with point 21.A.101 of Part - 21.

Powered by EASA eRules Page 183 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) For practical purposes, it is suggested that the S RM should also be reviewed and updated to facilitate its continued applicability up to the extended LOV. If this is not done, all SRM - based repairs will require individual approval. The results together with any necessary actions required to preclude WFD f rom occurring before the aeroplane reaches the revised LOV should be presented for review and approval by EASA.

Note : Although the extended LOV is established based on WFD considerations, it is intended that all maintenance actions required to address fati gue, corrosion, and accidental damage up to the extended LOV should be identified in the structural - maintenance programme. All inspections and other procedures (e.g.

modification times, replacement times) that are necessary to prevent a catastrophic failur e due to fatigue, up to the extended LOV, should be included in the ALS of the ICA, as required by CS 25.1529, along with the extended LOV.

9. CORROSION PREVENTION AND CONTROL PROGRAMME A corrosion prevention and control programme (CPCP) is a systematic ap proach to prevent and to control corrosion in the aircraft’s primary structure. The objective of a CPCP is to limit the deterioration due to corrosion to the level necessary to maintain airworthiness and, where necessary, to restore the corrosion protectio n schemes for the structure. A CPCP consists of a basic corrosion inspection task, task areas, defined corrosion levels, and compliance times (implementation thresholds and repeat intervals). The CPCP also includes procedures to notify the competent author ity and TCH of the findings and data associated with Level 2 and Level 3 corrosion and the actions taken to reduce future findings to Level 1 or better. See Appendix 4 for definitions and further details.

As part of the ICA, the TCH should provide an inspection programme that includes the frequency and extent of the inspections necessary to provide the continued airworthiness of the ai rcraft.

Furthermore, the ICA should include the information needed to apply protective treatments to the structure after inspection. In order for the inspections to be effectively accomplished, the TCH should provide corrosion removal and cleaning procedur es and reference allowable limits (e.g. an SRM). The TCH should include all of these corrosion - related activities in a manual referred to as the baseline CPCP. Alternatively, the baseline CPCP may be developed as part of the ICA established by the MRB (ISC ) using existing MSG - 3 procedures. This baseline CPCP documentation is intended to form a basis for operators to derive a systematic and comprehensive CPCP for inclusion in the operator’s maintenance programme. For operators and owners subject to point 26. 370 of Part - 26, the operator’s CPCP must take into account the TCH’s baseline CPCP. The competent authority for the operator’s CPCP is the authority responsible for their AMP. The TCH is responsible for monitoring the effectiveness of the baseline CPCP and , if necessary, for recommending changes based on the operator’s reports of findings. In line with the Part - M requirements, when the TCH publishes revisions to their baseline CPCP, these should be reviewed and the operator’s programme adjusted as necessary in order to limit corrosion to Level 1 or better.

The operator should ensure that the CPCP is comprehensive in that it addresses all corrosion likely to affect primary structure, and is systematic in that: (a) it provides step - by - step procedures that are applied on a regular basis to each identified task area or zone, and (b) these procedures are adjusted when they result in evidence that corrosion is not being limited to an established acceptable level (Level 1 or better).

Powered by EASA eRules Page 184 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Note : For an aeroplane with an A LS, in addition to providing a suitable baseline CPCP in the ICA, it is appropriate for the TCH to place an entry in the ALS stating that all corrosion should be limited to Level 1 or better. (This practice is also described in ATA MSG - 3.)

[Amdt 20/2] [Amd t 20/20] [Amdt 20/22]

A ppendix 1 to AMC 20 - 20 B Guidelines for the development of a

s upplementary s tructural i nspection p rogramme

ED Decision 2021/007/R 1. GENERAL 1.1 Purpose This Appendix 1 gives interpretations, guidelines and acceptable means of compliance for the SSIP actions. Aeroplanes addressed by point 26.302 of Part - 26 require damage tolerance inspections (DTIs) and other procedures to ensure freedom from catastrophic failure due to fatigue throughout the operational life of the aircraft. Co mpliance can be demonstrated by developing an SSIP or DT - based ALS. Other aircraft may benefit from an SSIP, and some TCHs have already developed programmes for general aviation types that should also be implemented under Part - M requirements.

1.2 Backgroun d Service experience has demonstrated that there is a need to have continu ally updated knowledge concerning the structural integrity of aircraft, especially as they become older , to ensure they continue to meet the level of safety intended by the certifica tion specifications . In addition, early fatigue requirements, such as ‘ fail safe ’ regulations , did not provide for timely inspection of an aircraft’s critical structure to ensure that damaged or failed components could be dependably identified and then rep aired or replaced before hazardous conditions developed.

In 1978 the damage tolerance concept was adopted for transport category aeroplanes in the USA as Amendment 25 - 45 to 14 C F R 25.571. This amended rule required damage tolerance analyses as part of the type design of transport category aeroplanes for which application for type certification was received after the effective date of the amendment.

In 1980 the requirement for damage tolerance analyses was also included in JAR 25.571 Change 7.

One prerequisi te for the successful application of the damage tolerance approach for managing fatigue is that crack growth and residual strength can be anticipated with sufficient precision to allow inspections to be established that will detect cracking before it reach es a size that will degrade the strength to less than a specified level. When damage is discovered, airworthiness is ensured by repair or revised maintenance action. Evidence to date suggests that when all critical structure is included, fatigue and damage - tolerance - based inspections and procedures (including modification and replacement when necessary) provide the best approach to address aircraft fatigue.

Pre - 14 C F R Part 25 Amendment 25 - 45 (JAR - 25 Change 7) aeroplanes were built to varying standards that embodied fatigue and fail - safe requirements. These aeroplanes, as certified, had no specific mandated requirements to perform inspections for fatigue.

Following the amendment of 14 CF R Part 25 to embody damage tolerance requirements, Powered by EASA eRules Page 185 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) the FAA published Advi sory Circular 91 - 56A. That AC was applicable to pre - Amendment 25 - 45 aeroplanes with a maximum gross weight greater than 75 000 lb (34 019 kg) . According to the AC , the TCH, in conjunction with operators, was expected to initiate development of a n SSIP for each aeroplane model.

AC 91 - 56A provided guidance material for the development of such programmes based on damage tolerance principles. Many TCHs of large aeroplan es developed SSIPs for their pre - Amendment 25 - 45 aeroplanes. The documents containing the SSIP are designated SSID s or SID s.

The competent authorities have in the past issued a series of ADs requiring compliance with these SSIPs . Generally , these ADs requi re the operators to incorporate the SSIPs into their maintenance programmes. Under Part - M requirements , it is expected that an operator will automatically incorporate the SSID into their maintenance programme once it is approved by EASA, unless already man dated by an AD .

For post - Amendment 25 - 45 aeroplanes (JAR - 25 Change 7), it was required that inspections or other procedures should be developed based on the DTE s required by 14 C F R 25.571, and included in the maintenance data. In Amendment 25 - 54 to 14 C F R 25 and change 10 to JAR - 25 , it was required to include these inspections and procedures in the ALS of the ICA required by 25.1529. At the same amendment, 25.1529 was changed to require applicants for type certificates to prepare IC A in accordance with Appe ndix H to FAR/JAR - 25. Appendix H requires that the ICA must contain a section titled a irworthiness l imitations that is segregated and clearly distinguishable from the rest of the document. This section shall contain the information concerning inspections a nd other procedures as required by FAR/JAR/CS 25.571.

The content of the ALS of the ICA is designated by some TCHs as a irworthiness l imitations i nstructions (ALI). Other TCHs have decided to designate the same items as ALI.

Part - M requires the ALS to be in corporated into the operator’s maintenance programme.

2. SUPPLEMENTAL STRUCTURAL INSPECTION PROGRAMME (SSIP) Increased utilisation, longer operational lives, and the high safety demands imposed on the current fleet of transport aeroplanes indicate the need for a programme to ensure a high level of structural integrity for all aeroplanes in the transport fleet.

This AMC is intended to provide guidance to TCHs and other DAHs to develop or review existing inspection programmes for effectiveness. SSIPs are based on a thorough technical review of the damage tolerance characteristics of the aircraft structure using the latest techniques and changes in operational usage. They lead to revised or new inspection requirements primarily for structural cracking and r eplacement or modification of structure where inspection is not practical.

Whether the aircraft was originally certified to be damage - tolerant or not, the TCH should review its operational usage on a regular basis and ensure that it remains in accordance w ith the assumptions made at certification or when the SSIP was first developed. Factors such as the payload, fuel at take - off and landing, flight profile, etc. should be addressed. For large transport aeroplanes, the requirement of point 26.305 of Part - 26 stipulates that a process must be in place to ensure that the continuing structural integrity programme remains valid, considering service experience and current operations.

Large transport aeroplanes that were certified according to 14 C F R 25.571 Amendmen t 25 - 45 or JAR 25 Change 7 or later are damage - tolerant. The maintenance instructions and airworthiness limitations arising from the fatigue and damage tolerance evaluations that have Powered by EASA eRules Page 186 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GEN ERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) been specified as mandatory are included in the ALS (and/or ADs). Other maintenance instructions are usually part of the MRB Report, as required by ATA MSG - 3. However, for pre - ATA MSG - 3 rev 2 aeroplanes there are no requirements for regular MRB Report review and for post - ATA MSG - 3 rev 2 aeroplanes there is only a requirement f or regular MRB Report review in order to assess whether the CPCP is effective. Concerning ageing aircraft activities, it is important to regularly review the part of the MRB Report containing the structural inspections resulting from the fatigue and damage tolerance analysis for effectiveness.

2.1 Pre - Amendment 25 - 45 aeroplanes The TCH is expected to initiate development of a n SSIP for each aeroplane model. Such a programme must be implemented before analysis, test and/or service experience indicate that a significant increase in inspection and or modification is necessary to maintain structural integrity of the aeroplane. This should ensure that an acceptable programme is available to the operators when needed. The programme should include procedures for ob taining service information, and assessment of service information, available test data, and new analysis and test data.

A n SSID should be developed in accordance with Paragraph 3 of this Appendix 1. The recommended SSIP, along with the criteria used and t he basis for the criteria, should be submitted by the T CH to EASA for approval. The SSIP should be adequately defined in the SSID and presented in a manner that is effective. The SSID should include the type of damage being considered, and likely sites; in spection access, threshold, interval method and procedures; applicable modification status and/or life limitation; and types of operation for which the SSID is valid.

The review of the SSID by EASA will include both engineering and maintenance aspects of t he proposal. In the event an acceptable SSID cannot be obtained on a timely basis , the competent authority may impose service life, operational, or inspection limitations to assure structural integrity .

The TCH should check the SSID periodically against current service experience. This should include an evaluation of current methods and findings. Any unexpected defect occurring should be assessed as part of the continuing assessment of structural integrity to determine a need for revi sion to the document.

2.2. Post - Amendment 25 - 45 aeroplanes Aeroplanes certified to FAR 25.571 Amendment 25 - 45, JAR 25.571 Change 7 and CS - 25 or later amendments are damage - tolerant. The airworthiness limitations including the inspections and procedures est ablished in accordance with FAR/JAR/CS 25.571 shall be included in the ICA , ref. FAR/JAR/CS 25.1529. Further guidance for the actual contents is incorporated in FAR/JAR/CS - 25 Appendix H.

To maintain the structural integrity of these aeroplanes , it is necessary to follow up the effectiveness of these inspections and procedures. The DAH should therefore check this information periodically against current service experience. Any unexpected defect occurring should be assessed as part of the continui ng assessment of structural integrity to determine a need for revision to this information. The revised data should be developed in accordance with the same procedures as at type certification giving consideration to any additional test or service data ava ilable and changes to aeroplanes operating patterns.

Powered by EASA eRules Page 187 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 3. GUIDELINES FOR DEVELOPMENT OF THE SUPPLEMENTAL STRU CTURAL INSPECTION DOCUMENT This paragraph is based directly on Appendix 1 to FAA AC 91 - 56 B which applies to transport category aeroplanes that were certified prior to Amendment 25 - 45 of 14 C F R 25 or equivalent requirement.

3.1. General Amendment 25 - 45 to § 25.571 of 14 CFR Part 25 introduced wording which emphasises damage - tolerant design. However, the structure to be evaluated, the type of damage co nsidered (fatigue, corrosion, service, and production damage), and the inspection and/or modification criteria should, to the extent practicable, be in accordance with the damage tolerance principles of the current § 25.571 of 14 CFR Part 25 standards. An acceptable means of compliance can be found in AC 25.571 - 1C ( ‘ Damage - Tolerance and Fatigue Evaluation of Structure ’, dated April 29, 1998) or later revision.

It is essential to identify the structural parts and components that contribute significantly to c arrying flight, ground, pressure, or control loads, and whose failure could affect the structural integrity necessary for the continued s afe operation of the aeroplane. The damage tolerance of these parts and components must be established or confirmed.

Fo llowing the guidance material of AMC 25.571, it is essential that the inspections provided in the SSIP or ALS are practical and effective in maintaining airworthiness.

Where this is not the case, modifications or replacements should be considered.

Analyses made in respect of the continuing assessment of structural integrity should be based on supporting evidence, including test and service data. This supporting evidence should include consideration of the operating loading spectra, structural loading distri bu tions, and material behaviour. Appropriate allowance should be made for the scatter in life to crack initiation and rate of crack propagation in establishing the inspection threshold, inspection frequency, and, where appropriate, retirement life.

Alterna tively, an inspection threshold may be based solely on a statistical assessment of fleet experience, if it can be shown that equal confidence can be placed in such an approach.

An effective method of evaluating the structural condition of older aeroplanes is selective inspection with intensive use of non - destructive techniques, and the inspection of individual aeroplanes, involving partial or complete dismantling ( ‘ teardown ’ ) of available structure.

The effect of repairs and modifications approved by the TCH should be considered. In addition, it may be necessary to consider the effect of non - TCH repairs and modifications on individual aircraft. The operator has the responsibility for ensuring notifica tion and consideration of any such aspects in conjunction with the DAH. Guidance on the EASA’s requirements for the DT of repairs and modifications is found in Appendix 3 to this AMC, and further guidance for the WFD evaluation of repairs and modifications is provided in Section 7 of Appendix 2 .

3.2. Damage - tolerant structures The damage tolerance assessme nt of the aircraft structure should be based on the best information available. The assessment should include a review of analysis, test data, operational experience, and any special inspections related to the type design.

Powered by EASA eRules Page 188 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) A determination should then be ma de of the site or sites within each structural part or component considered likely to crack, and the time or number of flights at which this might occur.

The growth characteristics of damage and interactive effects on adjacent parts in promoting more rapid or extensive damage should be determined. This determination should be based on study of those sites that may be subject to the possibility of crack initiation due to fatigue, corrosion, stress corrosion, disbonding, accidental damage, or manufacturing de fects in those areas shown to be vulnerable by service experience or design judgement. The damage tolerance certification specification of CS 25.571 requires not only fatigue damage to be addressed but also accidental and environmental damage.

Some types o f accidental damage (e.g. scribe marks) can not be easily addressed by the MSG process and require specific inspections based on fatigue and damage tolerance analysis and tests. Furthermore, some applicants may cho o se to address other types of accidental d amage and environmental damage in the SSID or ALS by modelling the damage as a crack and performing a fatigue and damage tolerance analysis. The resulting inspection programme may be tailored to look for the initial type of damage or the resulting fatigue cracking scenario, or both.

The minimum size of damage that is practical to detect and the proposed method of in spection should be determined. This determination should take into account the number of flights required for the crack to grow from detectable to the allowable limit, such that the structure has a residual strength corresponding to the conditions stated under CS 25.571.

Note : In determining the proposed method of inspection, consideration should be given to visual inspection, non - destructive test ing, and analysis of data from built - in load and defect monitoring devices.

The continuing assessment of structural integrity may involve more extensive damage than might have been considered in the original fail - safe evaluation of the aircraft, such as: ( a) a number of small adjacent cracks, each of which may be less than the typically detectable length, developing suddenly into a long crack; (b) f ailures or partial failures in other locations following an initial failure due to redistribution of loading c ausing a more rapid spread of fatigue; and (c) c oncurrent failure or partial failure of multiple load path elements (e.g., lugs, planks, or crack arrest features) working at similar stress levels.

3.3. Information to be included in the assessment The conti nuing assessment of structural integrity for the particular aircraft type should be based on the principles outlined in par agraph 3.2 of this Appendix. The following information should be included in the assessment and kept by the TCH in a form acceptable to EASA : (a) t he current operational statistics of the fleet in terms of hours or flights; (b) t he typical operational mission or missions assumed in the assessment; (c) t he structural loading conditions from the chosen missions; and (d) s upporting test evidence and relevant service experience.

Powered by EASA eRules Page 189 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) In addition to the information specified above, the following should be included for each critical part or component: (a) t he basis used for evaluating the damage tolerance characteristics of the par t or component; (b) t he site or sites within the part or component where damage could affect the structural integrity of the aircraft; (c) t he recommended inspection methods for the area; (d) f or damage - tolerant structures, the maximum damage size at which the residual strength capability can be demonstrated and the critical design loading case for the latter; and (e) f or damage - tolerant structures, at each damage site the inspection threshold and the damage growth interval between detectable and critical, including any likely interaction effect from o ther damage sites.

Note : Where re - evaluation of fail - safety or damage tolerance of certain parts or components indicates that these qualities cannot be achieved, or can only be demonstrated using an inspection procedure whose practicability or reliability may be in doubt, replacement or modification action may need to be defined.

3.4. Inspection programme The purpose of a continuing airworthiness assessment in its most basic terms is to adjust the current mainte nance inspection programme, as required, to assure continued safety of the aircraft type.

In accordance with Paragraphs 1 and 2 of this Appendix, an allowable limit of the size of damage should be determined for each site such that the structure has a resi dual strength for the load con ditions specified in CS 25.571. The size of damage that is practical to detect by the proposed method of inspection should be determined, along with the number of flights required for the crack to grow from detectable to the a llowable limit.

The recommended inspection programme should be determined from the data described above, giving due consideration to the following: (a) f leet experience, including all scheduled maintenance checks; (b) c onfidence in the proposed inspection technique; and (c) t he joint probability of reaching the load levels described above and the final size of damage in those instances where probabilistic methods can be used with acceptable confidence.

Inspection thresholds for supplemental ins pections shou ld be established. These inspections would be supplemental to the normal inspections, including the detailed internal inspections.

(a) For structure with reported cracking, the threshold for inspection should be determined by analysis of the service data a nd available test data for each individual case.

(b) For structure with no reported cracking, it may be acceptable, provided sufficient fleet experience is available, to determine the inspection threshold on the basis of analysis of existing fleet data alone. This threshold should be set such as to include Powered by EASA eRules Page 190 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) t he inspection of a sufficient number of high - time aircraft to develop added confidence in the integrity of the structure (see Paragraph 1 of this Appendix).

3.5. The supplemental structural inspection document (SSID) The SSID should contain the recommendat ions for the inspection procedures and replacement or modification of parts or components necessary for the continued safe operation of the aircraft up to the LOV. Where an LOV is not provided as a result of needing to meet a specific requirement for an LO V, the applicant may establish an LOV or must consider all the likely fatigue scenarios up to an operational life beyond which it is highly unlikely that the aircraft will remain in service. This may be either conservatively set based on experience or prov ided as a limitation in the ICA/SSID. The document should be prefaced by the following information: (a) i dentification of the variants of the basic aircraft type to which the document relates; (b) r eference to documents giving any existing inspections or m odifications of parts or components; (c) t he types of operations for which the inspection programme are considered valid; (d) a list of SB s (or other service information publication) revised as a result of the structural reassessment undertaken to develop the SSID, including a statement that the operator must account for these SB s ; (e) t he type of damage which is being considered (i.e. fatigue, corrosion and/or accidental damage) ; and (f) g uidance to the operator on which inspection findings should be reported to the TCH .

The document should contain at least the following information for each critical part or component (PSE and FCS) : (a) a description of the part or component and any relevan t adjacent structure, including means of access to the part ; (b) r elevant service experience ; (c) l ikely site(s) of damage ; (d) i nspection method and procedure, and alternatives ; (e) m inimum size of damage considered detectable by the method(s) of inspection ; (f) S B s (or other service information publication) revised or issued as a result of in - service findings resulting from implementation of the SSID (added as revision to the initial SID) ; (g) i nitial inspection threshold ; (h) r epeat inspection in terval ; (i) r eference to any optional modification or replacement of part or component as terminating action to inspection ; (j) r eference to the mandatory modification or replacement of the part or component at given life, if fail - safety by inspection is i mpractical; and Powered by EASA eRules Page 191 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) (k) i nformation related to any variations found necessary to ‘ safe lives ’ already declared.

The SSID should be compared from time to time against current service experience. Any unexpected defect occurring should be assessed as part of the continuing assessment of structural integrity to determine the need for revision of the SSID. Future structural SB s should state their effect on the SSID.

[Amdt 20/2] [Amdt 20/20] [Amdt 20/22]

Appendix 2 to AMC 20 - 20 B Guidelines for the development of a

pr ogramme to preclude the occurrence of widespread fatigue

damage

ED Decision 2021/007/R 1. INTRODUCTION The terminology and methodology in this A ppendix are based upon material developed by the AAWG and lessons learned since the first issue of this AMC .

2. DEFINITIONS Extended s ervice g oal (ESG) is an adjustment to the design service goal established by service experience, analysis, and/or test during which the principal structure will be reasonably free from significant cracking including WFD .

Monitoring period is the period of time when special inspections of the fleet are initiated due to an increased risk of MSD/MED (ISP) and ending when the SMP is reached.

Scatter f actor is a life reduction factor used in the interpretation of fatigue analysis and fatigue test results.

Test - to - s tructure f actor is a series of factors used to adjust test results to full - scale structure.

These factors could include, but are not limited to, d ifferences in: — stress spectrum, — boundary conditions, — specimen configuration, — material differences, — geometric considerations, and — environmental effects.

Teardown inspection is the process of disassembling structure and using destructive inspecti on techniques or visual (magnifying glass and dye penetrant) or other non - destructive inspection (NDI) methods (eddy current, ultrasonic) to identify the extent of damage, within a structure, caused by fatigue, environmental or accidental damage.

WFD is the point in time when 50 % of the fleet is expected to reach WFD for a (average behaviour) particular detail.

Powered by EASA eRules Page 192 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 3. GENERAL The likelihood of the occurrence of fatigue damage in an aircraft’s structure increases with aircraft usage. The design process g enerally establishes a design service goal (DSG) in terms of flight cycles/hours for the airframe. It is expected that any cracking that occurs on an aircraft operated up to the DSG will occur in isolation (i.e. local cracking), originating from a single s ource, such as a random manufacturing flaw (e.g. a mis - drilled fastener hole) or a localised design detail. It is considered unlikely that cracks from manufacturing flaws or localised design issues will interact strongly as they grow.

With extended usage, uniformly loaded structure may develop cracks in adjacent fastener holes, or in adjace nt similar structural details. These cracks may or may not interact, and they can have an adverse effect on the residual strength capability of the structure before the c racks become detectable. The development of cracks at multiple locations (both MSD and MED) may also result in strong interactions that can affect subsequent crack growth; in which case, the predictions for local cracking would no longer apply. An example of this situation may occur at any skin joint where load transfer occurs. Simultaneous cracking at many fasteners along a common rivet line may reduce the residual strength of the joint to less than the required levels before the cracks are detectable unde r the routine maintenance programme established at the time of certification.

For new type designs, certified to CS - 25 Amendment 19, AMC 25.571 provides guidance on how to establish an LOV. For existing types, for which TCHs need to comply with point 26.30 3 of Part - 26, CS 26.303 and this AMC apply. The TCH should conduct structural evaluations to determine where and when MSD/MED may occur. Based on these evaluations , the TCH sh ould provide additional maintenance instructions for the structure, as appropriat e. The maintenance instructions include, but are not limited to inspections, structural modifications, and limits of validity of the new maintenance instructions. In most cases, a combination of inspections and/or modifications/replacements is deemed neces sary to achieve the required safety level.

Other cases will require modification or replacement if inspections are not viable.

There is a distinct possibility that there could be a simultaneous occurrence of MSD and MED in a given structural area. This sit uation is possible on some details that were equally stressed. If this is possible, then this scenario should be considered in developing appropriate service actions for structural are a s.

4. STRUCTURAL EVALUATION FOR WFD 4.1 General The evaluation has thre e objectives: (a) Identify fatigue - critical structure that may be susceptible to MSD/MED, see paragraph 4.2 ; (b) Predict when it is likely to occur; see paragraph 4.3 ; and (c) Establish additional maintenance actions, as necessary, to ensure continued safe operation of the aircraft; see paragraph 4.4.

4.2 Structure susceptible to MSD/MED Susceptible structure is defined as that which has the potential to develop MSD/MED.

Such structure typically has the characteristics of multiple similar deta ils operating at similar stresses where structural capability could be affected by interaction of multiple cracking at a number of similar details. The following list provides examples of known types of structure susceptible to MSD/MED. (The list is not ex haustive): Powered by EASA eRules Page 193 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) STRUCTURAL AREA SEE FIGURE Longitudinal Skin Joints, Fr ames, and Tear Straps (MSD/MED) A2 - 1 Circumferential Joints and Stringers (MSD/MED) A2 - 2 Lap joints with Milled, Chem - milled or Bonded Radius (MSD) A2 - 3 Fuselage Frames (MED) A2 - 4 Stringer to Frame Attachments (MED) A2 - 5 Shear Clip End Fasteners on Shear Tied Fuselage Frames (MSD/MED) A2 - 6 Aft Pressure Dome Outer Ring and Dome Web Splices (MSD/MED) A2 - 7 Skin Splice at Aft Pressure Bulkhead (MSD) A2 - 8 Abrupt Changes in Web or Skin Thickness — Pressurised or Un - pressurised A2 - 9 Structure (MSD/MED) Window Surround Structure (MSD, MED) A2 - 10 Over Wing Fuselage Attachments (MED) A2 - 11 Latches and Hinges of Non - plug Doors (MSD/MED) A2 - 12 Skin at Runout of Large Doubler (MSD) — Fuselage, Wing or Empennage A2 - 13 Wing or Empennage Chordwise Splices (MSD/MED) A2 - 14 Rib to Skin Attachments (MSD/MED) A2 - 15 Typical Wing and E mpennage Construction (MSD/MED) A2 - 16 Figure A2 - 1 : Longitudinal s kin j oints, f rames, and t ear s traps (MSD/MED) Powered by EASA eRules Page 194 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Figure A2 - 2 : Circumferential j oints and s tringers (MSD/MED) Figure A2 - 3 : Lap joints with m illed, c hem - milled or b onded r adius (MSD) Powered by EASA eRules Page 195 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPA RT A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Figure A2 - 4 : Fuselage f rames (MED) Figure A2 - 5 : Stringer - to - f rame a ttachments (MED) Powered by EASA eRules Page 196 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Skin/Stringer Attachments Figure A2 - 6 : Shear c lip e nd f asteners on s hear t ied f uselage f rame (MSD/MED) Figure A2 - 7 : Aft p ressure dome outer ring and dome web splices (MSD/MED) Powered by EASA eRules Page 197 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Figure A2 - 8 : Skin splice at aft pressure bulkhead (MSD) Figure A2 - 9 : Abrupt changes in web or skin thickness — Pressurised or unpressurised structure (MSD/MED) Powered by EASA eRules Page 198 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Figure A2 - 10 : Window s urround s tructure (MSD, MED) Figure A2 - 11 : Over wing fuselage attachments (MED) Powered by EASA eRules Page 199 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Figure A2 - 12 : Latches and hinges of non - plug doors (MSD/MED) Figure A2 - 13: Skin at runout of large doubler (MSD) — Fuselage, wing or empennage Powered by EASA eRules Page 200 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Figure A2 - 14 : Wing or empennage chordwise splices (MSD/MED) Figure A2 - 15 : Rib - to - s kin a ttachments (MSD/MED) Powered by EASA eRules Page 201 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Figure A2 - 16 : Typical wing and empennage construction (MSD/MED) 4.3 WFD Evaluation Point 26.300 of Part - 26 requires an LOV to be established according to specifie d timescales for large transport aeroplanes with MTOWs above 34 901 kg (75 000 lb). For other types, it is recommended that by the time the highest - time aircraft of a particular model reaches its DSG, the evaluation for each area susceptible to the development of WFD should be completed. A typical evaluation process is shown in Figure A2 - 1 9 below.

This evaluation will establish the necessary elements to determine a maintenance programme to preclude WFD in that particular model’s aircraft fleet. These elements are developed for each susceptible area and include: 4.3.1 Identification of structure potentially susceptible to WFD Unless already fully addressed in the existing fatigue and damage tolerance evaluation, t he TCH sh ould identify each part of the aircraft’s structure that is potentially susceptible to WFD for further evaluation. A justification should be given that supports selection or rejection of each area of the aircraft structure.

DAHs for modified or repaired st ructure should evaluate their structure and its e ffect on existing structure.

Typical examples of structure susceptible to WFD are included in paragraph 4.2 of this A ppendix.

4.3.2 Predicting when WFD will occur (a) Characterisation of events leading to WF D The fatigue process that leads to WFD is shown in Figure A2 - 17. This figure is applicable to both damage that occurs in multiple sites (MSD) and damage that occurs in similar structures at more than one location (MED). For any susceptible structural area, it is not a question of whether WFD will occur, but when it will occur. In Figure A2 - 17, the ‘when’ is illustrated by the line titled ‘WFD ,’ which is the point when 50 % of the aeroplanes in (average behaviour) Powered by EASA eRules Page 202 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) a fleet would have experienc ed WFD in the considered area (note that the probability density function for flight cycles or flight hours to WFD has been depicted for reference). The WFD process includes this phase of crack initiation and a crack growth phase. During the crack initiati on phase, which generally spans a long period of time, there is little or no change in the basic strength capability of the structure. The actual residual strength curve depicted in Figure A2 - 17 is flat, and equal to the strength of the structure in its pr istine state. However, at some time after the first small cracks start to grow, residual strength begins to degrade. Crack growth continues until the capability of the structure degrades to the point of the minimum strength required by CS 25.571(b). In thi s context, the line in Figure A2 - 17 called WFD represents a point when 50 % of the aeroplanes in a fleet (average behaviour) fall below the minimum strength specifications of CS 25.571(b).

Probability density function for NOTE: No scale implied. Probability Function for For definition use only. cycles to WFD condition Density Cycles to ACTUAL REQUIRED RESIDUAL RESIDUAL STRENGTH STRENGTH MSD/MED MSD/MED CRACK CRACK GROWTH INITIATION a CRACK LENGTH cr WFD WFD (Average (average behaviour) Behavior FLIGHT CYCLES Figure A2 - 17: Effect on residual strength of developing WFD (b) Determination of WFD in the fleet (average behaviour) The time in terms of flight cycles/hours defining the WFD in the ( average behaviour ) fleet should be established for each susceptible structural area . The data to be assessed in determining the WFD includes: (average behaviour) — a complete review of the service history of the susceptible areas , to identify a ny occurrences of fatigue cracking and the continuing validity of loads and mission profiles , — evaluation of the operational statistics of the fleet in terms of flight hours and landings, Powered by EASA eRules Page 203 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) — significant production variants (material, design, assembly method, and any other change that might affect the fatigue performance of the detail), — fatigue test evidence including relevant full - scale and component fatigue and damage tolerance test data (see subparagraph 4.3. 9 and Annex 1 for more details), — teardown inspections, and — any fractographic analysis available.

The evaluation of the test results for the reliable prediction of the time to when WFD might occur in each susceptible area should include appropriate test - to - structure factors. If full - scale fatigue test evidence is used, Figure A2 - 20 below relates how that data might be utilised in determining WFD . Evaluation may be analytically deter mined, supported by (average behaviour) test and, where available, service evidence.

Regardless of whether the assessment of WFD is based on (average behaviour) in - service data, full - scale fatigue test evidence, analyses, or a combination of any of these, the following should be considered: 4.3.3 Initial c rack/ d amage s cenario This is an estimate of the size and extent of multiple cracking expected at MSD/MED initiation. This prediction requires empirical data or an assumption of the crack/damage locations and sequence plus a f atigue evaluation to determine the time to MSD/MED initiation. Alternatively, analysis can be based on either: — the distribution of equivalent initial flaws, as determined from the analytical assessment of flaws found during fatigue test and/or teardown i nspections regressed to zero cycles; or — a distribution of fatigue damage determined from relevant fatigue testing and/or service experience.

4.3.4 Final c racking s cenario This is an estimate of the size and extent of multiple cracking that could cause residual strength to fall to the minimum required level as shown in A2 - 17 .

Techniques exist for 3 - D elastic - plastic analysis of such problems; however, there are several alternative test and analysis approaches available that provide an equivalent le vel of safety. One such approach is to define the final cracking scenario as a subcritical condition (e.g. first crack at link - up). The u se of a subcritical scenario reduces the complexity of the analysis and, in many cases, will not greatly reduce the tot al crack growth time , because the majority of the time taken to reach the critical condition is generally in the initiation phase .

4.3.5 Crack g rowth c alculation Progression of the crack distributions from the initial cracking scenario to the final crackin g scenario should be developed. These curves can be developed: — analytically , typically based on linear elastic fracture mechanics, or — empirically , from test or service fractographic data.

Powered by EASA eRules Page 204 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 4.3.6 Potential for discrete source damage (DSD) A structure s usceptible to fatigue including MSD/MED may also be affected by DSD due to an uncontained failure of high - energy rotating mach inery (i.e. turbine engines). At this time, there is no specific requirement to address prior fatigue cracking in combination with DSD for certification. Nonetheless, when assessing in - service findings of fatigue cracking, the additional threat posed by any potential DSD should be taken into account when developing the corrective actions and the timescales for its implementation.

4.3 .7 Analysis m ethodology Differences between multiple - site damage and multiple - element damage Details of the approach used to characterise events leading up to WFD may be different. The differences will largely depend on whether MSD or MED is being consider ed. This is especially true for crack interaction.

(a) Crack interaction MSD has the potential for strong crack interaction, and the effect of multiple cracks on each other needs to be addressed. MED, in most cases, does not have the same potential for strong crack interaction. The differences between the interaction effects for MSD and MED are illustrated in Figure A2 - 18.

(b) MSD and MED interaction Some areas of an aeroplane are potentially susceptible to both MSD and MED. Simultaneous oc currence of MSD and MED is possible, even though it is not common. A comparison of inspection start points (ISPs) or modification start points might indicate the possibility of this occurrence. If so, the evaluation should consider the interaction between MSD and MED.

N (cycles) Single crack Single N (cycles) Multiple crack cracks Mu ltiple cracks a (mm) a (mm) Single crack Multiple cracks MED MSD Figure A2 - 18: Difference between MSD and MED interaction effects Powered by EASA eRules Page 205 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) The report ‘ Recommendations for Regulatory Action to Prevent Widespread Fatigue Damage in the Commercial Aeroplane Fleet ’ , Revision A, dated June 29, 1999 (a report of the AAWG for the ARAC’s Transport Aircraft and Engine Iss u es Group), discusses two Round Robin exercises developed by the TCHs to provide insight into their respective methodologies. One outcome of the exercises was an identification of key assumptions or methods that had the greatest impact on the predicted WFD behaviour. These assumptions were: — the flaw sizes assumed at initiation of crack growth phase of analysis; — material properties used (static, fatigue, fracture mechanics); — ligament failure criteria; — crack growth equations used; — statistics used to evaluate the fatigue behaviour of the structure (e.g.

time to crack initiation); — methods of determining the structur al modification point (SMP); — detectable flaw size assume d; — initial distribution of flaws; and — factors used to determine bound behaviour as opposed to mean behaviour.

(c) MED When considering MED, where interaction between cracks in different elements is not a factor, the following should be considered: (1) In a structure containing large numbers of similar elements, there is not normally a high probability that, after a crack initiates in an element, a second crack will initiate in the element right next to it. If this does happen, however, the consequences to the overall structure may be severe. This is because having two structural members fail right next to each other can completely negate any ability of the structure to tolerate additional damage. Consequently, when performing an evaluation, applicants sh ould make conservative assumptions and assume failures to be adjacent to each other.

(2) When an element fails completely, the load that has to be redistributed onto the non - failed structure can be large and can have a significant impact on the strength of both the cracked and uncracked structure; therefore, the effects of load redistribution must be included in the evaluation.

(d) Establishing maintenance actions The following parameters are developed from paragraphs 4.3.2 to 4.3.7 above, and are necessary to establish an MSD/MED maintenance programme for the area under investigation.

Fatigue damage is the gradual deterioration of a material subjected to repeated loads. This gradual deterioration is a function of use and can be statistically quantified. The term ‘WFD’ is used, and can be statistically Powered by EASA eRules Page 206 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) quantified, at the end of the deter ioration process when the structure is no longer able to carry the residual strength loads. WFD can never be absolutely precluded because there is always some probability, no matter how small, that it will occur. Therefore, modifying or replacing structure at a predetermined, analytically - derived time stated in flight cycles or flight hours, minimises the probability of having WFD in the fleet. Modification or replacement is the most reliable method for precluding WFD. The point at which a modification is u ndertaken is referred to as the ‘structural modification point (SMP)’ and it is illustrated in Figure 2 - 1 of Annex 2 . The SMP is generally a fraction of the number representing th e point in time when WFD will occur, and should result in the same reliability (average behaviour) as a successful two - lifetime fatigue test. This level of reliability for setting the SMP is acceptable if MSD or MED inspections are shown to be effective in detecting cracks. If the inspections are effective, they should be implemented before the SMP. The implementation times for these inspections are known as the ‘inspection start points (ISPs)’. Repeat inspections are usually necessary to maintain this effe ctiveness in detecting cracks. If MSD or MED inspections are not effective in detecting cracks, then the SMP should be set at the time of ISP. For the purposes of this AMC, an inspection is effective if, when performed by properly trained maintenance perso nnel, it will readily detect the damage in question . The SMP should minimise the extent of cracking in the susceptible structural area in a fleet of affected aeroplanes. In fact, if this point is appropriately determined, a high percentage of aeroplanes would not have any MSD or MED by the time the SMP is reached.

Due to the redundant nature of semi - monocoque structures, MED can be difficult to manage in a fleet environment. This stems from the fact that most aircraft structures are built - up in nature, an d that makes the visual inspection of the various layers difficult. Also, visual inspections for MED typically rely on internal inspections, which may not be practical at the frequency necessary to preclude MED due to the time required to gain access to th e structure. However, these issues are dependent on the specific design involved and the amount of damage being considered. In order to implement a viable inspection programme for MED, static stability must be maintained at all times and there should be no MED concurrent with MSD in a given structural area.

4.3.8 Inspection start point (ISP) This is the point at which inspection starts if a monitoring period is used. Inspection is not practical for all applications and cannot replace the SMP. The ISP is det ermined through a statistical analysis of crack initiation based on fatigue testing, teardown, or service experience of similar structural details. It is assumed that the ISP is equivalent to a lower bound value with a specific probability in the The cracking identified in the FAA Airworthiness Directive (AD) 2002 - 07 - 09 is an example of the type of cracking that MSD inspections are effective in detecting. These cra cks grow from the fastener holes in the lower row of the lower skin panel in such a way that the cracking is readily detectable using NDI methods. The cracking identified in the FAA AD 2002 - 07 - 08 is an example of places where MSD inspections are not effect ive. These cracks grow in the outer surface and between the fastener holes in the lower row of the lower skin panel in such a way that the cracking is not readily detectable using NDI methods. Modification is the only option to address this type of crackin g.

Powered by EASA eRules Page 207 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) statistic al di stribution of cracking events. Alternatively, the ISP may be established by applying appropriate factors to the average behaviour.

When inspections are determined to be effective, it is necessary to establish when those inspections should start. This point is illustrated in Figure 2 - 1. The start point is determined through a statistical analysis of crack initiation based on fatigue te sting, teardown, or in - service experience of similar structure. The ISP is assumed to be equivalent to a lower - bound value with a specific probability in the statistical distribution of cracking events. Alternatively, an ISP may be established by applying appropriate factors to the number representing WFD . (e.g. for (average behaviour) aluminium alloy structure, dividing the full - scale test result by a factor of 3).

For inspection intervals, see point 4.3.10.

4.3. 9 Structural m odification p oint (SMP) The SM P should be established as a point in time when structures should be modified or replaced to prevent WFD from occurring. This is typically established by: — calculating when WFD would first occur in the structure (predicted using the WFD ), (average behaviour ) — setting a time before the predicted occurrence of WFD to perform modifications or replacements that will prevent it.

The applicant should demonstrate that the proposed SMP established during the evaluation has the same confidence level as current reg ulations require for new certification. In lieu of other acceptable methods, the SMP for aluminium alloy structures can be established as a point reduced from the WFD , based (average behaviour) on the viability of inspections in the monitoring period. The SMP may be determined by dividing the number representing the timing when WFD will occur by a factor of 2 if there are effective inspections, or (average behaviour) by a factor of 3 if inspections are not effective . For other materials such as high - strength steel alloys, larger scatter factors may be necessary to account for increased variability in fatigue performance.

An aircraft should not be operat ed past the SMP unless the structure is modified or replaced, or unless additional approved data is provi ded that would extend the SMP. However, if during the structural evaluation for WFD, a TCH/DAH finds that the flight cycles and/or flight hours SMP for a particular structural detail have been exceeded by one or more aircraft in the fleet, the TCH/DAH should expeditiously evaluate selected high - time aircraft in the fleet to determ ine their structural condition. From this evaluation, the TCH/DAH should no tify the competent authorities and propose appropriate service actions.

A DAH may find that the SMP for a particular structural area has been exceeded by one or more aeroplanes in the fleet. In that case, the DAH should expedite the evaluation of those hig h - time aeroplanes to determine their structural condition, notify EASA and propose appropriate maintenance actions specific to those aeroplanes.

Powered by EASA eRules Page 208 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) The initial SMP may be adjusted based on the following: (a) The tasks necessary to extend an SMP may include any or all of the following: (1) Additional fatigue or residual strength tests , or both, on a full - scale aeroplane structure or a full - scale component followed by detailed inspections and analyses.

(2) Fatigue tests of new structure or structure from in - se rvice aeroplanes on a smaller scale than full component tests (i.e. subcomponent or panel tests , or both ). If a subcomponent test is used, the SMP would be extended only for that subcomponent.

(3) Teardown inspections (destructive) on structural components that have been removed from service.

(4) T eardown inspections (non - destructive) accomplished by selected, limited disassembly and subsequent reassembly of specific areas of high - time aeroplanes .

(5) Analysis of in - service data (e.g. inspections) from a st atistically significant number of aeroplanes .

(b) If cracks are found in the structural detail for which the evaluation was done during either the monitoring period or the modification programme, the SMP should be re - evaluated to ensure that the SMP does i n fact provide the required confidence level. If it is shown that the required confidence level is not being met, the SMP should be adjusted and the adjustment reflected in the appropriate SB s to address the condition of the fleet. Additional regulatory action may be required.

4.3.1 0 I nspection interval and method An interval should be chosen to provide a sufficient number of inspections between the ISP and the SMP so that there is high confidence that no MSD/MED condition will reach the final cracking scenario without detection.

The interval between inspections depends on the detectable crack size, the critical crack lengths and the probability that the cracks will be detected with the specific inspection method. Conservative scenarios should b e assumed for developing the inspection interval unless other assumptions can be consistently supported by test and service experience . If the crack cannot be detected, the SMP must be re - evaluated to ensure there is a high confidence level that no aircraf t will develop MSD/MED before modification.

4.4 Evaluation of maintenance actions For all areas that have been identified as susceptible to MSD/MED, the current maintenance programme should be evaluated to determine whether adequate structural maintenance and inspection programmes exist to safeguard the structure against unanticipated cracking or other structural degradation. The evaluation of the current maintenance programme typically begins with the determination of the SMP for each area.

Powered by EASA eRules Page 209 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Each area sho uld then be reviewed to determine the current maintenance actions and compare them to the maintenance needs established in this evaluation. Issues to be considered include the following: (a) Determine the inspection requirements (method, inspection start point, and repeat interval) of the inspection for each susceptible area (including that structure that is expected to arrest cracks) that is necessary to maintain the required level of safety.

(b) Review the elements of the existing mainte nance programmes already in place .

(c) Revise and highlight elements of the maintenance programme necessary to maintain safety.

For susceptible areas approaching the SMP, where the SMP will not be increased or for areas that cannot be reliably inspected, a programme should be developed and documented that provides for replacement or modification of the susceptible structural area.

4.4.1 Period of WFD evaluation validity At whatever point the WFD evaluation is made, it should support the LOV of the maintenan ce programme. Consistent with the use of test evidence to support individual SMPs, as described above in paragraph 4.3. 9 , the LOV of the maintenance programme should be based on fatigue test evidence. For an existing ageing aircraft type, the initial WFD e valuation of the complete airframe will typically cover a significant forward estimation of the projected aircraft usage beyond its DSG, als o known as the ‘ proposed ESG ’ and is effectively a proposed LOV. Typically, a n evalu a tion through an additional 25 % of the DSG would provide a realistic forecast, with reasonable planning time for necessary maintenance action. However, it may be appropriate to adjust the evaluation validity period depending on issues such as: (a) t he proj ected useful life of the aircraft at the time of the initial evaluation; (b) c urrent NDI technology; and (c) a irline advance planning requirements for introduction of new maintenance and modification programmes, to provide sufficient forward projection to identify all likely maintenance/modification actions essentially as one package.

Upon completion of the evaluation and publication of the revised maintenance requirements, the ‘ proposed ESG ’ becomes the LOV .

Note : This assumes that all other aspects of the maintenance programme that are required to support the LOV (such as SSID, CPCP, etc.) are in place and have been evaluated to ensure they too remain valid up to the LOV.

Powered by EASA eRules Page 210 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) REVIEW STRUCTURAL AREAS POTENTIALLY SUSCEPTIBLE TO WFD (See 4.3.1) FOR EACH AREA, DETERMINE THE WFD AVERAGE BEHAVIOUR IN THE FLEET (See 4.3.2 onwar ds ) NO IS NATURAL FATIGUE CRACKING LIKELY STOP ² WITHIN OPERATIONAL LIFE ESTIMATE ALLOWABLE FATIGUE DAMAGE SCENARIO FOR LIMIT LOAD (See 4.3.4) ESTABLISH THE SMP AND NO TERMINATING ACTION FATIGUE DAMAGE SCENARIO DETECTABLE PRIOR TO (See 4.3.10) MAXIMUM ALLOWABLE EXTENT UNDER LIMIT LOAD YES ESTABLISH ISP, INSPECTION INTERVAL AND METHOD AND SCHEDULE FOR TERMINATING ACTION (See 4.3.9//10/11) NOTES: 1. Fatigue cracking is defined as likely if the factored fatigue life is less than the projected ESG of the aircraft at time of WFD evaluation.

2. The operational life is the projected ESG of the aircraft at time of WFD Evaluation. (See 4.4.1).

Figure A2 - 1 9 : Aircraft WDF e valuation p rocess Powered by EASA eRules Page 211 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) FULL SCALE FATIGUE TEST DATA FULL - SCALE FATIGUE TEST DATA NO TEAR DOWN?

TEAR DOWN?

YES NO YES MSD/MED FINDINGS MSD/MED FINDINGS DURING TEST/TEARDOWN?

DURING TEST/TEARDOWN?

DETECTABLE CRACK SIZE AT DETECTABLE CRACK SIZE AT END OF TEST BEYOND NO YES END OF TEST BEYOND CRITICAL LENGTH AT LIMIT 2 CRITICAL LENGTH AT LIMIT LOAD?

LOAD?

ESTIMATED WFD AVERAGE BEHAVIOUR DETERMINED FROM TEST LIFE Minus TEST LIFE plus TEST LIFE m inus TEST LIFE plus TEST LIFE CRACK GROWTH LIFE 3 CRACK GROWTH LIFE 3 TEST LIFE CRACK GROWTH LIFE CRACK GROWTH LIFE NO SPECIAL INSPECTIONS LOV = Test Life/2 if all areas INSPECTION PROGRAMME/ REQUIRED (FAR 25.571, AMDT INSPECTION PROGRAMME/ inspectable 96) MODIFICATION PROGRAMME REQUIRED (See MODIFICATION PROGRAMME REQUIRED (See 4.3.7 onward) 4.3.7 onward) LOV = Test Life/2 Powered by EASA eRules Page 212 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 1 ASSUMED STATE AT END OF TEST : Best estimate of non - detected damage from inspection method used at the end of the test or d uring teardown.

2 CRITICAL CRACK LENGTH : First link - up of adjacent cracks at limit load (locally) or an adequate level of large damage capability.

3 CRACK GROWTH LIFE : Difference between assumed or actual state at the end of the test and critical crack length.

Figure A2 - 20: Use of fatigue test and teardown information to determine WFD average behaviour Powered by EASA eRules Page 213 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 5. DOCUMENTATION Any person seeking approval of an LOV of an aircraft type design should develop a document containing all the necessary ISPs, inspection procedures, replacement times, SMPs, and any other maintenance actions necessary to preclude WFD, and to support the LOV. That person must revise the SSID or ALS a s necessary, and/or prepare SB s that contain the aforementioned maintenance actions. Since WFD is a safety concern for all operators of older aircraft, EASA will make mandatory the identified inspecti on and modification programmes. In addition, EASA may co nsider separate AD action to address any SB s or other service information publications revised or issued as a result of in - service MSD/MED findings resulting from implementation of these programmes.

The following items should be contained in the front of t he documentation supporting the LOV : (a) i dentification of the variants of the basic aircraft type to which the document relates; (b) s ummary of the operational statistics of the fleet in terms of hours and flights; (c) d escription of the typical mission, or missions; (d) t he types of operations for which the inspection programme is considered valid; (e) r eference to documents giving any existing inspections, or modification of parts or components; and (f) t he LOV of the maintenance programme in te rms of flight cycles or flight hours or both as appropriate to accommodate variations in usage.

The document should contain at least the following information for each critical part or component: (a) d escription of the p rimary s tructure susceptible to WFD; (b) d etails of the monitoring period ( ISP , repeat inspection interval, SMP, inspection method and procedure (including crack size, location and direction) and alternatives) when applicable; (c) a ny optional modification or replacement of the structural el ement as terminating action to inspection; (d) a ny mandatory modification or replacement of the structural element; (e) SB s (or other service information publications) revised or issued as a result of in - service findings resulting from the WFD evaluations (added as a revision to the initial WFD document); and (f) g uidance to the operator on which inspection findings should be reported to the TCH/DAH, and appropriate reporting forms and methods of submission .

6. REPORTING REQUIREMENTS Operators, TCHs and STC Hs are required to report in accordance with various regulations (e.g.

point 21.A.3A, and point 145.A.60) . The regulations to which this AMC relates do not require any reporting requirements in addition to the current ones. Due to the potential threat to s tructural integrity, the results of inspections must be accurately documented and reported in a timely manner to preclude the occurrence of WFD. The current system of operator and TCH communication has been useful in identifying and resolving a number of i ssues that can be classified as WFD concerns. MSD/MED has been discovered via fatigue test ing and in - service experience. TCHs have been consistent in disseminating related data to operators to solicit Powered by EASA eRules Page 214 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) additional service experience. However, a more thorough means of surveillance and reporting is essential to preclude WFD.

When damage is found while conducting an approved MSD/MED inspection programme, or at the SMP where replacement or modification of the structure is occurring, the TCHs, STCHs and the operat ors need to ensure that greater emphasis is placed on accurately reporting the following items: (a) a description (with a sketch) of the damage, including crack length, orientation, location, flight cycles/hours, and condition of structure; (b) r esults of follow - up inspections by operators that identify similar problems on other aircraft in the fleet; (c) f indings where inspections accomplished during the repair or replacement/modification identify additional similar damage sites; and (d) a djacent repairs.

Operators must report all cases of MSD/MED to the TCH, STCH or the competent authority as appropriate, irrespective of ho w frequently such cases occur. Cracked areas from in - service aircraft (damaged structure) may be ne eded for detailed examination. Operators are encouraged to provide fractographi c specimens whenever possible. Aeroplanes undergoing heavy maintenance checks are perhaps the most useful sources for such specimens.

Operators should remain diligent in the reporting of potential MSD/MED con cerns not identified by the TCH/DAH. Indications of a developing MSD/MED problem may include: (a) d amage at multiple locations in similar adjacent details; (b) r epetitive part replacement; or (c) a djacent repairs.

Documentation will be provided by the TCH and STCH as appropriate to specify the required re porting format and time frame , supporting the mandatory reporting regulations (e.g. point 21.A.3A of Part 21, point 145.A.60 of Part - 145). The data will be reviewed by the TCH or STC H , operator(s), and EASA to evaluate the nature and magnitude of the problem and to determine the appropriate corrective action.

7. WFD EVALUATION FOR S TRUCTURAL MODIFICATIONS AND REPAIRS TCHs of aeroplanes subject to the point 26.303 of Part - 26 requirements for an LOV should per form WFD evaluations to assess all the applicable existing structure and the effect of future changes on the LOV.

The WFD evaluations of this AMC do not apply retroactively to existing STCH’s modifications, nor to existing repairs. Future changes and repai rs need to take into account the applicable certification basis, and applicants should consider the guidance of the applicable ACJ and AMC as discussed in paragraph 8 of this AMC. The DTEs for compliance with points 26.307, 26.308, 26.333 and 26.334 of Par t - 26 do not have to consider WFD , or the related SMP (average behaviour) and ISP.

In cases where a new DTE is performed by DAHs to comply with points 26.333 and 26.334 of Part - 26 for existing changes or for new changes or repairs, according to CS 25.571 Am dt 18 or earlier amendments, the DTE and development of DTIs should take into account the cracking scenarios that could reasonably be expected to occur in the remaining operational lifetime of an aeroplane into which the repair or modification is, or may b e, incorporated.

Powered by EASA eRules Page 215 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 8. RESPONSIBILITY FOR WFD EVALUATION, ESTABLISHING THE LOV AND IMPLEMENTATION OF THE LOV AND MAINTENANCE ACTIONS T he primary responsibility is with the DAH to perform the analyses and supporting tests .

However , it is expected that if exten sive maintenance actions are necessary, the practicality of their implementation will be evaluated in a cooperative effort between the operators and TCHs/DAHs, with participation of EASA .

The TCH is responsible for proposing and submitting an LOV in the AL S for approval.

Note : In some cases, the ALS may already contain an LOV which is approved in accordance with a regulation of another authority. There may also be other potentially more restrictive limitations on the validity of maintenance programmes. For these cases, when the TCH needs to publish the LOV as required by point 26.303 of Part - 26, this LOV and its relationship with the existing or superseded limitation should be clearly described so that no operator will exceed the most restrictive applicable limit on the general validity of the maintenance programme.

The operator is responsible for implementing the LOV in their maintenance programme.

Note : The LOV does not supersede or allow operations beyond any lower limitation applicable to the individual aeroplane and the components controlled by the maintenance programme.

[Amdt 20/2] [Amdt 20/20] [Amdt 20/22]

Annex 1 to Appendix 2 to AMC 20 - 20 B Full - scale fatigue test

evidence

ED Decision 2021/007/R Contents (a) Overview (b) Full - scale fatigue test evidence (c) Key elements of a full - scale fatigue test programme (1) Article (2) Test set - up and loading (i) Test set - up (i i ) Test loading ( 3 ) Test duration (i) New type certificates and derivatives (ii) Repairs and type design changes ( 4 ) Post - test evaluation (i) Residual strength tests (ii) Teardown inspections Powered by EASA eRules Page 216 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) ( d ) Scope of full - scale fatigue test article (1) New type designs (2) Derivative models (3) Type design changes — SBs (4) Type design changes — STCs (5) Major r epairs ( e ) Use of existing full - scale fatigue test data ( f ) Use of in - service data (a) Overview CS 25.571(b) Amendment 19 specifies that special consideration for WFD must be included in the fatigue and damage tolerance evaluation where the design is such that this type of damage could occur. CS 25.571(b) Amendment 19 specifies the effectiveness of the provisions to preclude the possibility of WFD occurring within the limits of validity of the maintenance programme to be demonstrated with sufficient fu ll - scale fatigue test evidence. The determination of what constitutes ‘sufficient full - scale test evidence’ requires a considerable amount of engineering judgement and is a matter that should be discussed and agreed to between an applicant and EASA early i n the planning stage of a certification project. Sufficient test evidence is also necessary to support compliance with CS 26.303 and the most straightforward means of compliance is to utilise existing full - scale test evidence.

(b) Full - scale fatigue test evidence In general, sufficient full - scale fatigue test evidence consists of full - scale fatigue testing to at least twice the LOV, followed by specific inspections and analyses to determine that WFD has not occurred. The following factors should be co nsidered in determining the sufficiency of the evidence: Factor 1: The comparability of the load spectrum between the test and the projected usage of the aeroplane.

Factor 2: The comparability of the airframe materials, design and build standards between t he test article and the certified aeroplane.

Factor 3: The extent of post - test teardown inspection, residual strength testing and analysis for determining whether widespread fatigue cracking has occurred.

Factor 4: The duration of the fatigue testing.

Fact or 5: The size and complexity of a design or build standard change. This factor applies to design changes made to a model that has already been certified and for which full - scale fatigue test evidence for the original structure should have already been det ermined to be sufficient.

Small, simple design changes, comparable to the original structure, could be analytically determined to be equivalent to the original structure in their propensity for WFD. In such cases, additional full - scale fatigue test evidenc e should not be necessary.

Factor 6: In the case of major changes and STCs, the age of an aeroplane being modified. This factor applies to aeroplanes that have already accumulated a portion of their LOV prior to being modified. An applicant should demonstr ate freedom from WFD up to the LOV in place for the original aeroplane and may take into account the age of the aeroplane being modified.

Powered by EASA eRules Page 217 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) ( c ) Key elements of a full - scale fatigue test programme The following guidance addresses key elements of a test prog ramme that is intended to generate the data necessary to support compliance, and it can also be used to evaluate and interpret existing full - scale test data for the purposes of supporting compliance with point 26.303 of Part - 26.

(1) Article . The test artic le should be representative of the structure of the aeroplane to be evaluated (i.e. ideally a production - standard article). The attributes of the type design that could affect MSD/MED initiation, growth and subsequent residual strength capability should be replicated as closely as possible on the test article. Critical attributes include, but are not limited to, the following: — material types and forms; — dimensions; — joining methods and details; — coating and plating; — the use of faying surface sealant; — assembly processes and sequences; and — the influence of secondary structure (e.g. loads induced due to proximity to the structure under evaluation).

(2) Test set - up and loading . The test set - up and loading should result in a realistic simulation of the expected operational loads.

(i) Test set - up . The test set - up dictates how loads are introduced into the structure and reacted. Every effort should be made to introduce and react loads as realistically as possible. When a compromise is made (e.g. wing air loading), the resulting internal loads should be evaluated (e.g. using finite element methods) to ensure that the structure is not being unrealistically underloaded or overloaded, locally or globally.

(ii) Loading spectrum . The test loading spectrum should include loads from all damaging sources (e.g. cabin pressurisation, manoeuvres, gusts, engine thrust, control surface deflections, and landing impacts) that are significant for the structure being evaluated. Consideration should also be given to temperatu re and other environmental effects that may affect internal loads. A supporting rationale should be provided when a load source is not represented in a sequence.

Additionally, differences between the test sequence and the expected operational sequence shou ld be justified. For example, it is standard practice to eliminate low loads that are considered to be non - damaging and to clip high infrequent loads that may non - conservatively bias the outcome, but care should be taken in both cases so that the test resu lts are representative.

(3) Test duration . For any WFD - susceptible area, the average time in flight cycles and/or hours to develop WFD should first be determined. This is referred to as the WFD for the subject area. The area should be modified or replaced at one (average behaviour) third of this time unless inspection for MSD/MED is practical. If inspection is practical, that inspection should start at one third of the WFD (average behaviour) , with modification/rep lacement at one half of that time. It is standard practice to interpret the non - factored fatigue life of one specimen as the average life. It follows that if one Powered by EASA eRules Page 218 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) full - scale fatigue test article survives a test duration of X time without an occurrence of WF D, it can be conservatively assumed that the WFD of all susceptible areas (average behaviour) is equal to X. Based on this, and assuming that the susceptible areas are impractical to inspect for MSD/MED, the replacement or modification should be implemente d at X/3.

For areas where MSD/MED inspections are practical, replacement/modification could be deferred until X/2, but MSD/MED inspections would have to start at X/3. The procedure should be kept in mind when deciding what the test duration will be.

(4) Post - test evaluation . One of the primary objectives of the full - scale fatigue test is to generate the data needed to determine the absolute WFD for each (average behaviour) susceptible area, or to establish a lower bound. Recall that the definition of WFD is the average time required for MSD/MED to initiate and grow to the (average behaviour) point that the static strength capability of the structure is reduced to less than the residual strength requirements of CS 25.571(b). Some work is required at the end of the test to determine the strength capability of the structure, either directly or indirectly.

(i) Residual strength tests . One acceptable way to demonstrate freedom from WFD at the end of a full - scale fatigue test is to subject the article to the requ ired residual strength loads specified in CS 25.571(b). If the test article sustains the loads, it can be concluded that the point of WFD has yet to be reached for any of the susceptible areas. However, because fatigue cracks that might exist at the end of the test are not quantified, it is not possible to determine how far beyond the test duration WFD would occur in any of the susceptible areas without accomplishing additional work (e.g. teardown inspection). Additionally, metallic test articles may be non - conservatively compromised relative to their future fatigue performance if static loads in excess of representative operational loads are applied. Residual strength testing could preclude the possibility of using an article for additional fatigue testing.

(ii) Teardown inspections . The residual strength capability may be evaluated indirectly by performing teardown inspections to quantify the size of any MSD/MED cracks that might be present, or to establish a lower bound on crack size based on the capabilit y of the inspection method. Once this is done, the residual strength capability can be estimated analytically. Depending on the results, crack growth analyses may also be required to project backwards or forwards in time to estimate the WFD for an area. As a minimum, teardown inspection methods (average behavi our) should be capable of detecting the minimum size of MSD or MED cracking that would result in a WFD condition (i.e. residual strength degraded to less than the level specified in CS 25.571(b)). Idea lly, it is recommended that inspection methods should be used that are capable of detecting MSD/MED cracking before it degrades the strength to less than the required level. Effective teardown inspections that are required to demonstrate freedom from WFD t ypically require significant resources.

They typically require disassembly (e.g. fastener removal) and destruction of the test article. All areas that are or may be susceptible to WFD should be identified and examined.

(d) Scope of full - scale fatigue test article The following examples offer some guidance on the types of data sets that might constitute ‘sufficient evidence’ for some kinds of certification projects. The scope of the test specimen and the duration of the test are considered.

Powered by EASA eRules Page 219 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) (1) New type de signs Normally, this type of project would necessitate its own full - scale fatigue test of the complete airframe to represent the new structure and its loading environment.

Nevertheless, prior full - scale fatigue test evidence from earlier tests performed by the applicant, or others, may also be used, and could supplement additional tests on the new model. Ultimately, the evidence needs to be sufficient to conclude with confidence that, within the LOV of the airframe, WFD will not occur. Factors 1 to 4 should be considered in determining the sufficiency of the evidence.

A test duration of a minimum of twice the LOV for the aeroplane model would normally be necessary if the loading spectrum is realistic, the design and construction for the test article principa l structure are the same as for the certified aeroplane, and the post - test teardown is exhaustive. If conformance to Factors 1 through 3 is less than ideal, a significantly longer test duration would be needed to conclude with confidence that WFD will not occur within the LOV. Moreover, no amount of fatigue testing will suffice if conformance to Factors 1 through 3 above is not reasonable. Consideration should also be given to the possible future need for life extension or product development, such as poten tial weight increases, etc.

(2) Derivative models The default position would be to test the entire airframe. However, it may be possible to reliably determine the occurrence of WFD for all or part of the derivative model from the data that the applicant ge nerated or assembled during the original certification project.

Nevertheless, the evidence needs to be sufficient to allow confidence in the calculations which show that WFD will not occur within the LOV of the aeroplane. Factors 1 through 5 should be cons idered in determining the sufficiency of the evidence for derivative models. For example, a change in the structural design concept, a change in the aerodynamic contours, or a modification of a structure that has a complex internal load distribution might well make analytical extrapolation from the existing full - scale fatigue test evidence very uncertain. Such changes might well necessitate full - scale fatigue testing of the actual derivative principal structure. On the other hand, a typical derivative often involves extending the fuselage by inserting ‘fuselage plugs’ that consist of a copy of the typical semi - monocoque construction for that model, with slightly modified material gauges. Normally this type of project would not necessitate its own full - scale fatigue test, particularly if very similar load paths and operating stress levels are retained.

(3) Type design changes — SBs Normally, this type of project would not necessitate its own full - scale fatigue test because the applicant would have generated, o r assembled, sufficient full - scale fatigue test evidence during the original certification project that could be applied to the change.

Nevertheless, as cited in the previous example, the evidence needs to be sufficient to allow confidence in the calculati ons which show that WFD will not occur within the LOV of the aeroplane. In addition, Factor 5, ‘The size and complexity of a design change’, should be considered.

(4) Type design changes — STCs (i) Sufficient full - scale test evidence for structures certifi ed under an STC may necessitate additional full - scale fatigue testing, although the extent of the design change may be small enough to use Factor 5 to establish the sufficiency of the existing full - scale fatigue test evidence. The applicant for an STC may not have access to the original equipment manufacturer (OEM)’s full - scale fatigue test data.

Powered by EASA eRules Page 220 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) For aeroplane types for which an LOV has been published, the STC applicant may assume that the basic structure was free from WFD up to the LOV, unless EASA has tak en AD action, or intends to take action (by a proposed AD) to alleviate a WFD condition, or inspections or modifications exist in the ALS relating to WFD conditions. For the purpose of the STC applicant’s demonstration that WFD will not occur on its modifi cation (or the underlying original structure) within the LOV, it may be assumed that the model types, to which the LOV is applicable, have received at least two full LOVs of fatigue testing, under realistic loads, and have received thorough post - test inspe ctions that did not detect any WFD, or the ALS includes from the outset details of the modifications required to address WFD that will need specific consideration by the STC applicant. With this knowledge, and Factors 1 through 5, the STC applicant may be able to demonstrate that WFD will not occur on its modification (or the underlying original structure) within the LOV.

If, however, the modification significantly affects the distribution of stress in the underlying structure, or significantly alters loads in other parts of the aeroplane, or significantly alters the intended mission of the aeroplane, or if the modification is significantly different in its structural concept from the certified aeroplane being modified, additional representative fatigue test evidence would be necessary.

(ii) In addition, Factor 6 ‘The age of the aeroplane being modified’ comes into play for modifications made to older aeroplanes. The STC applicant should demonstrate freedom from WFD up to the LOV of the aeroplane being modified. For example, an applicant for an STC to an aeroplane that has reached an age equivalent to 75 % of its LOV should demonstrate that the modified aeroplane will be free from WFD for at least the remaining 25 % of the LOV. Although an applicant coul d attempt to demonstrate freedom from WFD for a longer period, this may not be possible unless the OEM cooperates by providing data for the basic structure. A short DSG for the modification could simplify the demonstration of freedom from WFD for the STC a pplicant. Nevertheless, the applicant should also be aware that the LOV of the aeroplane is not a fixed life; it may be extended as a result of a structural re - evaluation and service action plan, such as those developed for certain models under the FAA’s ‘ Aging Aircraft Program’. Unless the modifier also re - evaluates its STC modification, the shorter goal for the modification could impede extending the LOV of the modified aeroplanes.

(5) Major repairs . New repairs (for which the applicable certification bas is requires WFD evaluation) that differ from the repairs contained in the OEM’s SRM, but that are equivalent in design from such repairs, and that meet CS - 25 specifications in other respects, would not necessitate full - scale fatigue testing to support free dom from WFD up to the LOV. Major repair solutions (that may be susceptible to WFD) which utilise design concepts (e.g. new materials, other production processes, new design details) different from the previously approved repair data may need further testi ng.

(e) Use of existing full - scale fatigue test data In some cases, especially for establishing an LOV in accordance with point 26.303 of Part - 26, or for derivative models and type design changes accomplished by the TCH, there may be existing full - scale fa tigue test data that may be used to support compliance and mitigate the need to perform additional testing.

Any physical differences between the structure originally tested and the structure being considered that could affect its fatigue behaviour must be identified and reconciled. Differences that should be addressed include, but are not limited to, differences in any of the physical Powered by EASA eRules Page 221 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) attributes listed under point (c)(1) of this Annex and differences in operational loading. Typical developments that affect the applicability of the original LOV demonstration data are the: — gross weight (e.g. if it increases), — cabin pressurisation (e.g. a change in the maximum cabin or operating altitude), or — flight segment parameters.

The older the test data, the harder it may be to demonstrate that it is sufficient. Often test articles were not conformed, neither were test plans or reports submitted to EASA as part of the compliance data package. The rigour of loading sequences has varied significantly over the ye ars, and from OEM to OEM. Additionally, testing philosophies and protocols were not standardised. For example, post - test evaluations, if any, varied significantly and in some cases consisted of nothing more than limited visual inspections. However, there m ay be acceptable data from the early full - scale fatigue tests that the applicant proposes to use to support compliance. In order to use such data, the configuration of the test article and the loading must be verified, and the issue of the residual strengt h capability of the article (or teardown data) at the end of the test must be addressed.

(f) Use of in - service data There may be in - service data that can be used to support WFD evaluations. Examples of such data are as follows: — Documented positive findin gs of MSD/MED cracks that include the location, size and the time in service of the affected aeroplane, along with a credible record of how the aircraft had been operated since the original delivery.

— Documented negative findings from in - service inspectio ns for MSD/MED cracks on a statistically significant number of aeroplanes, with the time in service of each aircraft, and a credible record of how each aircraft had been operated since the original delivery.

For this data to be useful, the inspection metho ds used should have been capable of detecting MSD/MED crack sizes equal to or smaller than those sizes that could reduce the strength of the structure to less than the residual strength levels specified in CS 25.571(b).

— Documented findings from the destr uctive teardown inspection of structures from in - service aircraft. This might be structures (e.g. fuselage splices) removed from the aircraft that were subsequently returned to service, or from retired aircraft. It would also be necessary to have a credibl e record of the operational loading experienced by the subject structure up to the time it was taken out of service.

Prior to using in - service data, any physical or loading differences that exist between the structure of the in - service or retired aeroplane s and the structure being certified should be identified and reconciled as discussed above.

[Amdt 20/20] [Amdt 20/22] Powered by EASA eRules Page 222 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20)

Annex 2 to Appendix 2 to AMC 20 - 20 B Example of how to establish

an LOV

ED Decision 2021/007/R This Annex provides a simplified example of how to establish an LOV for a specified aeroplane structural configuration. The process for establishing an LOV involves four steps: Step 1. Identifying a candidate LOV for the aeroplane structural configuration.

Step 2. Identifying WFD - susceptible structure. For this evaluation, it was determined that the aeroplane structural configuration had six areas with WFD - susceptible structures.

Step 3. Performing a WFD evaluation for each of the six areas of WFD - susceptib le structure to determine whether there are inspection start points and structural modification points for the candidate LOV identified. This allows the evaluation of the candidate LOV.

Figure 2 - 1, shown below, shows the WFD behaviour for one WFD - susceptib le area. The figure also shows three different candidate LOVs. Candidate LOV1 is at a point that occurs significantly before the WFD average behaviour line. This LOV will not require any maintenance actions. Candidate LOV2 occurs before the WFD average beh aviour line, but closer to it. As a result, inspection will need to start before the LOV. Although candidate LOV3 occurs before the WFD average behaviour line, with this LOV, the probability of WFD in the fleet is unacceptable, and inspection and subsequen t modification or replacement is required before the aeroplane reaches LOV3. Note that for LOV2 and LOV3, if inspections were determined to be unreliable, then the SMP would occur at the point on the chart where the ISP is. Using this example, this decisio n - making process needs to be repeated for all six WFD - susceptible areas.

Applicants should evaluate the candidate LOVs and the results of WFD evaluations for each susceptible area.

Candidate Candidate Candidate LOV 3 LOV 2 LOV 1 Residual strength Crack length WFD SMP IS P Flight cycles/hours (average behaviour) Figure 2 - 1: Comparison of WFD - susceptible structure to aircraft LOV Powered by EASA eRules Page 223 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Step 4. Finalising the LOV. Once all the susceptible areas have been evaluated, the final step is to determine where to establish the LOV that will be proposed for compliance. Figure 2 - 2 shows the results of the WFD evaluation of the six WFD - susceptible areas. As it is shown, there are inspections and modifications or replacements that should be performed over time to preclude WFD. Any LOV can be valid as long as it is demonstrated that, based on its inherent fatigue characteristics and any required maintenance ac tions, the aeroplane model will be free from WFD up to the LOV. The example in Figure 2 - 2 includes three LOVs that could be proposed for compliance.

— LOV1: Maintenance actions are not required to address WFD.

— LOV2: Inspection and modification or replace ment of area four are required to address WFD.

— LOV3: The DAH may propose an LOV that is greater than LOV2. However, as shown in Figure 2 - 2, that would result in more maintenance actions than identified for LOV2. Operators would be required to perform mai ntenance actions in four out of the six WFD - susceptible areas. Areas 1, 2 and 4 would have to be inspected prior to the LOV. Areas 3 and 5 are free from WFD maintenance actions. Area 4 would be required to be inspected and modified, and then the modificati on would be required to be inspected prior to the LOV. Area 6 would require modification prior to reaching the LOV. Some of the maintenance actions required for the LOV may have already been issued in an SB and mandated by an AD. For the rest, ADs will nee d to be issued.

Figure 2 - 2: Aeroplane maintenance actions [Amdt 20/20] [Amdt 20/22] Powered by EASA eRules Page 224 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20)

A ppendix 3 to AMC 20 - 20 B Guidelines for establishing instructions

for continued airworthiness of struc tural repairs and modifications

ED Decision 2021/007/R 1. INTRODUCTION With an SSID, CPCP , mandatory modifications and an LOV in place , an individual aircraft may still not meet the intended level of airworthiness for ageing aircraft structures. Repairs and modifications to aircraft structure also warrant investigation. It is recommended that f or large transport aeroplanes, all repairs an d modifications that affect the FCS should be assessed using some form of damage - tolerance - based evaluation. A regulatory requirement for damage tolerance was not applied to aeroplane design type s certified before 1978, and even after this time, the implem entation of DTE on repairs and modifications was not consistent. Therefore , the damage tolerance characteristics of repairs and modifications may vary widely and are largely unknown. In view of these concerns , it is necessary to perform an assessment of th e repairs and modifications on certain aircraft in service to establish their damage tolerance characteristics. Further informatio n on the background to the need for damage - tolerance - based inspection programmes for repairs is provided in Annex 6 to this Appendix.

Repairs and modifications to aeroplanes certified to JAR 25 Change 7 or 14 CFR 25 Amendment 45 or later must comply with the fatigue and damage tolerance requirements of their certification basis. In ad dition, points 26.307, 26.308, 26.309, 26.332 to 26.334 and 26.370 of Part - 26 define additional requirements for certain repairs and modifications that must be addressed using the damage tolerance methodology.

In cases where a new DTE is performed by DAHs to comply with points 26.333 and 26.334 of Part - 26 for existing changes or for new changes or repairs, according to CS 25.571 Amendment 18 or earlier amendments, the DTE and development of DTI should take into account the cracking scenarios that could reas onably be expected to occur in the remaining operational lifetime of the aeroplane into which the repair or modification can be incorporated.

2. DEFINITIONS See paragraph 4 of this AMC.

3. ESTABLISHMENT OF A DAMAGE - TOLERAN CE - BASED INSPECTION PROGRAMME FOR REPAIRS AFFECTING FCS 3.1 Overview of the TCH tasks for repairs that may affect the FCBS (a) Identify the affected aircraft model, models, aircraft serial numbers, and DSG stated as a number of flight cycles, flight hours, or both.

(b) Ide ntify the certifi cation level.

(c) Identify and develop a list of FCBS.

(d) Submit the list of FCBS to EASA for approval, and make it available to operators and STC H s.

( e ) Review and update published repair data as necessary.

( f ) Submit any new or updated published repair data to EASA for approval (or approve the data in accordance with Subpart M of Part 21) , and make it available to operators.

Powered by EASA eRules Page 225 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) ( g ) Develop REGs and submit them to EASA for approval, and make the approved REGs available to operators.

3.2. Certification l evel In order to understand what data is required, the TCH should identify the amendment level of the original aircraft certification relative to CS 25.571. The amendment level is useful in identifying what DT d ata may be available and what standard should be used for developing new DT d ata. The two relevant aircraft groups are: Group A Aircraft certified to CAR 4b or 14 CFR § 25.571, prior to Amendment 25 - 45 or JAR 25 Change 7 or equivalent. These aircraft were not evaluated for damage toler ance as part of the original type certification. Unless previously accomplished, existing and future repairs to FCBS will need DT d ata to be developed.

Group B Aircraft certified to JAR 25 Change 7 or 14 CFR § 25. 571, Amendment 25 - 45 or later. These aircra ft were evaluated for damage tolerance as part of the original type certification. As noted in the introduction, some of these repairs may not have repair data that includes appropriate DTI and the TCH and operators may need to identify and perform a DTE o f these repairs and develop DTI s .

3.3. Identifying fatigue - critical baseline structure (FCBS) TC h olders should identify and make available to operators a list of baseline structure that is susceptible to fatigue cracking that could contribute to a catastr ophic failure. The term ‘ baseline ’ refers to the structure that is designed under the original type certificate or amended type certificate for that aircraft model (that is, the ‘ as delivered aircraft model configuration ’ ). Guidance for identifying this st ructure can be found in CS - 25 AMC 25.571.

This structure is referred to in this AMC as ‘ fatigue - critical baseline structure. ’ The purpose of requiring identification and listing of FCS is to provide operators with a tool that will help in evaluating existing and future repairs or modifications. In this context, FCS is any structure that is susceptible to fatigue that could contribute to a catastrophic failure, and should be subject t o a DTE. The DTE would determine if DTIs need to be established for the repaired or modified structure. For the purpose of this AMC, structure that is modified after aircraft delivery from the TCH is not considered to be ‘ baseline ’ structure.

CS 25.571(a) states ‘ An evaluation of the strength, detail design, and fabrication must show that catastrophic failure due to fatigue environmental and accidental damage , will be avoided throughout the ope rational life of the aeroplane . This evaluation must be conducte d … for each part of the structure which could contribute to a catastrophic failure (such as wing, empennage, control surfaces, fuselage, engine mounts, and their related primary a ttachments) … ’. When identifying FCBS, it is not sufficient to consider only that structure identified in the SSID or ALS. Some SSIDs or ALSs might only include supplemental inspections of the most highly stressed elements of the FCBS. A n SSID or ALS often refer s to this structure as a PSE. If repaired, other areas of structure no t identified as a PSE in the SSID or ALS may require supplemental inspections. The term PSE has, at times, been interpreted narrowly by industry. The narrow application of the term PSE could incorrectly limit the scope of the structure that would be consid ered relative to fatigue if repairs or modifications exist or are made su bsequently. The relationship between PSE and FCS could vary significantly depending on the TCH’s working definition of PSE. In addition, there may be structure whose failure would be catastrophic, but due Powered by EASA eRules Page 226 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) to low operational loads on the part, the part will not experience fatigue cracking.

However, if the subject part is repaired or modified, the stresses in the part may be increased to a level where it is now susceptible to fatigue cra cking. These types of parts should be considered as FCS .

TCHs should develop the list of FCBS and it should include the locations of the FCS and a diagram showing the extent of the FCS. TCHs should make the list available to STCHs and to operators.

Note: Typically, for the purposes of compliance with Part - 26 related to FCS, it is not expected that composite structures will be identified as FCS; however, metallic repairs/changes to composites may be FCSs. If composite structures on a type design are f ound to be susceptible to fatigue cracking, this should be discussed with EASA under the CAW procedures. With the increase in the use of composites, EASA will monitor the adequacy of existing structural integrity programmes for composite structures, includ ing repairs.

3.4. Certification standard applied when performing a DTE For Group A aircraft, the TCH should use the requirements of JAR 25.571 Change 7 or 14 CFR § 25.571, at Amendment 25 - 45, as a minimum standard. For Group B aircraft, the TC H should use the requirements that correspond to the original certification basis as a minimum standard. For each repair requiring a DTE, the DAH should apply not less than the minimum standard when developing new or revised DT d ata. The certification stand ard applied by the TCH in performing a DTE for repairs should be identified in the Part - 26 compliance documentation submitted to EASA, and applicable Part - 26 paragraphs clearly referenced in the approved documentation provided to the operator.

3.5. Perform ing a DTE on a repair that affects FCBS When performing a DTE on a repair that affects the FCBS, the DTE would apply to the affected FCBS and repair. This may consist of an individual analysis or the application of a DT - based process such as RAGs that woul d be used by an operator. The result of the DTE should lead to developing DTI s that address any adverse effects the repair may have on the FCBS. If the DTE results determine that DTIs are not required to ensure the continued airworthiness of the affected F CBS, the TCH should note that in the DTE documentation.

The term ‘ adverse effects ’ refers to a degradation in the fatigue life or inspec tability of the affected FCBS. Degradation in fatigue life (earlier occurrence of critical fatigue cracking) may result from an increase in internal loading, while degradation of inspectability may result from physical changes made to the structure. The DTE should be performed within a time frame that ensures the continued airworthiness of the affected FCBS.

3.6. Review of published repair data Published repair data are generally applicable instructions for accomplishing repairs, such as th ose contained i n SRMs and SBs. TCHs should review their existing repair data and identify each repair that affects the FCBS. For each such repair, unless previously accomplished, the TCH must perform a DTE and develop any necessary DTI for the affected FCBS and repair data. For some repairs, the results of the DTE will conclude that no new DTI will be required for the affected FCBS or repair. For these cases, the TCH should provide a means that informs the operator that a DTE was pe rformed for the subject repair. This may be accomplished, for example, by providing a statement in a Powered by EASA eRules Page 227 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) document, such as an SRM, stating that all repai rs contained in this ma nual have had a DTE performed. This should preclude operators from questioning those repairs that do not have DTIs. TCHs should provide a list of their published repair data to operators and a statement that a DTE ha s been performed on this data. The following examples of published repair data developed by the TCH should be reviewed and included in this list: (a) SRMs, (b) SBs, (c) d ocuments containing AD - mandated repairs, and (d) o ther documents available to operators ( e.g. some sect ions of aircraft maintenance manuals and component maintenance manuals) that may contain approved repair data.

3.7. Developing DT data for existing published repair data 3.7.1. SRMs The TCH should review the repair data contained in each SRM and iden tify r epairs that affect FCBS. For these repairs, the TCH will need to determine if the SRM needs rev ising to provide adequate DTI. In determining the extent to which an SRM may need to be revised for compliance, consider the following: (a) Whether the existing SRM contains an adequate description of DTIs for the specific model.

(b) Whether normal maintenance procedures ( e.g. the inspection threshold and/or existing normal maintenance inspections) are adequate to ensure the continued airworthiness (inspectability ) is equal to the unrepaired surrounding structure.

(c) Whether SRM Chapter 51 standard repairs have a DT E .

(d) Whether all SRM - specific repairs affecting FCBS have had a DTE performed.

(e) Whether there is any gui dance on proximity of repairs.

(f) Whether existing superseded repairs are addressed and how a DTE will be performed for repairs that are likely to be superseded in the future and how any DTI will be made available.

3.7.2. SBs The TCH should review the repair data contained in its SBs (See Annex 4 ) and identify t hose repairs that affect FCBS. For those repairs, the TCH should then determine if a new DTE will need to be performed. This review may be done in conjunction with the review of SBs for modifications that affect FCBS.

3.7.3. ADs The TCH should review ADs that provide maintenance instructions to repair FCBS and determine if the instructions include any necessary DT d ata. While maintenance instru c tions supporting ADs are typically contained in SBs, other means of documentation may be used.

3.7.4. Other forms of data transmi ssion In addition to SRMs, SBs, and documentation for ADs, the TCH should review any other documents ( e.g. aircraft maintenance manuals and component maintenance Powered by EASA eRules Page 228 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) manu als) that contain approved repair data. Individual repair data not contained in the above documents will be identified and DT d ata obtained through the REGs process.

3.8. Developing DT data for future published repair data Following the completion of the review and revision of existing published data , any subsequent repair data proposed for publication should also be subject to DTE and DTI provided.

3.9. Appro val of DT data developed for published repair data For existing published repair data that requires new DT d ata for repairs affecting the FCBS, the TCH should submit the revised documentation to EASA for app roval unless otherwise agreed in the compliance p lan approved in accordance with point 26.301 of Part - 26. For instance, it may be agreed that the data can be approved according to an existing or a modified process utilising the Part 21 DOA privileges for repair approval of the TCH . The DT d ata for future published repair data may be approved according to existing processes.

3.10. Documentation of DT data developed for published repair data TCH s should include the means used to document any new DTI devel oped for published repair data. For example, in lieu of revising individual SBs, the TCH may choose to establish a collector d o cument that would contain new DTI developed and approved for specific rep airs contained in various SBs.

3.11. Existing repairs TCHs should develop processes that will enable operators to identify and obtain DTI for existing repairs on t heir aircraft that affect FCBS. Collectively, these processes are referred to as the REGs and are addressed in subparagraph 3.13 .

According to point 26.309 of Part - 26, REGs are required for aircraft for which the TC was issued prior to 11 January 2008. Derivatives of aircraft for which the original TC was issued prior to 11 January 2008 where only part of the structure is certified to CS - 25 Amdt 1 or later should have REGs that address the whole structure, due to the risk that subsequent repairs may have been implemented without adequate knowledge of the applicability of the certification basis to the various areas of the structure.

3.12. Future repairs Future r epairs to FCS must have a DTE performed in accordance with Part 21 and the applicable certification basis . This includes blend - outs, trim - outs, etc. , that ar e beyond published limits. For new repairs, the applicant may, in conjunction with an operator, use the three - stage approval process provide d in Annex 1 to this Appendix. This process involves incremental appr oval of certain engineering data to allow an operator to return its aircraft to service before all DT d ata is developed and approved. The applicant should document this process and the operator should reference it in their maintenance progra mme if it is intend ed to apply it.

3.13. Repair evaluation guidelines REG s provide instructions to the operator on how to survey aircraft, how to obtain DTI, and an implementation schedule that provides timelines for these actions. E ffective REG s may require that cert ain DT d ata be developed by the TCH and made available to operators. Updated SRMs and SBs, together with the existing, expanded, or new RAG Powered by EASA eRules Page 229 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) documents, form the core of the information that will need to be made available to the ope rator to support this proc ess. In developing REG s the TCH will need to determine what DT d ata is currently a vailable for repairs and what new DT d ata will need to be developed t o support operator compliance. REG s should include: (a) a process for conducting surveys of affected airc raft that will enable identification and documentation of all existing reinforcing repairs that affect FCBS ; (b) a process for obtaining DTI for repairs affecting FCBS that are identified during an aircraft survey; and (c) a n implementation schedule that p rovides timelines for: (1) c onducting aircraft surveys, (2) o btaining DTI, and (3) i ncorporating DTI into the operator’s maintenance programme.

3.13.1. Implementation s chedule (a) The schedule provided in this Section is applicable to REGs produced in compliance with point 26.309 of Part - 26. In cases where REGs are deemed necessary, the TCH should propose a schedule for a pproval by EASA that takes into account the distribution of the fleet relative to ¾ DSG, the extent of the work involved , and the airw orthiness risk. Aircraft fleets approaching or exceeding their DSG s should be given priority in the implementation schedule.

(b) Survey schedule for EASA - approved REGs applicable to aircraft maintained under Part - M The following basis for accomplishing the aircraft repair assessment survey is approved by EASA and may be used by operators maintaining aircraft according to the Part - M and Part - 26 requirements: The repair survey, the first step of the repair assessment, must be carried out at the earliest conve nient opportunity (e.g. the next heavy maintenance check). In addition, the implementation of the surveys across the fleet must be achieved without exceeding the DSG or a period of 7 years following the approval by EASA of these REGs, whichever occurs late r. By adhering to these timescales, the REGs are acceptable to EASA for use by operators needing to demonstrate compliance with point 26.370(a)(ii) of Part - 26.

To ensure that the TCH can support the operators’ requests for data following the survey, operators should not defer the implementation of the programme across their fleet until the end of the allowed time period.

(c) Obtaining DTIs and incorporation of DTIs into the maintenance programme must be completed as follows: For existing, non - publishe d repairs and deviations from published repairs identified in the survey, if the REGs direct operators to contact the TCH to obtain DTIs, the TCH should approve the DTIs within 12 months after identification, unless the TCH uses another process agreed by E ASA. To facilitate this, the operator should provide the TCH with that request and the associated information within 3 months from the identification.

Powered by EASA eRules Page 230 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) For repairs covered by the TCH’s published repair data, operators should obtain and incorporate into thei r maintenance programmes DTIs for existing repairs within 6 months after accomplishing the aeroplane survey. For non - published repairs found during the survey, the incorporation should be completed no later than 6 months after the approval of the data (see Annex 2 to this Appendix for the DTI assessment process).

3.13.2. Developing a process for conducting surveys of affected aircraft The TCH should develop a process for use by ope rator s to conduct aircraft surveys.

These aircraft surveys are conducted by operators to identify and document repairs and repairs to modifications that may b e installed on their aircraft. S urvey s are intended to help the operators determine which repairs may need a DTE in order to establish the need for DTI. Identification of repairs that need DTI should encompass only existing reinforcing repairs i.e. those repairs that reinforce and restore the stre ngth of the FCBS. This typically excludes maintenance actions such as blend - outs, plug rivets, trim - outs, etc. The process the TCH develops to conduct surveys should include: (a) a survey schedule ; (b) a reas and access provisions for the survey ; (c) a proc edure for repair data collection that includes: (1) r epair dimensions, (2) r epair material, (3) r epair fastener type, (4) r epair location, (5) r epair proximity to other repairs, (6) r epairs covered by published repair data, and (7) r epairs requiring DTI ; ( d) a means to determine whether a repair affects FCBS or not .

3.13.3. Developing a process to obtain DT data for repairs (a) The TCH must develop a process that operators can use to obtain DTIs that address the adverse eff ects that repairs may have on FCBS . In developing this process, TCHs will need to identify all applicable DTIs they have developed that are available to operators. This may include updated SRMs and SBs, existing RAGs, expanded or new RAGs, and other sources of DTIs developed by the TCH . For certain repairs, the process may instruct the operators to obta in direct support from the TCH. In this case, the TCH evaluates the operator’s request and makes available the DTI for a specific repair o r group of repairs, as needed. These may include operator or third - party developed/approved repairs, and repairs that deviate from a pproved published repair data.

(b) The process should state that existing repairs that already have DTIs developed and in place in the maintenance programme require no furth er action. For existing repairs identified during an individual aircraft survey that Powered by EASA eRules Page 231 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) need DTIs established, the process may direct the operators to obtain the required DTIs from the following sources: ( 1) TCH - published service information such as DT - based SRMs, SBs, or other documents containing applicable DT d ata for repairs.

(2) Existing approved RAG documents (developed for compliance with SFAR § 121.107).

(3) Expanded or newly developed RAG documents. In order to expedite the process for an operator to obtain the necessary DTI to address the adverse affects that repairs may have on FCBS, the TCH may determine that the existing RAG document should be expanded to address other FCBS of the aircraft ’s pressure boundary. In addition, for aircraft that do not currently have a RAG, the TCH may determine that in order to fully support operators in obtaining DTI s , a new RAG document may need to be develop ed. General guidance for developing this material can be found in Anne x 2 below, which is similar to FAA AC 120 - 73, Damage Tolerance Assessment of Rep airs to Pressurised Fuselages .

(4) Procedures developed to enable operators to establish DTIs without having to cont act the TCH for direct support. These procedures may be similar in concept to the RAG documents.

(5) Direct support fr om the TCH for certain repairs. The operator directly solicits DTIs from a TCH for certain individual repairs as those repairs are identified during the s urvey.

3.14 Repairs to removable structural components FCS may include structure on removable structural parts or assemblies that can be exchanged from one aircraft to another, such as door assemblie s and flight control surfaces. In principle, the DT d ata development and implementation process also applies to rep airs to FCS on r emovable components. During their life history, however, these parts may not have had their flight times recorded on an individual component level because they have been removed and reinstalled on dif ferent aircraft multiple times.

These ac tions may make it impossible to determine the component’s age or total flight hours or total flight cycles. In these situations, guidance for developing and implementing DT d ata for existing and new repairs is provided in Annex 3 to this Appendix. Additional guidance to assist in controlling and/or tracking certain maintenance requirements on removable structure components might be found in A4A Spec 120 ‘Removable Structural Compo nents Industry Guidelines’.

3.15 Training The complexity of the repair assessment and evaluation may require adequate training for proper implementation. In that case, it is necessary that each TCH consider providing training for all operators of the aircraft considered by this AMC https://publications.airlines.org/CommerceProductDetail.aspx?Product=197 Powered by EASA eRules Page 232 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 4. MODIFICATIONS AND REPAIRS TO MODIFICATIONS (COMPLIANCE WITH POINTS 26.307, 26.308 AND 26.332 TO 26.334 OF PART - 26) 4.1. TCH and STCH tasks — Modifications and repairs to modifications The following is an overview of the TCH and STCH tasks necessary for m odifications that affect FCBS. This overview also includes TCH and STCH tasks necessary for repairs that may affect any FCS of the subject modifications. These tasks are applicable to those modifications that have been de vel oped by the TCH or STCH.

(a) Establish a list of modi fications that may affect FCBS. From that list establish a list of modifications that may contain FCS.

(b) In consultation with operators, determine which aircraft have the modification(s) installed.

(c) STCHs should obtain a list of FCBS from the TCH for the aircraft models identified above.

(d) STCHs should identify: — m odifications that affect FCBS, or — m odifications that contain FCS.

(e) Determine if DT d ata exist s for the identified modifications .

(f) Develop additional DT d ata, if necessary.

(g) Establish an implementation schedule for DTI for modifications.

(h) Revie w existing DT d ata for published repairs made to modifications that affect FCBS.

(i) Develop additional DT d ata for published repairs made to modifications that affect FCBS.

(j) Establish an implementation schedule for DTI for published repairs made to modifications.

(k) Prepare documentation, submit it to EASA for approval, and m ake it available to operators.

4.2. Spec ific m odifications to be c onsidered The TCH should consider modifications and any STCs they own for modifications that fall into any of the categories listed in Annex 5 to this Ap pendix. STCHs should do the sam e for their STC modifications. For modifications that are not developed by a TCH or STCH , the operator should consider whether the modification falls into any of the categories listed in Annex 5 to this Appendix.

4.3. Modifications and published repairs affecting those modifications that need DT data Using the guidance provided in AMC 25.571 and the detailed knowledge of the modification and its e ffect on the FCBS, the TCH or STCH, or in certain cases the operator, should consider the following situations in determining what DT data need s to be developed .

4.3.1. Modifications that affec t FCBS Any modification identified in Annex 5 that is installed on FCBS should be evaluated regardless of the size or complexity of the modification. In addition, any Powered by EASA eRules Page 233 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) modification which indirectly affects FCBS ( e.g. modifications which change the fatigue loads environment, or affect the inspectability of the structure, etc.) must also have a DT E performed to assess its impact.

4.3.2. Modifications that contain new FCS For any modifi cation identified in Annex 5 to this A ppendix that affects FCBS, the TCH or STCH should identify any FCS of the modification. Any modification that con t ains new FCS should be evaluated regardless of the size or complexity of the modification. Exampl es of this type of modification may be a modification that adds new structural splices, or increases the operational loads causing existing structure to become fatigue critical. If a modification does not affect FCBS, then it can be assumed that this modif ication does not contain FCS.

4.3.3 Published repairs affecting modifications to FCS Published repair data are generally applicable instructions for accomplishing repairs, such as those contained in SRMs and SBs. TCHs and STCHs should review their existing repair data and identify each repair that affects FCMS. The following examples of published repair data developed by the TCHs and STCHs should be reviewed and included in this list: (a) SRMs, (b) SBs, (c) documents containing AD - mandated repairs, and (d) other documents available to operators (e.g. some sections of aircraft maintenance manuals and component maintenance manuals) that may contain approved repair data.

4.4. Reviewing e xisting DT data for modifications that affect FCBS Based on the CS 25.571 c ertification amendment level and other existing rules, the modification’s approval documentation may already provide appropriate DT data.

The TCH or STCH should identify modifications that have existing approved DT data.

Acceptable DT data contain s a state ment of DTE accomplishment and are approved.

Confirmation that approved DT data exists should be provided to the operators.

Modifications that have been developed by a TCH may affect FCBS. These inclu de design changes and in some cases STCs. These changes to type design also require review for appropriate DT data.

4.5. Developing a dditional DT data for modifications that affect FCBS DT data may be submitted for approval and published as follows: (a) STC modifications : A dditional DT data for existing modifications may be approved as a change to an existing STC by the STCH and published , for example, as a supplement to the ALS. Alternatively, an application can be made to EASA in order for the data to be submitted to EASA in the form of a specific Part - 26 compliance document, and the resulting approved DTI made available to operators .

(b) TC h older modifications : A dditional DT data for existing modifications may be published in the form of a revised ALS, an SSID and TCH ser vice information.

Powered by EASA eRules Page 234 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Note: The TCH and STCH should submit data to EASA that describes and supports the means used to determine whether a modification affects FCBS, and the means used for establishing FCS of a modification.

(c) Modifications not developed by a TCH or STCH : For modifications identified in Annex 5 to this A ppendix that affect FCBS and were not developed by a TCH or STCH, the operator is responsible for obtaining DT data f or those modifications.

Operators may establish agreements with DAHs f or those existing individual modifications that do not have DT data or other procedures implemented . In cooperation with the operator, the DAH should establish DT data according to an im plementation plan approv ed by the c ompetent a uthority with respect to the maintenance programme. Part - 26 and CS - 26 provide critical timelines for this activity .

(d) In cases w here the threshold inspection of the DTI is likely to have been or soon will be e xceeded by the fleet leaders, an implementation schedule will be needed.

Typically, the proposed grace period should not exceed 24 months.

The approval of the DT data will be according to a process agreed by EASA.

The process for operators to obtain the data and the implementation schedule should follow that given in paragraph 6.

4.6. Developing additional DT data for published repairs that affect FCMS For each such repair, unless previously accomplished, the TCH or other DAH must perform a DTE and develop any necessary DTI for the affected FCBS, and repair data. For some repairs, the results of the DTE will conclude that no new DTI will be required for the affected FCBS or repair. For these cases, the TCH or other DAH should provide a means that inf orms the operator that a DTE was performed for the subject repair. This may be accomplished, for example, by providing a statement in a document, such as an SRM, stating that ‘all the repairs contained in this manual have had a DTE performed’. This is inte nded to assist operators in showing compliance with point 26.370 of Part - 26 and prevent them from questioning those repairs that do not have DTIs. TCHs and other DAHs should provide a list of their published repair data to operators, and a statement that a DTE has been performed on this data.

5. DEVELOPMENT OF TCH AND STCH DOCUMENTATION AND EASA APPROVAL TCH, STCHs, operators and the airworthiness authorities should work together to develop model - specific documentation with oversight provided by those autho rities and assistance from the ARAC AAWG. It is anticipated that TCHs will utilise structural task groups (STG s ) to support their development of model - specific documents. EASA will approve the TCH or STCH submissions of the REGs and any other associated do cumentation required by Part - 26 . In order to facilitate operators’ compliance with Part - 26, the DAHs may find it helpful to consolidate their compliance data in as few documents as possible, or provide a guide to all the relevant DT data in a separate comm unication to operators.

6. OPERATOR TASKS — REPAIRS, MODIFICATIONS AND REPAIRS TO MODIFICATIONS IN SUPPORT OF COMPLIANCE WITH POINT 26.370 OF PART - 26 AND CS 26.370 This paragraph provides guidance to operators for developing a means for addressing the adve rse effects that repairs and modifications may have on FCS. The guidance supports operators that need to comply with point 26.370 of Part - 26, and explains how operators can develop an implementation plan to obtain and implement all the applicable DT data f or Powered by EASA eRules Page 235 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) modifications and repairs when using CS 26.370 as a means of compliance. The plan will contain processes and timelines for operators to use, for obtaining and incorporating into their maintenance programme, DTIs that address the adverse effects of repai rs and modifications.

Operators will need to determine how they will obtain the information necessary to develop the plan by considering the following conditions: (a) The operator processes ensure that DT data for repairs and modifications affecting FCBS h ave been developed and all the applicable DTIs have been incorporated into the operator’s maintenance p rogramme. If an operator is able to demonstrate that these processes have been in place and followed throughout the operational life of the aircraft for all repairs and modifications affecting FCBS, then no further action is required for existing repairs and modifications (b) The TCH or STCH or other DAH exists and will make the DTIs available to the operator automatically or upon request according to poin ts 26.333 and 36.334 of Part - 26 respectively.

(c) DTIs already exist and are available.

(d) DTIs are not available from the TCH or STCH or other DAH; (e) DTIs are not available for modifications developed by organisations other than TCH or STC holders (e.g . major changes approved under FAA Form 337, accepted under the EU - USA bilateral agreement, but that were approved before 14 CFR Part - 26 became applicable).

Figure A3 - 1 below outlines an overview of developing a means of compliance for modifications to be addressed by STCHs/TCHs and operators in order to comply with points 26.306 to 26.309, 26.332 to 26.334 and 26.370 of Part - 26.

Powered by EASA eRules Page 236 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) TCH tasks Operator tasks • Identify affected aeroplanes • Identify applicable modifications that • Identify FCBS exist in the operator’s fleet that have • Identify certification amendment level been embodied in or affect FCBS.

• The operator should identify and contact the TCH and STCHs for applicable modifications and request TCH and STCH tasks — Modifications DT data for the modifications, unless • Review EASA approved modification data it is already available.

and identify modifications that may affect FCBS.

• Verify applicability of modifications. Do they: o affect FCBS?

o create new FCS?

No TCH or Modifications No STC H supported by support?

existing DT data?

Operator establishes Yes schedule for obtaining DT data for Yes Develop the approval by needed DT data competent authority TCH or STCH provides evidence to EASA according to compliance plan.

Establish DT data implementation schedule Complete EASA documentation Approval of document(s) DAH makes DT Operator data available to operator Figure A3 - 1: Developing a means of com pliance for modifications Powered by EASA eRules Page 237 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 6.1. Contents of the maintenance programme (a) The operator ’s maintenance programme should contain or refer to an implementation plan that ensures that: (1) all new repairs and modifications that affect FCBS will have DT data and DTI or other procedures implemented ; (2) all existing repairs and modifications to FCBS have been or will be evaluated for damage tolerance and have DTI or other procedures implemented. In the context of this implementation plan, there should be a process that: (i) r eview s operator processes to determine if DT data for repairs and modifications affecting FCBS have been developed and incorporated into the operator’s maintenance programme for the op erational life of the aircraft. If an operator is ab le to demonstrate that these processes ensure that DT data is developed for all repairs and modifications affecting FCBS, then no further action is required for exist ing repairs and modifications.

(ii) identif ies or survey s existing repairs (using the appl icable REGs or survey parameters from Annex 2 to this Appendix) and modifications that affect FCBS and obtain and implement DTI for those repairs and modifications. This should inc lude an implementation schedule that provides timing for incorporation of the DT data into the operator’s maintenance programme, within the time frame given in the applicable TCH or STCH’s approved documentation.

(b) Figure A3 - 2 below outlines one possible means that an operator can use to develop an implementation plan for aircraft in their fleet.

Powered by EASA eRules Page 238 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) STC H : Approved documentation for modifications and repairs as embodied i n specific aircraft serial Operator’s plan for revision of the maintenance numbers programme — DTE processes from compliance document(s) Operator: Approved documentation for — DTI from complian ce document(s) modifications and repairs other than those provided by STCH and TCH — Repair survey plan for existing repairs embodied i n specific aircraft serial numbers — Means of identifying through reviewing records or surveying to determine modifications embodied i n aircraft — Implementation schedule • aeroplane surveys TCH: • repairs Approved documentation for repairs and • modifications modifications • repairs to modifications for a particular aircraft model Competent authority approval of the maintenance programme Figure A3 - 2 : Operator’s maintenance programme approval process Powered by EASA eRules Page 239 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — G ENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 6.1.1. Implementation plan for repairs Except as described in CS 26.370, t he maintenance programme should include a repair survey schedule to identify repairs th at may need DT data developed. The TCH’s REG s may be used as a basis for this plan. (See Paragraph 3 .13 above and Annex 2 for further information) 6.1.2. Implementation plan and ac tions for modifications (a) Points 26.307, 26.308, 26.333 and 26.334 of Part - 26 require DAHs to develop DTI for existing modifications (design changes) within a certain timescale.

CS 26.370 provides means of compliance to operators on how to revise the mai ntenance programme by including an implementation plan to show how approved DTI data will be obtained and used to address the potential adverse effects of repairs and modifications to FCS and submit it for approval to the competent authority. To show compl iance with CS 26.370, operators are first requested to develop a list of modifications affecting FCBS through a review of the aircraft records. The operator will need to show to their competent authority that the aircraft records are a reliable means for i dentifying modifications that affect FCBS. The aircraft records, in conjunction with data provided by the DAH, may also be sufficient to help identify whether DTI exists for all modifications. However, for some older aircraft, a review of records alone may not always be adequate to identify all the modifications that have an adverse effect on FCBS, or be sufficient to establish whether a DTE has been accomplished and DTI is complete, without requesting such information from the DAH. Physical inspection of t he aircraft may help establish the scope of the modification if it is unclear from the records. Finally, the aircraft survey for repairs may also identify modifications affecting FCS, which should then be evaluated and DTI obtained as necessary in accordan ce with CS 26.370(h).

(b) To support identification of modifications that need to be address ed, operators should — concurrent ly with the TC H and STCHs’ tasks — identify the TCH or STC or othe r approval holder - developed modifications that exist in their aircraft fleet s . To support compliance with point 26.370 of Part - 26 as envisaged in CS 26.370, operators should perform the following tasks: (1) From the review of records, c ompile a listing of all TCH and STCH - developed modifications that are currently installed on their fleet .

(2) Delete from the listing those modifications that do not affect FCB S.

Docume n ts from the TCH may be used to identify the FCBS.

Note: In order to ensure timely compliance with point 26. 370 of Part - 26, operators should begin developing the list of modifications that affect FCBS, for each affected aircraft in the fleet, as soon as the TCHs make their FCBS listing available.

(3) The modifications that affect FCBS must be reviewed to determi ne whether: (i) DT data already exist s in the maintenance programme, or is available and is complete ; or (ii) DT data need s to be developed.

Powered by EASA eRules Page 240 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) (4) For DT data that is complete, the operator should incorporate it into the maintenance programme and implement i t according to the schedule provided in 6.1.3 or as otherwise agreed by the competent authority. Note: Complete DTI for STCs approved after 1 September 2003 should be available to operators not later than 30 months after the date of applicability of point 26.370 of Part - 26 following approval by EASA unless the STCH no longer exists.

(5) For DT data that is not available or is incomplete 30 months after the date of applicability of point 26.370 of Part - 26, the operator should ensure that the plan developed a ccording to CS 26.370 will address each affected modification.

(6) Where DT data is not available or is incomplete, the operator should notify both the STCH or a third party that DT data for the modification is required.

(7) Establish whether the STCH or a third party will provide the data.

Note: For modifications addressed by point 26.334 of Part - 26 (for change approvals issued before 1 September 2003), the DAH does not need to develop the DT data until requested by an operator and has 24 months from that date to submit the data for approval. It is therefore envisaged that DTI for these modifications will be addressed in accordance with paragraph (8) and the timescales of 26.370 (h).

Whatever the approval date of the change, the operator is responsible for obtaining the DTI from the approval holder once it becomes available. It is therefore recommended that the operator contacts the approval holder or a third party as soon as possible after identifying a modification that affects FCBS to establish when the DTI will become available.

(8) For those modifications where the DTI will not be incorporated into the maintenance programme within 36 months from the date of applicability of point 26.370(a)(ii) of Part - 26, the operator’s DT data implementation plan should contain the following information: (i) a description of the modification; (ii) the affected aircraft and the affected FCS; (iii) the DSG of the affe cted aircraft; (iv) a list of the FCS introduced by the modification (if it exists); (v) the CS 25.571 certification level for determining the DT data; (vi) a plan for obtaining DT data for each modification (e.g. reliance on the existing STCH or a formal contract with a Part 21 - Subpart J - approved third party) to produce DT data within a specified compliance time in accordance with CS 26.370; (vii) a DT data implementation schedule for incorporating the DT data into the maintenance programme once it is rece ived; Powered by EASA eRules Page 241 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) (viii) a means of ensuring that the aircraft will not be operated beyond the time limit established for obtaining DT data.

(9) For modifications that are found during the aircraft survey for repairs, the operator should ensure that DT data is obtaine d and submitted to EASA for approval. Once approved, the operator should incorporate the DTIs into its maintenance programme no later than 12 months from the date when the modification was identified.

6.1.3. Implementation of DTI Operators should accomplis h the first inspection of a change according to the approved DTI implementation schedule. If the age of the modification is unknown, the operator should use the aircraft age in total flight cycles or total flight hours, as applicable. Where there is any do ubt about the applicability of the programme data or the t imescales provided in the DAH documentation, EASA should be consulted by the operators and competent authorities concerned.

7. ROLE OF THE COMPETENT AUTHORITY The competent authority ’s role is to verify that the AMP is in compliance with point 26.370 of P a rt - 26 and ensure that their aircraft continuing airworthiness monitoring survey programme takes into account the risks associated with potential non - compliance of operators’ or owners’ AMPs with t he requirements of point 26.370 of Part - 26. (Ref. Part - M requirements for the Competent Authority (M.B.301 and 303)).

[Amdt 20/2] [Amdt 20/20] [Amdt 20/22]

Annex 1 to Appendix 3 to AMC 20 - 20 B Approval process for new

repairs

ED Decision 2021/007/R The ap proval process for new repairs may use a three - stage approach, as now commonly used in the aviation industry.

DT d ata include s inspection requirements, such as the inspection threshold, inspection method, and inspection repetitive interval, or may specify a time limit when a repair or modification needs to be replaced or modified. The required data may be submitted all at once, prior to the aircraf t’ s return to service, or it may be submitted in stages. The following three - stage approval process is availab le, which involves incremental approval of engineering data to allow an aircraft to return to service before all the engineering data previously d escribed is submitted. The three stages are described as follows: (a) The first stage is the approval of the s tatic strength data and the schedul e for submission of the DT d ata. This approval is required prior to ret urning an aircraft to service.

(b) The second st age is approval of the DT d ata. Sufficient data to substantiate continued safe operation should be submitted no later th a n 12 months after the ai rcraft was returned to service , unless a temporary limitation was substantiated by sufficient fatigue and damage tolerance evaluation data and approved at the first stage of approval, in which case t he second stage DT data should be approved before the temporary limit is reached . At th e second stage , the DT d ata need only contain the threshold when inspections are required to begin as long as a process is in place to develop the required inspection me thod and repetitive intervals be fore Powered by EASA eRules Page 242 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) the threshold is reached. In this case, the submission and approval of the remaining DT d ata may b e deferred to the third stage. The approved threshold acts as a limitation on the repair data.

(c) The third stage is approval of the inspection metho d and the repetitive intervals. This final element of the repair certification data in compliance with CS 25.571 should be submitted and approved prior to the inspe ction threshold being reached.

The applicant should inform t he operator if this process is being used, and of the expected timelines for the delivery of the data. To follow the three - stage process, the DAHs subject to Part 21 will need to establish procedures to be accepted by EASA under their design organisation a pprovals.

[Amdt 20/2] [Amdt 20/20] [Amdt 20/22]

Annex 2 to Appendix 3 to AMC 20 - 20 B Assessment of existing

repairs

ED Decision 2021/007/R A DTI assessment process consists of an aircraft repair survey, identification and disposition of repairs requiring immediate action and development of damage - tolerance - based inspections, as described below: 1. AIRCRAFT REPAIR SURVEY A survey will be used to identify existing repairs and repair configurations on all FCS and provide a means to categorise those repairs. The survey would apply to all affected aircraft in an operator’s fleet, as defined in the maintenance programme, using the process contained in the REG s or similar document s . The procedure to identify repairs that require DTE should be developed and documented using CS 25.571 and AMC 25.571 (dependent on aircraft certification level), together with additional guidance spec ific to repairs, such as: (a) Size of the repair ; (b) Repair configuration : (1) SRM standards , (2) o ther ; (c) Proximity to other repairs ; and (d) Potential e ffect on FCS : (1) i nspectability (access and method) , (2) l oad distribution.

See Paragraph 4 of thi s Annex for more details.

2. IDENTIFICATION AND DISPOSITION OF REPAIRS REQUIRING IMMEDIATE ACTION Certain repairs may not meet the minimum requirements because of cracking, corrosion , dents, or inadequate design. The operator should use the guidance provid ed in the c ompliance d ocument to identify these repairs and, once they are identified, take appropriate corrective action. In some cases, modifications may need to be made before further flight s . The operator should consider establishing a fleet campaign i f similar repairs may have be en installed on other aircraft.

Powered by EASA eRules Page 243 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 3. DAMAGE TOLERANCE INSPECTION DEVELOPMENT This includes the development of the appropriate maintenance plan for t he repair under consideration. During this step determine the inspection method, thres hold, and repeat interval. Determine this information from existing guidance information as documented in the RAG (see Paragraph 4), the REGs or from the results of an individual DTE performed us ing the guidance in AMC 25.571. Then determine the feasibility of an inspection programme to ma intain continued airworthiness. If the inspection programme is practical, incorporate the DTI into the individual aircraft maintenance programme. If the inspection is either impractical or imp ossible, incorporate a replacement time for the repair into the individual aircraft maintenance programme . The three - stage approach discussed in Annex 1 to this Appendix may be us ed, if appropriate.

4. REPAIR ASSESSMENT GUIDELINES 4.1. Criteria to assist in developing the repair assessment guidelines The following criteria are those developed for the fuselage pressure boundary, similar to those found in FAA AC 120 - 73 and previous JAA and EASA documentation. DAHs may find it appropriate to develop similar practices for other types of aircraft and areas of the structure.

The purpose is to develop repair assessment guidelines requiring specific maintenance programmes, if necessary, to maintain the damage tolerance integrity of the repaired airframe. The following criteria have been developed to assist in the development of that guidance material: (a) Specific repair size limits for which no assessment is necessary may be selected for each model of aircraft and structural location. This will enable to minimise the burden on the operator while ensuring that the aircraft’s baseline inspection programme remains valid.

(b) Repairs that are not in accordance with SRM must be reviewed and may require further action.

(c) Repairs must be reviewed where the repair has been installed in accordance with SRM data that h a s been superseded or rendered inactive by new damage - tolerant designs.

(d) Repairs in close proximity to other repairs or modifications require review to determine their impact on the continued airworthiness of the aircraft.

(e) Repairs that exhibit struc tural distress should be replaced before further flight s .

4.2. Repair assessment methodology The next step is to develop a repair assessment methodology that is effective in evaluating the continued airworthiness of existing repairs for the fuselage pressure boundary. Older aircraft models may have many structural repairs, so the efficiency of the assessment procedure is an important consideration. In the past, evaluation of repairs for damage tolerance would require direct assistance from th e DAH. Considering that each repair design is different, that each aircraft model is different, that each area of the aircraft is subjected to a different loading environment, and that the number of engineers qualified to perform a damage tolerance assessm ent is small, the size of an assessment task conducted in that way would be unmanageable. Therefore, a new approach has been developed as an alternative.

Powered by EASA eRules Page 244 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Since repair assessment results will depend on the model - specific structure and loading environment, t he DAHs should create an assessment methodology for the types of repairs expected to be found on each affected aircraft model. Since the records on most of these repairs are not readily available, locating the repairs will necessitate surveying the structu re of each aircraft. A survey form is created by the DAH that may be used to record key repair design features needed to accomplish a repair assessment. Airline personnel not trained as damage tolerance specialists can use this form to document the configu ration of each observed repair.

Some DAH s have developed simplified methods using the information from the survey form as input data, to determine the damage tolerance characteristics of the surveyed repairs. Although the repair assessments should be perfo rmed by well - trained personnel familiar with the model - specific repair assessment guidelines, these methods enable appropriate staff, not trained as damage tolerance specialist s , to perform the repair assessment without the assistance of the TCH. This meth odology should be generated by the aircraft TCH. Model - specific repair assessment guidelines will be prepared by the TCHs.

From the information on the survey form, it is also possible to classify repairs into one of three categories: Category A: A permanen t repair for which the baseline zonal inspection (BZI) (typical maintenance inspection intervals assumed to be performed by most operators) is adequate to ensure continued airworthiness.

Category B: A permanent repair that requires supplemental inspections to ensure continued airworthiness.

Category C: A temporary repair that will need to be reworked or replaced prior to an established time limit. Supplemental inspections may be necessary to ensure continued airworthiness prior to t his limit.

When the LOV of the maintenance programme is extended , the initial c ategorisation of r epairs may need a review by the applicant for the LOV extension, and the operator may need to ensure that these remain valid up to the new LOV.

4.3. Repair as sessment process There are two principal techniques that can be used to accomplish the repair assessment.

The first technique involves a three - stage procedure. This technique could be well - suited for operators of small fleets. The second technique involves the incorporation of the repair assessment guidelines as part of an operator ’ s routine maintenance programme.

This approach could be well - suited for operators of large fleets and would evaluate repairs at predetermined planned maintenance visits as part o f the maintenance programme.

The first technique generally involves the execution of the following three stages ( s ee Figure A3(2) - 1): Stage 1 : Data c ollection This stage specifies what structure should be assessed for repairs and collects data for further analysis. If a repair is on a structure in an area of concern, the analysis continues, otherwise the repair does not require classification per this programme.

Repair assessment guidelines for each model will provide a list of structure for which r epair assessments are required. Some DAHs have reduced this list by determining the Powered by EASA eRules Page 245 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) inspection requirements for critical details. If the requirements are equal to normal maintenance checks (e.g. BZI checks), those details may be excluded from this list.

Re pair details are collected for further analysis in Stage 2. Repairs that do not meet the minimum design requirements or are significantly degraded are immediately identified, and corrective actions must be taken before further flight s .

Stage 2 : Repair c ate gorisation The repair categorisation is accomplished by using the data gathered in Stage 1 to answer simple questions regarding structural characteristics.

If the maintenance programme is at least as rigorous as the BZI identified in the TCH ’ s model - specif ic repair assessment guidelines, well - designed repairs in good condition meeting size and proximity requirements are Category A. Simple condition and design criteria questions are provided in Stage 2 to define the lower bounds of Category B and C repairs. The process continues for Category B and C repairs.

Powered by EASA eRules Page 246 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) STAGE 1 AREA / COMPONENT LOCATION AREA WITH NO AREA WITH NEED NEED FOR FOR EVALUATION EVALUATION STAGE 2 REPAIR CATEGORI S ATION CATEGORY B CATEGORY C CATEGORY A STAGE 3 INSPECTION /REPLACEMENT REQUIREMENTS GUIDELINES CANNOT BE INSPECTIONS APPLY GUIDELINES IN REPAIR APPLIED. SEND DETAILS TO REQUIREMENTS DOCUMENT TO DETERMINE MANUFACTURER FOR DEFINED IN SRM INSPECTION REQUIREMENTS ASSESSME NT Figure A3(2) - 1 : Repair a ssessment s tages Stage 3 : Determination of structural maintenance requirements The specific supplemental inspection and/or replacement requirements for Category B and C repairs are determined in this stage. Inspection requirements for the repair are determined by calculation or by using predetermined values provided by the DAH, or ot her values obtained using an EASA - approved method.

In evaluating the first supplemental inspection, Stage 3 will define the inspection threshold in flight cycles measured from the time of the repair installation. If the time of the repair installation is u nknown and the aircraft has exceeded the assessment implementation times or has exceeded the time for first inspection, the first inspection Powered by EASA eRules Page 247 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) should occur by the next ‘ C - check ’ interval, or equivalent cycle limit after the repair data is gathered (Stage 1).

The operator may choose to accomplish all three stages at once, or just Stage 1. In the latter case, the operator would be required to adhere to the schedule specified in the EASA - approved model - specific repair assessment guidelines for completion of Stag es 2 and 3. Incorporating the maintenance requirements for Category B and C repairs into an operator ’ s individual aircraft maintenance or inspection programme completes the repair assessment process for the first technique.

The second technique would invol ve setting up a repair maintenance programme to evaluate all the applicable structure s as detailed in paragraph 1 at each predetermined maintenance visit to confirm that they are permanent. This technique would require the operator to choose an inspection method and interval in accordance with the EASA - approved repair assessment guidelines. The repairs whose inspection requirements are fulfilled by the chosen inspection method and interval would be inspected in accordance with the approved maintenance progr amme. Any repair that is not permanent, or whose inspection requirements are not fulfilled by the chosen inspection method and interval, would either be: (a) u pgraded to allow utilisation of the chosen inspection method and interval ; or (b) i ndividually tr acked to account for the repair ’ s unique inspection method and interval requirements.

This process is then repeated at the chosen inspection interval.

Repairs added between the predetermined maintenance visits, including interim repairs installed at remote locations, would be required either to have a threshold greater than the length of the predetermined maintenance visit or to be tracked individually to account for the repair ’ s unique inspection method and interval requirements. This would ensure the airw orthiness of the structure until the next predetermined maintenance visit, at which time the repair would be evaluated as part of the repair maintenance programme.

5. MAINTENANCE PROGRAMME CHANGES When a maintenance or inspection programme interval is revi sed, the operator should evaluate the impact of the change on the repair assessment programme. If the revised maintenance or inspection programme intervals are greater than those in the BZI, the previous classification of Category A repairs may become inva lid. The operator may need to obtain approval of an alternative inspection method, upgrade the repair to allow utilisation of the chosen inspection method and interval, or re - categorise some repairs and establish unique supplemental inspection methods and intervals for specific repairs. Operators using the ‘ second technique ’ of conducting repetitive repair assessments at predetermined maintenance visits would evaluate whether the change to the predetermined maintenance visit continues to fulfil the repair i nspection requirements.

6. SRM UPDATE The general section of each SRM will contain brief descriptions of damage tolerance considerations, categories of repairs, description of BZIs , and the repair assessment logic diagram. In updating each SRM, existing lo cation - specific repairs should be labelled with appropriate repair category identification (A, B or C), and specific inspection requirements for B and C repairs should also be provided as applicable. SRM descriptions of generic repairs will also contain re pair category considerations regarding size, zone, and proximity. Detailed Powered by EASA eRules Page 248 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUB PART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) information for the determination of inspection requirements will have to be provide d for each model. Repairs which were installed in accordance with a previous revision of the SRM, but which have now been superseded by a new damage - tolerant design, will require review. Such repairs may be reclassified to Category B or C, requiring additional inspections and/or rework.

7. STRUCTURE MODIFIED BY A N STC The current repair assessment guidelines provided by the TCH are not always applicable to structure modified by an STC . Nonetheless , it is expected that all the structure modified by an STC should be evaluated by the operator and, if possible, in conjuncti on with the STC H .

Point 26.370 of Part - 26 requires the operator to amend their maintenance programme to address all such repairs, and a conservative extension of the TCH’s REGs to all STCs containing FCS can be envisaged to ensure that all repairs to FCS a re identified. Subsequently, each repair can be subjected to a DTE, and DTI be provided with the support of a DAH. The STC H should conduct specific damage tolerance assessments of known published repairs (SRM, SBs, etc.) and provide appropriate instruction s to the operator.

It is expected that the STC H will assist the operators by preparing the required documents. If the STC H is no longer in business, or is otherwise unable to provide assistance, the operator would have to acquire the EASA - approved guidelin es independently. Ultimately, the operator remains responsible for the continued safe operation of the aircraft.

[Amdt 20/2] [Amdt 20/20] [Amdt 20/22]

Annex 3 to Appendix 3 to AMC 20 - 20 B Repairs and modifications to

removable structural components

ED Decis ion 2021/007/R 1. DETERMINING THE AGE OF A REMOVABLE STRUCTURAL COMPONENT Determining the actual component ’ s age or assigning a conservative age provides flexibility and reduces operator burden when implementing DT data for repairs and modificat ions to structural components. In some cases, the actual component ’s age m ay be determined from records. If the actual age cannot be determined this way, the component ’s age may be conservatively assigned using one of the following fleet leader concepts, depending upon the origin of the component: (a) If component times are not available, but records indicate that no part changes have occurred, aircraft flight cycles or flight hours can be used.

(b) If no records are available, and the parts could have been switched from one or more older aircraft under the same maintenance programme, it should be assumed that the time on a ny component is equal to the ol dest aircraft in the programme. If this is unknown, the time should be assumed to be equal to the same model aircraft that is the oldest or has the most flight cycles or flight hours in the world fleet.

(c) A manufacturing da te marked on a component may also be used to help establish the component’s age in flight cycles or flight hours. This can be done by using the above reasoning and comparing it to aircraft in the affected fleet with the sam e or older manufacturing date.

If none of these options can be used to determine or assign a component age or total number of flight cycles or flight hours, a conservative implementation schedule can be established by Powered by EASA eRules Page 249 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) using the guidelines applied in paragraph 3 of this A ppendix, for the i nitial inspection, if required by the DT data.

2. TRACKING An effective control or tracking system should be established for removable structural components that are identifi ed as FCBS or that contain FCS. This will help ensure compliance with the maintena nce programme ’s requirements specific to repairs and modifications installed on an affected r emovable structural component. Paragraph 4 of this A ppendix provides options that could be used to alleviate some of the burden associated with tracking all repair s to affected re movable structural components.

3. DEVELOPING AND IMPLEMENTING DT DATA (a) Repairs Accomplish the initial repair assessment of the affected structural component at the same time as the aircraft level repair survey for the aircraft on whi ch t he component is installed. Develop the DT data according to the process given in Annex 2 and incorporate DTI int o the maintenance programme.

(b) Modifications Accomplish the initial modification assessment of the affected structural component at the same time as the aircraft level modification assessment for the aircraft on whi ch the component is installed. Develop DT data and incorporate the DTI int o the maintenance programme.

If the actual age of the repairs or modifications installation, or the total number of flight cycles or flight hours is known, use th at information to establish when the initial inspection of the component should be performed. Repeat the inspection at the intervals provided by the TCH or STCH for the repair or modification against the component.

If the actual age of the repairs or modif ications installation, or the total number of flight cycles or flight hours is unknown, but the component ’s age or total number of flight cycles or flight hours is known, or can be assigned conservatively, use the component ’s age, or the total number of fl ight cycles or flight hours to establish when the initial inspection of the component should be performed. Repeat the inspection at the intervals provided by the TCH or STC H for the repairs and modifications against the component.

As an option, accomplish the initial inspection on the affected component at the next C - check (or equivalent interval) f ollowing the repair assessment. Repeat the inspection at the intervals provided by the TCH or STCH for the repairs and modificati ons against the component.

4. EX ISTING REPAIRS AND MODIFICATIONS — COMPONENTS RETRIEVED FROM STORAGE (a) If the time on the component (in flight cycles or flight hours) is known, or can be conservatively assigned, perform the following: (1) s urvey the component ; (2) d ispos e repairs and m odifications ; (3) i mplement any DTI in accordance with the approved schedule ; (4) a ccomplish the initial inspection using the actual age of the repairs or modifications, or the total number of flight cycles or flight hours, if known. If the age of the repa irs or modifications is not known, use the component ’s age. Repeat Powered by EASA eRules Page 250 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) the inspection at the intervals given for the repairs or modifications against the component.

(b) If the time on the component (in flight cycles or flight hours) is unknown and cannot be co nservatively assigned, perform the initial repair or modification assessment of the affected component prior to installation, and perform the following actions: (1) d evelop DT data according to the process given in paragraph 3 or 4 of Appendix 3 to this AMC as applicable ; (2) i ncorporate any DTI into the maintenance programme ; (3) a ccomplish the first inspection on the affected component at the next C - check (or equivalent interval) following the repair or modification assessment ; (4) r epeat the inspection at the intervals given for the repair or modification against the component.

5. IMPLEMENTATION OPTIONS TO HELP REDUCE TRACKING BURDEN The following implementation techniques could be used to alleviate some of the burden associated with tracking repairs to affected removable structural components. These techniques, if used, would need to be includ ed in the m aintenan ce p rogramme and may require additional EASA approval and TCH or STCH input for DTI.

(a) Upgrading e xisting r epairs As an option, existing repairs may be removed and replaced with new parts of the same design revised as necessary to support the new install ation. This practice would permit the DTI requirements of the repair to be set to zero and to re - establish an initial tracking point for the repair. Normally, this would be done at or before the survey for maximum benefi t. The initial and repetitive inspec tions for the upgraded repair would then be accomplished at the intervals given for the repair against the component.

A repair could also be upgraded to one whose inspection requirements and methods are already fulfilled by an operator’s maintena nce or ins pection programme. That repair would then be repetitively inspected at each routine inspection inte rval applicable to the repair. Specific tracking would not be required because that area of the aircraft would have already be en normally inspected on each aircraft in the fleet as part of the existing a pproved maintenance programme. If the operator’s programme intervals were changed, the e ffect on requirements for specific tracking would have to be re - evaluated.

(b) Special initia l and/or routine inspections As an option, existing repairs may have special initial inspections accomplishe d during the component survey. This initial inspection establishes an initial tracking point for the repair. Following this initial inspection, the DTI requirements (e.g. repetitive inspections) of the repair would be implemented.

In addition, special routine inspections could be defined for typical repairs that could be applied at a normal interval. In this case, an operator could check the affected components on each aircraft for this type of a repair at the defined interval. If the repair is found, the special inspection would be applied to ensure its airworthiness until the next scheduled check. This alleviates the need to specifically track affect ed components for every repair, especially typical ones.

[Amdt 20/2] [Amdt 20/20] [Amdt 20/22] Powered by EASA eRules Page 251 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20)

Annex 4 to Appendix 3 to AMC 20 - 20 B Service bulletin review

process

ED Decision 2021/007/R Guidelines for f ollowing the s ervice b ulletin (SB) f low c hart Note : While it is believed that this guidance is fairly comprehensive, it may not add ress every possible situation. It is therefore incumbent on the user to use good judg e ment and rationale when making any determination.

Screening SBs to determine which ones re quire DT data is primarily a TCH responsibility.

The result of this screening is a list of SBs which require special directed inspections to ensure continued airworthiness. SBs included i n the list will be groupe d into Type I and Type II SBs. Type I SBs ha ve existing DT data and Type II S Bs require developing DT data. The list is not comprehensive and will not include all the SB s associated with an aircraft. T he list does not need to include those SBs where the inspection programme developed for the repair assessment programme has been determined to be sufficient to meet the damage tolerance requirements for the FC BS that is affected by the SB.

To ensure compliance with Part - 26, any DTI identified in the existing programme that is required to continue to be implemented to satisfy point 26.370 should be identified as such in the ICA.

Query 1 Does the SB address a structural re pair or a modification to FCS?

Historically, any SB, service letter or other document that lists ATA C hapters 51 through 57 could provide repair or modification instruc tions that may require DT data. In addition, certain repairs or modifications accomplished under othe r ATA chapters may affect FCS.

The first step in the screening process is to identify all such service instructions and develop a list of candidates for review (Q2).

Query 2 Does the service instruction specify either a repair or modificatio n that creates or affects FCS?

If it does, then the service instruction requires further review (Q3). If it does not, then the service instruction does not require further review.

Query 3 Is the service instruction mandated?

S B s and other service instructions that are mandated by an AD have requirements to ensure inspection findings (e.g., detected cracks or other structural damage/degradation) are a ddressed in an approved manner. If the TCH can demonstrate that it applies a process for developing inspection programmes for mandated SBs u sing DT data and/or service - based inspection results, and for continuously reviewing the SBs for their adequacy to detect cracks in a timely manner, the mandated SBs should then be considered as compliant wi th the intent of this process. Otherwise, the TCH will need to demonstrate that the inspection programme in the mandated SB has been developed using DT data and/or appropriate ser vice - based inspection results. The outcome of Query 3 branch es to two unrelated boxes (Q4 : if mandated by an AD , or Q7 : if not mandated by an AD).

Query 4 Does the SB or service instructi on contain terminating action?

Query 3 established that the inspection programme for the baselin e configuration is acceptable.

Powered by EASA eRules Page 252 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 2 0B Products, Parts and Appliances (AMC - 20) Query 5 Does the te rminating action have DT data?

If the terminati ng action has a documented continuing airworthiness inspection programme based on damage tolerance principles , then no further review is required. The SB sh ould be documented in the list. If the terminating action does not have DT data, or the status of th e inspection programme cannot be verified, then further review is necessary (Q6).

Query 6 Does th e SB address a safe - life part?

If it does , no further action is required. Otherwise, damage - tolerance - based inspections will need to be developed and provided to the operators. The SB should be included in the list along with where to find the required continued airworthiness inspection programme.

Query 7 In Query 3 a structural SB that was mandated by AD was identified.

Query 7 asks if a one - time inspection is required to satisfy the intent of the requirement. If it does, it is deemed that this is being done to verify that a condition does not exist and, on finding that condition, correct that condit ion to baseline configuration. As such, normal SSID programmes would then be expected to cover any required continued airworthiness inspections. If a repair is necessary, it is further assumed that this was done by reference to t he SRM or other suitable means. No further action is required if this is the case and, if a repair was necessary, other means exist to determine the required DT data. If no inspections or multiple inspections are required, additional evaluation is required (Q8).

Query 8 Is this a major structural desig n change (e.g. modification)?

This is a TCH decision that is part of the original certification process and is not a major/minor repair decision. If it is not a major design change , then proceed to Q10 ; if not, proceed to Q9.

Query 9 Does the change require NDI s to verify the integrity of the st ructure or are normal routine maintenance inspections sufficient?

This is a subjective question and may require re - evaluating the change and determining where specific fati gue cracking might be expected. If normal maintenance inspections are adequate, no f urther action is required. Otherwise, proceed to Q10.

Query 10 : Does the SB contain DT data for both the baseline and mod ified aircraft configurations?

If so, the SB is satisfactory. Otherwise, damage - tolerance - based inspections will need to be developed a nd provided to the operators. The SB should be documented in the list along with where to find the required continued airworthiness inspection programme.

SB screening procedure 1. The TCH will perform the screening and the Structures Task Group will valida te the results.

2. A list of all SBs requiring action will be included in the TCH compliance document . Those not requiring action will not be included in the list.

3. SBs included i n the list will fall into one of two general types: Type I — SBs which have existing DT data.

Type II — SBs that require developing DT data.

Powered by EASA eRules Page 253 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 4. TCH actions: Type I — No action required.

Type II — Develop DT data and make it available to operators.

5. Operator actions (apply to both SB t ypes): — Review SB incorporation on a tail number basis.

— For incorporated SBs that rely on BZI (i.e. no special inspections required based on DTE performed), reconcile any maintenance planning document structural inspe ction escalations.

— For incorporated SBs that require DTI, verify that DTI has been included in the operations specification and include it if it is missing.

Figure A3(4) - 1 : SB flow chart [Amdt 20/2] [Amdt 20/2 0 ] [Amdt 20/22] Powered by EASA eRules Page 254 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20)

Annex 5 to Appendix 3 to AMC 20 - 20 B List of major changes and

STCs that may adversely affect fatigue - critical structure

ED Decision 2021/007/R (1) Passenger - to - freighter conversions (including addition of main deck cargo doors).

(2) Gross weight increases (increased operating weights, increased zero fuel weights, increased landing weights, and increased maximum take - off weights).

(3) Installation of fuselage cut - outs (passenger entry doors, emergency exit doors or crew escape hatches, fuselage access doors, and cabin window relocations).

(4) Complete re - engine or pylon modifications.

(5) Engine hush kits.

(6) Wing modifications such as installing winglets or changes in flight control settings (flap droop), and modification of wing trailing edge structure.

(7) Modified skin splices.

(8) Antenna i nstallations.

(9) Any modification that affects several stringer or frame bays.

(10) An y modification that covers structure requiring periodic insp ection by the operator’s maintenan ce programme.

(11) An y modification that results in operational mission change that s ignificantly changes the manufacturer’s load or stress spectrum (e.g. passenger - to - freighter conversion).

(12) An y modification that changes areas of the fuselage that prevents external visual inspection (e.g. installat ion of a large external fuselage doubler that results in hiding details beneath it).

(13) In general, attachmen t of interior monuments to FCS. Interior monuments include large items of mass such as galleys, closets, and lavatories.

[Amdt 20/2] [Amdt 20/2 0 ] [Amdt 20/22]

Annex 6 to Appendix 3 to AMC 20 - 20 B Background to the need for

damage - tolerance - based inspection programmes for repairs

ED Decision 2021/007/R Repairs are a concern on older aircraft because of the possibility that they may develop, cause, or obscure metal fatigue, corrosion, or other damage during service. This damage might occur within the repair itself or in the adjacent structure, and might ultimately lead to structural failure.

In general, repairs present a more challenging problem to solve than the original structure because they are unique and tailored in design to correct particular damage to the original structure. While the performance of the original structure may be predicted from tests and from experience on other aircraft in se rvice, the behaviour of a repair and its effect on the fatigue characteristics of the original structure are generally known to a lesser extent than for the basic unrepaired structure.

Repairs may be of concern as time in service increases for the followin g reasons: As aircraft age, both the number and age of the existing repairs increase. Along with this increase is the possibility of unforeseen repair interaction, failure, or other damage occurring in the repaired Powered by EASA eRules Page 255 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) area. The continued operational safety of these aircraft depends primarily on a satisfactory maintenance programme (with inspections conducted at the right time, in the right place, using the most appropriate technique, or in some cases, replacement of the repair). To develop this programme, a DT E of repairs to aircraft structure is essential. The longer an aircraft is in service, the more important this evaluation and a subsequent inspection programme become.

The practice of repair justification has evolved gradually over the last 20 years. Some repairs described in the aircraft manufacturers’ SRMs were not designed in accordance with fatigue and damage tolerance principles (Ref. AAWG Report: Recommendations concerning ARAC taskings FR Doc 04 - 10816; Aging Aircraft Safety Final Rule. 14 CFR 121.370 a and 129.16.). Repairs accomplished in accordance with the information contained in the early versions of the SRMs may require additional inspections if evaluated using the fatigue and damage tolerance methodology.

Damage tolerance is a structural design and inspection methodology used to maintain safety by considering the possibility of metal fatigue or other structural damage (i.e. safety is maintained by adequate structural inspection until the damage is repaired). One prerequisite for the successful ap plication of the damage tolerance approach for managing fatigue is that crack growth and residual strength can be anticipated with sufficient precision to allow inspections to be established that will detect cracking before it reaches a size that will degr ade the strength to less than a specified level. A DTE entails the prediction of sites where fatigue cracks are most likely to initiate in the aircraft’s structure, the prediction of the crack path and rates of growth under repeated aircraft structural loa ding, the prediction of the size of the damage at which strength limits are exceeded, and an analysis of the potential opportunities for inspection of the damage as it progresses. This information is used to establish an inspection programme for the struct ure that will be able to detect cracking that may develop before it could contribute to a catastrophic failure.

The evidence to date is that when all the critical structure is included, damage - tolerance - based inspections and procedures, including modificat ion and replacement, provide the best assurance of continued structural integrity that is currently available. In order to apply this concept to existing transport aeroplanes, the competent authorities have issued a series of ADs requiring compliance with the first supplemental inspection programmes resulting from the application of this concept to existing aeroplanes. Generally, these ADs require that operators incorporate SSIDs into their maintenance programmes for the affected aeroplanes. These documents were derived from damage tolerance assessments of the originally certified type designs for these aeroplanes. For this reason, the majority of ADs written for the SSIP did not attempt to address the issues related to the damage tolerance of repairs that h ad been made to the aeroplanes. The objective of repair assessment and repair evaluation guidelines is to provide the same level of assurance for areas of the structure that have been repaired as that achieved by the SSIP for the baseline structure as orig inally certified.

[Amdt 20/2 0 ] [Amdt 20/22]

Appendix 4 to AMC 20 - 20 B Guidelines for the development of a

corrosion prevention control programme

ED Decision 2021/007/R 1. GENERAL The TCH should develop a baseline CPCP, which should be reviewed by EASA. The baseline CPCP is intended to facilitate the development of a CPCP by an operator for their maintenance programme.

Powered by EASA eRules Page 256 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) The operator should include a CPCP in the maintenance programme, and where a TCH baseline CPCP exists, it should be taken into accou nt in the development of the operator’s CPCP . The operator should show that the CPCP is comprehensive in that it addresses all the corrosion likely to affect p rimary s tructure , and is systematic in that: (a) it provides s tep - by - step procedures that are app lied on a regular basis to each identified task area or zone, and (b) t hese procedures are adjusted when they result in evidence that corrosion is not being controlled to an established acceptable level (Level 1 or better).

1.1 Purpose This A ppendix gives guidance to operators and DAHs who are developing and implementing a CPCP for aeroplanes maintained in accordance with a n aircraft maintenance programme developed in compliance with point M.A.302 of Part - M .

CPCPs have been developed by the DAH with the ass istance of aircraft operators and competent authorities. They relied heavily on service experience to establish CPCP implementation thresholds and repeat intervals. Since that time a logical evaluation process has been developed to ensure environmental dam age is considered in the evaluation of aircraft structure. This process is identified in ATA MSG - 3 Scheduled maintenance development document, which introduced the CPCP concept in revision 2, circa 1993.

1.2 Approval Approval of a TCH CPCP may either be through the MRB (ISC) using existing procedures for EASA MRBR approval, or directly by EASA if no EASA - approved MRBR exists for the type. Provided that the operator has an NAA - approved aircraft maintenance programme (AMP) that controls corrosion to Level 1 or better, the operator need not follow exactly the programme offered by the TCH. However, revisions to the TCH’s approved programme should be considered by the operator for incorporation in the operator’s MP under the Part - M requirements.

2. DEFINITIONS — Allowable Limit : t h is is the amount of material (usually expressed in the thickness of the material) that may be removed or blended out without affecting the ultimate design strength capability of the structural member. Allowable limits may be establishe d by the TCH/DAH. EASA may also establish allowable limits. The DAH normally publishes allowable limits in the SRM or in SBs. Note: This revision of the AMC amends the definition of corrosion levels such that the concept of local and widespread corrosion i s no longer specified. Nonetheless, when deriving allowable limits for the structure and the adjacent structure, the full extent of the damage and material removed in the finding and the previous findings affecting the same areas must be taken into account . Applicable fatigue and damage tolerance requirements must be taken into account when establishing the allowable limits.

— Baseline CPCP: this is a CPCP developed for a specific model aeroplane. The TCH typically develops the baseline CPCP ( s ee TCH - d evelo ped b aseline CPCP below) . It contains the corrosion inspection tasks, an implementation threshold, and a repeat interval for task accomplishment in each area or zone.

— Basic t ask(s) : t h is is a specific and fundamental set of work elements that should be p erformed repetitively in all task areas or zones to successfully control corrosion. The Powered by EASA eRules Page 257 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) contents of the basic task may vary depending upon the specific requirements in an aeroplane area or zone. The basic task is developed to protect the primary structure of the aeroplane.

— Corrosion prevention and control programme (CPCP) : this is a comprehensive and systematic approach to controlling corrosion in such a way that the load carrying capability of an aircraft structure is not degraded to less than a level ne cessary to maintain airworthiness. It is based upon the baseline CPCP described above. A CPCP consists of a basic corrosion inspection task, task areas, defined corrosion levels, and compliance times (implementation thresholds and repeat intervals).

The CP CP also includes procedures to notify the competent authority of the findings and data associated with Level 2 and Level 3 corrosion and the actions taken to reduce future findings to Level 1.

— Implementation t hreshold (IT) : this is the aircraft age assoc iated with the first time the basic corrosion inspection task should be accomplished in an area or zone.

— Level 1 c orrosion is: Damage occurring between successive inspections that is within the allowable damage limits; or Damage occurring between successive inspections that does not require structural reinforcement, replacement or new damage - tolerance - based inspections; or Corrosion occurring between successive inspections that exceeds the allowable limits but can be attributed to an event not typi cal of operator usage of other aircraft in the same fleet; or Light corrosion occurring repeatedly between inspections that eventually requires structural reinforcement, replacement, or new damage - tolerance - based inspections.

— Level 2 c orrosion is any cor rosion finding that exceeds Level 1, requiring a review of the operator’s CPCP effectiveness, but that is not determined to be Level 3.

The operator is responsible for making the initial determination of the corrosion level, and this may subsequently be ad justed based on consultation with the DAH.

A finding of Level 2 corrosion requires repair, reinforcement, or complete or partial replacement of the applicable structure , or revised fatigue and damage tolerance inspections .

Note: A statement of fact in previously mandated CPCPs states: corrosion findings that were discovered during the corrosion inspection task accomplished at the implementation threshold, and which require repair, reinforcement, or complete or partial replacement of the applicable struc ture, should not be used as an indicator of the effectiveness of the operator ’ s CPCP. The argument is that an operator ’ s corrosion programme effectiveness can only be determined after a repeat inspection has been performed in a given inspection task area. This argument is valid for aircraft with mandated CPCP s introduced after the aircraft has been in service for a number of years without a CPCP. This argument, however, is not valid for aircraft that have been maintained since entry into service using a CPC P that takes into account the TCH baseline CPCP and environmental deterioration (ED) programme . Consequently, corrosion findings exceeding L evel 1 found on the corrosion inspection task implementation threshold may indicate that the threshold has been set too high and action should be taken to adjust the implementation threshold.

Powered by EASA eRules Page 258 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) — Level 3 c orrosion is that corrosion occurring during the first or subsequent accomplishments of a n inspection task that the operator or subsequently the TCH or competent authorit y determines to be an urgent airworthiness concern.

Note: If L evel 3 corrosion is determined at the implementation threshold or any repeat inspectio n , then it should be reported. Any corrosion that is more than the maximum acceptable to the DAH or EASA mus t be reported in accordance with the current regulations. This determination should be conducted jointly with the DAH.

— Light c orrosion is corrosion damage so slight that removal and blend - out over multiple repeat intervals may be accomplished before mate rial loss exceeds the allowable limit.

— Local c orrosion. Generally, local corrosion is corrosion of a skin or web (wing, fuselage, empennage or strut) that does not exceed one frame, stringer, or stiffener bay. Local corrosion is typically limited to a single frame, chord, stringer or stiffener, or corrosion of more than one frame, chord, stringer or stiffener where no corrosion exists on two adjacent members on each side of the corroded member.

— Operator - d eveloped p rogramme. In order to operate an aeroplane in compliance with the maintenance programme of Part - M and Part - 26, an operator should include in their maintenance or inspection programme an approved CPCP. An operator may adopt the baseline CPCP provided by the DAH or they may choose to develop their own CPCP, or may be required to if none is available fr om the DAH. In developing their own CPCP , an operator may join with other operators and develop a baseline CPCP similar to a TCH - developed baseline CPCP for use by all operators in the group. The advantages of an operator - developed baseline CPCP are that i t provides a common basis for all operators in the group to develop their CPCP and it provides a broader experience base for development of the corrosion inspection tasks and identification of the task areas.

— Repeat I nterval (RI) : this is the calendar ti me between the accomplishment of successive corrosion inspection tasks for a task area or zone.

— Task a rea : this is a region of aircraft structure to which one or more corrosion inspection tasks are assigned. The task area may also be referred to as a zon e.

— TCH - d eveloped b aseline CPCP. The baseline CPCP may be developed as an integral part of the ICA or in a stand - alone section or manual. The TCH should provide an inspection programme that includes the frequency and extent of inspections necessary to ens ure the continued airworthiness of the aircraft. Furthermore, the programme should include the information needed to apply protective treatments to the structure after inspection.

In order for the inspections to be effectively accomplished, the TCH should include, in the ICA, corrosion removal and cleaning procedures and reference allowable limits. The baseline CPCP is intended to facilitate the operator’s development of a CPCP for their maintenance programme .

— Urgent a irworthiness c oncern : this is damage that could jeopardise continued safe operation of any aircraft. An urgent airworthiness concern typically requires correction before the next flight and expeditious action to inspect the other aircraft in the operator’s fleet.

— Widespread c orrosion : this is corrosion of two or more adjacent skin or web bays (a web bay is defined by frame, stringer or stiffener spacing). Or widespread corrosion is corrosion of two or more adjacent frames, chords, stringers, or stiffeners. Or widespread corrosion is c orrosion of a frame, chord, stringer, or stiffener and an adjacent skin or web bay.

Powered by EASA eRules Page 259 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) — Zone. See ‘T ask area ’.

3. DEVELOPMENT OF A BASELINE CPCP 3.1. Baseline CPCP The objective of a baseline CPCP is to establish requirements for control of corrosion of airc raft structure to Level 1 or better for the ope rational life of the aircraft. The baseline CPCP should include the basic task, implementation th resholds, and repeat intervals. The baseline CPCP should also include procedures to notify the competent authori ty of the findings and data associated with Level 2 and Level 3 corrosion and the actions taken to reduce future findings to Level 1.

3.1.1. Baseline CPCP considerations To establish an effective baseline CPCP, consideration of the following is necessary: (a) t he flight and maintenance history of the aircraft model and perhaps similar models; (b) t he corrosion properties of the materials used in the aircraft structure; (c) t he protective treatments used; (d) t he general practice applied during co nstruction and maintenance; and (e) l ocal and widesprea d corrosion * ( s ee Figure A4 - 1).

* Note: In some existing CPCPs, the concept of local and widespread corrosion is directly related to the corrosion level definitions, and for those programmes, those definitions remain applicable. The alignment of a programme with the corrosion level definitions of this amendment of the AMC may require a reassessment of the allowable limits and the way they are presented in the applicable ICA. This is because the assumptions made to determine the allowable limits may not have taken into account the fatigue and dam age tolerance requirements that are now applicable through retroactive rulemaking and the updated certification basis. In addition, programmes that addressed widespread corrosion within the allowable limits as Level 2 corrosion may have addressed the deriv ation of the allowable limits without assuming that the maximum material loss would occur over the whole area.

When determining the detail of the corrosion inspection tasks, the implementation threshold and the repeat interval, a realistic operational envi ronment should be considered. Technical representatives of both the TCH and the operators should participate in evaluating the service history and operational envi ronment for the aircraft model. For new aircraft models and for aircraft models that have bee n in operation for only a short time, technical representatives of operators of similar aircraft models should be invited to participate.

Powered by EASA eRules Page 260 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Figure A4 - 1 3.1.2. TCH - developed b aseline CPCP During the design development process, the TCH should provide a base line CPCP as part of the ICA . The TCH initially evaluates the service history of corrosion available for aircraft of similar design used in the same operational environment.

Where no similar design with service experience exists , those structural features concerned should be assessed using the environmental damage approach of ATA MSG - 3. The TCH develops a preliminary baseline CPCP based on this evaluation.

The TCH then convenes a working group consisting of operator technical representatives and representat ives of the participating competent authorities.

The working group reviews the preliminary baseline CPCP to assure that the tasks, implementation thresholds and repeat intervals are practical and assure the Powered by EASA eRules Page 261 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENER AL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) continued airworthiness of the aircraft. Once the working group review is complete, the TCH incorporates the baseline CPCP into the ICA ( s ee Figure A4 - 2) .

The TCH evaluates corrosion service history The TCH convenes a working group and establishes a baseline programme The TCH incorporates baseline programme into the instructions for continued airworthiness Figure A4 - 2: TCH - d eveloped b aseline CPCP 3.1.3 Operator - d eveloped CPCP Exceptionally, there may be instances where the TCH does not provide a baseline CPCP . In such instances, an operator may develop their CPCP without using a baseline CPCP , as long as the operator - developed CPCP is cons istent with the requirements. It would be beneficial for an operator developing its own CPCP to consult other operators of the same or similar aircraft models in order to broaden the service experience available for use in preparing their programme. When a TCH - prepared baseline CPCP is unavaila ble, a group of operators may prepare a baseline CPCP from which each operator in th e group will develop their CPCP.

(a) Operator - d eveloped b aseline CPCP An operator - developed baseline CPCP should particularly focus on the areas of the aircraft prone to corrosion, such as: (i) e xhaust trail areas, (ii) b attery compartments and battery vent openings, (iii) a reas surrounding lavatories, buffets and galleys, (iv) b ilges, (v) f uselage internal lower structure, (vi) w heel wells and landing gear, (vii) e xternal skin areas, (viii) w ater entrapment areas, Powered by EASA eRules Page 262 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) (ix) e ngine frontal areas and cooling air vents, (x) e lectronic or avionics compartments, and (xi) f light control cavities open during take - off and landing.

Note: CPCP s for large transport aeroplane s were developed based on a triad amongst the Airworthiness Authorities, DAH s, and the operators for the particular aeroplane model. If operator(s) were to develop a CPCP , they may want to follow the example of the large transports.

The l ead o perator e valuates c orrosion s ervice h istory Are m ultiple o perators No i nvolved?

Yes Convene w orking g roup and e stablish b aseline p rogram me Publish b aseline The o perator develops p rogram me CPCP Figure A4 - 3: Operator - developed baseline CPCP (b) Individual o perator - d eveloped CPCP An operator may develop their CPCP without reference to a baseline CPCP only when a baseline CPCP does not exist. The CPCP should be consistent with the requirements of th e applicable operating rules. Any operator who develops their own CPCP without a baseline CPCP , should review all available corrosion - related service data on the individual aircraft model and similar design details in similar aircraft models when the opera tor’s data and the s ervice d ifficulty r eport data show no entries.

Powered by EASA eRules Page 263 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 3.1.4. Continuous a nalysis and s urveillance The operator’s continuous analysis and surveillance system should contain procedures to review corrosion inspection task findings and establish corrosion levels. These procedures should provide criteria for determining if findings that exceed allowable limits are an isolated incident not ty pical of the operator’s fleet.

The operator’s programme should also provide for notifying the competent auth ority whenever a determination of Level 2 or Level 3 corrosion is made. Due to the potential urgent airworthiness concern associated with a Level 3 finding, the operator’s procedures s hould provide for notification as soon as possible but no later than 3 c alendar days after the Level 3 determination has been made.

3.2. Baseline CPCP documentation The baseline CPCP documentation should include instructions to implement the baseline CPCP. It may be in a printed form or other form acceptable to the competent authority.

It should also be in a form that is easy to revise. The date of the last revision s hould be entered on each page. The baseline CPCP documentation should be clearly identified as a baseline CPCP. The aircraft make, model and the person who prepared the documentation should also be identified.

3.2.1. Purpose and b ackground This section of the documentation should state the purpose of the baseline CPCP , which is to establish minimum requirements for preventing and controlling corrosion tha t may jeopardise continuing airworthine ss of the aircraft model fleet.

The section should further state that an operator should include an effective CPCP in their maintenance or inspection programme.

3.2.2. Introduction The introduction should include a general statement that corrosion becomes more widespread as aircraft age and that it is more likely to occur in conjunction with other d amage such as fatigue cracking. The introduction should also indicate that it is not the intent of a CPCP to e stablish rigid requirements to eliminate all corrosion in the fleet, but to control corrosion at or below levels that do not jeopardise continued airworthiness. However, due to the unpredictability of corrosion , it must be removed and the structure repaire d and corrosion prevention treatment reapplied.

3.2.3. Programme a pplication For a programme to be fully effective, it is essential that a corrosion inspection task be applied to all areas where corrosion may affect p rimary s tructure. This section should r ecommend that priority for implementing the CPCP be given to older aeroplanes and to areas requiring significant changes to previous maintenance procedures in order to meet corrosion prevention and control requirements. T his section should allow an operato r to continue its current corrosion control procedures in a given task area or zone where there is documentation to show that corrosion is being consiste ntly controlled to L evel 1.

3.2.4. Baseline CPCP This section should fully d escribe the baseline CPCP . It should include the basic task, corrosion inspection task areas, implementation thresholds, and repeat intervals.

Powered by EASA eRules Page 264 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 3.2.5. Reporting s ystem Procedures to report findings of Level 2 and Level 3 corrosion as necessary to the TCH and the competent authority should be clearly established in this section. The TCH should indicate any specific requirement they have for reporting on corrosion levels that may be needed to revise the baseline CPCP. The information on Level 2 corrosion may be needed in a form acceptable to the competent authority responsible for approval of any revision to the maintenance programme resulting from a Level 2 finding. The timing of reporting should take into account the processes for the periodic review (see 3.2. 6). All Level 2 and Level 3 findings should be reported in accordance with any applicable AD, operator ’ s service difficulty reporting procedures or reporting required b y other competent authorities.

P rocedures for alerting the competent authority of L evel 3 findings should be established that expedite such reporting. This report to the competent authority shall be made after the determination of the corrosion level.

3.2.6 Periodic r eview This section should establish a period for the TCH (or lead operator) and participating operators to meet with EASA and review the reported Level 2 and Level 3 findings. The purpose of this review is to assess the baseline CPCP and make adjustments if neces sary. This may be accomplished through maintenance programme reviews conducted via the Maintenance Programme Industry Steering Committees (MRB Structures Working Group or equivalent meetings) for the model.

3.2.7. Corrosion - r elated a irworthiness d irectives This section should include a list of all ADs that contain requireme nts related to kn own corrosion - related problems. This section should state that these ADs are in addition to and take precedence over the operator ’ s CPCP.

3.2.8. Development of the b aseline CPCP This section should identify the actions taken in pre paring t he baseline CPCP . It should include a description of the participants, the documents (e.g. SBs, service letters, ADs, service difficulty reports, accident and incident reports) reviewed, and the methodology for selecting and categorising the corrosion - pron e areas to be inclu ded in the baseline CPCP . The s election criteria for corrosion - prone areas should be based on areas having similar corrosion exposure characteristics and inspection ac cess requirements. Some corrosion - prone areas that should be considere d are the main wing box, the fuselage crown, the bilge, areas und er lavatories and galleys, etc. This section should state that the implementation threshold was selected to represent the typical aircraft age beyond which an effective corrosion inspection task should be implemented for a given task area.

3.2.9. Procedures for recording corrosion inspe ction findings EASA has not imposed a requirement for additional record - keepin g for an operator’s CPCP. However, the operator should maintain adequate records to substantiate any proposed programme adjustments. For example, an operator should maintain reco rds to enable the operator to determine the amount of damage that has occurred during the repeat interval for each corrosion inspection task. Such data should be maintained for multiple repeat intervals in order to determine whether the damage remains cons tant o r is increasing or decreasing.

Powered by EASA eRules Page 265 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Such records are necessary when an op erator is seeking approval for i nterval extension (escalation) or task reduction.

3.2.10. Glossary This section should define all terms specifically used in the baseline CPCP documen tation .

3.2.11. Application of the basic task This section should describe in detail the basi c task. It should provide procedures describing how to accomplish the following actions: (a) Removal of all systems equipment and interior furnishings to allow acc ess to the area.

(b) Cleaning of the area as required.

(c) Visual inspection of all task areas and zones listed in the baseline CPCP .

(d) Removal of all corrosion, damage evaluation, and repair of structure as necessary.

(e) Unblocking holes and gaps that may hinder drainage.

(f) Application of corrosion protective compounds.

(g) Reinstallation of dry insulation blankets, if applicable.

3.2.12. Determination of corrosion levels based on findings This section should describe how the corrosion level definitions are used in evaluating the corrosion findings a nd assigning a corrosion level. This section should also instruct the operator to consult the DAH or the competent authority for advice in determining corrosion levels.

3.2.13. Typical actions foll owing determination of corrosion levels This section should establish criteria for evaluating whether or not Level 2 or Level 3 corrosion is occurring on other air craft in the operator ’ s fleet. Cri teria to be considered include: cause of the corrosion problem, past maintenance history, operating environment, production build standard, years in service, and inspe ctability of the corroded area. These and any other identified criteria should be used in identifying those aircraft tha t should be included in a fleet campaign.

The results of the fleet campaign should be used to determine necessary adjus tments in the operator ’ s CPCP. The following instructions should also be included in this section: (a) If corrosion exceeding the allowab le limit is found during accomplishment of the corrosion inspection task implementation threshold for a task area, it may be necessary to adjust the CPCP. ( S ee ‘ NOTE ’ under ‘L evel 2 corrosion ’ definition) (b) A single isolated occurrence of corrosion betwe en successive inspections that exceeds Level 1 does not necessarily warrant a change in the operator ’ s CPCP. If the operator experiences multiple occurrences of Level 2 or Level 3 corrosion for a specific task area, then the operator should implement a cha nge to the CPCP.

Powered by EASA eRules Page 266 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) (c) The operator should not defer maintenance actions for Level 2 and Level 3 corrosion. These maintenance actions should be accomplished in accordance with the operator’s maintenance manual.

(d) The operator may implement changes such as the following to improve the effectiveness of the programme: ( 1 ) r eduction of the repeat interval, ( 2 ) m ultiple applications of corrosion treatments, ( 3 ) a dditional drainage provisions , ( 4 ) i ncorporation of DAH s service information, such as SB s and service letters.

3.2.14. Programme i mplementation This section should state that each task is to be implemented on each aircraft when the aircraft reaches the age represented by the impleme ntation threshold for the task. It should also describe procedures to be used for establishing a schedule for implementation where the aircraft age exceeds the implementation threshold for individual tasks. Finally, i t should state that once a task is implemented in an area, subsequent tasks are to be accomplished at the repeat interval in that task area.

4. DEVELOPMENT OF OPERATORS PROGRAMME 4.1. Baseline CPCP available If a baseline CPCP is available, the operator should use it as a basis for developing their CPCP. In addit ion to adopt ing the basic task, task areas, implementation thresholds and repeat intervals of the baseline CPCP , the operat or should make provisions for: (a) a eroplanes that have exceeded the implementation threshold for certain tasks, (b) a eroplanes being removed fro m storage, (c) u nanticipated scheduling adjustments, (d) c orrosion findings made during non - CPCP inspections, (e) a dding newly acquired aircraft, and (f) m odifications, configuration changes, and operating environment .

4.1.1. Provisions for aircraft that h ave exceeded the implementation threshold The operator ’ s CPCP must establish a schedule for accomplishing all corrosion inspection tasks in task areas where the aircraft age has exceeded the implementation threshold (see main text of AMC paragraph 12).

4.1.2. Aeroplanes being removed from storage Corrosion inspection task intervals are established b ased on elapsed calendar time.

Elapsed calendar time includes time out of service. The operator ’ s CPCP should provide procedures for establishing a schedule f or accomplishment of corrosion inspection tasks that have accrued during the storage period.

The schedule should result in accomplishment of all accrued corrosion inspection tasks before the aircraft is placed in service.

Powered by EASA eRules Page 267 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) 4.1.3. Unanticipated scheduling adjustments The operator ’ s CPCP should include provisions for adjustment of the repeat interval for u nanticipated schedule changes. Such provisions should not exceed 10 % of the repeat interval. The CPCP should include provisions for notifying the competen t authority when an unanticipated scheduling adjustment is made.

4.1.4. Corrosion findings made during non - CPCP inspections Corrosion findings that exceed allowable limits may be found during any scheduled or unscheduled maintenance or inspection activitie s. These findings may be indicative of an ineffective CPCP. The operator should make provision in their CPCP to evaluate these findings and adjust their CPCP accordingly.

4.1.5. Adding newly acquired aircraft Before adding any aircraft to the fleet, the op erator should establish a schedule for accomplishing all corrosion inspection tasks in all task areas that are due. This schedule should be established as follows: (a) For aircraft that have previously operated under an approved maintenance programme, the initial corrosion inspection task for the new operator must be accomplished in accordance with the previous operator ’ s schedule or in accordance with the new operator ’ s schedule, whichever would result in the earliest accomplishment of the corrosion inspec tion task.

(b) For aircraft that have not previously been operated under an approved maintenance programme, each initial corrosion task inspection must be accomplished either before the aircraft is added to the operator ’ s fleet, or in accordance with the s chedule approved by the competent authority. After each corrosion inspection task has been performed once, the subsequent corrosion task inspections should be accomplished in accordance with the new operator ’ s schedule.

4.1.6. Modifications, configuration changes and operating environment The operator must ensure that their CPCP takes account of any modifications, configurations changes and the operating environment applicable to them, that were not addressed in the b aseline CPCP documentation .

4.2. Baseli ne CPCP no t available If there is no baseline CPCP available for the operator to use in developing their CPCP, the operator should develop their CPCP using the provisions listed in Paragraph 3 of this A ppendix for a baseline CPCP as well as the provisions listed in subparagraphs 4.1.1 through 4.1.6 of this paragraph.

[Amdt 20/2] [Amdt 20/20] [Amdt 20/22] Powered by EASA eRules Page 268 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20)

Appendix 5 to AMC 20 - 20 B — Guidelines for ensuring the validity of

continuing structural integrity programmes

ED Decision 2021/007/R 1. GENERAL Point 21.A.65 of Part 21 and point 26.305 of Part - 26 require a process to be established that ensures that the continuing structural integrity programme remains valid throughout the operational life of the aircraft, considering in - service experience and cu rrent operations. The intent is for the TCHs of large transport aeroplanes to review the validity of the certification assumptions upon which the maintenance programme is based and to ensure that unsafe levels of fatigue cracking or other damage will be mi nimised in service. This Appendix provides guidance as to what the processes should include.

This A ppendix also provides interpretation, guideline s and EASA accepted means of compliance for the review of s tructural S B s including a procedure for selection, assessment and related recommended corrective action for ageing aircraft structures.

2. CONTENT OF THE PROCESSES FOR COMPLIANCE WITH POINT 26.305 of PART - 26 AMC1 21.A.65 and CS 26.305 establish compliance on the basis of sub - paragraphs (a) to (g), reproduced below, and consideration of the criteria of sub - paragraph (h): (a) a process exists, and a report that describes the process and how it is implemented is submitted to EASA; and (b) the process is either continuous with each service finding or is a regular review following a number of findings, or a combination of both; and (c) the process includes a plan to audit and report to EASA the effectiveness of the continuing structural integrity programme, including the continuing validity of the assumpt ions upon which it is based, prior to reaching any significant point in the life of the aircraft; and (d) the process includes criteria for summarising findings of fatigue environmental or accidental damage and their causes and recording them in a way that allows any potential interaction to be evaluated; and (e) the process includes criteria to assess and record the relevance of each potential contributing factor to the finding, including operational usage, fatigue load spectra, environmental conditions, m aterial properties, manufacturing processes and the fatigue and damage tolerance analysis methodology and its implementation; and (f) the process includes criteria for establishing and revising sampling programmes to supplement the inspections and other pr ocedures established in compliance with the applicable fatigue and damage tolerance requirements; and (g) the process includes criteria for establishing when structure should be modified or the inspection programme revised in the light of in - service damage findings.

(h) Sunset criteria: The extent to which the above elements of the process require definition may be tailored to the size of the fleet and its expected useful remaining life (e.g. if less than 10 % of the fleet remains in operation worldwide at the date of applicability of point 26.305 and there is significant experience of aircraft reaching the maximum expected operating life, then additional criteria beyond the existing processes may be agreed to be unnecessary).

Powered by EASA eRules Page 269 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) It should be noted that point 2 6.305 of Part - 26 applies to all structure whose failure could contribute to a catastrophic failure, and is not limited to metallic structures and fatigue cracking, but should also encompass composite and hybrid structures.

The reporting of findings that co uld be relevant to the continuing structural integrity of the aeroplane should be facilitated by providing clear instructions and easy - to - use reporting means to operators that encourage and facilitate both their support and that of the customer support sta ff in identifying developing risks.

The intent of the audit and the associated report is to provide the TCH and EASA with a series of properly planned opportunities to assess the continuing structural integrity programme for significant systemic shortcomin gs and take timely action in advance of potential unsafe conditions. The audit should consider each of the parts of the continuing structural integrity programme and any links between them or with programmes for other types. In the context of this requirem ent, the audit should address all structures, not only metallic structures.

The audit report should summarise the processes and their evolutions. The report should describe any measures taken in the audit that are beyond the basic processes established in accordance with point 21.A.65 of Part 21 or as described in the original summary report prepared in accordance with point 26.305 of Part - 26 (e.g. additional field inspections or tear - down inspections of fleet leading aircraft in terms of age and usage). Th e report should summarise the status of each part of the continuing structural integrity programme, the findings of the audit and proposals for the actions to be taken.

The audit should provide evidence that the processes required by point 21.A.65 of Part 21 and point 26.305 of Part - 26 have been properly implemented, such that: — reported service findings have been recorded and summarised in a way that allows causes, trends and actions to be reviewed ; — service findings are evaluated for consistency with th e assumptions on which the programme is based; — the continuing structural integrity programme remains effective (e.g. changes have been made to the programme in response to findings, and few emergency or short - term airworthiness actions have been necessar y); — a comparison of the loading, operational usage, fatigue methodology, design tools, and test evidence with that upon which the programme is based, shows that the programme remains valid; — causal analysis results have been reviewed and evaluated for e vidence of repetitive themes for which no specific action has been taken; and — the fleet leader sampling programme has been implemented, and any findings resulting from it have been properly dispositioned.

The audit report should record how any deviations from the applicable processes, identified during the audit, have been or will be addressed.

Significant points in the aircraft life that should be considered in the audit plan include: points at which a common threshold exist for multiple damage - tolerance - based inspections, half - DSG, DSG, LOV, etc. In order to plan for a timely assessment that will allow proactive revision of the maintenance programme, the audit should take place several years before reaching the significant point.

Powered by EASA eRules Page 270 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Assumptions made at certification and subsequently regarding key operating variable parameters such as weight, fuel, payload, mission length, etc., should be evaluated on a regular basis or each time a finding indicates that the assumptions may be compromised, resulting in an adverse effect on the fatigue analysis and inspection programme.

One way to ensure confidence in the maintenance programme is by establishing a fleet leader sampling programme encompassing various operators and operations in different environments. This m ay, for example, be developed in coordination with the MRB and requires the cooperation of the leading operators. The sampling programme need not address all potential damage locations, and should focus on the most critical that would provide early indicat ions of potentially erroneous assumptions. Sampling may also be beneficial where new materials or methods of construction have been introduced, especially when the extent of testing may have been limited at certification, e.g. for areas of hybrid structure where the temperature differential was not part of the full - scale fatigue test. The sampling programme may also impose more intrusive or detailed inspections and analyses of samples taken from the structure (for composites or other materials subject to en vironmental degradation).

The details of the sampling programme requirements and the associated reporting requirements should be established in coordination with the operators. The ICA, in compliance with Appendix H to CS - 25, may need to be supplemented wi th this information to support the core compliance elements of the continuing structural integrity programme generated through compliance with CS 25.571.

The process for establishing when a structure should be modified or the inspection programme revised i n the light of in - service damage findings should include special consideration of: — damage detected and reported before the inspection threshold; and — damage that is generally being found at or near to the critical crack size; and — changing damage configurati ons for which the reasons are not fully understood; and — new damage scenarios reported under existing inspection or repair procedures that could otherwise be considered to be addressed, and overlooked.

The objectives of modifying structures are to provide a reasonably high probability that the ultimate load capability will be retained over long periods of the aircraft’s life, and to significantly reduce the potential for interaction with new cracking that may develop later in the aircraft’s life.

The followi ng guidance regarding the SB review process is retained from the original issue of this AMC for general guidance on the subject, and the criteria for bulletin selection provide useful additional factors for establishing when structures should be modified o r the inspection programme revised.

3 . SB REVIEW PROCESS SBs issued early in the life of an aircraft fleet may utilise inspections (in some cases non - mandatory inspections) alone to maintain structural integrity. Inspections may be adequate at this early s tage, when cracking is possible, but not highly likely. However, as aircraft age, the probability of fatigue cracking becomes more likely. During this later period, it is not prudent to rely only on inspections alone because there are more opportunities fo r cracks to be missed, and cracks may no longer occur in isolation. It is then prudent to reduce reliance strictly on inspections, with their inherent human factors limitations, and to incorporate modifications to the structure to eliminate the source of t he cracking. In some cases, reliance on an inspection Powered by EASA eRules Page 271 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) programme, in lieu of modification, may be acceptable through the increased use of mandatory versus non - mandatory inspections.

The TCH, in conjunction with the operators, is expected to initiate a revie w of all structurally related inspection and modification SBs and determine which require further actions to ensure continued airworthiness, including mandatory modification action or enforcement of special repetitive inspections.

Any aircraft primary stru ctural components that would require frequent repeat inspections, or where the inspection is difficult to perform, taking into account the potential airworthiness concern, should be reviewed to preclude the human factors issues associated with repetitive i nspections.

The SB review is an iterative process consisting of the following items: (a) The TCH or the TCH in conjunction with the operators at a preliminary STG meeting should review all the issued structural inspection and modification SBs to select can didate bulletins, using the following four criteria: (i) There is a high probability that structural cracking exists.

Related to the number and type of finding in service and from fatigue testing.

A ‘no finding’ result should be associated with the number of performed inspections.

The type of finding should include an analysis of its criticality.

(ii) Potential structural airworthiness concern The structural airworthiness of the aircraft is dependent on repeat inspections to verify its structural condition, and therefore on the reliability of the inspections.

A short repeat inspection interval (e.g. a short time for a crack to grow from a detectable crack to a critical length divided by a factor) will lead to increased workloads for inspectors and a possible increased risk of them missing damage.

Special attention should be paid to any single inspection tasks involving multiple repeat actions needed to verify the structural condition that may increase the risk of the inspectors missing damage (e.g. lap splice inspections).

(iii) Damage is difficult to detect during routine maintenance (i.e. there are few additional opportunities for detection beyond the specific requirement of the SB).

(Of particular concern is damage that is found when it is well - developed an d closer to being critical, rather than damage which is in the early stages with several further opportunities available for detection before it becomes critical.)

The areas to be inspected are difficult to access.

NDI methods are proving unsuitable.

The human factors associated with the inspection technique are so adverse that the detection of cracks may not be sufficiently dependable to assure safety.

(iv) There is adjacent structural damage or the potential for it.

Particular attention s hould be paid to areas susceptible to WFD and also to potential interaction between corrosion and fatigue cracking, e.g. between fastener damage (due to stress corrosion or other factors) and fatigue cracking.

Powered by EASA eRules Page 272 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) It is recommended to consider the potential in teraction of modifications or repairs usually implemented in the areas concerned to check whether the inspections are still reliable or not (operator’s input).

(b) The TCH and operator members will be requested to submit information on their individual fle et experience related to candidate SBs. This information will be collected and evaluated by the TCH. The summarised results will then be reviewed in detail at an STG meeting (see point (c) below).

(c) The final selection of SBs for recommendation of the ap propriate corrective action to assure structural continued airworthiness, taking into account the in - service experience, will be made during an STG meeting by the voting members of the STG, either by consensus or majority vote, depending on the preference of the individual STGs.

(d) An assessment will be made by the TCH as to whether or not any subsequent revisions to SBs affect the decisions previously made. Any subsequent revisions to the SBs previously chosen by the STG for mandatory inspection or incorp oration of modification action that would affect the previous STG recommended action should be submitted to the STG for review.

(e) The TCH should review all new structural SBs periodically to select further candidate bulletins. The TCH should schedule a m eeting of the STG to address the candidates.

Operator members and the competent authority will be advised of the selected candidates and provided with the opportunity to submit additional candidates.

The SB selection, review, assessment and recommendation process within the Structural Task Group (STG) is summarised in Figure A5 - 1. For the first SB review within an STG meeting, all the inspection SBs should be selected. Moreover, some specific modification SBs not linked to an inspection SB ma y also be selected for review.

The information input by operators should address the points as detailed in Figure A5 - 2. This information should be collected and analysed by the TCH for the STG meeting.

If, for a given selected SB, there is not sufficient i n - service data available before the STG meeting that would enable a recommendation to be made, its review may be deferred until enough data is available. The TCH should then check periodically until the data becomes available.

The operators and EASA should be advised by the TCH of the SB selection list and be given the opportunity to submit additional SBs. For this purpose, the TCH should give the operators enough information in advance (e.g. 2 months) for them to be able to properly consider the proposed s election and to gather data.

When an SB is selected, it is recommended to also select, in the same package, inspection SBs that interact with it and all the related modification SBs. The main criteria for selecting SBs are defined in the following subparag raphs.

4 . STG MEETING, SB REVIEW AND RECOMMENDATIONS It is recommended to review at the same time all SBs that can interact, the so - called SB package , in the selection process. The meeting should start with an STG agreement on the selected SB list and on t hose deferred. At the meeting the TCH should present their analysis of each SB utilising the collection of operator input data. The STG should then collectively review the ratings (Figure A5 - 2) against each criteri on to reach a co nsensus recommendation. Su ch a n STG recommendation for a selected SB shall consider the following options: Powered by EASA eRules Page 273 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) (a) t o mandate a structural modification at a given threshold , (b) t o mandate the selected inspection SB , (c) t o revise the modification or repair actions , (d) t o revise oth er SB (s) in the same area concerned by damages , (e) t o review the inspection method and related inspection intervals , (f) t o review ALI/MRB R or other maintenance instructions , (g) t o defer the review to the next STG and request operators ’ reports on findings for a specific SB or request an inspection sampling on the oldest aircraft .

STG recommendations for mandatory action are the responsibility of the TCH to forward to EASA for appropriate action. Other STG recommendations is information provided to the STG members. It is their own responsibility to carry them out within the appropri ate framework.

Powered by EASA eRules Page 274 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) Figure A5 - 1: SB s election p rocess and SB r eview Powered by EASA eRules Page 275 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) IN - SERVICE DATA/SECTION 1 NAME OF THE OPERATOR : ________________________________________________ _________________________________ ________ AIRCRAFT MODEL/SERIES : ___________________________ ______________________________________________________ ________ SERVICE BULLETIN (SB) NUMBER : ________________________________________ _____________________ ____________________________ TITLE : ________________________________________________________________________________ ____ RELATED INSPECTION/MODIFICATION SB: 1/________________________________________________________________________________ _______ 2/________________________________________________________________________________ _______ 3/____________________________________________________________________ ____________ _______ SB MANDATED ?  YES  NO IF NOT, IS THE SB IMPLE MENTED IN THE MAINTENANCE PROGRAMME ?  YES  NO NUMBER OF AIRCRAFT TO WHICH THE SB APPLIES (INCLUDING ALL AIRCRAFT IN THE SB EFFECTIVITY) : ______________________________________________________ _____________________ ______________ NUMBER OF AIRCRAFT EXC EEDING THE SB INSPECTION THRESHOLD (IF APPLICABLE) : ____________________________ _____________________________________________________________ NUMBER OF AIRCRAFT INSPECTED PER SB (IF APPLICABLE)?

__________________________ ____________________________________________________ ___________ SPECIFY TYPE OF INSPECTION USED : ____________ ______________________________________________________________ _______________ NUMBER OF AIRCRAFT WITH REPORTED FINDINGS : _____________________ ____________________________________________________________ ________ TYPE OF FINDINGS : NUMBER OF FINDINGS DUE TO INSPECTIONS OTHER THAN THE ONE PRESCRIBED IN THE SB (IF AP P LICABLE) : ___________________________________________________________________________ ______________ SPECIFY TYPE OF INSPECTION USED : _______________ ______________________ ____________________________________________________ NUMBER OF AIRCRAFT EXCEEDING THE SB TERMINATING MODIFICATION THRESHOLD (IF APPLICABLE) : ________________________________________________________________________ _________________ NUMBER OF AIRCRAFT IN WHICH THE TERMINATING MODIFICATION HAS BEEN ACCOMPLISHED (IF APPLICABLE) : _________________________________________________________________________________ ________ NEED THIS SB (OR RELATED SB) BE IMPROVED ?  YES  NO COMMENTS: ______________________________________________________________________ ________ _________________________________________________________________________________ ________ Powered by EASA eRules Page 276 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 20B Products, Parts and Appliances (AMC - 20) IN - SERVICE DATA/SECTION 2 (A) (B) (C) (D) (E) CRITERIA INSPECTABILITY FREQUENCY FREQUENCY OF SEVERITY ADJACENT ACCESS REPETITIVE DEFECTS RATING STRUCTURE INSPECTION DAMAGE RATING FIGURE A5 - 2: O perators fleet experience (A) INSPECTABILITY/ACCESS RATING OK  Inspection carried out with little or no difficulty.

Acceptable  Inspection carried out with some difficulty.

Difficulty  Inspection carried out with significant difficulty.

Note: Rating should consider difficulty of access as well as inspection techniq ue and size of inspection area.

(B) FREQUENCY OF REPETITIVE INSPECTIONS RATING OK  Greater than 6 years.

Acceptable  Between 2 and 6 years.

Difficulty  Less than 2 years.

(C) FREQUENCY OF DEFECTS NOTED RATING = % OF THOSE AEROPLANES BEYOND THRESHOLD ON WHICH DEFECTS HAVE BEEN FOUND OK  No defect noted.

Acceptable  Defects noted but not of a significant amount (less than 10 %).

Difficulty  Substantial defects noted (greater than 10 %).

(D) FINDING SEVERITY RATING OK  Airworthiness not affected.

Accept able  Damage not of immediate concern, but could progress or cause secondary damage.

Difficulty  Airworthiness affected. Damage requires immediate repair.

(E) ADJACENT STRUCTURE DAMAGE RATING (MULTIPLE - SITE DAMAGE, MULTIPLE - ELEMENT DAMAGE, CORROSION, ETC.)

OK  Low rate of adjacent structural damage.

Acceptable  Medium rate of adjacent structural damage.

Difficulty  High rate of adjacent structural damage/Multiple service actions in area.

[Amdt 20/2] [Amdt 20/20] [Amdt 20/22] Powered by EASA eRules Page 277 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20)

AMC 20 - 21

AMC 20 - 21 Programme to enhance aeroplane Electrical Wiring

Interconne ction System (EWIS) maintenance

ED Decision 2008/007/R 1 P URPOSE This AMC provides acceptable means of compliance for developing enhanced EWIS maintenance for operators, holders of type c ertificates (TC), holders of supplemental type certificates (STC) and maintenance organisations. The information in this AMC is derived from the maintenance, inspection, and alteration best practices identified through extensive research. This AMC provides an acceptable means of compliance with the appropriate certification, maintenance and operating rules. This AMC promotes a housekeeping philosophy of “protect, clean as you go” when performing maintenance, repair, or alterations on or around aircraft EWIS .

2 O BJECTIVE The objective of this AMC is to enhance the maintenance of aircraft EWIS through adoption by the aviation industry of the following: a. Enhanced Zonal Analysis Procedure (EZAP). This AMC presents an “enhanced zonal analysis procedure” and log ic that will benefit all aircraft regardless of whether they currently have a structured Zonal Inspection Programme (ZIP), (see Appendix A .

Enhanced Zonal Analysis Logic Diagram a nd Steps and Appendix B . EZAP Worksheets).

Application of this procedure will ensure that appropriate attention is given to wiring installations. Using EZAP it will be possible to select stand - alone inspections (either general or detailed) and tasks to minimise the presence of combustible material. The procedure and logic in this AMC complement existing zonal analysis procedures and will also allow the identification of new wiring tasks for those aircraft that do not have a structured ZIP.

b. Gu idance for General Visual Inspection (GVI). This AMC provides clarification of the definition for a GVI as well as guidance on what is expected from such an inspection, whether performed as a stand - alone GVI or as part of a zonal inspection. It is assumed this new inspection standard will be the standard applied by operators, or their maintenance provider, when the new tasks are incorporated in to their maintenance programme.

c. Protection and Caution. This AMC identifies protection and caution to be added to maintenance instructions, thereby enhancing procedures that will lead to minimisation of contamination and accidental damage while working on the aircraft.

The enhanced aircraft wiring maintenance information described in this AMC is intended to improve maintenance and inspection programmes for all aircraft systems. This information, when used appropriately, will improve the likelihood that wiring system degradation, including age - related problems, will be identified and corrected. Therefore, the goal of enhanced wiring maintenance information is to ensure that maintenance actions, such as inspection, repair, overhaul, replacement of parts, and preservation, do not cause a loss of wiring system function, do not cause an increase in the potential for smoke and fire in the aircraft, and do not inhibit the safe operation of the aircraft.

Powered by EASA eRules Page 278 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) In order to fully realise the objectives of this AMC, operators, TC holders, STC holders and maintenance providers, will need to rethink their current approach to maintaining and modifying aircraft wiring and systems. This may require more than simply updating maintenance manuals and work cards and enhancing training. Maintenance personnel need to be aware that aircraft EWIS should be maintained with the same level of intensit y as any other system in the aircraft. They also need to recognise that visual inspection of wiring has inherent limitations. Small defects such as breached or cracked insulations, especially in small gauge wire may not always be apparent. Therefore effect ive wiring maintenance combines visual inspection techniques with improved wiring maintenance practices and training.

Good wiring maintenance practices should contain a "protect, clean as you go" housekeeping philosophy. In other words, care should be take n to protect wire bundles and connectors during work, and to ensure that all shavings, debris and contamination are cleaned up after work is completed. This philosophy is a proactive approach to wiring system health. Wiring needs to be given special attent ion when maintenance is being performed on it, or around it. This is especially true when performing structural repairs, work under STCs or field approvals, or other modifications.

To fully achieve the objectives of this AMC it is imperative that all perso nnel performing maintenance on or around EWIS receive appropriate training (see AMC 20 - 22 : Aeroplane EWIS training programme).

3 A PPLICABILITY a. The guidance provided in this docu ment is directed to operators, TC applicants and holders, STC applicants and maintenance organisations: b. The guidance provided in this AMC can be applied to all aeroplane maintenance or inspection programmes. The EZAP in Appendix A of this AMC is specifically directed towards enhancing the maintenance programmes for aircraft whose current programme does not include tasks derived from a process that specifically considers wiring in all zones as the potential source of ignition of a fire.

c. This AMC, when followed in its entirety, outlines an acceptable means of compliance to the requirement for the development of enhanced scheduled maintenance tasks for the EWIS for the aircraft me ntioned in 3a. above.

d. Similarly, it also provides an acceptable means of compliance for CS 25.1739 and 25.1529 Appendix H25.5 for new designs.

4 R ELATED DOCUMENTS — Regulation (EC) No 216/2008 — Regulation (EC) No 1702/2003 Regulation (EC) No 216/2008 of the European Parliament and of the Council of 20 February 2008 on common rules in the field of civil aviation and establishing a European Aviation Safety Agency, and repealing Council Directive 91/670/EEC, Regulation (EC) No 1592/2002 and Directive 2004/36/EC (OJ L 79, 19.3.2008 , p.1).

Commission Regulation (EC) No 1702/2003 of 24 September 2003 laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of desig n a nd production organisations (OJ L 243, 27.9.2003, p. 6). Regulation as last amended by Regulation (EC) No 287/2008 (OJ L 87, 29. 3.2008, p.3).

Powered by EASA eRules Page 279 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SU BPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) — Regulation (EC) No 2042/2003 — EASA Certification Specification CS - 25 Large Aeroplanes — EU - OPS Commercial Air Transportation (Aeroplanes) 5 RELATED READING MATERIAL a. EASA AMC 20 — AMC 20 - 22 Aeroplane EWIS training — AMC 20 - 23 Development of electrical standard wiring practices documentation b. FAA Advisory Circulars (AC).

— AC 25 - 16 Ele ctrical Fault and Fire Protection and Prevention — AC 25.981 - 1B Fuel Tank Ignition Source Prevention Guidelines — AC 43 - 12A Preventive Maintenance — AC 43.13 - 1B Acceptable Methods, Techniques and Practices for Repairs and Alterations to Aircraft — AC 43 - 204 Visual Inspection For Aircraft — AC 43 - 206 Avionics Cleaning and Corrosion Prevention/Control — AC 65 - 15A Airframe and Powerplant Mechanics Airframe Handbook, Chapter 11, Aircraft Electrical Systems — AC 120 - YYY Training modules for wiring maintenance c. Reports — Trans port Aircraft Intrusive Inspection Project, (An Analysis of the Wire Installations of Six Decommissioned Aircraft), Final Report, The Intrusive Inspection Working Group, December 29, 2000.

http://www.mitrecaasd.org/atsrac/intrusive_inspection.html — FAA Aging Transport Non - Structural Systems Plan, July 1998.

— National Transportation Safety Board, Safety Recommendation, September 19, 2000, A - 00 - 105 through - 108. http://www.ntsb.gov/recs/letters/2000/A00_105_108.pdf — Wire System Safety Inter agency Working Group, National Science and Technology Council, Review of Federal Programmes for Wire System Safety 46 (2000).

— Aging Transport Systems Rulemaking Advisory Committee, Task 1 and 2, Aging Systems, Final Report.

http://www.mitrecaasd.org/atsrac/final_reports/Task_1&2_Final%20_August_2000.pdf Commission Regulation (EC) No 2042/2003 of 20 November 2003 on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks ( OJ L 315, 28.11.2003, p. 1). Regulation as last amended by Regulation (EC) No 376/2007 of (OJ L 94, 4.4.2007, p. 18).

Executive Direc tor Decision No 2003/2/RM of 14 October 2003 on certification specifications, including airworthiness codes and acceptable means of comp liance, for large aeroplanes («CS - 25 »). Decision as last amended by Executive Director Decision No 2008/006/R of 29 Augu st 2008 (CS - 25 Amendment 5).

Council Regulation (EEC) No 3922/91 of 16 December 1991 on the harmonisation of technical requirements and administrative procedures in the field of civil aviation (OJ L 373, 31.12.1991, p. 4). Regulation as last amended by R egulation (EC) No 8/2008 of 11 December 2007 ( OJ L 10, 12.1.2008, p. 1).

Powered by EASA eRules Page 280 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) — Aging Transport Systems Rulemaking Advisory Committee, Task 3, Final Report.

http://www.mitrecaasd.org/atsrac/final_reports/Task_3_Final.pdf — Aging Transport Systems Rulemaking Advisory Committee, Task 4, Final Report, S tandard Wiring Practices.

http://www.mitrecaasd.org/atsrac/final_reports/Task_4_Final_Report_Sept_2000.pdf — Aging Transport Systems Rulemaking Advisory Committee, Task 5, Final Report, Aircraft Wiring Systems Traini ng Curriculum and Lesson Plans.

http://www.mitrecaasd.org/atsrac/final_reports/Task_5_Final_March_2001%20.pdf — ATA Specification 117 (Wiring Maintenance Practice s/Guidelines).

d. Other Documents — Operator/Manufacturer Scheduled Maintenance Development, ATA Maintenance Steering Group (MSG - 3). May be obtained from the Air Transport Association of America; Suite 1100, 1301 Pennsylvania Ave, NW, Washington, DC 20004 - 1707.

6 DEFINITIONS Arc tracking : A phenomenon in which a conductive carbon path is formed across an insulating surface. This carbon path provides a short circuit path through which current can flow. Normally a result of electrical arcing. Also refer red to as "Carbon Arc Tracking," "Wet Arc Tracking," or "Dry Arc Tracking."

Combustible : For the purposes of this AMC the term combustible refers to the ability of any solid, liquid or gaseous material to cause a fire to be sustained after removal of the i gnition source. The term is used in place of inflammable/flammable. It should not be interpreted as identifying material that will burn when subjected to a continuous source of heat as occurs when a fire develops.

Contamination : For the purposes of this AMC, wiring contamination refers to either of the following: — The presence of a foreign material that is likely to cause degradation of wiring; — The presence of a foreign material that is capable of sustaining combustion after rem oval of ignition source.

Detailed Inspection (DET): An intensive examination of a specific item, installation or assembly to detect damage, failure or irregularity. Available lighting is normally supplemented with a direct source of good lighting at an int ensity deemed appropriate. Inspection aids such as mirrors, magnifying lenses or other means may be necessary. Surface cleaning and elaborate access procedures may be required.

Electrical Wiring Interconnection System (EWIS) : See CS 25.1701.

Functional Fai lure : Failure of an item to perform its intended function within specified limits.

General Visual Inspection (GVI) : A visual examination of an interior or exterior area, installation or assembly to detect obvious damage, failure or irregularity. This level of inspection is made from within touching distance unless otherwise specified. A mirror may be necessary to enhance visual access to all exposed surfaces in the inspection area. This level of inspection is made under normally available lighting condition s such as daylight, hangar lighting, flashlight or droplight and may require removal or opening of access panels or doors. Stands, ladders or platforms may be required to gain proximity to the area being checked.

Powered by EASA eRules Page 281 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Lightning/High Intensity Radiated Field (L/ HIRF) protection : The protection of aeroplane electrical systems and structure from induced voltages or currents by means of shielded wires, raceways, bonding jumpers, connectors, composite fairings with conductive mesh, static dischargers, and the inheren t conductivity of the structure; may include aircraft specific devices, e.g., RF Gaskets.

Maintenance : As defined in Regulation (EC) No 2042/2003 Article 2(h) “maintenance means inspection, overhaul, repair, preservation, and the replacement of parts, but excludes preventive maintenance.” For the purposes of this advisory material, it also includes preventive maintenance.

Maintenance Significant Item (MSI) : Items identified by the manufacturer whose failure could result in one or more of the following: — coul d affect safety (on ground or in flight); — is undetectable during operations; — could have significant operational impact; — could have significant economic impact.

Needling : The puncturing of a wire’s insulation to make contact with the core to test the contin uity and presence of voltage in the wire segment.

Stand - alone GVI : A GVI which is not performed as part of a zonal inspection. Even in cases where the interval coincides with the zonal inspection, the stand - alone GVI shall remain an independent step within the work card.

Structural Significant Item (SSI) : Any detail, element or assembly that contributes significantly to carrying flight, ground, pressure or control loads and whose failure could affect the structural integrity necessary for the safety of the aircraft.

Swarf : A term used to describe the metal particles, generated from drilling and machining operations. Such particles may accumulate on and between wires within a wire bundle.

Zonal Inspection : A collective term comprising selected GVI and visual checks that are applied to each zone, defined by access and area, to check system and powerplant installations and structure for security and general condition.

7 BACKGROUND Over the years there have been a number of in - flight smoke and fire events where c ontamination sustained and caused the fire to spread. Regulators and Accident Investigators have conducted aircraft inspections and found wiring contaminated with items such as dust, dirt, metal shavings, lavatory waste water, coffee, soft drinks, and napk ins. In some cases dust has been found completely covering wire bundles and the surrounding area.

Research has also demonstrated that wiring can be harmed by collateral damage when maintenance is being performed on other aircraft systems. For example a per son performing an inspection of an electrical power centre or avionics compartment may inadvertently cause damage to wiring in an adjacent area.

In recent years regulator and industry groups have come to the realisation that current maintenance practices m ay not be adequate to address aging non - structural systems. While age is not the sole cause of wire degradation, the probability that inadequate maintenance, contamination, improper repair or mechanical damage has caused degradation to a particular EWIS in creases over time. Studies by industry and regulator working groups have found that Powered by EASA eRules Page 282 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) although EWIS management is an important safety issue, there has been a tendency to be complacent about EWIS. These working groups have concluded that there is a need to be tter manage EWIS so that they continue to function safely.

8 WIRE DEGRADATION Normal maintenance actions, even using acceptable methods, techniques and practices, can over time be a contributing factor to wire degradation. Zones that are subject to a high level of maintenance activity display more deterioration of the wiring insulation than those areas not subject to frequent maintenance. Degradation of wiring is further accelerated when inappropriate maintenance practices are used. Examples include th e practice of needling wires to test the continuity or voltage, and using a metal wire or rod as a guide to feed new wires into an existing bundle. These practices could cause a breach in the wiring insulation that can contribute to arcing.

Over time, insu lation can crack or breach, thereby exposing the conductor. This breakdown, coupled with maintenance actions, can exacerbate EWIS malfunction. Wiring that is undisturbed will have less degradation than wiring that is disturbed during maintenance.

For addi tional information on the principle causes of wire degradation see Appendix E .

9 INSPECTION OF EWIS Typical analytical methods used for the development of maintenance programmes have not provided a focus on wiring. As a result most operators have not adequately addressed deterioration of EWIS in t heir programmes. EASA has reviewed the current inspection philosophies with the objectives of identifying improvements that could lead to a more consistent application of the inspection requirements, whether they are zonal, stand - alone GVI, or DET inspecti ons.

EASA believes that it would be beneficial to provide guidance on the type of deterioration that a person performing a GVI, DET, or zonal inspection would be expected to discover. Though it may be realistically assumed that all operators provide such g uidance to their inspectors, it is evident that significant variations exist and, in certain areas of the world, a significant enhancement of the inspection could be obtained if internationally agreed guidance material could be produced. The guidance provi ded by this AMC assumes each operator will adopt recent improvements made to the definitions of GVI and DET inspections. This information should be incorporated in operators’ training material and in the introductory section of maintenance planning documen tation.

This section is divided into three parts. The first part addresses the levels of inspection applicable to EWIS, the second part provides guidance for performing zonal inspections, and the third part provides lists of installations and areas of conc ern.

a. Levels of inspection applicable to EWIS (1) Detailed Inspection (DET) An intensive examination of a specific item, installation or assembly to detect damage, failure or irregularity. Available lighting is normally supplemented with a direct source of good lighting at an intensity deemed appropriate. Inspection aids such as mirrors, magnifying lenses or other means may be necessary. Surface cleaning and elaborate access procedures may be required.

A DET can be more than just a visual inspection since it may include tactile assessment in which a component or assembly is checked for tightness/security.

This is of particular significance when identifying applicable and effective tasks to Powered by EASA eRules Page 283 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) ensure the continued integrity of installations such as bonding jum pers, terminal connectors, etc.

Though the term Detailed Visual Inspection remains valid for DET using only eyesight, it should be recognised that this may represent only part of the inspection called for in the source documents used to establish an operat or’s Maintenance Programme. For this reason it is recommend that the acronym “DVI” not be used since it excludes tactile examination from this level of inspection.

(2) General Visual Inspection (GVI).

A visual examination of an interior or exterior area, i nstallation or assembly to detect obvious damage, failure or irregularity. This level of inspection is made from within touching distance unless otherwise specified. A mirror may be necessary to enhance visual access to all exposed surfaces in the inspecti on area. This level of inspection is made under normally available lighting conditions such as daylight, hangar lighting, flashlight or droplight and may require removal or opening of access panels or doors. Stands, ladders or platforms may be required to gain proximity to the area being checked.

Recent changes to this definition have added proximity guidance (within touching distance) and the allowance to use a mirror to enhance visual access to exposed surfaces when performing a GVI. These changes should result in more consistent application of GVI and support the expectations of what types of EWIS discrepancies should be detected by a GVI.

Though flashlights and mirrors may be required to provide an adequate view of all exposed surfaces, there is no requi rement for equipment removal or displacement unless this is specifically called for in the access instructions. Paint and/or sealant removal is not necessary and should be avoided unless the observed condition is suspect. Should unsatisfactory conditions b e suspected, items may need to be removed or displaced in order to permit proper assessment.

It is expected that the area to be inspected is clean enough to minimise the possibility that accumulated dirt or grease might hide unsatisfactory conditions that would otherwise be obvious. Any cleaning that is considered necessary should be performed in accordance with accepted procedures in order to minimise the possibility of the cleaning process itself introducing anomalies.

In general, the person performing a GVI is expected to identify degradation due to wear, vibration, moisture, contamination, excessive heat, aging, etc., and make an assessment as to what actions are appropriate to address the noted discrepancy.

In making this assessment, any potential effec t on adjacent system installations should be considered, particularly if these include wiring. Observations of discrepancies, such as chafing, broken clamps, sagging, interference, contamination, etc., need to be addressed.

(3) Zonal Inspection A collectiv e term comprising selected GVI and visual checks that are applied to each zone, defined by access and area, to check system and powerplant installations and structure for security and general condition.

A zonal inspection is essentially a GVI of an area or zone to detect obvious unsatisfactory conditions and discrepancies. Unlike a stand - alone GVI, it is not directed to any specified component or assembly.

Powered by EASA eRules Page 284 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) b. Guidance for zonal inspections The following EWIS degradation items are typical of what should be detectable and subsequently addressed as a result of a zonal inspection (as well as a result of a stand - alone GVI). It is also recommended that these items be included in maintenance and training documentation. This list is not intended to be exhaustive an d may be expanded as considered appropriate.

(1) Wire/Wire Harnesses — Wire bundle/wire bundle or wire bundle/structure contact/chafing — Wire bundle sagging or improperly secured — Wires damaged (obvious damage due to mechanical impact, overheat, localised chafing, etc.)

— Lacing tape and/or ties missing/incorrectly installed — Wiring protection sheath/conduit deformity or incorrectly installed — End of sheath rubbing on end attachment device — Grommet missing or damaged — Dust and lint accumulation — Surface contamination by metal shavings/swarf — Contamination by liquids — Deterioration of previous repairs (e.g., splices) — Deterioration of production splices — Inappropriate repairs (e.g., incorrect splice) — Inappropriate attachments to or separation from fluid lines (2) Connectors — External corrosion on receptacles — Backshell tail broken — Rubber pad or packing on backshell missing — No backshell wire securing device — Foolproofing chain broken — Missing or broken safety wire — Discoloration/evidence of overheat on terminal lugs/blocks — Torque stripe misalignment (3) Switches — Rear protection cap damaged (4) Ground points — Corrosion Powered by EASA eRules Page 285 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) (5) Bonding braid/bonding jumper — Braid broken or disconnected — Multiple strands corroded — Multiple strands broken (6) Wiring clamps or brackets — Corroded — Broken/missing — Bent or twisted — Faulty attachment (bad attachment or fastener missing) — Unstuck/detached — Protection/cushion damaged (7) Supports (rails or tubes/conduit) — Broken — Deformed — Fastener missing — Missing edge protection on rims of fe ed through holes — Racetrack cushion damaged — Obstructed drainage holes (in conduits) (8) Circuit breakers, contactors or relays — Signs of overheating — Signs of arcing c. Wiring installations and areas of concern Research has shown that the following installati ons and areas need to be addressed in existing maintenance material.

(1) Wiring installations Clamping points – Wire chafing is aggravated by damaged clamps, clamp cushion migration, or improper clamp installations. Aircraft manufacturers specify clamp type and part number for EWIS throughout the aircraft. When replacing clamps use those specified by the aircraft manufacturer. Tie wraps provide a rapid method of clamping especially during line maintenance operations. Improperly installed tie wraps can have a detrimental effect on wire insulation. When new wiring is installed as part of a STC or any other modificat ion the drawings will provide wiring routing, clamp type and size, and proper location. Examples of significant wiring modifications are the installation of new avionics systems, new galley installations and new instrumentation. Wire routing, type of clamp and clamping location should conform to the approved drawings. Adding new wire to existing wire bundles may overload the clamps causing wire bundle to sag and wires to chafe.

Raceway clamp foam cushions may deteriorate with age, fall apart, and consequent ly would not provide proper clamping.

Powered by EASA eRules Page 286 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Connectors – Worn environmental seals, loose connectors, missing seal plugs, missing dummy contacts, or lack of strain relief on connector grommets can compromise connector integrity and allow contamination to enter th e connector, leading to corrosion or grommet degradation. Connector pin corrosion can cause overheating, arcing and pin - to - pin shorting. Drip loops should be maintained when connectors are below the level of the harness and tight bends at connectors should be avoided or corrected.

Terminations – Terminations, such as terminal lugs and terminal blocks, are susceptible to mechanical damage, corrosion, heat damage and contamination from chemicals, dust and dirt. High current - carrying feeder cable terminal lugs can over time lose their original torque value due to vibration. One sign of this is heat discoloration at the terminal end. Proper build - up and nut torque is especially critical on high current carrying feeder cable lugs. Corrosion on terminal lugs and b locks can cause high resistance and overheating. Dust, dirt and other debris are combustible and therefore could sustain a fire if ignited from an overheated or arcing terminal lug. Terminal blocks and terminal strips located in equipment power centres (EP C), avionics compartments and throughout the aircraft need to be kept clean and free of any combustibles.

Backshells – Wires may break at backshells, due to excessive flexing, lack of strain relief, or improper build - up. Loss of backshell bonding may also occur due to these and other factors.

Sleeving and Conduits – Damage to sleeving and conduits, if not corrected, may lead to wire damage. Therefore, damage such as cuts, dents and creases on conduits may require further investigation for condition of wirin g within.

Grounding Points – Grounding points should be checked for security (i.e., finger tightness), condition of the termination, cleanliness, and corrosion. Any grounding points that are corroded or have lost their protective coating should be repaired.

Splices – Both sealed an d non - sealed splices are susceptible to vibration, mechanical damage, corrosion, heat damage, chemical contamination, and environmental deterioration. Power feeder cables normally carry high current levels and are very susceptible to installation error and splice degradation. All splices should conform to the TC or STC holder’s published recommendations. In the absence of published recommendations, environmental splices are recommended to be used.

(2) Areas of concern Wire Raceways and Bundles – Adding wire s to existing wire raceways may cause undue wear and chafing of the wire installation and inability to maintain the wire in the raceway. Adding wire to existing bundles may cause wire to sag against the structure, which can cause chafing.

Wings – The wing leading and trailing edges are areas that experience difficult environments for wiring installations. The wing leading and trailing edge wiring is exposed on some aircraft models whenever the flaps or slats are extended. Other potential damage sources incl ude slat torque shafts and bleed air ducts.

Engine, Pylon, and Nacelle Area – These areas experience high vibration, heat, frequent maintenance, and are susceptible to chemical contamination.

Powered by EASA eRules Page 287 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Accessory compartment and equipment bays – These areas typically contain items such as electrical components, pneumatic components and ducting, hydraulic components and plumbing, and may be susceptible to vibration, heat, and liquid contamination.

Auxiliary Power Unit (APU) – Like the engine/nacelle area, the APU is su sceptible to high vibration, heat, frequent maintenance, and chemical contamination.

Landing Gear and Wheel Wells – This area is exposed to severe external environmental conditions in addition to vibration and chemical contamination.

Electrical Panels and Line Replaceable Units (LRU) – Panel wiring is particularly prone to broken wires and damaged insulation when these high density areas are disturbed during troubleshooting activities, major modifications, and refurbishments. Wire damage may be minimised by tying wiring to wooden dowels to reduce wire disturbance during modification. There may be some configurations where connector support brackets would be more desirable and cause less disturbance of the wiring than removal of individual connectors from the supports.

Batteries – Wires in the vicinity of all aircraft batteries are susceptible to corrosion and discoloration. These wires should be inspected for corrosion and discoloration.

Discoloured wires should be inspected for serviceability.

Power Feeders – High current wiring and associated connections have the potential to generate intense heat. Power feeder cables, terminals, and splices may be subject to degradation or loosening due to vibration. If any signs of overheating are seen, splices or terminat ion should be replaced. Depending on design, service experience may highlight a need to periodically check for proper torque of power feeder cable terminal ends, especially in high vibration areas. This applies to galley and engine/APU generator power feed ers.

Under Galleys, Lavatories, and Cockpit – Areas under the galleys, lavatories, and cockpit, are particularly susceptible to contamination from coffee, food, water, soft drinks, lavatory fluids, dust, lint, etc. This contamination can be minimised by ad herence to proper floor panel sealing procedures in these areas.

Fluid Drain plumbing – Leaks from fluid drain plumbing may lead to liquid contamination of wiring. In addition to routine visual inspections, service experience may highlight a need for perio dic leak checks or cleaning.

Fuselage Drain provisions – Some installations include features designed to catch leakage that is plumbed to an appropriate exit. Blockage of the drain path can result in liquid contamination of wiring. In addition to routine v isual inspections, service experience may highlight that these installations and associated plumbing should be periodically checked to ensure the drain path is free of obstructions.

Cargo Bay/Underfloor – Damage to wiring in the cargo bay underfloor can oc cur due to maintenance activities in the area.

Wiring subject to movement – Wiring that is subject to movement or bending during normal operation or maintenance access should be inspected at locations such as doors, actuators, landing gear mechanisms, and electrical access panels.

Access Panels – Wiring near access panels may receive accidental damage as a result of repetitive maintenance access and thus may warrant special attention.

Powered by EASA eRules Page 288 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Under Doors – Areas under cargo, passenger and service entry doors are su sceptible to fluid ingress from rain, snow and liquid spills. Fluid drain provisions and floor panel sealing should be periodically inspected and repaired as necessary.

Under Cockpit Sliding Windows – Areas under cockpit sliding windows are susceptible to water ingress from rain and snow. Fluid drain provisions should be periodically inspected and repaired as necessary.

Areas where wiring is difficult to access – Areas where wiring is difficult to access (e.g., flight deck instrument panels, cockpit pedesta l area) may accumulate excessive dust and other contaminants as a result of infrequent cleaning. In these areas it may be necessary to remove components and disassemble other systems to facilitate access to the area.

10 ENHANCED ZONAL ANALYSIS PROCEDURE (E ZAP) The EZAP identified in Appendix A of this AMC is designed to permit appropriate attention to be given to electrical wiring installations. This is achieved by providing a means to identify applicable and effective tasks to minimise accumulation of combust ible materials and address wiring installation discrepancies that may not otherwise be reliably detected by inspections contained in existing maintenance programmes.

For aircraft models operating on maintenance programmes that already include a dedicated Z IP, the logic described in this AMC will result in enhancements to those programmes, and the zonal inspection requirements may not differ greatly from the existing ZIP.

In analysis conducted under the EZAP, items such as plumbing, ducting, systems installations, etc., should be evaluated for possible contribution to wiring failures. In cases where a GVI is required to assess degradation of these items, a zonal GVI within a ZIP may be considered appropriate.

For those operators that do not have a ded icated ZIP, application of the logic is likely to result in identification of a large number of wiring - related tasks that will need to be consolidated within the existing Systems/Powerplant Programme.

In either case, any new tasks identified by the logic m ay be compared with existing tasks and credit given for equivalent tasks already contained in the maintenance programme. For operators with ZIP that already contain zonal GVI, the number of new tasks that must be added to the programme may be significantly fewer than for an operator without a dedicated ZIP.

Therefore, operators without a ZIP may find it beneficial to develop a ZIP in accordance with an industry - accepted methodology in conjunction with application of the EZAP.

The logic and procedures identi fied in this AMC apply to TC, STC and other modifications. It is expected that the TC and STC holders would use the logic and procedures to identify any need for additional instructions for continued airworthiness. However, the operator may be required to ensure the logic is used to identify such instructions for modifications or STC where they are no longer supported by the design organisation or STC holder.

11 MAINTENANCE PR ACTICES: PROTECTION AND CAUTION RECOMMENDATIONS EASA has identified some specific maintenance and servicing tasks for which more robust practices are recommended to be adopted by operators, and/or maintenance providers. These recommendations apply to all tasks, including those performed on an unscheduled basis without an accompanying ro utine job instruction card. Performance of these maintenance practices will help prevent contamination of EWIS that result from contact with harmful solids (such as metal shavings) or fluids during maintenance, modifications, and repairs of aeroplane Powered by EASA eRules Page 289 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) struc tures, and components. In addition, the training of maintenance and servicing personnel should address the potential consequences of their actions on the wiring in the work vicinity.

a. Item 1: Installation, repair, or modification to wiring.

Wiring and it s associated components (protective coverings, connectors, clamping provisions, conduits, etc.) often comprise the most delicate and maintenance - sensitive portions of an installation or system. Extreme care should be exercised and proper procedures used du ring installation, repair, or modification of wiring to ensure safe and reliable performance of the function supplied by the wiring.

Proper wire selection, routing/separation, clamping configurations, use of splices, repair or replacement of protective cov erings, pinning/de - pinning of connections, etc., should be performed in accordance with the applicable sections of the Aircraft Maintenance Manual (AMM), Wiring Practices Manual (WPM), or other documents authorised for maintenance use. In addition, special care should be taken to minimise disturbance of existing adjacent wiring during all maintenance activities. When wiring is displaced during a maintenance activity, special attention should be given to returning it to its normal configuration in accordance with the applicable maintenance instructions.

b. Item 2: Structural repairs, STC, modifications.

Structural repair, STC or modification activity inherently introduces tooling and residual debris that is harmful to aircraft wiring. Structural repairs or mo difications often require displacement (or removal) of wiring to provide access to the work area. Even minor displacement of wiring, especially while clamped, can damage wire insulation, which can result in degraded performance, arcing, or circuit failure.

Extreme care should be exercised to protect wiring from mechanical damage by tools or other equipment used during structural repairs, STC or modifications. Drilling blindly into the aircraft structure should be avoided. Damage to wire installation could c ause wire arcing, fire and smoke. Wiring located adjacent to drilling or riveting operations should be carefully displaced or covered to reduce the possibility of mechanical damage.

Debris such as drill shavings, liberated fastener pieces, broken drill bit s, etc., should not be allowed to contaminate or penetrate wiring or electrical components. This can cause severe damage to insulation and potential arcing by providing a conductive path to ground or between two or more wires of different loads. Once conta minated, removal of this type of debris from wire bundles is extremely difficult. Therefore, precautions should be taken to prevent contamination of any kind from entering the wire bundle.

Before initiating structural repair, STC or modification activity, the work area should be carefully surveyed to identify all wiring and electrical components that may be subject to contamination. All wiring and electrical components in the debris field should be covered or removed to prevent contamination or damage. Cons ideration should be given to using drills equipped with vacuum aspiration to further minimise risk of metallic debris contaminating wire bundles. Clean electrical components and wiring after completion of work per applicable maintenance instructions.

c. It em 3: Aircraft De - Icing or Anti - Icing.

In order to prevent damage to exposed electrical components and wiring in areas such as wing leading and trailing edges, wheelwells, and landing gear, care should be exercised when spraying de/anti - icing fluids. Direc t pressure spray onto electrical components and wiring can lead to contamination or degradation and thus should be avoided.

Powered by EASA eRules Page 290 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) d. Item 4: Inclement weather.

EWIS in areas below doorways, floors, access panels, and servicing bays are prone to corrosion or cont amination due to their exposure to the elements. Snow, slush, or excessive moisture should be removed from these areas before closing doors or panels.

Remove deposits of snow/slush from any items (e.g. cargo containers) before loading in the aircraft. Duri ng inclement weather, keep doors/panels closed as much as possible to prevent ingress of snow, slush, or excessive moisture that could increase potential for EWIS degradation.

e. Item 5: Component removal/installation (relating to attached wiring).

Excessi ve handling and movement during removal and installation of components may be harmful to aircraft wiring. Use appropriate connector pliers (e.g. soft jawed) to loosen coupling rings that are too tight to be loosened by hand. Alternately, pull on the plug b ody and unscrew the coupling ring until the connector is separated. Do not use excessive force, and do not pull on attached wires. When reconnecting, special care should be taken to ensure the connector body is fully seated, the jam nut is fully secured, a nd no tension is on the wires.

When equipment is disconnected, use protective caps on all connectors (plug or receptacle) to prevent contamination or damage of the contacts. Sleeves or plastic bags may be used if protective caps are not available. Use of s leeves or plastic bags should be temporary because of the risk of condensation. It is recommended to use a humidity absorber with sleeves or plastic bags.

f. Item 6: Pressure Washing.

In order to prevent damage to exposed electrical components and wiring i n areas such as wing leading and trailing edges, wheelwells, and landing gear, care should be exercised when spraying water or cleaning fluids. Direct high - pressure spraying onto electrical components and wiring can lead to contamination or degradation and should be avoided.

When practical, wiring and connectors should be protected before pressure washing.

Water rinse should be used to remove cleaning solution residue after washing.

Breakdown of wire insulation may occur with long term exposure of wiring to cleaning solutions. Although these recommendations are good practice and technique, the aeroplane maintenance manual or STC holder’s instructions should be consulted for additional detailed instructions regarding pressure washing.

g. Item 7: Cleaning of E WIS (in situ).

Extreme care should be exercised and proper procedures used during cleaning to ensure safe and reliable performance of the function supplied by the wiring.

Care should be taken to avoid displacement or disturbance of wiring during cleaning of non - aggressive contamination. However, in the event of contamination by aggressive contaminants (e.g. livestock waste, salt water, battery electrolyte, etc.) such displacement may be necessary. In these cases wiring should be released from its installation so as to avoid undue stress being induced in wiring or connectors. Similarly, if liquid contamination enters the bundle, then ties should be removed before separating the wires. Although these recommendations for cleaning of EWIS are considere d good practice and technique, the aeroplane maintenance manual or STC holder’s instructions should be consulted for additional detailed instructions.

Clean only the area and items that have contamination. Before cleaning, make sure that the cleaning mater ials and methods will not cause more contamination. If a cloth is used, Powered by EASA eRules Page 291 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) make sure that it is clean, dry, and lint - free. A connector should be completely dry before mating. Any fluids remaining on a connector can have a deteriorating affect on the connector or the system or both.

h. Item 8: Servicing, modifying, or repairing waste/water systems.

EWIS in areas adjacent to waste/water systems are prone to contamination from those systems. Care should be exercised to prevent any fluids from reaching electrical components and wiring while servicing, modifying, or repairing waste/water systems.

Cover exposed electrical components and wiring during waste/water system modification or repair. Operator practice may call for a weak acid solution to be periodically flus hed through lavatory systems to enhance reliability and efficiency of operation. In view of the effect of acid contamination on systems and structure, the system should be confirmed to be free of leaks before using such solutions.

i. Item 9: Servicing, mod ifying, or repairing oil systems.

Electrical wiring interconnections in areas adjacent to oil systems are prone to contamination from those systems. To minimise the attraction and adhesion of foreign material, care should be exercised to avoid any fluids f rom reaching electrical components and wiring while servicing, modifying, or repairing oil systems. Oil and debris in combination with damaged wiring can present a fire hazard.

j. Item 10: Servicing, modifying, or repairing hydraulic systems.

EWIS in areas adjacent to hydraulic systems are prone to contamination from those systems. To minimise the attraction and adhesion of foreign material, care should be exercised to avoid any fluids from reaching electrical components and wiring while servicing, modifyin g, or repairing hydraulic systems.

k. Item 11: Gaining access (entering zones).

When entering or working on the aircraft, care should be exercised to prevent damage to adjacent or hidden electrical components and wiring, including wiring that may be hidden from view (e.g., covered by insulation blankets). Use protective boards or platforms for adequate support and protection. Avoid using wire bundles as handholds, steps and supports. Work lights should not be hung or supported by wiring. If wiring must be d isplaced (or removed) for work area access, it should be adequately released from its clamping (or other restraining provisions) to allow movement without damage and returned after work is completed.

l. Item 12: Application of Corrosion Preventions Compoun ds (CPC).

When applying CPC in aeroplane zones containing wire and associated components (i.e.

clamps, connectors and ties), care should be taken to prevent CPC from coming in contact with the wire and components. Dust and lint is more likely to collect on wire that has CPC on it. Application of CPC should be done in accordance with the aircraft manufacturer’s recommendations.

12 C HANGES The programme to enhance EWIS maintenance also applies to EWIS installed, modified, or affected by changes or STC. Change s that could affect EWIS include, but are not limited to, those that install new equipment in close proximity to wiring, introduce a heat source in the zone, or introduce potential sources of combustible material or harmful contamination into the zone.

Powered by EASA eRules Page 292 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) The owner/operator is responsible for determining if the EWIS has been changed (or affected by a change) and ensuring that their maintenance programme is enhanced as appropriate.

[Amdt 20/4] Powered by EASA eRules Page 293 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20)

Appendix A to AMC 20 - 21 Enhanced Zonal Analysis Logic Diagram

and St eps

ED Decision 2008/007/R Figure 1. Enhanced Zonal Analysis Procedure Identify aircraft zones, including boundaries 1.

2.

List details of Zone, e.g.

- Access - Installed equipment - L/HIRF protection features - Wire bundle installation - Possible combustible materials 3.

Yes No Zone contains wiring?

4.

7.

No Combustible No Is wiring close to both materials in primary and back - up zone?

hydraulic, mechanical, or electrical flight controls?

Yes Yes 5.

8.

Is there an effective No further action No Selection of wiring task to significantly inspection level and reduce the likelihood interval of accumulation of combustible materials?

See Figure 2.

Yes 6.

Inspection Task(s) Define task and interval 9 .

Continue the analysis Consider consolidation with existing inspection tasks in GVI GVI consolidated Systems & Powerplant and/or stand - alone GVI in zonal inspection Zonal Programmes DET Maintenance Programme Maintenance Programme Systems and Powerplant Zonal Section Section Aircraft with ZIP Recommend inclusion in ATA 20 Powered by EASA eRules Page 294 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Figure 2. Step 8 - Wiring Inspection Level and Interval Selection Using rating tables, assess zone attributes to determine appropr iate level of inspection (examples provided in Appendix B) Programmes with Zonal Inspection Programme Programmes without Zonal Inspection p rogramme List zone List zone Yes description description and and Yes boundaries for boundaries Is GVI of all GVI of all wiring Is zonal GVI for zonal GVI wiring in the in the zone alone zone at same effective for Define interval effective all wiring in specific for all wiring in the zone?

wiring in the the zone?

Define specific zone for wiring in the which stand - zone for which No alone GVI is GVI at more No justified frequent Zonal GVI must be Some wiring interval is augmented with Define justified requires GVI at stand - alone GVI specific more frequent and/or DET wiring in the interval and/or Define specific inspection zone for DET inspection wiring in the which DET is zone for which justified DET is justified Using rating tables, assess likelihood of damage to wiring in the zone to determine an appropriate interval for each inspection task identified (examples p rovided in Appendix B) Powered by EASA eRules Page 295 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Explanation for Steps in Enhanced Zonal Analyses Procedure Logic Diagram The following paragraphs provide further explanation of each step in the Enhanced Zonal Analyses Procedure logic, (Figures 1 and 2). It is recommended that, where possible, the analysts utilise the availability of actual aircraft to ensure they fully understand the zones being analysed. This will aid in determination of den sity, size, environmental issues, and accidental damage issues.

Step 1 “Identify aircraft zones, including boundaries” The system consists of Major Zones, Major Sub Zones and Zones.

The zones, wherever possible, shall be defined by actual physical boundar ies such as wing spars, major bulkheads, cabin floor, control surface boundaries, skin, etc. and include access provisions for each zone.

If the type design holder or operator has not yet established aircraft zones, it is recommended that it does so. Whene ver possible, zones should be defined using a consistent method such as ATA iSpec 2200 (formerly ATA Spec 100), varied only to accommodate particular design constructional differences.

Step 2 “List of details of zone” An evaluation will be carried out to identify system installations, significant components, L/HIRF protection features, typical power levels in any installed wiring bundles, combustible materials (present or possible accumulation), etc.

With respect to power levels the analyst should be aw are whether the bundle consists primarily of main generator feeder cables, low voltage instrumentation wiring or standard bus wiring. This information will later be used in determining the potential effects of deterioration.

The reference to combustible ma terials highlights the need to assess whether the zone might contain material/vapour that could cause a fire to be sustained in the event of an ignition source arising in adjacent wiring. Examples include the possible presence of fuel vapours, dust/lint ac cumulation and contaminated insulation blankets. See also under Step 4 for further information.

For aircraft types whose design directives may not have excluded the possibility of inadequate segregation between systems, the analyst should identify location s where both primary and back - up flight controls are routed within 2 inches/50 mm of a wiring harness. This information is required to answer the question in Step 7.

Step 3 “Zone contains wiring?” This question serves as a means to eliminate from the EZAP those zones that do not contain any wiring.

Step 4 “Combustible materials in zone?” This question requires an evaluation of whether the zone might contain combustible material that could cause a fire to be sustained in the event of an ignition source ari sing in adjacent wiring. Examples include the possible presence of fuel vapours, dust/lint accumulation, and contaminated insulation blankets.

With respect to commonly used liquids (e.g., oils, hydraulic fluids, corrosion prevention compounds) the analyst should refer to the product specification in order to assess the potential for combustibility. The product may be readily combustible only in vapour/mist Powered by EASA eRules Page 296 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) form and thus an assessment is required to determine if conditions might exist in the zone for the pro duct to be in this state.

Although liquid contamination of wiring by most synthetic oil and hydraulic fluids (e.g.

skydrol) may not be considered combustible, it is a cause for concern if it occurs in a zone where it causes significant adherence of dust an d lint.

The analyst should assess what sources of combustible products may contaminate the zone following any single failure considered likely from in - service experience.

Unshrouded pipes having connections within the zone should be considered as potential contamination sources. Inherent ventilation in the zone should be taken into account when determining the potential for subsequent combustion. This influences the response to the question of how near to the harness the source should be for there to be a c oncern.

Avionics and instruments located in the flight compartment and equipment bays tend to attract dust, etc. In view of the heat generated by these components and the relatively tightly packed installations, the analyst should consider these zones as h aving potential for combustible material. Thus, the enhanced logic should always be used for these zones.

Note: Although moisture (whether clean water or otherwise) is not combustible, its presence on wiring is a cause for concern because it may increase t he probability of arcing from small breaches in the insulation, which could cause a localised fire in the wire bundle. The risk of a sustained fire caused by moisture induced arcing is mitigated in Step 5 by identification of a task to reduce the likelihoo d of accumulation of combustible material on or adjacent to the wiring.

Step 5 “Is there an effective task to significantly reduce the likelihood of accumulation of combustible materials?” Most operator maintenance programmes have not included tasks direc ted towards removal or prevention of significant accumulations of combustible materials on or adjacent to wiring.

This question requires an evaluation of whether the accumulation on or adjacent to wiring can be significantly reduced. Task effectiveness cri teria should include consideration of the potential for damaging the wiring.

Though restoration tasks (e.g., cleaning) are the most likely applicable tasks, the possibility to identify other tasks is not eliminated. A detailed inspection of a hydraulic pip e might be assessed as appropriate if high - pressure mist from pinhole corrosion could impinge a wire bundle and the inherent zone ventilation is low.

Step 6 “Define task and interval” This step will define an applicable task and an effective interval. It should be included as a dedicated task in the Systems and Powerplant section. Within Maintenance Review Board (MRB) Reports, this may be introduced under ATA 20 with no Failure Effect Category quoted.

It is not the intent that restoration tasks should be s o aggressive as to damage the wiring, but should be applied to a level that significantly reduces the likelihood of combustion.

Powered by EASA eRules Page 297 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERA L of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Step 7 “Is wiring close to primary and back - up hydraulic, mechanical, or electrical flight controls?” Where wiring is close ( i.e. within 5 cm (2 inches)) to both primary and back - up hydraulic, mechanical, or electrical flight controls, this question is asked to ensure that Step 8 logic is applied even in the absence of combustible materials in the zone.

For zones where combustible materials are present (as determined in Step 4), proximity is addressed in the inspection level definition portion of Step 8 and this question need not be asked.

It addresses the concern that segregation between primary and back - up flight controls may not have been consistently achieved. Even in the absence of combustible material, a localised wire arcing could impact continued safe flight and landing if hydraulic pipes, mechanical cables, or wiring for fly - by - wire controls are routed in cl ose proximity (i.e.

within 5 cm (2 inches)) to a wiring harness. In consideration of the redundancy in flight control systems, the question needs to be answered ‘Yes’ only if both the primary and back - up system might be affected by wire arcing. Note that i n zones where a fire might be sustained by combustible material the enhanced logic will automatically be followed.

On all aircraft type designs, irrespective of TC date, modifications may not have taken into account the TC holder’s design and installation criteria. It is thus recommended that STC holders assess their design changes with this question included in the logic unless they can demonstrate that they followed equivalent installation criteria. Similarly, air carriers and air operators will have to a ssess modifications that have been accomplished on their aircraft.

Step 8 “Selection of Wiring Inspection Level and Interval” a. Inspection Level.

At this point in the analysis, it is already confirmed that wiring is installed in a zone where the presence of combustible materials is possible and/or the wiring is in close proximity to primary and back - up hydraulic or mechanical flight controls.

Therefore, some level of inspection of the wiring in the zone is required, and this step details how the proper le vel of inspection and interval can be selected.

One method of selecting the proper inspection level and interval is through the use of ratings tables which rate attributes of the zone and how the wiring is affected by, or can affect those attributes. The p recise format of this will be determined by the analyst, but example rating tables appear in Appendix B and may be referred to for clarity.

The inspection level characteristics tha t may be included in the rating system are: — Zone size (volume); — Density of installed equipment within the zone; — Potential effects of fire on adjacent wiring and systems.

Zone size will be assessed relative to the size of the aircraft, typically identified as small, medium or large. The smaller the zone and the less congested it is, the more likely it is that wiring degradation will be identified by GVI.

Density of installed equipment, including wiring, within the zone will be assessed relative to the size o f the zone. The density of the zone is typically identified as low, medium or high.

Powered by EASA eRules Page 298 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Potential effects of fire on adjacent wiring and systems requires the analyst to assess the potential effect of a localised fire on adjacent wiring and systems by consideri ng the potential for loss of multiple functions to the extent that continued safe operation may not be possible.

Consideration of potential effect must also include whether wiring is in close proximity (i.e. within 5 cm (2 inches)) to both primary and back - up flight controls.

A GVI alone may not be adequate if a fire caused by failure of the wiring poses a risk to aircraft controllability.

At minimum, all wiring in the zone will require a GVI at a common interval. For operators with a ZIP, this may be defin ed as a zonal GVI. For operators without ZIP, it shall be defined as a GVI of all wiring in the zone.

The question is asked, "Is a GVI (or zonal GVI) of all wiring in the zone at the same interval effective for all wiring in the zone?" This is to consider if there are specific items/areas in the zone that are more vulnerable to damage or contamination and thus may warrant a closer or more frequent inspection.

This determination could result in the selection of a more frequent GVI, a stand - alone GVI (for ope rators with a ZIP), or even a DET inspection. The intention is to select a DET of wiring only when justified by consideration of all three characteristics of the zone (size, density, and potential effect of fire). The analyst should be cautious to avoid un necessary selection of DET where GVI is adequate.

Over - use of DET dilutes the effectiveness of the inspection.

Note: The level of inspection required may be influenced by tasks identified in Steps 5 and 6. For example, if a cleaning task was selected in St ep 5 and 6 that will minimise the accumulation of combustible materials in the zone, this may justify selection of a GVI in lieu of a DET for the wiring in the zone.

b. Inspection Interval.

The selection of an effective interval can also be accomplished us ing a rating system. The characteristics for wiring to be rated should include the following: — Possibility of Accidental Damage; — Environmental factors.

The rating tables should be designed to define increasing inspection frequency with increasing risk of ac cidental damage and increasing severity of the local environment within the zone. Examples are provided in Appendix E .

The selection of inspection tasks possible in this step is sp ecific to whether the maintenance programme includes a dedicated ZIP or not.

For ZIP programmes, the possible inspection tasks are: — Zonal GVI; — Stand - alone GVI; — DET.

For non - ZIP programmes, the possible inspection tasks are: — GVI; — DET.

Powered by EASA eRules Page 299 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Note: At this point the analyst will have determined the required inspection level and interval for wiring in the zone. Task consolidation in Step 9 allows consideration as to whether an inspection selected as a result of this analysis can be considered accomplished as part of the existing maintenance programme.

Step 9 “Task Consolidation” This step in the procedure examines the potential for consolidation between the tasks derived from the EZAP and inspections that already exist in the Maintenance Programme.

Consolidation requires that the inspections in the existing maintenance programme are performed in accordance with the inspection definitions provided in this AMC.

For programmes that include a ZIP: Some GVI identified by application of the EZAP may be ade quately covered by existing zonal GVI in the zone and no change or addition to the existing zonal GVI is required. This should reduce the number of new GVI that must be introduced into a programme that already includes a ZIP.

The consolidation of GVI tasks has to take into account the access requirements and the interval of each task. The Working Group may conclude that a stand - alone GVI of the wiring may be justified if the zonal GVI of the other systems within the same zone does not need to have such a fr equent inspection.

Stand - alone GVI and DET identified by application of EZAP cannot be consolidated into the ZIP and must be introduced and retained as dedicated tasks in the scheduled maintenance programme under ATA 20. These tasks, along with tasks ident ified to reduce the accumulation of combustible materials, shall be uniquely identified to ensure they are not consolidated in the zonal programme nor deleted during future programme development. Within MSG - 3 based MRB Reports, these may be introduced unde r ATA 20 with no Failure Effect Category quoted.

For programmes without a ZIP: Although non - ZIP programmes may already include some dedicated inspections of wiring that may be reviewed for equivalency to new tasks identified by application of the EZAP, it is expected that a significant number of new wiring inspections will be identified for introduction as dedicated tasks in the System and Powerplant programme. All new tasks identified by application of EZAP shall be uniquely identified to ensure they are n ot deleted during future programme development.

The following guide can be used to determine proper consolidation between EZAP derived inspections and existing inspections that have not been specifically identified as stand - alone tasks, of the same item or area: a. Where the EZAP inspection interval and existing inspection interval are equal, but the inspection levels are different, the more intense inspection will take precedent (i.e. a 1C DET takes precedent over a 1C GVI).

b. Where the EZAP inspection in terval and existing inspection interval are different, but the inspection levels are equal, the more frequent inspection will take precedent (i.e. a 1C GVI takes precedent over a 2C GVI).

c. Where the EZAP inspection interval and level are different from t he existing inspection interval and level, these tasks may be consolidated only when the more frequent inspection is also the more intense (i.e. a 1C DET takes precedent over a Powered by EASA eRules Page 300 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) 2C GVI). When the more frequent inspection is less intense, the tasks should no t be consolidated.

For all programmes, these tasks shall be uniquely identified in the programme for future development consideration.

For EZAP - derived STC tasks, it may not be possible for the STC holder to determine whether a ZIP exists on specific aircr aft that will utilise the STC. Therefore, where a ZIP exists, consolidation of EZAP - derived STC tasks into a specific operator’s ZIP will be the responsibility of the operator and subject to approval by the competent authority.

In cases where the STC holde r determines a requirement for a GVI that should not be consolidated into a ZIP, this stand - alone GVI should be specifically identified as such in the EZAP derived ICAW for the STC.

[Amdt 20/4] Powered by EASA eRules Page 301 of 605 | Jun 2023 Easy Access Rules for Acceptable Means of Compliance for SUBPART A — GENERAL Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 21

Appendix B to AMC 20 - 21 Examples of Typical EZAP Worksheets

ED Decision 2008/007/R The following works heets are provided as an example to assist implementation of the EZAP logic explained in this AMC. These may be adjusted by t he analyst to suit specific applications.

1. Details of Zone.

2. Assessment of Zone Attributes.

3A. Inspection Level Determination based on Rating Tables (for use where a dedicated ZIP exists).

3B. Inspection Level Determination based on Rating Tables (for use where no dedicated ZIP exists).

4. Interval Determination based on Rating Tables.

5. Task Summary.

In particular, the interval ranges quoted in the rating table on Sheet 4 are solely to explain a typical arrangement of values. For a particular applicat ion, these must be compatible with the interval framework used in the existing maintenance or inspection programme. They may be ex pressed in terms of usage parameter (e.g. flight hours or calendar time) or in terms of letter check (as in the example).

Powered by EASA eRules Page 302 of 605 | Jun 2023 Easy Access Rules for Acceptable Means of Compliance for SUBPART A — GENERAL Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 21 Enhanced Zonal Analysis - Details of Zone Sheet 1 of 5 ZONE DESCRIPTION: ZONE NO: 1. Zone Details (Boundaries, Access): 2. EQUIPMENT INSTALLED COMMENTS Hydraulic Plumbing Hydraulic Components (valves, actuators, pumps) This sheet is used to comply with Steps 1 and 2 of Pneumatic Plumbing the Enhanced Zonal Analysis Procedure: Pneumatic Components (valves, actuators) 1. Describe the zone (location, access, boundaries) Electrical Wiring - Power Feeder (high voltage, high amperage) 2. List the content of the zone; installed equipment, wiring, plumbing, components, etc.

Electrical Wiring - Motor Driven Devices Electrical Wiring - Instrumentation, and Monitoring In the comments section on this sheet, it would be appropriate to note significant wire related items Electrical Wiring - Data Bus such as "Wire bundle routed within 2" of high-temp Electrical Components anti-ice ducting". The intent is to provide the analyst with a clear understanding of what's in the zone and Primary Flight Control Mechanisms how it could potentially affect wiring.

Secondary Flight Control Mechanisms Engine Control Mechanisms Fuel Components Insulation Oxygen Potable Water Waste Water Sample EZAP Worksheet Date: Page 1 of 5 Powered by EASA eRules Page 303 of 605 | Jun 2023 Easy Access Rules for Acceptable Means of Compliance for SUBPART A — GENERAL Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 21 Enhanced Zonal Analysis - Assessment of Zone Attributes Sheet 2 of 5 ZONE NO: ZONE DESCRIPTION: Steps 1 and 2 completed on Sheet 1.

Answers and Explanation to Questions (Note: Steps 1 & 2 completed on Sheet 1.)

N 3. Zone contains wiring?

Y 3.

This sheet is used to answer Questions 3 thru 7 of the Enhanced Zonal Analysis Procedure.

7. Is wiring close to If the answer to Questions 3 and 7 is 'NO', then no further both primary and back- N N action is required in this analysis which is designed to address 4. Combustible materials in up hydraulic, No further action.

4. only wiring systems.

zone? mechanical, or electrical flight controls? If the answer to Question 5 is 'YES', and a task is identified Y Y that can significantly reduce the likelihood of accumulation of combustible materials, the task and interval must be defined in Step 6. If the task identified is a cleaning task to remove 5. dust/lint accumulation from wiring, the interval for the task must be frequent enough to keep the wiring relatively clean based on the expected rate of accumulation of dust/lint on the wiring in 5. Is there an effective task 8. Wiring to significantly reduce the inspection task N the zone.

likelihood of accumulation determination.

of combustible materials? See Sheet 3.

In all cases, after Step 5 and/or Step 6, the analysis is 6. continued to Step 8.

Y Continue the analysis 6. Define task and interval.

List on Sheet 5, Task 7.

Summary.

Sample EZAP Worksheet Date: Page 2 of 5 Powered by EASA eRules Page 304 of 605 | Jun 2023 Easy Access Rules for Acceptable Means of Compliance for SUBPART A — GENERAL Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 21 Powered by EASA eRules Page 305 of 605 | Jun 2023 Easy Access Rules for Acceptable Means of Compliance for SUBPART A — GENERAL Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 21 Powered by EASA eRules Page 306 of 605 | Jun 2023 Easy Access Rules for Acceptable Means of Compliance for SUBPART A — GENERAL Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 21 Enhanced Zonal Analysis - Interval Determination Based on Hostility of Environment and Likelihood of Accidental Damage Sheet 4 of 5 ZONE NO: ZONE DESCRIPTION: Interval selection is specific to each task identified on Sheet 3A or 3B. For GVI of entire zone, consider overall zone environment and likelihood of damage. For Stand-alone GVI or DET, consider environment and likelihood of damage only in respect to the specific item/area defined for inspection.

Item/Area Defined for Inspection: Inspection Level: Hostility of Environment Likelihood of Accidental Damage 1 - Passive, 2 - Moderate, 3 - Severe 1 - Low, 2 - Medium, 3 - High Ground Handling Equipment Temperature Vibration F. O. D.

Weather Effects (hail, etc.) Chemicals (toilet fluids, etc.)

Humidity Frequency of Maintenance Activities Contamination Fluid Spillage Other - Passenger Traffic Highest Result Other - Highest Result Interval Determination Likelihood of Accidental Damage 1 2 3 1 4C-6C 2C-4C 1C-2C Hostility of 2 2C-6C 1C-4C A-1C Environment 3 1C-6C 1C-4C A-1C RESULT Upon completion, enter all task and interval selections onto Sheet 5, Task Summary.

Sample EZAP Worksheet Date: Sheet 4 of 5 Powered by EASA eRules Page 307 of 605 | Jun 2023 Easy Access Rules for Acceptable Means of Compliance for SUBPART A — GENERAL Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 21 Enhanced Zonal Analysis - Task Summary Sheet 5 of 5 ZONE NO: ZONE DESCRIPTION: Zone Description: TASK SUMMARY Task Number Access Interval Task Description This Sheet is used to list all tasks and intervals selected as a result of EZAP analysis.

Sample EZAP Worksheet Date: Sheet 5 of 5 [Amdt AMC/4] Powered by EASA eRules Page 308 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20)

Appendix C to AMC 20 - 21 Determination if a major change to an

aircraft should be specifically subjected to an EZAP

ED Decision 2008/007/R The EZAP provides a means for TC and STC holders to develop improvements to EWIS maintenance programs. These improvements will be in the form of new inspections and other tasks designed to prevent significant accumulation of combustible material s on or adjacent to EWIS components that would be added to the Instructions for Continued Airworthiness or Service Bulletins (SB) for the aircraft and STC.

While TC holders are required to conduct the EZAP for all zones in an aircraft, it may be determined that EZAP for an SB or STC is not necessary where the modification does not appreciably affect the zones where it is installed. The “Determination if SB modification or STC requires EZAP” procedure was developed to identify modifications that sufficiently affect zone attributes to warrant re - application of EZAP to the entire zone.

This logic assumes that the aircraft TC holder has accomplished the EZAP on each zone of the aircraft without consideration of the SB modification or STC installation. The object ive of this analysis is to assess whether the modification itself has affected wiring or certain zone attributes that could change the outcome of the EZAP performed by the aircraft TC holder.

The determination if the SB or STC requires EZAP, and re - applica tion of the EZAP to SB or STC affected zones, is the responsibility of the respective holder of the SB or STC. It is expected that the TC and STC holders will collaborate with each other and operators as necessary to obtain information required to conduct the analysis. The TC or STC holder should communicate the results of the procedure, including the cases when no new tasks are identified. The method of communication may be via SB, Service Letter, ICAW Revision, or other means acceptable to EASA.

In situat ions where a previously installed STC is no longer supported by a viable STC holder (e.g. STC holder defunct), the responsibility for determining if the STC requires EZAP, and re - application of EZAP to any affected zones, is assigned to the individual oper ators who utilise the STC on their aircraft. In cases where the operator does not have experience in application of analytical logic processes, it will be necessary for the operator to gain competence in, or seek external assistance in conducting the analy sis.

A record of the outcome of operator accomplished analysis for STC (even if no tasks are identified) should be permanently retained by the operator. A copy of the record should be included in the aircraft records normally transferred upon change of air craft operator.

The attached logic chart provides a means to assess whether an SB modification or STC has sufficiently affected wiring or certain other zone attributes as to require reapplication of the EZAP to the entire zone with consideration of the mod ification present. The section following the chart provides detailed explanations of each step in the “Determination if SB modification or STC requires EZAP” with appropriate examples.

It is recommended that, where possible, the analyst should utilise the availability of actual aircraft to ensure they fully understand the zones being analysed. Specifically, it must be determined how installation of the modification could affect zone attributes such as density, environment, proximity of wiring to primary and back - up flight controls, presence of combustible materials, and potential for accidental damage to wiring.

Powered by EASA eRules Page 309 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Appendix C. Figure 1. Determination if SB modification or STC requires EZAP Does the STC: - affect or modify wiring or its environment - install or result in wiring being located within 5 cm (2 inches) of both primary & backup hydraulic, mechanical, or electrical flight controls - change the density of the zone, or NO - change the potential effects of fire in the zone?

No further action required YES Perform EZAP analysis Determine if there is an existing YES No further action required because the existing MRBR EZAP task(s) that is EZAPderived maintenance task is adequate applicable and effective?

NO Develop appropriate task and incorporate it into existing maintenance program Explanation of Steps Step 1 : Does the SB or STC affect or modify wiring or it’s environment?

The question asks whether the STC affects or modifies wiring. Modifications to wiring or other EWIS components include, but are not limited to removal, addition, relocation, etc.

Does the SB or STC ins tall or result in wiring being located within 5 cm (2 inches) of primary and back - up hydraulic, mechanical or electric flight controls, change the density of the zone or change the potential effects of fire in the zone?

Does the SB or STC affect zone densi ty? If the STC includes the addition or deletion of numerous components in a small area, the density of the zone could be changed even if wire bundles are untouched. A significant change in the zone density should warrant re - analysis of the zone.

Potential effects of fire on adjacent wiring and systems require the analyst to assess the potential effect of a localised fire on adjacent wiring and systems by considering the potential for loss of multiple functions to the extent that a hazard could be introduce d.

Powered by EASA eRules Page 310 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) Consideration of potential effect must also include whether wiring is in close proximity (i.e. within 5 cm (2 inches)) to both primary and back - up flight controls.

Additionally, this question requires an evaluation of whether the zone might contain comb ustible material that could cause a fire to be sustained in the event of an ignition source arising in adjacent wiring. Examples include the possible presence of fuel vapours, dust/lint accumulation, and contaminated insulation blankets.

With respect to co mmonly used liquids (e.g. oils, hydraulic fluids, and corrosion prevention compounds), the analyst should refer to the product specification in order to assess the potential for combustibility. The product may be readily combustible only in vapour/mist for m and thus an assessment is required to determine if conditions might exist in the zone for the product to be in this state.

Although liquid contamination of wiring by most synthetic oil and hydraulic fluids (e.g.

skydrol) may not be considered combustible , it is a cause for concern if it occurs in a zone where contamination causes significant adherence of dust and lint.

If the answer to this question is ‘No’, then no further action is required (Step 2), since the density of the zone or the potential effect s of fire in the zone has not changed.

Step 2 : No further action is required.

Step 3 : Perform an EZAP analysis.

If the answer to question 1 is ‘Yes’, then the only way to determine if existing EWIS maintenance tasks are sufficient is to perform the EZAP f or the SB or STC and compare the results with the existing EWIS maintenance tasks (see Step 4).

Step 4 : Is there an existing MRBR EZAP task(s) that is applicable and effective?

Once the SB or STC EZAP has been accomplished, a comparison of the derived mai ntenance tasks can be made with the existing EWIS maintenance tasks. If the existing tasks are adequate, then no further action regarding EWIS maintenance actions for the STC is necessary.

Step 5 : No further action is required since the existing EZAP - deriv ed maintenance task is adequate.

Step 6 : Develop an appropriate task and incorporate it into the existing maintenance programme.

These tasks should be incorporated into the operator’s existing maintenance programme.

[Amdt 20/4]

Appendix D to AMC 20 - 21

ED D ecision 2008/007/R (RESERVED) Powered by EASA eRules Page 311 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SU BPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20)

Appendix E to AMC 20 - 21 Causes of Wire Degradation

ED Decision 2008/007/R The following items are considered principal causes of wiring degradation and should be used to help focus maintenance programmes: Vibration - High vibration areas tend to accelerate degradation over time, resulting in “chattering” contacts and intermittent symptoms. High vibration of tie - wraps or string - ties can cause damage to insulation. In addition, high vibration will exacerbate any exist ing problem with wire insulation cracking.

Moisture - High moisture areas generally accelerate corrosion of terminals, pins, sockets, and conductors. It should be noted that wiring installed in clean, dry areas with moderate temperatures appears to hold up well.

Maintenance - Scheduled and unscheduled maintenance activities, if done improperly, may contribute to long - term problems and wiring degradation. Certain repairs may have limited durability and should be evaluated to ascertain if rework is necessary. Repairs that conform to manufacturers recommended maintenance practices are generally considered permanent and should not require rework. Furthermore, care should be taken to prevent undue collateral damage to EWIS while performing maintenance on other sy stems.

Metal shavings and debris have been discovered on wire bundles after maintenance, repairs, modifications, or STC have been performed. Care should be taken to protect wire bundles and connectors during modification work. The work areas should be clea ned while the work progresses to ensure that all shavings and debris are removed; the work area should be thoroughly cleaned after the work is complete; and the work area should be inspected after the final cleaning.

Repairs should be performed using the m ost effective methods available. Since wire splices are more susceptible to degradation, arcing, and overheating, the recommended method of repairing a wire is with an environmental splice.

Indirect Damage - Events such as pneumatic duct ruptures or duct c lamp leakage can cause damage that, while not initially evident, can cause wiring problems at a later stage. When events such as these occur, surrounding EWIS should be carefully inspected to ensure that there is no damage or no potential for damage is evi dent. The indirect damage caused by these types of events may be broken clamps or ties, broken wire insulation, or even broken conductor strands. In some cases the pressure of the duct rupture may cause wire separation from the connector or terminal strip.

Contamination - Wire contamination refers to either of the following situations: a. The presence of a foreign material that is likely to cause degradation of wiring.

b. The presence of a foreign material that is capable of sustaining combustion after remo val of ignition source.

The contaminant may be in solid or liquid form. Solid contaminants such as metal shavings, swarf, debris, livestock waste, lint and dust can accumulate on wiring and may degrade or penetrate wiring or electrical components.

Chemical s in fluids such as hydraulic fluid, battery electrolytes, fuel, corrosion inhibiting compounds, waste system chemicals, cleaning agents, de - icing fluids, paint, soft drinks and coffee can contribute to degradation of wiring.

Hydraulic fluids, de - icing flu ids and battery electrolyte require special consideration. These fluids, although essential for aircraft operation, can damage connector grommets, wire bundle clamps, wire ties and wire lacing, causing chafing and arcing. Wiring exposed to these fluids sho uld be given special Powered by EASA eRules Page 312 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 21 Products, Parts and Appliances (AMC - 20) attention during inspection. Contaminated wire insulation that has visible cracking or breaches to the core conductor can eventually arc and cause a fire. Wiring exposed to, or in close proximity to, any of these chemicals may need to be inspected more frequently for damage or degradation.

When cleaning areas or zones of the aircraft that contain both wiring and chemical contaminants, special cleaning procedures and precautions may be needed. Such procedures may include wrapping wire an d connectors with a protective covering prior to cleaning. This would be especially true if pressure - washing equipment is utilised. In all cases the aircraft manufacturer recommended procedures should be followed.

Waste system spills also require special a ttention. Service history has shown that these spills can have detrimental effects on aircraft EWIS and have resulted in smoke and fire events. When this type of contamination is found all affected components in the EWIS should be thoroughly cleaned, inspe cted and repaired or replaced if necessary. The source of the spill or leakage should be located and corrected.

Heat - Exposure to high heat can accelerate degradation of wiring by causing insulation dryness and cracking. Direct contact with a high heat so urce can quickly damage insulation. Burned, charred or even melted insulation are the most likely indicators of this type of damage. Low levels of heat can also degrade wiring over a longer period of time. This type of degradation is sometimes seen on engi nes, in galley wiring such as coffee makers and ovens, and behind fluorescent lights, especially the ballasts.

[Amdt 20/4] Powered by EASA eRules Page 313 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20)

AMC 20 - 22

AMC 20 - 22 Aeroplane Electrical Wiring Interconnection System

Training Programme

ED Decision 2008/007/R 1 P URPOSE This AMC provides acceptable means of compliance for developing an enhanced Electrical Wiring Interconnection System (EWIS) training programme. The information in this AMC is derived from the best practices training developed through extensive research. Th is AMC is an effort by the Agency to officially endorse these best practices and to dispense this information industry - wide so that the benefits of this information can be effectively realised. Following this AMC will result in a training programme that wi ll improve the awareness and skill level of the aviation personnel in EWIS production, modification, maintenance, inspection, alterations and repair. This AMC promotes a philosophy of training for all personnel who come into contact with aeroplane EWIS as part of their job and tailors the training for each workgroup to their particular needs.

2 O BJECTIVE This AMC has been published in order to provide the approved organisations with acceptable means of compliance to comply with their training obligations as required in paragraphs 21.A.145 and 21.A.245 of Part - 21, 145.A.30 and 145.A.35 of Part - 145 and M.A.706 of Part - M with respect to EWIS.

To fully realise the objectives of this AMC, operators, holders of type certificates (TC), holders of supplemental type certificates (STC), maintenance organisations and persons performing modifications or repairs, will need to rethink their current approach to maintaining and modifying aeroplane wiring and systems. This may require more than simply updating maintenance man uals and work cards and enhancing training. Maintenance personnel need to be aware that aeroplane EWIS should be maintained with the same level of intensity as any other system in the aeroplane. They also need to recognise that visual inspection of wiring has inherent limitations. Small defects such as breached or cracked insulation, especially in small gage wire may not always be apparent. Therefore, effective wiring maintenance combines visual inspection techniques with improved wiring maintenance practic es and training.

The objective of this EWIS training programme is to give operators, holders of TC, holders of STC, maintenance organisations and persons performing field approval modifications or repairs a model for the development of their own EWIS train ing programme. This will ensure that proper procedures, methods techniques, and practices are used when performing maintenance, preventive maintenance, inspection, alteration, and cleaning of EWIS.

The training syllabus and curriculum for those personnel d irectly involved in the maintenance and inspection of EWIS, identified as Target Group 1 and 2, are in Appendix A and C to this AMC.

This AMC also provides guidance on the development of EWIS training programmes for personnel who are not directly involved in the maintenance and inspection of EWIS. Although there is no direct regulatory requirement for EWIS training of these personnel, operators may choose to provide EWIS training. The training syllabus and curriculum for these personnel, identified as Target Groups 3 through 8, are in Appendix B and C to this AMC.

It is believed that training personnel in these groups would greatly enhance awareness of the importance of EWIS safety in the overall safe operation of aeroplanes. Although these groups Powered by EASA eRules Page 314 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) are not directly involved in the maintenance of EWIS, they have the potential to have an adverse impact on EWIS. Thi s can occur through inadvertent contact with EWIS during aeroplane cleaning or when individuals perform unrelated maintenance that could impact the integrity of EWIS. Mechanics leaving drill shavings on wire bundles is one example of how this could occur.

Some people prepare paperwork that guides mechanics, training this target group in EWIS should help to ensure that proper attention is paid to EWIS issues.

This programme was developed for eight different target groups and may be used for the minimum requi rements for initial and recurrent training (see training matrix). Depending on the duties, some may fall into more than one target group and, therefore, must fulfil all objectives of the associated target groups. The target groups are: a. Qualified staff p erforming EWIS maintenance.

These staff members are personnel who perform wiring systems maintenance and their training is based on their job description and the work being done by them (e.g. avionics skilled workers or technicians cat B2).

b. Qualified st aff performing maintenance inspections on wiring systems.

These staff members are personnel who perform EWIS inspections (but not maintenance), and their training is based on their job description and the work being done by them (e.g. inspectors/technician s cat B2).

c. Qualified staff performing electrical/avionic engineering on in - service aeroplane.

These staff members are personnel who are authorised to design EWIS installations, modifications and repairs (e.g. electric/avionic engineers).

d. Qualified st aff performing general maintenance/inspections not involving wire maintenance (LRU change is not considered wire maintenance).

These staff members are personnel who perform maintenance on aeroplane that may require removal/reconnection of electrical connec tive devices (e.g.

inspectors/technicians cat A or B1).

e. Qualified staff performing other engineering or planning work on in - service aeroplane.

These staff members are personnel who are authorised to design mechanical/structure systems installations, mod ifications and repairs, or personnel who are authorised to plan maintenance tasks.

f. Other service staff with duties in proximity to EEWIS.

These staff members are personnel whose duties would bring them into contact/view of aeroplane wiring systems. This would include, but not be limited to: Aeroplane cleaners, cargo loaders, fuelers, lavatory servicing personnel, de - icing personnel, push back personnel.

g. Flight Deck Crew.

(E.g. Pilots, Flight Engineers) h. Cabin Crew.

Powered by EASA eRules Page 315 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) 3 APPLICABILITY This AMC describes acceptable means, but not the only means, of compliance with the appropriate certification, maintenance and operating regulations.

The information in this AMC is based on lessons learned by Aging Transport Systems Rulemaking Advisory Committee (A TSRAC) Harmonised Working Groups, regulatory authorities, manufacturers, airlines and repair stations. This AMC can be applied to any aeroplane training programme.

4 RELATED DOCUMENTS — Regulation (EC) No 216/2008 — Regulation (EC) No 1702/2003 — Regulation (EC) No 2042/2003 — EASA Certification Specification CS - 25 Large Aeroplanes — EU - OPS Commercial Air Transportation (Aeroplanes) 5 RELATED READING MATERIAL a. EASA AMC - 20 — AMC 20 - 21 Programme to Enhance Aeroplane Electrical Wiring Interconnection System Maintenance — AMC 20 - 23 Development of Electrical Standard Wiring Practices Documentation b. FAA 14 CFR Parts — Part 21, Certification Procedures for Products and Parts — Part 25, Airworthiness Standards, Transport Category Aeroplanes — Part 43, Maintenance, Preventive Maintenance, Rebuilding, and Alteration — Part 91, General Operating and Flight Rules — Part 119, Certification: Air Carriers and Commercial Operators — Part 121, Operating Requirements: Domestic, Flag, and Supplemental Operations Regulation (EC) No 216/2008 of the European Parliament and of the Council of 20 February 2008 on common rules in the field of civil aviation and establishing a European Aviation Saf ety Agency, and repealing Council Directive 91/670/EEC, Regulation (EC) No 1592/2002 and Directive 2004/36/EC (OJ L 79, 19.3.2008, p. 1).

Commission Regulation (EC) No 1702/2003 of 24 September 2003 laying down implementing rules for the airworthiness an d environmental certification of aircraft and related products, parts and appliances, as well as for the certification of desig n and production organisations ( OJ L 243, 27.9.2003, p. 6 ). Regulation as last amended by Regulation (EC) No 2 87/2008 (OJ L 87, 29.3.2008, p. 3).

Commission Regulation (EC) No 2042/2003 of 20 November 2003 on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks ( OJ L 315, 28.11.2003, p. 1). Regulation as last amended by Regulation (EC) No 376/2007 of (OJ L 94, 4.4.2007, p. 18).

Executive Director Decision No 2003/2/RM of 14 October 2003 on certification specifications, including airworthiness codes and acceptable m eans of compliance, for large aeroplanes («CS - 25»). Decision as last amended by Executive Director Decision No 2008/006/R of 29 August 2008 (CS - 25 Amendment 5).

Council Regulation (EEC) No 3922/91 of 16 December 1991 on the harmonisation of technical req uirements and administrative procedures in the field of civil aviation (OJ L 373, 31.12.1991, p. 4). Regulation as last amended by Regulation (EC) No 8/2008 of 11 December 2007 ( OJ L 10, 12.1.2008, p. 1).

Powered by EASA eRules Page 316 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) — Part 125, Certification and Operations: Aeroplanes Having a Seating Capacity of 20 or More Passengers or a Maximum Payl oad Capacity of 6,000 pounds or More — Part 129, Operations: Foreign Air Carriers and Foreign Operators of U.S. - Registered Aircraft Engaged in Common Carriage — Part 135, Operating Requirements: Commuter and On - demand Operations — Part 145, Repair Stations c. FAA Advisory Circulars (AC) — AC 20 - 13, Protection of Aircraft Electrical/Electronic Systems against the Indirect Effects of Lightning — AC 20 - 53A, Protection of Aeroplane Fuel Systems against Fuel Vapour Ignition due to Lightning AC 25 - 16, Electri cal Fault and Fire Protection and Prevention — AC 25.981 - 1B, Fuel Tank Ignition Source Prevention Guidelines — AC 25.17YY Development of Standard Wiring Practices Documentation — AC 43 - 3, Non - destructive Testing in Aircraft — AC 43 - 4A, Corrosion Control for Aircraft — AC 43 - 7, Ultrasonic Testing for Aircraft — AC 43 - 12A, Preventive Maintenance — AC 43.13 - 1A, Acceptable Methods, Techniques and Practices - Aircraft Inspection and Repair — AC 43.13 - 1B, Acceptable Methods, Techniques and Practices for Repairs and Alterat ions to Aircraft — AC 43 - 204, Visual Inspection for Aircraft — AC 43 - 206, Avionics Cleaning and Corrosion Prevention/Control — AC 65 - 15A, Airframe and Powerplant Mechanics Airframe Handbook, Chapter 11.

Aircraft Electrical Systems — AC 120 - XX, Programme to enhance aircraft Electrical Wiring Interconnection System maintenance — AC 120 - YY Aircraft Electrical Wiring Interconnection System training programme d. Reports — Transport Aircraft Intrusive Inspection Project, (An Analysis of the Wire Installations of Six Decommis sioned Aircraft), Final Report, The Intrusive Inspection Working Group, December 29, 2000. http://www.mitrecaasd.org/atsrac/intrusive_inspection.html — FAA Aging Transport Non - Structural Systems Plan, July 1998.

— National Transportation Safety Board, Safety Recommendation, September 19, 2000, A - 00 - 105 through - 108. http://www.ntsb.gov/re cs/letters/2000/A00_105_108.pdf — Wire System Safety Interagency Working Group, National Science and Technology Council, Review of Federal Programmes for Wire System Safety 46 (2000).

Powered by EASA eRules Page 317 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) — Aging Transport Systems Rulemaking Adv isory Committee, Task 1 and 2, Aging Systems, Final Report.

http://www.mitrecaasd.org/atsrac/final_reports/Task_1&2_Final%20_August_2000.pdf — Aging Transport Systems Rulemaking Advisory Committee, Task 3, Final Report.

http://www.mitrecaasd.org/atsrac/final_reports/Task_3_Final.pdf — Aging Transport Systems Rulemaking Advisory Committee, Task 4, Final Report, Standard Wiring Practices.

http://www.mitrecaasd.org/atsrac/final_reports/Task_4_Final_Report_Sept_2000.pdf — Aging Transport Systems Rulemaking Advisory Committee, Task 5, Final Report, Aircraft Wiring Sys tems Training Curriculum and Lesson Plans.

http://www.mitrecaasd.org/atsrac/final_reports/Task_5_Final_March_2001%20.pdf — ATA Specification 117 (Wiring Maintenance Practices/Guidelines).

— Aging Transport Systems Rulemaking Advisory Committee, Task 6, Task 7 and Task 9 Working Group Final Reports http://www.mitrecaas d.org/atsrac/final_reports.html e. Other Documents ATA Operator/Manufacturer Scheduled Maintenance Development as revised, ATA Maintenance Steering Group (MSG - 3), may be obtained from the Air Transport Association of Ame rica; Suite 1100: 1301 Pennsylvania Ave, NW, Washington, DC 20004 - 1707.

FAA Handbook Bulletin 91 - 15 "Origin and propagation of inaccessible aircraft fire under in - flight airflow conditions".

6 DEFINITIONS Arc tracking : A phenomenon in which a conductive carbon path is formed across an insulating surface. This carbon path provides a short circuit path through which current can flow.

Normally, a result of electrical arcing. Also referred to as "Carbon Arc Tracking", "Wet Arc Tracking", or "Dry Ar c Tracking".

Combustible : For the purposes of this AMC, the term combustible refers to the ability of any solid, liquid or gaseous material to cause a fire to be sustained after removal of the ignition source. The term is used in place of inflammable/flamm able. It should not be interpreted as identifying material that will burn when subjected to a continuous source of heat as occurs when a fire develops.

Contamination : For the purposes of this AMC, wiring contamination refers to either of the following: — The presence of a foreign material that is likely to cause degradation of wiring.

— The presence of a foreign material that is capable of sustaining combustion after removal of ignition source.

Detailed Inspection (DET) : An intensive examination of a specific i tem, installation, or assembly to detect damage, failure or irregularity. Available lighting is normally supplemented with a direct source of good lighting at an intensity deemed appropriate. Inspection aids such as mirrors, magnifying lenses or other mean s may be necessary. Surface cleaning and elaborate access procedures may be required.

Electrical Wiring Interconnection System (EWIS) : See CS 25.1701.

Functional Failure : Failure of an item to perform its intended function within specified limits.

Powered by EASA eRules Page 318 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) General Visual Inspection (GVI) : A visual examination of an interior or exterior area, installation, or assembly to detect obvious damage, failure or irregularity. This level of inspection is made from within touching distance unless otherwise specified. A mirror may be necessary to enhance visual access to all exposed surfaces in the inspection area. This level of inspection is made under normally available lighting conditions such as daylight, hangar lighting, flashlight or droplight and may require removal or op ening of access panels or doors. Stands, ladders or platforms may be required to gain proximity to the area being checked.

Lightning/High Intensity Radiated Field (L/HIRF) protection : The protection of aeroplane electrical systems and structure from induce d voltages or currents by means of shielded wires, raceways, bonding jumpers, connectors, composite fairings with conductive mesh, static dischargers, and the inherent conductivity of the structure; may include aeroplane specific devices, e.g., RF Gaskets.

Maintenance : As defined in Regulation (EC) 2042/2003 Article 2(h) “maintenance means inspection, overhaul, repair, preservation, and the replacement of parts, but excludes preventive maintenance.” For the purposes of this advisory material, it also includ es preventive maintenance.

Maintenance Significant Item (MSI) : Items identified by the manufacturer whose failure: — could affect safety (on ground or in flight).

— is undetectable during operations.

— could have significant operational impact.

— could have signif icant economic impact.

Needling : The puncturing of a wire’s insulation to make contact with the core to test the continuity and presence of voltage in the wire segment.

Stand - alone General Visual Inspection (GVI) : A GVI which is not performed as part of a zonal inspection. Even in cases where the interval coincides with the zonal inspection, the stand - alone GVI shall remain an independent step within the work card.

Structural Significant Item (SSI) : Any detail, element or assembly that contributes significa ntly to carrying flight, ground, pressure, or control loads and whose failure could affect the structural integrity necessary for the safety of the aeroplane.

Swarf : A term used to describe the metal particles, generated from drilling and machining operati ons. Such particles may accumulate on and between wires within a wire bundle.

Zonal Inspection : A collective term comprising selected GVI and visual checks that are applied to each zone, defined by access and area, to check system and powerplant installations and structure for security and general condition.

7 BACKGROUND Over the years there have been a number of in - flight smoke and fire events where contamination sustained and caused the fire to spread. Regulators and Accident Investigators have conducted aircraft inspections and found wiring contaminated with items such as dust, dirt, metal shavings, lavatory waste water, coffee, soft drinks, and napkins. In some cases, dust has been found completely covering wire bundles and the surrounding area .

Research has also demonstrated that wiring can be harmed by collateral damage when maintenance is being performed on other aircraft systems. For example, a person performing Powered by EASA eRules Page 319 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) an inspection of an electrical power centre or avionics compartment may inadvert ently cause damage to wiring in an adjacent area.

Aviation Accident Investigators have specifically cited the need for improved training of personnel to ensure adequate recognition and repair of potentially unsafe wiring conditions.

This AMC addresses only the training programme. It does not attempt to deal with the condition of the fleet's wiring, or develop performance tests for wiring.

This AMC captures, in EASA guidance form, the aeroplane EWIS training programme developed by ATSRAC. This includes a tra ining syllabus, curriculum, training target groups and a matrix outlining training for each training group.

8 ESSENTIAL ELEMENTS FOR A TRAINING PROGRAMME a. Initial Training.

Initial training should be conducted for each designated work group. The initial training for each designated work group is outlined in EWIS Minimum Initial Training Programme - Appendix A and B . Curriculum and Lesson Plans for each dedicated module are included in Appendix C .

The m ost important criteria are to meet the objectives of the Lesson Plans – Appendix C (using classroom discussion, computer - based training or hands - on practical training).

Assessment or achieving the objectives should be at the discretion of the training organisation (such as written test, oral test or demonstration of skills).

Supporting documentation such as AMC is an integral part of training and should be used to support developme nt of the Curriculum and Lesson Plans.

b. Refresher Training.

Refresher training should be conducted in a period not exceeding two years. It could consist of a review of previously covered material plus any new material or revisions to publications. Refres her training will follow the EWIS Minimum Initial Training Programme - Appendix A or B for that particu lar target group.

[Amdt 20/4]

Appendix A to AMC 20 - 22 – EWIS Minimum Initial Training

Programme for Group 1 a nd 2

ED Decision 2008/007/R Target Group 1: Qualified staff performing EWIS maintenance.

Target Group 2: Qualified staff performing maintenance inspections on EWIS.

TARGET GROUP 1 2 A – GENERAL ELECTRICAL WIRING INTERCONNECTION SYSTEM PRACTICES Know or demonstrate safe handling of aeroplane electrical systems, line replaceable units (LRU), tooling, troubleshooting procedures, and electrical measurement.

1. Safety practices X X 2. Electrostatic discharge sensitive (ESDS) device handling and protection X X 3. Tools, special tools, and equipment X 4. Verifying calibration/certification of instruments, tools, and equipment X 5. Required wiring checks using the troubleshooting procedures and charts X Powered by EASA eRules Page 320 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) 6. Measurement and troubleshooting using meters X 7. LRU replacement general practices X X B – WIRING PRACTICES DOCUMENTATION Know or demonstrate the construction and navigation of the applicable aeroplane wiring system overhaul or practices manual.

8. Standard wiring practices manual structure/overview X X 9. Chapter cross - reference index X X 10. Important data and tables X X 11. Wiring diagram manuals X X 12. Other documentation as applicable X X C – INSPECTION Know the different types of inspections, human factors in inspections, zonal areas and typical damages.

13. General visual inspection (GVI), detailed inspection (DET), special detailed inspection X X (SDI), and zonal inspection, and their criteria and standards 14. Human factors in inspection X 15. Zonal areas of inspection X 16. Wiring system damage X X D – HOUSEKEEPING Know the contamination sources, materials, cleaning and protection procedures.

17. Aeroplane external contamination sources X X 18. Aeroplane internal contamination sources X X 19. Other contamination sources X X 20. Contamination protection planning X 21. Protection during aeroplane maintenance and repair X 22. Cleaning processes X E – WIRE Know or demonstrate the correct identification of different wire types, their inspection criteria and damage tolerance, repair and preventative maintenance procedures.

23. Wire identification, type and construction X X 24. Insulation qualities and damage limits X X 25. Inspection criteria and standards for wire and wire bundles X 26. Wire bundle installation practices X X 27. Typical damage and areas found (aeroplane specific) X X 28. Maintenance and repair procedures X X 29. Sleeving X X 30. Unused wires - termination and storage X X 31. Electrical bonding and grounds X X F – CONNECTIVE DEVICES Know or demonstrate the procedures to identify, inspect, and find the correct repair for typical types of connective devices found on the applicable aeroplane.

32. General connector types and identification X X 33. Cautions and protections X X 34. Visual inspection procedures X X 35. Typical damage found X X 36. Repair procedures X X Powered by EASA eRules Page 321 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) G – CONNECTIVE DEVICE REPAIR Demonstrate the procedures for replacement of all parts of typical types of connectors found on the applicable aeroplane.

37. Circular connectors X 38. Rectangular connectors X 39. Terminal blocks - modular X 40. Terminal blocks - non - modular X 41. Grounding modules X 42. Pressure seals X [Amdt 20/4 ]

A ppendix B to AMC 20 - 22 – EWIS M inimum Initial T raining

P rogramme for G roup 3 through 8

ED Decision 2008/007/R Target Group 3: Qualified staff performing electrical/avionic engineering on in - service aeroplane.

Target Group 4: Qualified staff performing general maintenance/inspections not involving wire maintenance (LRU change is not considered wire maintenance) Target Group 5: Qualified staff performing other engineering or planning work on in - service aeroplane Target Group 6: Other service staff with duties in proximity to electrical wiring interconnection systems Target Group 7: Flight Deck Crew Target Group 8: Cabin Crew TARGET GROUPS 3 4 5 6 7 8 A – GENERAL ELECTRICAL WIRING INTERCONNECTION SYSTEM PRACTICES Know or demonstrate th e safe handling of aeroplane electrical systems, line replaceable units (LRU), tooling, troubleshooting procedures, and electrical measurement.

1. Safety practices X X X X 2. Electrostatic discharge sensitive (ESDS) device X handling and protection 7. LRU replacement general practices X B – WIRING PRACTICES DOCUMENTATION Know or demonstrate the construction and navigation of the applicable aeroplane wiring system overhaul or practices manual.

8. Standard wiring practices manual structure/overview X 9. Chapter cross - reference index X 10. Important data and tables X 11. Wiring diagram manuals X 12. Other documentation as applicable X Powered by EASA eRules Page 322 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) C – INSPECTION Know the different types of inspections, human factors in inspections, zonal areas and typical damages.

13. General visual inspection (GVI), detailed inspection X X (DET), special detailed inspection (SDI), and zonal inspection, and their criteria and standards 14. Human factors in inspection X 15. Zonal areas of inspection X 16. Wiring system damage X X Low Low Low level level level D – HOUSEKEEPING Know the contamination sources, materials, cleaning and protection procedures.

17. Aeroplane external contamination sources X X X X 18. Aeroplane internal contamination sources X X X X 19. Other contamination sources X X X X 20. Contamination protection planning X X X 21. Protection during aeroplane maintenance and repair X X X 22. Cleaning processes X X X X E – WIRE Know or demonstrate the correct identification of different wire types, their inspection criteria and damage tolerance, repair and preventative maintenance procedures.

23. Wire identification, type and construction X 24. Insulation qualities and damage limits X 25. Inspection criteria and standards of wire and wire X bundles 26. Wire bundle installation practices X 27. Typical damage and areas found (aeroplane specific) X X X Low Low Low level level level 28. Maintenance and repair procedures X 29. Sleeving X 30. Unused wires - termination and storage X 31. Electrical bonding and grounds X X X Bond F – CONNECTIVE DEVICES Know or demonstrate the procedures to identify, inspect, and find the correct repair for typical types of connective devices found on the applicable aeroplane.

32. General connector types and identification X 33. Cautions and protections X 34. Visual inspection procedures X 35. Typical damage found X 36. Repair procedures X [Amdt 20/4] Powered by EASA eRules Page 323 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20)

Appendix C to AMC 20 - 22 – Curriculum and Lessons Plan

ED Decision 2008/007/R Electrical Wiring Interconnection System Curriculum 1 O VERVIEW This training is targeted at each person who performs aeroplane maintenance, inspections, alterations or repairs on EWIS and/or structure. After training, the person is able to properly evaluate the EWIS and effectively use the manufacturers Chapter 20 Wiring System overhaul manual for that aeroplane. The training programme must include: wiring system condition, applicable repair schemes, wiring modifications and ancillary repairs to wiring systems and compone nts. All of the training components are integrated to maintain wiring system quality and airworthiness of the aeroplane.

2 O BJECTIVES Depending on the modules taught, the person shows competency in the following skills: a. Know or demonstrate the safe hand ling of aeroplane electrical systems, Line Replaceable Units (LRU), tooling, troubleshooting procedures, and electrical measurement.

b. Know or demonstrate the construction and navigation of the applicable aeroplane wiring system overhaul or wiring practic es manual.

c. Know the different types of inspections, human factors in inspections, zonal areas and typical damages.

d. Know the contamination sources, materials, cleaning and protection procedures.

e. Know or demonstrate the correct identification of dif ferent wire types, their inspection criteria, and damage tolerance, repair and preventative maintenance procedures.

f. Know or demonstrate the procedures to identify, inspect and find the correct repair for typical types of connective devices found on the applicable aeroplane.

g. Demonstrate the procedures for replacement of all parts of typical types of connective devices found on the applicable aeroplane.

3 S COPE The course is to be used by training providers for all maintenance persons at any stage i n their careers. The person can be trained to the appropriate level using the applicable modules, depending on the person’s experience, work assignment and operator’s policy.

MODULE A – GENERAL ELECTRICAL WIRING INTERCONNECTION SYSTEM PRACTICES: (1) Safet y practices (2) ESDS device handling and protection (3) Tools, special tools and equipment (4) Verify calibration/certification of instruments, tools, and equipment (5) Required wiring checks using the Troubleshooting Procedures and charts (6) Measurement and troubleshooting using meters (7) LRU replacement general practices Powered by EASA eRules Page 324 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) MODULE B – WIRING PRACTICES DOCUMENTATION: (1) Chapter 20 structure/overview (2) Chapter 20 cross - reference index (3) Chapter 20 important data and tables (4) Wiring Diagram Manual (5 ) Other documentation (as applicable) MODULE C – INSPECTION: (1) Special inspections (2) Criteria and standards (3) Human factors in inspection (4) Zonal areas of inspection (5) Wiring system damage MODULE D – HOUSEKEEPING: (1) Aeroplane external contamination sources (2) Aeroplane internal contamination sources (3) Other contamination sources (4) Contamination protection planning (5) Protection during aeroplane maintenance and repair (6) Cleaning processes MODULE E – WIRE: (1) Identification, type and construction (2) Insulation qualities (3) Inspection criteria and standards of wire and wire bundles (4) Wire bundle installation practices (5) Typical damage and areas found (aeroplane specific) (6) Maintenance and repair procedures (7) Sleeving (8) Unused wires - termination and storage (9) Electrical bonding and grounds MODULE F – CONNECTIVE DEVICES: (1) General types and identification (2) Cautions and protections (3) Visual inspection procedures (4) Typical damage found (5) Repair procedures Powered by EASA eRules Page 325 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) MODUL E G – CONNECTIVE DEVICE REPAIR: (1) Circular connectors (2) Rectangular connectors (3) Terminal blocks - modular (4) Terminal blocks - non - modular (5) Grounding modules (6) Pressure seals MODULE A: GENERAL ELECTRICAL WIRING INTERCONNECTION SYSTEM PRACTICE 1 O VERVIEW Through Module A, the instructor lays the groundwork of safe, effective maintenance and repair of the aeroplane EWIS and LRU removal and replacement, including BITE test, without damage to the aeroplane or injury to the student.

The ins tructor may vary the depth and scope of the topics to be covered, depending on the type of aeroplane to be maintained and skills of the persons.

2 O BJECTIVES After this module is complete, the student is able to demonstrate the following skills: a. Know the safety procedures of normal and non - normal maintenance procedures so that the person can protect himself/herself and the aeroplane.

b. Recognise ESDS equipment and demonstrate standard anti - static procedures so that no damage occurs to that equipm ent.

c. Demonstrate the correct use of hand tools including specialised and automated tools and equipment.

d. Verify the calibration of electrical measuring instruments, tools and equipment so that correct maintenance procedures may be carried out.

e. Demo nstrate the process and procedures to successfully use the troubleshooting procedures and charts of current aeroplane faults and know re - occurring problems causing “No Fault Found” on removed LRU.

f. Demonstrate the correct use of electrical meters for mea suring voltage, current, resistance, continuity, insulation and short to ground.

g. Know the removal and replacement techniques so that no damage will occur to the LRU or aeroplane connector.

3 S TRATEGIES Normal classroom lecture can be used for the majori ty of the training. The following strategies can be used to expedite learning and are recommended to the instructor: ESDS handling and protection Multimedia/training aids Calibration/certification of instruments, tools, and equipment Company policy Wiring checks using the Troubleshooting Procedures and charts Aeroplane manuals Measurement and troubleshooting using meters Meters and circuits LRU removal and replacement Aeroplane manuals Powered by EASA eRules Page 326 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) MODULE A – GENERAL ELECTRICAL WIRING INTERCONNECTION SYSTEM PR ACTICES: 1 Safety Practices a. Current is lethal - First aid b. Applying power to the aeroplane c. Isolating the circuit d. Aeroplane warnings e. Human factors 2 ESDS Device Handling and Protection a. Sources of electrostatic discharge b. Soft and hard failures c. ESDS safety procedures d. ESDS handling/packing procedures 3 Tools, Special Tools and Equipment a. General hand tools b. Specialised tools c. Automated tools and equipment 4 Verify Calibration/Certification of Instruments, Tools and Equipment a. Tools requiring certification b. Determining certification requirements c. Typical problems 5 Required Wiring Checks Using the Troubleshooting Procedures and charts a. Troubleshooting procedures manual (all chapters) b. Aeroplane Maintenance M anual/Illustrated Parts Catalogue c. Wiring schematics/troubleshooting graphics d. Wiring diagrams e. The process of troubleshooting f. Testing of LRU connectors g. Troubleshooting exercises h. Company “No Fault Found” policy and data 6 Measurement and Tro ubleshooting Using Meters a. Voltage, current and resistance b. Continuity c. Insulation d. Short to ground e. Loop impedance Powered by EASA eRules Page 327 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) 7 LRU Replacement - General Practices a. Different retention devices b. Certification considerations (e.g. CAT 2/CAT3 Landing) c. LRU re - racking procedures d. “No Fault Found” data (aeroplane specific) e. Built - in test equipment (BITE) MODULE B: WIRING PRACTICES DOCUMENTATION 1 O VERVIEW Through Module B, the instructor lays the groundwork for safe, effective maintenance and repair of aeroplane EWIS. The intent of this module is to teach the person how to locate desired information in the Chapter 20 Wiring System overhaul manual, Wiring Diagram Manual and other applicable documentation. The instructor may vary the depth an d scope of the topics to be covered, depending on the type of aeroplane to be maintained and skills of the persons.

2 O BJECTIVES After this module is complete, the person is able to demonstrate the following skills: a. Know the applicable Sub - Chapters and Section to follow during normal and non - normal electrical maintenance procedures.

b. Demonstrate the use of the Cross - Reference Index, Chapter Table of Contents, and Subject Tables of Contents so as to find specific material within each Sub - Chapter and Sec tion.

c. Demonstrate the use of the associated tables for replacement of wire, connective devices and contacts, and associated components, including approved replacements.

d. Demonstrate the use of the Wiring Diagram Manual.

e. Demonstrate the use of other documentation (as applicable).

3 S TRATEGIES Normal classroom lecture can be used for the majority of the training. The Chapter 20 Wiring Practices Manual, Wiring Diagram Manual, and other applicable documentation should be made available to the class so that hands - on exploration of the material can be achieved.

MODULE B – WIRING PRACTICES DOCUMENTATION: 1 Chapter 20 Structure/Overview a. Table of contents b. Sub - chapter titles c. Section structure d. General procedures Powered by EASA eRules Page 328 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) 2 Chapter 20 Cross - Reference Index a. Cross - reference index – Alphanumeric b. Cross - reference index – Standard Part number c. Cross - reference index – Suppliers e. Equivalence tables – Std Part Numbers EN - ASN - NSA 3 Chapter 20 Important Data and Tables a. Contact crimp t ools, insertion/extraction tools b. Wire Insulation removal tools c. Electrical cable binding d. Wire type codes and part numbers identification e. Connective devices types and contacts f. Terminal blocks and terminations g. Terminal blocks modules, ground ing modules and contacts h. Cleaning procedures i. Repair procedures 4 Wiring Diagram Manual (WDM) a. Front matter b. Diagrams c. Charts d. Lists 5 Other documentation (as applicable) MODULE C: INSPECTION 1 O VERVIEW Through Module C, the instructor lays the groundwork for safe, effective maintenance and repair of aeroplane wiring systems, by teaching the skills of inspection so as to identify wiring system damage. The instructor may vary the depth and scope of the topics to be covered, dep ending on the type of aeroplane to be maintained and skills of the persons.

2 O BJECTIVES After this module is complete, the person is able to demonstrate the following skills: a. Know the different types of inspections: General Visual Inspection (GVI), Det ailed Inspection (DET), Zonal Inspection and Enhanced Zonal Analysis Procedure (EZAP).

b. Know the criteria and standards of inspection so that the person knows which tools are used to ensure inspection procedures and standards are achieved, which leads to all defects being found.

c. Know the effects of fatigue and complacency during inspection and how to combat these effects (Human Factors).

Powered by EASA eRules Page 329 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERA L of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) d. Know the specific zonal inspection requirements related to system affiliation and environmental conditions.

e. Re cognise typical wiring system damage, such as hot gas, fluid contamination, external mechanically induced damage, chafing, corrosion, signs of overheating of wire, wire bundles, connective and control device assemblies.

3 S TRATEGIES Normal classroom lectur e can be used for the majority of the training. ATA 117 video and colour photos of actual wiring system damage could be used to show typical problems found on the aeroplane. Examples of discrepancies should be made available to the student. AMC 20 - 21 , Programme to Enhance Aeroplane EWIS Maintenance is recommended as a source of typical aeroplane wiring installations and areas of concern.

MODULE C – INSPECTION 1. Special Inspection s a. General Visual Inspection (GVI) b. Detailed Inspection (DET) c. Zonal Inspection d. Enhanced Zonal Analysis Procedure (EZAP) 2. Criteria and Standards a. Tools b. Criteria/standards c. Procedures of inspection 3. Human Factors in Inspection a. Fatigue b. Complacency 4. Zonal Areas of Inspection a. Zonal areas of inspection b. Zonal inspection procedures and standards 5. Wiring System Damage a. Swarf/FOD/metal shavings b. External mechanically induced damage c. Hot gas d. Fluid contamination e. Vibration/chafing f. Corrosion g. Signs of overheating Powered by EASA eRules Page 330 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) MODULE D: HOUSEKEEPING 1 O VERVIEW Through Module D, the instructor lays the groundwork for safe, effective maintenance and repair of aeroplane EWIS, by teaching housekeeping strategies, so as to keep the EWIS free of contamination. The Instructor may vary the depth and scope of the topics to be covered, depending on the type of aeroplane to be maintained and ski lls of the persons .

2 O BJECTIVES After this module is complete, the person is able to demonstrate the following skills: a. Recognise external contamination and other damage due to external environmental conditions.

b. Know the aeroplane internal contamination sources so that inspection processes can be effec tively carried out and contamination damage easily recognised.

c. Recognise other possible contamination sources.

d. Know the planning procedures to be followed, on EWIS areas in different parts of the aeroplane.

e. Know the protection procedures and proce sses to protect the EWIS during maintenance and repair.

f. Know the process of cleaning wiring systems during maintenance and repair.

3 S TRATEGIES Normal classroom lecture can be used for the majority of the training. ATA 117 video and colour photos of act ual EWIS contamination could be used to show typical problems found on the aeroplane. Relevant Aeroplane Maintenance Manual and/or Chapter 20 Wiring Practices procedures should be used. The ATSRAC Task Group 1, Non - Intrusive Inspection Final Report could b e used to identify typical housekeeping issues. AMC 20 - 21 , Programme to Enhance Aeroplane EWIS Maintenance is recommended as a source of typical aeroplane wiring installations and areas of concern.

MODULE D – HOUSEKEEPING 1 Aeroplane External Contamination Sources a. De - ice fluids b. Water and rain c. Snow and ice d. Miscellaneous (e.g. cargo/beverage spillage) e. Air erosion 2 Aeroplane Internal Contamination Sources a. Hydraulic oils b. Engine and APU oils c. Fuel d. Greases Powered by EASA eRules Page 331 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) e. Galleys and toilets f. Lint/Dust g. Bleed air and hot areas h. Hazardous materials 3 Other Contamination Sources a. Paint b. Corrosion inhibitor c. Drill shavings/Swarf d. Foreign objects (screws, washers, rivets, tools, etc.)

e. Animal waste 4 Contamination Protection Planning a. Have a plan/types of plan/area mapping b. Protection and Caution Recommendations c. Procedures d. Keep cleaning 5 Protection during Aeroplane Maintenance and Repa ir a. Recommended general maintenance protection procedures b. Recommended airframe repair protection procedures c. Recommended powerplant repair protection procedures 6 Cleaning Processes a. Fluid contamination (1) Snow and ice (2) De - ice fluid (3) Cargo spillage (4) Water and rain (5) Galleys (6) Toilets water waste (7) Oils and greases (8) Pressure washing b. Solid contamination (1) Drill shavings/Swarf (2) Foreign objects (screws, washers, rivets, tools, etc.)

c. Environmental contamination (1) Li nt and dust (2) Paint Powered by EASA eRules Page 332 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) (3) Corrosion inhibitor (4) Animal waste MODULE E: WIRE 1 OVERVIEW Through Module E, the instructor lays the groundwork for safe, effective maintenance, alteration and repair of aeroplane EWIS by teaching wire selection and inspectio n strategies.

The Instructor may vary the depth and scope of the topics to be covered, depending on the type of aeroplane to be maintained and skills of the persons.

2 O BJECTIVES After this module is complete, the person is able to demonstrate the followin g skills: a. Demonstrate the procedure used to identify specific wire types using the aeroplane manuals.

b. Know from approved data different insulation types and their relative qualities.

c. Know the inspection criteria for wire and wire bundles.

d. Know the standard installation practices for wire and wire bundles (aeroplane specific).

e. Know typical damage that can be found (aeroplane specific).

f. Demonstrate the repair procedures for typical damage found on the student’s type of aeroplane.

g. Dem onstrate the procedures to fitting differing types of sleeving (aeroplane specific).

h. Know the procedures for termination and storage of unused wires.

i. Know the correct installation practices for electrical bonds and grounds (aeroplane specific).

3 S TR ATEGIES Normal classroom lecture can be used for the majority of the training with hands - on practice for Section 6. Chapter 20 Wiring Practices, Wiring Diagram Manual and WDM Lists should be made available to the class to ensure hands - on use of the manual so that wire identification, inspection, installation and repair procedures can be fully explored. Examples of wire discrepancies should be made available to the student. The ATSRAC Task Group 1, Intrusive Inspection Final Report could be used to identify typical wire issues. AMC 20 - 21 , Programme to Enhance Aeroplane EWIS Maintenance is recommended as a source of typical aeroplane wiring installations and areas of concern.

MODULE E – WIRE 1 Identification, Type and Construction a. Wire type codes – alphanumeric b. Wire type codes – specification and standard part number c. Wire type codes – specified wire and alternate d. Manufacturer identification Powered by EASA eRules Page 333 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) 2 Insulation Qualities a. Types of insulation b. Typical insulation damage and limitations c. Carbon arcing 3 Inspection Criteria and Standards of Wire and Wire Bundles a. Inspection of individual wiring b. Inspection of wire bundles 4 Wire Bundle Installation Practices a. Routing b. Segregation rules c. Clearance d. Clamp inspection e. Clamp removal and fitting f. Conduit types and fitting g. Raceways h. Heat shields and drip shields 5 Typical Damage and Areas Found (aeroplane specific) a. Vibration b. Heat c. Corrosion d. Contamination e. Personnel traffic passage 6 Maintenance and Repair Procedures a. Wire damage assessment and classification b. Approved repairs - improper repairs c. Shielded wire repair d. Repair techniques e. Terminals and splices f. Preventative mainten ance procedures 7 Sleeving a. Identification sleeves b. Shrink sleeves c. Screen braid grounding crimp sleeves d. Screen braid grounding solder sleeves Powered by EASA eRules Page 334 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) 8 Unused Wires - Termination and Storage a. Termination – end caps b. Storage and attachment 9 Electrical Bonding and Grounds a. Inspection standards b. Primary Bonding (HIRF protection) c. Secondary Bonding (System grounding) d. Lightning strikes MODULE F: CONNECTIVE DEVICES 1 O VERVIEW Through Module F, the instructor lays the groundwork for safe, effective maintenance, alteration and repair of aeroplane EWIS by teaching the identification, inspection and repair of connective devices found on the aeroplane. The instructor may vary the depth and scope of the topics to be covered, depending on the ty pe of aeroplane to be maintained and skills of the persons.

2 O BJECTIVES After this module is complete, the person is able to demonstrate the following skills: a. Know the general types and positive identification of connective devices (aeroplane specific) .

b. Know the various safety procedures, cautions and warnings prior to inspection.

c. Know the relevant visual inspection procedures for each type of connector so that any internal or external damage can be found.

d. Recognise typical external and interna l damage to the connector.

e. Demonstrate where to find the relevant repair schemes from Chapter 20 for connector repair.

3 S TRATEGIES Normal classroom lecture can be used for the majority of the training. The Chapter 20 Wiring Practices manual should be made available to the class so that hands - on use of the manual can be ensured. Connector identification, inspection and repair procedure s should be fully explored.

Colour photographs of typical external damage and internal damage could be used to show problems on the aeroplane. The ATSRAC Task Group 1, Non - Intrusive Inspection and Intrusive Inspection Final Report, Chapter 7, could be used to identify typical connector issues. AMC 20 - 21 , Programme to Enhance Aeroplane EWIS Maintenance is recommended as a source of typical aeroplane wiring installations and areas of concern.

Powered by EASA eRules Page 335 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) MODULE F – CONNECTIVE DEVICES 1 General Types and Identification a. Part number identification b. Reference tables c. Specific connective devices chapters 2 Cautions and Protections a. Safety precautions b. Maintenance precautions 3 Visual Inspection Procedures a. Installed inspection criteria b. Removed inspection criteria 4 Typical Damage Found a. Exterior damage b. Internal damage 5 Repair Procedures a. Finding the correct section b. Finding the correct part c. Finding the correct tooling d. Confirming the correct repair MODULE G: CONNECTIVE DEVICES REPAIR 1 O VERVIEW Through Module G, the instructor lays the groundwork for safe, effective maintenance, alteration and repair of aeroplane EWIS. This module is primarily a hands - on clas s, emphasising the repair and replacement of connective devices found on the aeroplane. This list can be used to cover typical connectors for aeroplanes and can be adjusted to suit training requirements.

The instructor may vary the depth and scope of the t opics to be covered, depending on the type of aeroplane to be maintained and skills of the persons.

2 O BJECTIVE After this module is complete, the person will have the following skills: a. Demonstrate the replacement of components for circular connectors.

b. Demonstrate the replacement of components for rectangular connectors.

c. Demonstrate the replacement of components for terminal blocks - modular.

d. Demonstrate the replacement of components for terminal blocks - non - modular.

e. Demonstrate the replacement of components for grounding modules.

f. Demonstrate the replacement of pressure seals.

Powered by EASA eRules Page 336 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) 3 S TRATEGIES This class is primarily a hands - on class to give the student motor skills in the repair of connective devices from their aeroplane. The Chapter 20 Wiring Practices Manual and the appropriate connective devices should be made available to the class so that repair procedures can be fully explored. Photographs of typical internal conditions and external damage could be made available. It is recommended that MODULE F: CONNECTORS should precede this module.

AMC 20 - 21 , Programme to Enhance Aeroplane EWIS Maintenance is recommended as a source of typical aeroplane wiring installations and areas of concern.

MODULE G – CONNECTIVE DEVICES REPAIR 1 Circular Connectors a. Disassembly b. Back - s hell maintenance c. Contact extraction and insertion d. Contact crimping e. Assembly and strain relief 2 Rectangular Connectors a. Disassembly b. Back - shell maintenance c. Contact extraction and insertion d. Contact Crimping e. Assembly and strain relief 3 Terminal Blocks - Modular a. Disassembly b. Contact extraction and insertion c. Contact Crimping d. Assembly and strain relief 4 Terminal Block – Non - modular a. Disassembly b. Terminal Lug Crimping c. Terminal Lug Stacking d. Assembly, torque and strain relief 5 Grounding Modules a. Disassembly b. Contact extraction and insertion c. Contact Crimping d. Assembly and strain relief Powered by EASA eRules Page 337 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 22 Products, Parts and Appliances (AMC - 20) 6 Pressure Seals a. Disassembly b. Maintenance c. Assembly and strain relief [Amdt 20/4] Powered by EASA eRules Page 338 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 23 Products, Parts and Appliances (AMC - 20)

AMC 20 - 23

AMC 20 - 23 Development of Electrical Standard Wiring Practices

documentation

ED Decision 2008/007/R 1 PURPOSE This AMC provides acceptable means of compliance for developing an electrical standard wiring practices document for operators, holders of and applicants for type certificates (TC), applicants for supplemental type certificates (STC) and maintenance organisations. The information in this AMC is based on recommendations submitted to the FAA from the Aging Transport Systems Rulemaking Advisory Committee (ATSRAC) . JAA and latterly EASA are participating members of ATSRAC. The information in this AMC is derived from the maintenance, inspection, and alteration best practices identified through extensive research by ATSRAC working groups and Federal government workin g groups. This AMC provides a means, but not the only means of creating a document that meets the expectations of CS 25.1529 and Appendix H.

2 OBJECTIVE The objective of this AMC is to promote a common format for documents containing standard practices for electrical wiring, and to provide a summary of the minimum content expected to be contained within that document. Although the title of the document or manual is left to the discretion of the organisation, such a document will be referred to in this AMC a s the Electrical Standard Wiring Practices Manual (ESWPM).

Titles in other organisations for such document may be Standard Wiring Practices Manual (SWPM) or Electrical Standard Practices Manual (ESPM).

3 APPLICABILITY The guidance provided in this AMC is applicable to all operators, holders of and applicants for TC, applicants for STC and maintenance organisations.

4 RELATED DOCUMENTS — Regulation (EC) No. 216/2008 — Regulation No. 1702/2003 — Regulation No. 2042/2003 Regulation (EC) No 216/2008 of the European Parl iament and of the Council of 20 February 2008 on common rules in the field of civil aviation and establishing a European Aviation Safety Agency, and repealing Council Directive 91/670/EEC, Regulation (EC) No 1592/2002 and Directive 2004/36/EC ( OJ L 79, 19.3.2008, p.1 ).

Commission Regulation (EC) No 1702/2003 of 24 September 2003 laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations (OJ L 243, 27.9.2003, p. 6). Regulation as last amended by Regulation (EC) No 287/2008 (OJ L 87, 29. 3.2008, p.3).

Commission Regulation (EC) No 2042/2003 of 20 November 2003 on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks (OJ L 315, 28.11.2003, p. 1) . Regulation as last amended by Regulation (EC) No 376/2007 of (OJ L 94, 4.4.2 007, p. 18).

Powered by EASA eRules Page 339 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 23 Products, Parts and Appliances (AMC - 20) — EASA Certification Specification CS - 25 Large Aeroplanes — EU - OPS Commercial Air Transportation (Aeroplanes) 5 RELATED READING MATERIAL a. EASA AMC - 20 — AMC 20 - 21 , Programme to Enhance Aircraft Electrical Wiring Interconnection System Maintenance — AMC 20 - 22 , Aircraft Electrical Wiring Interconnection System Training Programme b. FAA 14 CFR Parts — Part 21, Certification Procedures for Products and Parts — Part 25, Airworthiness Standards, Transport Category Airplanes — Part 43, Maintenance, Preventive Maintenance, Rebuilding, and Alteration — Part 91, General Operat ing and Flight Rules — Part 119, Certification: Air Carriers and Commercial Operators — Part 121, Operating Requirements: Domestic, Flag, and Supplemental Operations — Part 125, Certification and Operations: Airplanes Having a Seating Capacity of 20 or More Pass engers or a Maximum Payload Capacity of 6,000 pounds or More — Part 129, Operations: Foreign Air Carriers and Foreign Operators of U.S. - Registered Aircraft Engaged in Common Carriage — Part 135, Operating Requirements: Commuter and On - demand Operations and Rules Governing Persons on Board such Aircraft — Part 145, Repair Stations c. FAA Advisory Circulars (AC) — AC 25 - 16, Electrical Fault and Fire Protection and Prevention — AC 25.981 - 1B, Fuel Tank Ignition Source Prevention Guidelines — AC 43 - 12A, Pr eventive Maintenance — AC 43.13 - 1B, Acceptable Methods, Techniques and Practices for Repairs and Alterations to Aircraft — AC 43 - 204, Visual Inspection for Aircraft — AC 43 - 206, Avionics Cleaning and Corrosion Prevention/Control — AC 65 - 15A, Airframe and Powerplan t Mechanics Airframe Handbook, Chapter 11.

Aircraft Electrical Systems — AC 25.17XX Certification of EWIS on Transport Category Airplanes Executive Director Decision No 2003/2/RM of 14 October 2003 on certification specifications, including airworthiness codes and acceptable means of compliance, for large aeroplanes («CS - 25 »). Decision as last amended by Executive Director Dec ision No 2008/006/R of 29 August 2008 (CS - 25 Amendment 5).

Council Regulation (EEC) No 3922/91 of 16 December 1991 on the harmonisation of technical requirements and administrative procedures in the field of civil aviation (OJ L 373, 31.12.1991, p. 4). R egulation as last amended by Regulation (EC) No 8/2008 of 11 December 2007 ( OJ L 10, 12.1.2008, p. 1).

Powered by EASA eRules Page 340 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 23 Products, Parts and Appliances (AMC - 20) d. Reports — Aging Transport Systems Rulemaking Advisory Committee, Task 1 and 2, Aging Systems, Final Report http://www.mitrecaasd.org/atsrac/final_reports/Task_1&2_Final%20_August_2000.pdf — Aging Transport Systems Rulemaking Advisory Committee, Task 3, Final Report http://www.mitrecaasd.org/atsrac/final_reports/Task_3_Final.pdf — Ag ing Transport Systems Rulemaking Advisory Committee, Task 4, Final Report, Standard Wiring Practices http://www.mitrecaasd.org/atsrac/final_reports/Task_4_Final_ Report_Sept_2000.pdf — Transport Aircraft Intrusive Inspection Project, (An Analysis of the Wire Installations of Six Decommissioned Aircraft), Final Report, The Intrusive Inspection Working Group, December 29, 2000 http://www.mitrecaasd.org/atsrac/intrusive_inspection.html — Aging Transport Systems Rulemaking Advisory Committee Task 7, Final Report, Electrical Standard Wire Practices Manual (ESWPM) http://www.mitrecaasd.org/atsrac/final_reports/Task_7_Final_Report - 10 - 31 - 2002.pdf e. Other Documents — ATA Specification 117 (Wiring Maintenance Practices/Guidelines) — FAA Policy Statement Number ANM - 01 - 04: System Wiring Policy for Certification of Part 25 Airplanes, June 25, 2001 6 DEFINITIONS Consumable materials : Materials consumed during the maintenance or repair of EWIS which are not an eventual component of the EWIS.

Drip loop : The practice of looping a wire or wire bundle to provide a point lower than the adjacent connector for moisture to collect.

Electrical Wiring Interconnection Syst em (EWIS) : See CS 25.1701.

Legacy document : An organisation’s ESWPM existing prior to the adoption of the requirements of H25.5(a)(2) of Appendix H to CS - 25.

Master Breakdown Index (MBI) : An index developed to supplement a legacy document. An MBI provides a means of finding information without the need for reformatting the legacy SWPM.

An example of an MBI is presented at the end of paragraph 9 of this AMC.

Separation : Defined as either spatial distance, or physical barrier, between wiring from adjacent str ucture, systems or wiring; or the practice of installing wiring supporting redundant or multi - channel systems.

Standard practices : Industry - wide methods for repair and maintenance of electrical wire, cable bundles and coaxial cables. Procedures and practices for the inspection, installation and removal of electrical systems components including, but not limited to: wire splices, bundle attachment methods, connectors and electrical terminal connections, bonding/grounding, etc.

7 STANDARDISED ESWPM FOR MAT A representative example of the standard format and sequence of major topics included within an ESWPM is contained within Appendix A of this AMC.

Powered by EASA eRules Page 341 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 23 Products, Parts and Appliances (AMC - 20) 8 MINIMUM ESWPM CONTENT A d efinition and description of ESWPM minimum content is necessary to ensure that operators and repair stations have at their disposal the information necessary to properly maintain their airplanes. Although the original airframe manufacturer’s electrical ins tallation design philosophy concerning components, installation procedures, segregation rules, etc. need not be included within the ESWPM, sufficient minimum information should be provided to enable the end - user to maintain the aircraft in a condition that conforms to the electrical installation design philosophy of the original manufacturer.

The content of any ESWPM should include, at a minimum, the following: a. Front Matter Provide information regarding the content and use of the ESWPM. Describe changes to the document in a record of revisions. Ensure the document contains a table of contents or index to allow the user to readily retrieve necessary information.

b. Safety Practices Provide general instruction, cautions and warnings which describe safe prac tices implemented prior to the start of any or all of the specific standard electrical practices contained within the core of the ESWPM. Safety cautions, warnings or notes specific to the procedure shall be placed within the body of the procedure.

c. Clean ing Requirements and Methods “Protect, clean as you go” philosophy.

Non - destructive methods for cleaning dust, dirt, foreign object debris (FOD), lavatory fluid, and other contaminants produced by an aircraft environment from wiring systems.

Wire replaceme nt guidelines when an accumulation of contaminants, either on the surface and/or imbedded in the wire bundle, cannot be safely removed.

d. Wire and Cable Identification (1) Specify requirements for wire and cable identification and marking to provide safet y of operation, safety to maintenance personnel, and ease of maintenance.

(2) Specify methods of direct wire marking. Also, identify specific requirements and cautions associated with certain types of wire marking.

e. Wire and Cable Damage Limits Specify limits to positively identify the thresholds where damaged wire/cable replacement may be necessary and where repairs can be safely accomplished. Establish limits for each applicable wire/cable type, if necessary.

(1) Include damage limits for terminals, st uds, connectors, and other wiring system components, as necessary.

f. Installation Clamping and Routing Requirements (1) Specify the requirements for the installation of wiring systems with respect to physical attachment to the aircraft structure. These re quirements must be compatible with the different environments applicable to aircraft and aircraft systems.

(2) Specify applicable methods of clamping, support, termination, and routing to facilitate installation, repair, and maintenance of wires, wire bund les, and cabling.

Powered by EASA eRules Page 342 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 23 Products, Parts and Appliances (AMC - 20) (3) Specify minimum bend radii for different types of wire and cable.

(4) Specify minimum clearance between wiring and other aircraft systems and aircraft structure.

(5) Include the requirements for the installation of wiring conduit with respect to physical attachment, routing, bend radii, drain holes, and conduit end coverings.

(6) Emphasise special wiring protective features, such as spatial separation, segregation, heat shielding, and moisture protection that are required t o be maintained throughout the life of the aircraft.

(7) Ensure necessary information for the maintenance of bonding, grounding and lightning, high - intensity radio frequency (L/HIRF) provisions is included.

(8) Include information on the use and maintenanc e of wire protective devices, conduits, shields, sleeving etc. (this bullet is deleted in the FAA AC).

g. Repair and Replacement Procedures Describe methods to safely repair and/or replace wiring and wiring system components.

(1) Include types and maximum numbers of splice repairs for wiring and any limitations on the use of splices. When splicing wire, environmental splices are highly recommended over non - environmental splices. Guidance should be provided on how long a temporary splice may be left in the w ire.

(2) Specify procedures for the repair, replacement, and maintenance of connectors, terminals, modular terminal blocks, and other wiring components.

h. Inspection Methods In wiring inspection methods, include a general visual inspection (GVI), or a det ailed inspection (DET), as determined by the Enhanced Zonal Analysis Procedure (EZAP).

Typical damage includes heat damage, chafing, cracked insulation, arcing, insulation delaminating, corrosion, broken wire or terminal, loose terminals, incorrect bend ra dii, contamination, and deteriorated repairs.

(1) Identify detailed inspections and, where applicable, established and emerging new technologies non - destructive test methods to complement the visual inspection process.

Whenever possible, ensure that inspec tion methods can detect wiring problems without compromising the integrity of the installation.

i. Customised data Provide a location and procedures that allow users to include customised or unique data such as that relating to STC, operator - unique mainten ance procedures, etc.

A comprehensive listing of the typical content included within an ESWPM, including the minimum required content described above, is contained within Appendix A of this AMC.

9 ALTERNATIVE PROCEDURE FOR LEGACY DOCUMENTS The definition of a new layout and chapter format may require each organisation with an existing ESWPM to reformat and to republish using the standardised format. Whether the organisation produces a stand - alone manual or provides the electrical standard practices as Chapter 20 of a wiring diagram manual, the resultant reorganisation would cause a significant economical impact for both the authoring organisation and their end - users.

Powered by EASA eRules Page 343 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SU BPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 23 Products, Parts and Appliances (AMC - 20) To address this concern, a conversion tool, identified in the last paragraph of this chapter, was devised which takes the following variables into account: — Effects on manufacturers’ current technical document editorial policy as it exists in current legacy documents.

— Cost s resulting from an immediate major manual overhaul.

— Inconvenience to end - users who are accustomed to the format they are currently using.

When using a traditional paper format ESWPM, the most efficient method of retrieving standard procedures and maintena nce information has traditionally been to search in: — the table of contents (TOC) and/or — the indexes (i.e., alphanumerical index and/or numerical index, as available).

The ease and speed with which information may be found with these methods relies heavily on the quality of the TOC and/or the indexes. For aircraft maintenance technicians needing to locate and extract the pertinent and applicable data necessary to perform a satisfactory design modification or maintenance action, finding relevant data may be time - consuming.

When using an electronic format, a search engine can often be used. This allows the user to bypass the TOC or indexes in finding the needed procedure or data. By searching with such alternative methods, a user can find information wi thout needing to know the rules, such as ATA references, governing assignment of the subject matter to its place in the TOC.

The use of a conversion tool, identified as a Master Breakdown Index (MBI) is one method of achieving a common format until existin g legacy documents can be physically altered or digitised to an electronic format. The intent of the MBI is to supplement the TOC and existing indexes by providing to users a method of searching existing documents using topical information rather than by p art number, alphabetic subject, or Chapter - Section - Subject reference. The arrangement of the MBI duplicates the standardised format described in Paragraph 7 of this AMC, but does not require complete rearrangement of legacy documents to achieve a common fo rmat. The MBI acts as a conversion key used to effectively convert an existing document arrangement into the proposed arrangement. In essence the MBI duplicates in paper form for legacy documents the electronic search engine for HTML - based documents.

This is an example of an MBI which could be used to mitigate the need for legacy documents to be reformatted to achieve the standardised format described above: APPEARS IN THIS GROUP MAJOR TOPIC DOCUMENT AS SUBJECT GENERAL DATA SAFETY PRACTICES 20 - 10 - 10 AIRPLANE ENVIRONMENTAL AREAS 20 - 20 - 12 CONSUMABLE MATERIALS 20 - 00 - 11 WIRING MATERIALS 20 - 10 - 13 COMMON TOOLS 20 - 00 - 13 ELECTRICAL WIRING EWIS PROTECTION DURING MAINTENANCE 20 - 10 - 20 INTERCONNECT EWIS CLEANING 20 - 10 - 20 SYSTEM (EWIS) EWIS INSPECTION 20 - 10 - 20 MAINTENANCE EWIS TESTING 20 - 10 - 13 EWIS DISASSEMBLY 20 - 10 - 19 EWIS REPAIR AND REPLACEMENT 20 - 20 - 00 WIRING INSTALLATION WIRE SEPARATION / SEGREGATION 20 - 10 - 11 Powered by EASA eRules Page 344 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 23 Products, Parts and Appliances (AMC - 20) 20 - 10 - 12 ELECTRICAL BONDS AND GROUNDS 20 - 30 - 60 WIRE HARNESS INSTALLATION 20 - 10 - 17 20 - 10 - 18 Installation of Sleeves on Wiring WIRING ASSEMBLY WIRE AND CABLE TYPES 20 - 00 - 15 WIRE MARKING 20 - 60 - 01 WIRE HARNESS ASSEMBLY 20 - 50 - 01 WIRE INSULATION AND CABLE JACKET 20 - 90 - 12 REMOVAL TERMINATION TYPE (SPECIFICS OF 20 - 61 - 44 TERMINATIONS) ELECTRICAL DEVICES DEVICE TYPE (SPECIFICS OF ELECTRICAL 20 - 80 - 09 Assembly of DEVICE) Leach Relay Sockets SPECIFIC SYSTEM UNIQUE WIRING 20 - 73 - 00 Fuel Quantity WIRING ASSEMBLIES/INSTALLATIONS Indicating System AIRLINE CUSTOMISED AIRLINE SPECIFIED 20 - 91 - 00 DATA [Amdt 20/4]

Appendix A: Groups, Major Topics, Standardised Sequence and

Description of Minimum Content

ED Decision 2008/007/R GROUP MAJOR TOPIC DESCRIPTION Safety regulations and general safety precautions to SAFETY PRACTICES prevent injury to personnel and damage to the airplane Definition of types of areas upon which wiring AIRPLANE ENVIRONMENTAL configuration and wiring component selection is AREAS constrained GENERAL DATA Wiring maintenance processing materials (solvents, CONSUMABLE MATERIALS aqueous cleaners, lubricants, etc.)

Materials that become an integral part of the wiring WIRING MATERIALS configuration excluding wire and cable, e.g., sleeves, shield material, tie material, sealants, etc.

COMMON TOOLS Description and operation of common tools EWIS PROTECTION DURING Procedures to protect EWIS during airplane MAINTENANCE maintenance and modification In support of inspection as well as prevention of degradation and preparation for repair; recommended EWIS CLEANING cleaning materials and procedures based on type of contamination EWIS MAINTENANCE Criteria for correct installation, correct wiring assembly configuration; damage conditions and limits for wiring EWIS INSPECTION components (wire and cable, termination types, electrical devices); factors that warrant disassembly for inspection; determination of cause of damage EWIS TESTING Wiring integrity testing Powered by EASA eRules Page 345 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 23 Products, Parts and Appliances (AMC - 20) GROUP MAJOR TOPIC DESCRIPTION Data and procedures in support of inspection, cleaning EWIS DISA SSEMBLY when applicable; also supports new wiring installation Repair of wiring installation, wiring assembly EWIS REPAIR AND configuration, wiring components (wire and cable, REPLACEMENT wiring terminations, electrical devices); wire and cable replacement; wiring functional identification Explanation of separation/segregation categories, WIRE SEPARATION/ separation/segregation identification, and necessary SEGREGATION conditions for maintaining separation/segregation WIRING ELECTRICAL BONDS AND Bond surface preparation, ground hardware INSTALLATION GROUNDS configurations, bond integrity testing Routing, supports; wiring protection, factors affecting WIRE HARNESS wiring ass embly configuration; connection to INSTALLATION equipment, new wiring, removal from service The principal material component of airplane wiring; WIRE AND CABLE TYPES includes type identification and basic description; alternative wire types (replacements, substitutions) WIRE MARKING Marking; applicable conditions Wiring assembly configuration: Assembly materials, WIRE HARNESS ASSEMBLY layout, overall protection; factors affecting wiring installation Wire and cable: Insulation removal, jacket removal; WIRE INSULATION AND associated damage limits, tool description and CABLE JACKET REMOVAL operation WIRING Wiring terminations and accessories (connectors, ASSEMBLY terminal lugs, splices, backshells, etc.) grouped by termination type from simple to complex: a. Common data or procedures by group (if any), e.g., <<TERMINATION TYPE>> tool description and operation, definition of e.g., SOURIAU 8950 SERIES internal damage and limits, internal cleaning, CONNECTORS accessories b. By individual type - pa rt numbers and description, definition of internal damage and limits (if not specified by common data), disassembly, assembly, installation Electrical devices (circuit breakers, r elays, switches, filters, lamps, etc.) grouped by device type: a. Common data or procedures by group (if any), e.g., tool description and operation, definition of <<DEVICE TYPE>> ELECTRICAL internal damage and limits, internal cleaning, e.g., KLIXON 7274 SERIES DEVICES accessories CIRCUIT BREAKER b. By individual type - part numbe rs and description, definition of internal damage and limits (if not specified by common data), disassembly, assembly, installation For wiring that has a necessarily specific configuration (e.g. Primary Flight Control, Fuel Quantity Indicator SPECIFIC SYSTEM System, etc.): SPECIFIC WIRING ASSEMBLY WIRING – Applicable conditions for repair and replacement – Disassembly, assembly, installation, assembly integrity testing Powered by EASA eRules Page 346 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 23 Products, Parts and Appliances (AMC - 20) GROUP MAJOR TOPIC DESCRIPTION AIRLINE CUSTOMISED AIRLINE SPECIFIED Reserved for airline use DATA [Amdt 20/4] Powered by EASA eRules Page 347 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20)

AMC 20 - 24

AMC 20 - 24 Certification Considerations for the Enhanced ATS in

Non - Radar Areas using ADS - B Surveillance (ADS - B - NRA) Application

via 1090 MHZ Extended Squitter.

ED Decision 2008/004/R 1 PREAMBLE 1.1 The scope of this Acceptable Means of Compliance (AMC) is the airworthiness and operational approval of the “Enhanced Air Traffic Services in Non - Radar Areas using ADS - B Surveill ance” (ADS - B - NRA) application.

1.2 Operational benefits of the ADS - B - NRA application include the enhancement of the Air Traffic Control Service in current non - radar airspace. ADS - B - NRA would provide controllers with improved situational awareness of aircraft positions, and in consequence ap propriate separation minima could be applied depending on the environment and the approval of the competent authority. Current non - radar airspace is controlled using procedural methods which demand large separations. ADS - B - NRA separation minima would be sm aller than that used in current non - radar airspace. Alerting Services in nonradar airspace will be enhanced by more accurate information on the latest position of aircraft.

Hence, it is expected that in areas where radar coverage is not feasible or not ec onomically justified this application will provide benefits to capacity, efficiency and safety in a way similar to what would be achieved by use of SSR radar.

1.3 The European CASCADE programme is the mechanism for co - ordination of the European implement ation of ADS - B (ADS - B - NRA and other ADS - B based ground and airborne surveillance applications). One of the programme’s aims is to ensure harmonisation and efficiency of implementation.

1.4 CASCADE uses the globally interoperable 1090 MHz Extended Squitter (ES) data link technology, compliant with ICAO SARPS in Annex 10 and in line with the recommendations of the Conference ICAO ANC - 11.

1.5 In parallel, the FAA Airservices Australia and Nav Canada plan to deploy ADS - B using the same data link technology. It is assumed that aircraft will be interoperable with all implementation programmes using the EUROCAE/RTCA ADS - B - NRA standard (ED126, DO - 303).

1.6 The meaning of abbreviations may be found in Appendix 1 .

2 PURPOSE 2.1 This AMC is for operators seeking to operate in airspace classifications A to E where ADS - B - NRA services have been implemented by the Air Navigation Service Provider. It provides the basis for approval of aircraft systems and identifi es operational considerations.

It may also assist other stakeholders by alerting them to aircraft requirements, operator procedures and related assumptions. These other stakeholders could include airspace planners, air traffic service providers, ATS system manufacturers, surveillance data Powered by EASA eRules Page 348 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) processing system manufacturers, communication service providers, aircraft and avionics equipment manufacturers and ATS regulatory authorities.

2.2 Acceptable Means of Compliance (AMC) illustrate a m eans, but not the only means, by which a requirement contained in an EASA airworthiness code or an implementing rule of the Basic Regulation, can be met.

An applicant correctly implementing this AMC in its entirety is assured of acceptance of compliance wi th the airworthiness considerations prior to use of the automatic dependent surveillance broadcast equipment. The operational considerations in this AMC are consistent with the operational considerations in the position paper 039 revision 8, that is endors ed by the JAA Operations Sectorial Team (OST). An Operator that, in conjunction with the airworthiness considerations, has correctly implemented this AMC should be ensured of acceptance of compliance with the operations rules ap plicable in JAA Member State s.

3 SCOPE 3.1 This AMC is applicable to the various ATS services contained in the ADS - B - NRA application, including separation services. This AMC fulfils the ADS - B - NRA Safety, Performance Requirements and Interoperability Requirements as established in 1 2 E UROCAE ED - 126 , using the methodology described in EUROCAE document ED - 78A .

AMC requirements are driven by the ED - 126 requirements for a 5NM separation service (applicable to both en - route and TMA airspace).

Note: the actual choice of ADS - B - NRA ATC se rvice provision, including of the applicable separation minima, is at the discretion of the implementing Air Traffic Service Provider, and should be based on local safety cases.

3.2 The AMC addresses the 1090 MHz Extended Squitter (ES) data link technolo gy as the ADS - B transmit technology.

4 REFERENCE DOCUMENTS 4.1 Related Regulatory Requirements — CS/FAR 25.1301, 25.1307, 25.1309, 25.1322, 25.1431, 25.1581, or equivalent requirements of CS 23, 27 and 29, if applicable.

— EU - OPS 1.230, 1.420, 1.845, 1.865, 1040, 1.1045 and 1.1060, as amended, or, if applicable, equivalent requirements o f JAR - OPS 3.

— National operating regulations.

4.2 Related EASA/JAA TGL/NPA/AMC (and FAA TSO) Material — ETSO - 2C112b: Minimum Operational Performance Specification for SSR Mode S Transponders (adopts ED - 73B) — ETSO - 129A (TSO - 129/TSO - 129A): Airborne Supplement al Navigation Equipment Using the Global Positioning System (GPS) ED - 126: “Safety, Performance and Interoperability Requirements Document for ADS - B - NRA” Application ED - 78A: Guidelines for approval of the provision a nd use of Air Traffic Services supported by Data communications Other, requirements compliant, ADS - B transmit systems (e.g. VDL Mode 4) are expected to be covered through separate regulatory material , as appropriate.

Powered by EASA eRules Page 349 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) — ETSO - 145/ETSO - 146 (TSO - 145/TSO - 146; TSO - 145A/TSO - 146A): Airborne Navigation Sensors Using the Global Positioning System (GPS) Augmented by the Wide Area Augmentation System (WAAS) — AMC 20 - 1 3 Certification of Mode S Transponder Systems for Enhanced Surveillance — JAA Temporary Guidance leaflet (TGL) 13, Revision 1: Certification of Mode S Transponder Systems for Elementary Surveillance 4.3 Related FAA Advisory Circular Material — FAA AC20 - 13 8A: Airworthiness Approval of Global Navigation Satellite System (GNSS) Equipment 4.4 Related EUROCAE/RTCA Standards — ED - 126 (DO - 303): Safety, Performance and Interoperability Requirements Document for ADS - B - NRA Application (December 2006) — ED78A (DO - 2 64): Guidelines for Approval of the Provision and Use of Air Traffic Services Supported by data communications; — ED - 102 (DO - 260): MOPS for 1090MHz for ADS - B — DO - 260A: MOPS for 1090MHz for ADS - B — ED - 73B (DO - 181C): Minimum Operational Performance Specific ation for Secondary Surveillance Radar Mode S Transponders — E D - 26: MPS for airborne altitude measurements and coding systems 4.5 Related ICAO Standards and Manuals — PANS - ATM, Doc 4444, Amendment 4: Procedures for Air Navigation Services – Air Traffic Man agement — Annex 10 (Volume III & IV): Aeronautical Telecommunications 5 ASSUMPTIONS Applicants should note that this AMC is based on the following assumptions.

5.1 Air Traffic Service Provider (ATSP) ATSP implements the ADS - B - NRA application complia nt with relevant requirements of the safety, performance and interoperability requirements of EUROCAE standard ED - 126.

Deviations from, or supplements to the established standards are assessed by the ATSP.

Deviations that potentially impact the airborne do main should be assessed in coordination with relev ant stakeholders as per ED78A.

Section 8 of this document, “Airworthiness Considerations”, lists permissible deviations from the target requirements related to the use of existing aircraft installations in support of initial implementations . These deviations are currently considered operationally acceptable under the assumption that ground mitigation means as discussed in the following subsections, are implemented, at the descretion of the ATSP.

Refer to sections 8.3.3, 8.3.5 an d 8.8.2.

Powered by EASA eRules Page 350 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) 5.1.1 Consistency of position quality indicators with associated position information at time of transmission In cases where position quality indicators are not consistent with actual position quality (e.g., due to uncompensated latency in posi tion transmissions), the implementing ATSP might: — treat the higher quality indicator encodings as an advised lower one (e.g.

NUC=7 may be treated as NUC=5) or, — consider, for separation purpose, a quality indicator more stringent than the one stated in ED - 126 (e.g. NUC =5 rather than NUC=4).

5.1.2 Encoding of NUC Quality Indicator (DO - 260 compliant transponders) In order to mitigate the encoding of the NUC quality indicator based on accuracy quality information (HFOM) in the case of the unavailability of the GPS RAIM function (i.e. unavailability of HPL information), the implementing ATSP may, for instance, rely on the analysis of the frequency and duration of the unavailability of the RAIM function (as part of the local safety assessment).

5.1.3 Tra nsmission of generic emergency indicator only In order to mitigate the transmission of only the generic emergency indicator (and not also the discrete codes selected by the flight crew), It is assumed that appropriate operational procedures have been esta blished by the implementing ATSP and that pilots and controllers have been trained in their use.

5.1.4 Communi cations Service Provider (CSP) In case of CSPs providing (part of) the ground surveillance data communication services (operation of ADS - B groun d stations and/or surveillance data networks), the CSP is committed to provide communication services to ATSPs with the expected Quality of Service as defined in a specific Service Level Agreement.

The Service Level Agreement is bilaterally agreed betwee n the CSP and an ATSP.

The terms of reference of the Service Level Agreement are consistent with the performance requirements of the ED - 126 document.

5.2 Ae ronautical Information Service Each State publishes in its AIP/NOTAM, or equivalent notification, information related to the surveillance provisions, schedule, relevant procedures and confirmation of compliance with ED - 126.

6 SYSTEM DESCRIPTION The basic concept of ADS - B involves the broadcasting of surveillance information from aircraft via a data link.

To support the ADS - B - NRA application, the overall ADS - B avionics system (in the following referred to as “ADS - B System”) would need to provide the following functions: — Adequate sur veillance data provision capability; — ADS - B message processing (encoding and generation); — ADS - B message transmission (1090 MHz ES airborne surveillance data - link); Powered by EASA eRules Page 351 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) Whereas the latter two functions are incorporated in the 1090 MHz ES ADS - B transmit syst em, the surveillance data provision is realised through various on - board surveillance data sources (e.g. horizontal position source, barometric altimetry, ATC transponder control panel).

The horizontal position accuracy and integrity requirements of the ADS - B - NRA application are associated with quality indicators which form part of the air - to - ground ADS - B message exchange. The interconnecting avionics architecture is part of the ADS - B Syst em.

7 FUNCTIONAL CRITERIA Note: ICAO and EUROCAE/RTCA interoperability references, including aspects of range and resolution of the various data items listed hereafter, for both ED - 102/DO - 260 and DO - 260A equipment - based ADS - B transmit systems, are presen ted in Appendix 4 .

7.1 In line with ED - 126 (section 4), the ADS - B System needs to meet the following surveillance data transmission requirements, as a minimum: — A unique ICAO 24 bit aircraft address (contained within each ADS - B message transmission); — Horizontal Position (latitude and longitude); — Horizontal Position Quality Indicator(s) (position integrity for both ED - 102/DO - 260 and DO - 260A based ADS - B transmit systems, as well as accuracy for DO - 260A based ADS - B transmit systems); — Barometric Altitude; — Aircraft Identification; — Special Position Identification (SPI); — Emergency Status and Emergency Indicator; — Version Number (in aircraft operational status message, if avio nics are DO - 260A compliant).

7.2 In line with ED - 126 (section 4), it is recommended that the ADS - B System meets the following optional surveillance data transmission requirement: — Ground Velocity.

8 AIRWORTHINESS CONSIDERATIONS 8.1 Airworthiness Certi fication Objectives For the purposes of the ADS - B - NRA application, the ADS - B System installed in the aircraft needs to be designed to deliver data that satisfy the airborne domain requirements in line with ED - 126 Section 3.4, ( Appendix 3 provides a summary for information purposes).

8.2 ADS - B System 8.2.1 The (overall) ADS - B System integrity level with respect to the processing of horizontal position data and horizontal positi on quality indicators, covering the processing (and data exchange) chain from horizontal position data source(s) to ADS - B transmit data string encoding) needs to be 10 - 5/fh (refer also to Table 1 in Appendix 3 ).

Note 1: this integrity level is required to adequately protect against the corruption of horizontal position data and horizontal position quality indicators when apply ing separation.

Powered by EASA eRules Page 352 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) Note 2: These performance figures have been set for the “ADS - B out” function, to be used in ADS - B NRA operations as laid down by the Operational Safety Assessment in Annex C of ED 126.

Note 3: Compliance with these performance figures do n ot constitute per se a demonstration that the safety objectives of ADS - B NRA operations allocated to avionics are achieved.

Note 4: Also refer to § 3.1.

8.2.2 The (overall) ADS - B System continuity level needs to be 2*10 - 4/fh (refer also to Table 1 in Appendix 3 ).

Note 1: These performance figures have been set for the “ADS - B out” function, to be used in ADS - B NRA operations as laid down by the Operational Safety Assessment in Ann ex C of ED 126; Note 2: Compliance with these performance figures do not constitute per se a demonstration that the safety objectives of ADS - B NRA operations allocated to avionics are achieved; Note 3: Also refer to § 3.1.

8.2.3 The latency of the horizontal position d ata, including any uncompensated latency, introduced by the (overall) ADS - B System does not exceed 1.5 second in 95% and 3 seconds in 99.9% of all ADS - B message transmission cases (refer also to Table 1 in Appendix 3 ).

8.3 ADS - B Transmit System 8.3.1 Compliance with the air - ground interoperability requirements, as specified in ED - 126 and presented in Section 7.1 and Appendix 4 , needs to be demonstrated.

8.3.2. For 1090 MHz Extended Squitter ADS - B transmit systems, this should be demonstrated by the relevant tests documented in: — ED - 73B/ETSO - 2C112b (or DO - 181C); — ED - 102, as a minimum, or an equivalent s tandard which is acceptable to the Agency (e.g. DO - 260 or DO - 260A).

8.3.3 ADS - B transmit systems need to transmit horizontal position quality indicators consistent with the associated position information at the time of transmission.

For the expression of the position accuracy quality, the related indicator should therefore reflect: — The quality (in terms of both integrity and accuracy) of the position measurement itself; and — Any (uncompensated) latency in curring prior to transmission.

Note: guidance on the quality indicators is provided in A ppendix 4 .

The applicant needs to demonstrate the correctness of consistent quality indicator encodings in line with (minimum) position source quality and any (uncompensated) maximum latency as expressed in 8.2.3.

Powered by EASA eRules Page 353 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) Per missible deviation for initial implementations: For initial implementations, some aircraft installations may not take into account any (uncompensated) latency in the encoding of the position accuracy quality indicator as applicable at the time of transmis sion. Hence, such installations might transmit horizontal position quality indicators that are consistent with the associated position information only for lower quality indicator encodings (e.g.

NUC=5 or NAC=5) but not higher ones (e.g. NUC=7 or NAC=7). Such deviation from the above target requirement need to be listed in the Aircraft Flight Manual (refer to Section 9.3).

8.3.4 The value of the horizontal position quality indicators need to be based on the integrity information for the encoding of the ED - 102/DO - 260 related NUC and the DO - 260A related NIC quality indicator, as related to the horizontal position sources.

In addition, the encoding of the DO - 260A NAC quality indicator needs to be based on the accuracy information of the horizontal position sources.

8.3.5 In case of ED - 102/DO - 260 based ADS - B transmit systems, the NUC Quality Indicator value need to be encoded based on the integrity containment radius only.

Permissible deviation for initial implementations: For initial implementations, some GNSS position source based aircraft installations may encode the NUC Quality Indicator on accuracy quality information (HFOM) under rare satellite constellation circumstances leading to the temporary unavailability of the integrity monitoring (RAIM) f unction (i.e. unavailability of integrity containment radius calculation). Such deviation from the above target requirement need to be listed in the Aircraft Flight Manual (refer to Section 9.3).

8.3.6 If the ADS - B transmit system does not have a means t o determine an appropriate integrity containment radius and a valid position is reported, then the Quality Indicator (i.e. NUC or NIC) need to be encoded to indicate that the integrity containment radius is unknown (i.e. NUC/NIC should be set to ‘zero’).

8.3.7 Transmitter antenna installation needs to comply with guidance for installation of ATC transponders to ensure satisfactory functioning. (Also refer to ED - 73B) 8.3.8 If more than one ADS - B transmit system is installed, simultaneous operation of both transmit systems needs to be prevented.

8.4 Horizontal Position Data Sources 8.4.1 The requirements on horizontal position data sources are based on the ED - 126 safety a nd performance assessments.

8.4.2 Components of horizontal position data sources external to the aircraft ADS - B system (such as the GNSS space segment) fall outside these airworthiness This is a consequence of the definition of the quality indicator encoding describing an interval of values between a lower an d an upper bound (refer also to Appendix 4.2). For instance, a NUC=5 encoding expresses an upper bound of position accur acy quality indication of 0.3NM whilst a NUC=7 encoding expresses an upper bound of 0.05NM. Therefore, in case of e.g. the actual GNSS position source performance, a NUC=5 encoding provides sufficient margin to also correctly express the effects of on - boar d uncompensated latency whilst this is not the case for a NUC=7 encoding any more.

I.e. GNSS conformant HPL/HIL information.

Powered by EASA eRules Page 354 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) considerations. Such external components are assumed to operate in ac cordance with their specified nominal performance .

Nevertheless, failures of the external data source components are required to be detected through on - board monitoring (as expressed in section 8.4.3).

8.4.3 Any eligible horizontal position data source needs to meet the following minimum requirements (refer also to Table 2 in Appendix 3 ): — Correct encoding of quality indicator inform ation in line with the actual performance of the selected horizontal position data source(s), i.e. in relation to position integrity containment bound (ED - 102/DO - 260 and DO - 260A ADS - B transmit systems) and position accuracy (DO - 260A ADS - B transmit systems) ; - 4 2 — Position source failure probability: 10 per hour ; — Position integrity alert failure probability, commensurate with the 3 - 3 performance characteristics of GNSS integrity monitoring : 10 (per position source failure event); — Position integrity time to alert: 10 seconds.

8.4.4 If available and valid, integrity containment radius information should be provided to the ADS - B transmit system from the position data source, or equivalent, on the same interface as and together with each positional data.

8.4.5 If the integrity containment radius is not provided by the horizontal position data source, the ADS - B transmit system may use other means to establish an appropriate integrity containment radius , provided a requirements compliant integrity alert m echanism is available.

8.4.6 Use of GNSS Systems as Primary Position Data Source 8.4.6.1 GNSS is considered as primary horizontal position data source for the provision of an acceptable accuracy and integrity performance in support of the ATC separatio n services contained within the ADS - B - NRA application.

The ED - 126 safety and performance assessments are based on the specified performance and characteristics of GNSS systems, including receiver autonomous integrity monitoring. Therefore, for GNSS syste ms as specified in section 8.4.6.2, a safety and performance demonstration is not required.

8.4.6.2 If GNSS is used as a positional source, the GNSS system should be either compatible with: — ETSO C - 129A, TSO C - 129 or TSO C - 129A; or — ETSO C - 145/C - 146 or T SO C - 145A/C - 146A, For GNSS based systems, this includes satellite constellation aspects.

For GNSS based position sources, the failure occurs outside the aircraft system and is therefore expressed as per ATSU - hour. Proof of - 5 compliance of alternative solely aircraft based sources should take this into account and might have to express the requireme nt as 10 per flight hour (i.e. for the e n - route environment).

As realised through receiver autonomous integrity monitoring (RAIM), including its characteristics of increasingly less likel y to fail for position errors beyond the horizontal protection limit. Within ED - 126, the position source fa ilure is modelled as a bias error that equals the integrity containment radius.

E.g. HPL/HIL based upon known RAIM protection threshold.

Powered by EASA eRules Page 355 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) capable of delivering position data with a periodic interval of at least 1.2 s .

8.4.6.3 For GNSS systems compatible with (E)TSO C - 129 (any revision), it is highly desired that the system incorporates Fault Detection and Exclusion cap ability as defined in AC 20 - 138A, Appendix 1, “GPS as a Primary Means of Navigation for Oceanic/Remote Operations”.

8.4.7 Use of Alternative Compliant Position Data Sources As the ED - 126 safety and performance assessments are based on the performance and characteristics of GNSS systems, for alternative position sources a dedicated safety and performance assessment is required to demonstrate compliance with the ED - 126 requirem ents.

8.4.8 Use of Temporary Back - up Position Data Sources Back - up position data sources not complying with the requirements referred to in section 8.4.3 may prove very useful in enhancing the continuity of ADS - B surveillance provision during temporary outages of the primary (or equivalent alternative) position data sources.

Any such back - up position data source needs to report its accuracy and integrity performance to the ADS - B transmit system, in a format compliant with ED - 102/DO - 260 or DO - 260A, as ap propriate.

8.5 Barometric Altitude Data Sources 8.5.1 Pressure altitude provided to the ADS - B transmit system needs to be in accordance with existing requirements for ATC transponders.

8.5.2 The digitizer code selected needs to correspond to within p lus or minus 38.1 m (125 ft), on a 95% probability basis, with the pressure - altitude information (referenced to the standard pressure setting of 1013.25 hectopascals), used on board the aircraft to adhere to the assigned flight profile. (ICAO Annex 10, Vol IV, 3.1.1.7.12.2.4. See also EUROCAE ED - 26).

The performance of the encoders and of the sensors needs to be independent from the pressure setting selected.

8.5.3 The transponder should indicate correctly the altitude resolution (quantisation) used, i.e. 25ft (from an appropriate source, default resolution) or 100ft (Gillham’s coded source, permissible alternative resolution).

The conversion of Gillham’s coded dat a to another format before inputting to the transponder is not permitted unless failure detection can be provided and the resolution (quantisation) is set in the transmitted data to indicate 100ft.

8.5.4 In case more stringent barometric altimetry requ irements are applicable in line with e.g. airspace requirements (e.g. RVSM) or other function requirements (e.g.

ACAS II), then these requirements and their related regulation take precedence.

ETSO C - 145/C146 provides additional capabilities compared with ETSO C129A such as: processing of GPS without Select ive Availability, processing of SBAS signals when available and Fault Detection Exclusion as a basic function. Therefore ETSO C145/146 usually provides higher quality integrity valu es than ETSO C - 129A equipment.

For instance, this need can be satisfied by means of dual independent altitude corrected sensors together with an altitude data comparator (which may be incorporated and enabled in the ADS - B transmit system).

Powered by EASA eRules Page 356 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) 8.6 Aircraft Identification 8.6.1 Identification needs to b e provided to the ADS - B transmit system so that the information is identical to the filed ICAO flight plan. This information may be provided from: — A flight management system; or — A pilot control panel; or — For aircraft, which always operate with the sa me flight identification (e.g.

using registration as the flight identification) it may be programmed into equipment at installation.

8.6.2 In case no ICAO flight plan is filed, the Aircraft Registration needs to be provided to the ADS - B transmit system.

8.7 Special Position Identification (SPI) For ATC transponder - based ADS - B transmit systems, the SPI capability needs to be provided. The SPI capability should be integrated into the transponder functionality and should be controlled from the transponder control panel.

8.8 Emergency Status/Emergency Indicator 8.8.1 When an emergency status (i.e. discrete emergency code) has been selected by the flight crew, the emergency indicator needs to be set by the ADS - B transmit system.

8.8.2 For ATC transponder - b ased ADS - B transmit systems, the discrete emergency code declaration capability should be integrated into the transponder functionality and should be controlled from the transponder control panel.

Permissible deviation for initial implementations: For i nitial implementations, instead of the required transmission of the discrete emergency codes 7500, 7600 and 7700 when selected by the flight crew, the transmission of only the generic emergency indicator can satisfy this requirement.

Such deviation from th e above target requirement needs to be listed in the Aircraft Flight Manual (refer to Section 9.3).

8.9 Airworthiness Considerations regarding Optional Provisions 8.9.1 Ground Velocity (OPTIONAL) Ground velocity, e.g. from an approved GNSS receiver, in the form of East/West and North/South Velocity (including a velocity quality indicator) is recommended to be provided.

8.9.2 Special Position Identification (SPI) (OPTIONAL) For non - ATC transponde r - based ADS - B transmit systems (i.e. installations based on dedicated ADS - B transmitters), a discrete input or a control panel should be provided to trigger the SPI indication.

8.9.3 Emergency Status/Emergency Indicator (OPTIONAL) For non - ATC transponder - based ADS - B transmit systems (i.e. installations based on dedicated ADS - B transmitters), a discrete input or a control panel should be provided to indicate the emergency status (discrete emergency code).

Powered by EASA eRules Page 357 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) 8.9.4 Flight Deck Control Capabilities (OPTIONAL) 8.9.4.1 Means should be provided to the flight crew to modify the Aircraft Identification information when airborne.

8.9.4.2 Means should be provided to the flight crew to disable the ADS - B function on instruction from ATC without disabling the operatio n of the ATC transponder function.

Note: It is recommended to implement an independent ADS - B disabling function.

For future ADS B application such flight deck capability may become mandatory. It should be recalled that disabling the operation of the trans ponder will disable also the ACAS function.

8.9.4.3 Means should be provided to the flight crew to disable the transmission of the barometric altitude.

9 COMPLIANCE WITH THIS AMC 9.1 Airworthiness 9.1.1 When showing compliance with this AMC, the following points should be noted: a) The applicant will need to submit, to the Agency, a certification plan and a compliance statement that shows how the criteria of this AMC have been satisfied, together with e vidence resulting from the activities described in the following paragraphs.

b) Compliance with the airworthiness requirements (e.g. CS - 25) for intended function and safety may be demonstrated by equipment qualification, safety analysis of the interface between the ADS - B equipment and data sources, structural analyses of new antenna installations, equipment cooling verification, evidence of a human to machine interface, suitable for ADS - B - NRA.

c) The safety analysis of the interface between the ADS - B tr ansmit system and its data sources should show no unwanted interaction under normal or fault conditions.

d) The functionality for ADS - B - NRA application may be demonstrated by testing that verifies nominal system operation, the aircraft derived surveillanc e data contained in the ADS - B messages, and the functioning of system monitoring tools/fault detectors (if any).

9.1.2 The functionality for ADS - B - NRA application may be further demonstrated by ground testing, using ramp test equipment where appropriate, that verifies nominal system operation, the aircraft derived surveillance data contained in the ADS - B messages, and the functioning of system monitoring tools/fault detectors (if any).

Note: this limited testing assumes that the air - ground surveillance sy stems have been shown to satisfactorily perform their intended functions in the flight environment in accordance with applicable requirements .

To minimise the certification effort for follow - on installations, the applicant may claim credit, from the Agen cy, for applicable certification and test data obtained from equivalent aircraft installations.

Powered by EASA eRules Page 358 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) 9.2 Performance Where compliance with a performance requirement cannot readily be demonstrated by a test, then the performance may be verified by an alternat ive method such as analysis, including statistical analysis of measurements under operational conditions.

9.3 Aircraft Flight Manual 9.3.1 The Aircraft Flight Manual (AFM) or the Pilot’s Operating Handbook (POH), whichever is applicable, needs to provid e at least a statement of compliance that the ADS - B System complies with this AMC20 - 24 and if deviations are applicable.

Deviations, includin g those stated in this document , as appropriate may be included or referred to.

9.4 Existing installations 9.4.1 The applicant will need to submit, to the Agency, a compliance statement, which shows how the criteria of this AMC have been satisfied for existing installations.

Compl iance may be supported by design review and inspection of the installed system to confirm the availability of required features, functionality and acceptable human - machine interface.

9.4.2 Where this design review finds items of non - compliance, the appl icant may offer mitigation that demonstrates an equivalent level of safety and performance. Items presented by the applicant which impact safety, performance and interoperability requirements allocation will need to be coordinated in accordance with ED - 78A .

10 OPERATIONAL CONSIDERATIONS 10.1 General 10.1.1 The installation should be certified according to airworthiness considerations in section 8 prior to operational approval.

10.1.2 The assumptions in section 5, concerning Air Traffic and Communicat ions Services Providers, and Aeronautical Information Services, should have been satisfied.

10.1.3 A unique ICAO 24 bit aircraft address should be assigned by the responsible authority to each airframe.

10 .2 Operational Safety Aspects 10.2.1 In all case s, flight crews should comply with the surveillance provisions, schedules and relevant procedures contained in the Aeronautical Information Publications (AIP) published by the appropriate authorities.

10.2.2 Direct controller - pilot VHF voice communicatio ns should be available at all times.

10.2.3 If flight crew receive equipment indications showing that position being broadcast by the ADS - B system is in error (e.g. GPS anomaly), they should inform the ATSP, as appropriate, using any published contingency procedures.

10.2.4 When there is not an independent Flight Deck Control selection between the ADS - B function (ADS - B on/off) and the ATC transponder function, the crew must be fully aware that disabling the ADS B function will also lead to disable the ACA S function.

Refer to sections 8.3.3, 8.3.5 and 8.8.2.

Powered by EASA eRules Page 359 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) 10.3 Operations Manual and Training 10.3.1 Operations Manual 10.3.1.1 The Operations Manual should include a system description, operational and contingency procedures and training elements for use of the ADS - B - NRA application.

10.3.1.2 The Operations Manual, preferably section B, should contain the operational aspects described in this guidance material.

10.3.1.3 Operators operating under the provisions of ICAO Annex 6 Part II “International General Aviation – Aeroplanes” are not requi red to have an operations manual.

However, in order to use ADS - B applications, the operator should develop similar training and operational procedures to the ones described in this guidance material. This material may need to be approved by the State of Registry of the operator in accordan ce with national practice and sight of this approval may be required by the ADS - B navigation service provider.

10.3.2 Flight Crew Training 10.3.2.1 Aircraft operators should ensure that flight crew are thoroughly familiar with all relevant aspects of AD S - B applications.

10.3.2.2 Flight crew training should address the: a) General understanding of ADS - B - NRA operating procedures; b) Specific ADS - B associated phraseology; c) General understanding of the ADS - B technique and technology; d) Characteristics and limitations of the flight deck human - machine interface, including an overview of ADS - B environment and system descriptions; e) Need to use the ICAO defined format for ent ry of the Aircraft Identification or Aircraft Registration marking as applicable to the flight; Note 1: ICAO Document 8168 - OPS/611 Volume I (Procedures for Air Navigation Services) requires that flight crew of aircraft equipped with Mode “S” having an air craft identification feature should set the aircraft identification into the transponder. This setting is required to correspond to the aircraft identification that has been specified at Item 7 of the ICAO flight plan and consists of no more than seven cha racters. If the aircraft identification consists of less than seven characters, no zeros, dashes or spaces should be added. If no flight plan has been filed, the setting needs to be the same as the aircraft’s registration, again, up to a maximum of seven c haracters.

Note 2: The shortened format commonly used by airlines (a format used by International Airlines Transport Association (IATA)) is not compatible with ICAO provisions for the flight planning and ATC services used by ATC ground systems.

Powered by EASA eRules Page 360 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) f) Operat ional procedures regarding the transmission of solely the generic emergency flag in cases when the flight crew actually selected a discrete emergency code (if implemented, refer to section 8.8) and SPI; g) Indication of ADS - B transmit capability within th e ICAO flight plan but only when the aircraft is certified according to this AMC; h) Handling of data source errors (e.g. discrepancies between navigation data sources) (refer to 10.2.3); i) Incident reporting procedures; j) Crew Resources Management an d associated human factors issues.

10.4 Incident reporting Significant incidents associated with ATC surveillance information transmitted by the ADS - B data link that affects or could affect the safe operation of the aircraft will need to be reported in ac cordance with EU - OPS 1.420 (or nationa l regulations, as applicable).

10.5 Minimum Equipment List The MEL will need to be revised to indicate the possibility of despatch of aircraft with the ADS - B system unserviceab le or partially unserviceable.

11 MAINTEN ANCE 11.1 Maintenance tests should include a periodic verification check of aircraft derived data including the ICAO 24 bit aircraft address using suitable ramp test equipment. The check of the 24 bit aircraft address should be made also in the event of a change of state of registration of the aircraft.

11.2 Maintenance tests should check the correct functioning of system fault detectors (if any).

11.3 Maintenance tests at ADS - B transmit system level for encoding altitude sensors with Gillham’s code out put should be based on the transition points defined in EUROCAE ED - 26, Table 13.

11.4 Periodicity for the check of the ADS - B transmitter should be established.

12 AVAILABILITY OF DOCUM ENTS EASA documents are available from http://www.easa.europa.eu .

JAA documents are available from the JAA publisher Information Handling Services (IHS).

Information on prices, where and how to order is available on both the JAA web site www.jaa.nl and th e IHS web site www.avdataworks.com .

ICAO documents may be purchased from Document Sales Unit, International Civil Aviation Organisation, 999 University Street, Montreal, Quebec, C anada H3C 5H7, (Fax: 1 514 954 6769, e - mail: sales_unit@icao.org ) or through national agencies.

EUROCAE documents may be purchased from EUROCAE, 102 rue Etienne Dolet, 92240 MALAK OFF, France, (Fax: 33 1 46556265). Web site: www.eurocae.org .

RTCA documents may be purchased from RTCA, Incorporated, 1828 L Street, Northwest, Suite 820, Washington, D.C. 20036 - 4001 U.S.A. Web site: www.rtca.org .

Powered by EASA eRules Page 361 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERA L of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) EUROCONTROL documents may be requ ested from EUROCONTROL, Documentation Centre, GS4, Rue de la Fusee, 96, B - 1130 Brussels, Belgium; (Fax: 32 2 729 9109 or web site www.eurocontrol.int ).

FAA documents may be obtaine d from Department of Transportation, Subsequent Distribution th Office SVC - 121.23, Ardmore East Business Centre, 3341 Q 75 Av enue, Landover, MD 20785, USA.

Australia CASA documents are available from http://www.casa.gov .au/ .

[Amdt 20/3]

Appen dix 1 to AMC 20 - 24

ED Decision 2008/004/R Appendix 1.1: Common Terms Reference should be made to EUROCAE document ED - 126 for the definitions of terms.

Appendix 1.2: Abbreviations ADS - B Automatic Dependent Surveillance - Broadcast ADS - B - NRA Enhanced ATS in Non - Radar Areas using ADS - B Surveillance AFM Aircraft Flight Manual ANC Air Navigation Commission (ICAO) ATSP Air Traffic Service Provider ATC Air Traffic Control ATS Air Traffic Services ATSU Air Traffic Service Unit ATM Air Traffic Management CASCADE Co - operative ATS through Surveillance and Communication Applications Deployed in ECAC EUROCONTROL European Organisation for the Safety of Air Navigation FAA Federal Aviation Administration GNSS Global Navigation Satellite System HPL Horizontal P rotection Limit HIL Horizontal Integrity Limit ICAO International Civil Aviation Organisation INTEROP Interoperability Requirements MEL Minimum Equipment List NIC Navigation Integrity Category NACp Navigation Accuracy Category NUC Navigation Uncertainty Category POH Pilots Operating Handbook RFG Requirement Focus Group SIL Surveillance Integrity Level SPI Special Position Identifier SPR Safety and Performance Requirements SSR Secondary Surveillance Radar OSED Operational Services and Environment Definition Powered by EASA eRules Page 362 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) Rc Horizontal Position Integrity Containment Radius TMA Terminal Manoeuvring Area [Amdt 20/3]

Appendix 2 to AMC 20 - 24

ED Decision 2008/004/R Appendix 2.1: Summary of core ADS - B - NRA Operational Assumptions — The ADS - B - NRA application assumes implementation of the procedures contained in the PANS - ATM ADS - B amendment. Fallback procedures from the radar environment apply to ADS - B - NRA when necessary. For example, ATC could apply alternate procedural separation (e.g., a vertical s tandard) during degraded modes.

— En route traffic density is assumed to be the same as in the current environment in which single radar coverage wo uld enable the provision of a 5NM separation service for en route regions.

This corresponds t o low or medium density.

— Direct Controller - Pilot Communication (VHF) is assumed to be available at all times.

— It is assumed that the ADS - B coverage is known to the Control ler in the controlled airspace.

Appendix 2.2: Summary of core ADS - B - NRA Ground Domain Assumptions — Controller operating procedures are assumed to be unaffected by the selection of an ADS - B data link, i.e., the ADS - B data link is assumed to be trans parent to the controller.

— Air Traffic Controllers are assumed to follow existing procedures for coordination and transfer of aircraft. This applies to coordinating appropriate information with downstream units and complying with local agreements establis hed between ATC units regarding separation standards to be established prior to entry in to a bordering ATC unit.

— Appropriate ATS authorities are assumed to provide controllers with adequate contingency procedures in the event of ADS - B failures or degradati on.

— It is assumed that there is a monitoring capability in the ADS - B Receive Subsystem that monitors the health and operation of the equipment and sends alerts and status messages to the Air Traffic Processing Subsystem.

[Amdt 20/3]

Appendix 3 to AMC 20 - 24

ED Decision 2008/004/R Summary of ADS - B - NRA Airborne Safety and Performance Requirements Parameter Requirement - 5 Horizontal Position and Horizontal Position Quality 10 /fh Indicator(s) - 4 ADS - B System Continuity 2*10 /fh Horizontal Position Latency 1.5 sec/95% Table 1: Overall Minimum Airborne ADS - B System Requirements Uncompensated delay measured from to the time of validity of position measurement until ADS - B transmission (i.e. at RF level).

As defined in section 6.

Powered by EASA eRules Page 363 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) Parameter Requirement Horizontal Position Source — Accuracy (95%) — 5 NM Sep: 926 m — Integrity — Containment Radius (Rc) — 5 NM Sep: Rc=2 NM - 4 1 — Source Failure Probability 10 /h - 3 — Alert Failure Probability 10 (per position source failure event) — Time to Alert — 5 NM Sep: 10 sec Table 2: Minimum Horizont al Position Source Requirements Note: for DO - 260 based ADS - B transmit systems, the related encoding of the horizontal position quality indicator through the Navigation Uncertainty Category (NUC) effectively leads to a containment radius requirement of 1NM for a 5 NM separation service.

Note: accuracy and integrity containment radius requirements are expressed here as guidance to related horizontal position source regulation (refer to section 8.4).

Note: the containment bound requirements reflect the outcomes of both the collision risk a ssessment (CAP) and time - to - alert assessment.

Note: the accuracy and integrity containment radius requirements have to be met by the horizontal position source, taking into account the effects of on - board latency (if not compensated for).

An uncompensate d latency of 1.5 seconds translates into a dilution in the order of 450 metres (assuming an aircraft speed of 600 knots in en - route airspace). This value of 450 metres has to be added to the actual performance of the horizontal position source(s), the sum of which has to be within the required bounds.

The GNSS equipment specified in 8.4.6 meets the overall accuracy and integrity requirements, including the effects of an uncompensated latency of maximum 1.5 second accumulated u p to the time of transmission.

Parameter Requirement Barometric Altitude — Accuracy: as per the installed sensors (refer to section 8.5.2) — Maximum Latency: 1 sec (as for SSR) Aircraft Identification, SPI, Emergency Status As for SSR [AMC20 - 13].

Table 3: Other Minimum ADS - B Surveillance Data Requirements Parameter Loss Corruption Note Barometric Alt itude Minor Minor As for SSR [AMC20 - 13].

Aircraft Identification Minor Minor As for SSR.[AMC20 - 13] Table 4: Failure Condition Categories [Amdt 20/3] For GNSS based functions, expressed as an assumption of GNSS performance.

Powered by EASA eRules Page 364 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20)

Appendix 4 to AMC 20 - 24

ED Decision 2008/004/R Appendix 4.1: Summary of ADS - B - NRA Air - to - ground Interoperability Requirements The minimum set of parameters that should be provided to support the ADS - B - NRA application are summarised in the following table extracted from ED - 126 : Version 0 Version 1 BDS Parameter ICAO Annex 10 Amendment 79, register DO - 260/ED102 DO - 260A VOL III, App to chap 5 Aircraft identification 0.8 §2.3.4 §2.2.3.2.5 §2.2.3.2.5 SPI 0.5 §2.3.2.6 §2.2.3.2.3.2 §2.2.3.2.3.2 Emergency indicator 0.5 §2.3.2.6 §2.2.3.2.3.2 §2.2.3.2.3.2 Barometric altitude 0.5 §2.3.2.4 §2.2.3.2.3.4 §2.2.3.2.3.4 Quality indicator 0.5 §2.3.1 §2.2.3.2.3.1 §2.2.3.2.3.1 (NUC/NIC) Airborne Latitude 0.5 §2.3.2.3 §2.2.3.2.3.7 §2.2.3.2.3.7 Position Longitude 0.5 §2.3.2.3 §2.2.3.2.3.8 §2.2.3.2.3.8 3 4 Emergency status 6.1 Table 2 - 97 §2.2.3.2.7.9 §2.2.3.2.7.8 Quality indicator (NACp) 6.5 No definition No definition §2.2.3.2.7.2.7 Quality indicator (SIL) 6.5 No definition No definition §2.2.3.2.3.1.1 Version Indicator 6.5 No definition No definition §A.1.4.10.5 Table 5: Mandatory ADS - B - NRA Parameters The minimum set of parameters that should be provided to support the ADS - B - NRA application are summarised in the following table extracted from ED - 126 : Version 0 Version 1 BDS Parameter ICAO Annex 10 Amendment 79, register DO - 260/ED102 DO - 260A VOL III, App to chap 5 Airborne Ground Velocity 0.9 §2.3.5 §2.2.3.2.6 §2.2.3.2.6 Table 6 : Optional ADS - B - NRA Parameters Appendix 4.2: Guidance on Encoding o f Positional Quality Indicators In order to be able to check the compliance of the actually transmitted ADS - B data with the required quality on the recipient side, ADS - B message transmissions contain “Quality Indicators”. These are expressed for ED - 102/DO - 260 and DO - 260A compliant ADS - B transmit systems as follows: — ED - 102/DO - 260: Navigation Uncertainty Category (NUC), a combined expression of (accuracy and) integrity requirements through a single parameter; The notion of version “0” and “1” differentiates between DO - 260/E D - 102 and DO - 260A transponders.

If provided by flight deck controls.

If provided by flight deck controls.

For special conditions under which the non - transmission of selected discrete emergency codes is allowed, refer to Section 8.8.2.

Only for D0 - 260A based ADS - B transmit systems.

Powered by EASA eRules Page 365 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 24 Products, Parts and Appliances (AMC - 20) — DO - 260A: Navigation Accuracy Category (NACp) to express the position accuracy (a s a 95 percentile), Navigation Integrity Category (NIC) to express the integrity containment radius and Surveillance Integrity Level (SIL) to specify the probability of the true position lying outside that containment radius without alerting.

Minimum acce ptable NUC and NIC/NACp values in support of 5 NM ADS - B - NRA separation services, based on the requirements summarised in Table 2 of Appendix 4, are as follows in line with the “NIC/NACp to NUC” conversion table below.

NUC values (encoding based on HPL, wit h the accuracy requirements met by GNSS systems by design and in line with the related NACp val ues in below conversion table): — 5 NM separation: NUC = 4; The corresponding NIC/NACp values are as follows.

— 5 NM separation: NIC = 4, NACp = 5, The SIL value is established to SIL ≥2 in line with the combination of the position source failure and position integrity alert failure requirements, as summa rised in Table 2 of Appendix 4.

Note 1: In case the SIL value is not output by the position data sources, it is recommended that the ADS - B transmit system provides for the static setting of SIL as part of the installation procedure and as demonstrated for the applicable position data sou rce configuration.

Note 2: ED - 126 provides, based on its reference collision risk analysis only, arguments for an equally appropriate encoding of a SIL=2 as a matter of expressing the system integrity as well. As for the presentation of the values present ed in this document, it is at the discretion of the ATSP to decide upon the appropriate threshold values required in support of the separ ation services in its airspace.

NUC (max Rc NM) NIC (max Rc NM) NACp (95% bound) 9 (0.003) 11 (0.004) 11 (3 m) 8 (0.01) 10 (0.013) 10 (10 m) - 9 (0.04) 9 (30 m) 7 (0.1) 8 (0.1) 8 (0.05 NM) 6 (0.2) 7 (0.2) 7 (0.1 NM) 5 (0.5) 6 (0.6) 6 (0.3 NM) 4 (1.0) 5 (1.0) 5 (0.5 NM) 3 (2.0) 4 (2.0) 4 (1 NM) - 3 (4.0) 3 (2 NM) - 2 (8.0) 2 (4 NM) 2 (10) 1 (20) 1 (10 NM) 1 (20) 1 (20) 1 (10 NM) 0 (no integrity) 0 (> 20) 0 (unknown) Table 7: NUC conversion to NIC and NACp [Amdt 20/3] Powered by EASA eRules Page 366 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 25A Products, Parts and Appliances (AMC - 20)

AMC 20 - 25A

AMC 20 - 25A Airworthiness considerations for Electronic Flight Bags

(EFBs)

ED Decision 2019/008/R 1 PURPOSE AND SCOPE This Acceptable Means of Compliance (AMC) is one, but not the only, means to obtain an airworthiness approval for installed electronic flight bags (EFBs) a nd for EFB installed resources.

Additional guidance material can be found in ICAO Doc 10020 ‘Manual of Electronic Flight Bags’.

Operational considerations for the evaluation and approval of the use o f EFB applications can be found in Commission Regulation (E U) No 965/2012.

2 REFERENCE DOCUMENTS 2.1 Related Certification Specifications CS 25.561, 25.777, 25.789, 25.1301, 25.1302, 25.1309, 25.1316, 25.1321, 25.1322, 25.1357, 25.1431, 25.1529, 25.1581 CS 23.2270, 23.2500, 23.2505, 23.2510, 23.2600, 23.2605, 23.2620 CS 29.1301, 29.1309, 29.1321, 29.1322, 29.1431, 29.1581 CS 27.1301, 27.1 309, 27.1321, 27.1322, 27.1581 Appendix G to CS - 23, Appendix H to CS - 25, and Appendices A to CS - 27 and CS - 29: Instructions for Continued Airworthiness EASA Special Condition: Information Security Protection of Aircraft Systems and Networks 2.2 Related Guidance Material EASA AMC 25.1 581 Appendix 1 – Computerised Aeroplane Flight Manual EASA AMC 25.1309 System Design and Analysis EASA AMC 25 - 11 Electronic Flight Deck Displays EUROCAE ED - 130() Guidance for the Use of Portable Electronic Devices (PEDs) on Board Aircraft EUROCAE ED - 12( ) Software Considerations in Airborne Syst ems and Equipment Certification EUROCAE ED - 1 4D/DO - 160D (or later revisions ) En vironmental Conditions and Test Procedures for Airborne Equipment EUROCAE ED - 76/RTCA DO - 200A (or later revisions) Standards for Processing Aeronautical Data EUROCAE ED - 80() Design Assurance Guidance for Airborne Electronic hardware FAA AC 120 - 76() Guidelines for the Certification, Airworthiness, and Operational Approval of Electronic Flight Bag Computing Devices FAA AC 20 - 173 Installation of Electronic Flight Bag Components Powered by EASA eRules Page 367 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 25A Products, Parts and Appliances (AMC - 20) EASA ETSO - C165A/FAA TSO - C165A Electronic Map Systems for Graphical Depicti on of Aircraft Position / Electronic Map Display Equipment for Graphical Depiction of Aircraft Position (Own - ship) RTCA DO - 178() Software Considerations in Airborne Systems and Equipment Certification RTCA DO - 254() Design Assurance Guidance for Airborne E lectronic Hardware RTCA DO - 257() Minimum Operation Performance Standards for the Depiction of Navigational Information on Electronic Maps RTCA DO - 311() Minimum Operational Performance Standards for Rechargeable Lithium Battery Systems TGM/21/0 7 Electric al Wiring Policy for certification of large Aeroplanes, Engines and Propeller 3 GLOSSARY OF TERMS IN THE CONTEXT O F THIS AMC 3.1 Consumer device Electronic equipment primarily intended for non - aeronautical use.

3.2 Data connectivity for EFB systems Data connectivity for EFB system supports either uni - or bi - directional data communication between the EFB and other aircraft systems (e.g. avionics).

Direct interconnectivity between EFBs or direct connectivity between EFBs and ground systems as with a T - PED (e.g. GSM, Bluetooth) are not covered by this definition.

3.3 Electronic Flight Bag (EFB) An electronic information system, comprised of equipment and applications for flight crew, which allows for the storing, updating, displaying, and processing of EFB functions to support flight operations or duties.

3.4 EFB host platform When considering an EFB system, the EFB host platform is the equipment (i.e. hardware) in which the computing capabilities and basic software (e.g. operating system, input/output software) reside.

3.5 EFB software application Software installed on an EFB system that pr ovides specific operational functionality.

3.6 EFB system An EFB system comprises the hardware (including any battery, connectivity provision, I/O devices) and software (including databases and operating system) that is needed to support the intended EF B application(s).

3.7 EFB system supplier The company that is responsible for developing, or for having developed the EFB system or part of it. The EFB system supplier is not necessarily a host pla tform or aircraft manufacturer.

3.8 Mounting device A mo unting device is an aircraft certified part that secures portable or installed EFB, or EFB system components.

Powered by EASA eRules Page 368 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 25A Products, Parts and Appliances (AMC - 20) 3.9 Portable Electronic Device (PED) PEDs are any kind of electronic device, typically, but not limited to, consumer electronics that is brough t on board the aircraft by crew members, passengers, or as part of the cargo, and that is not included in the configuration of the certified aircraft. It includes all equipment that is able to consume electrical energy. The electrical energy can be provide d from internal sources such as batteries (chargeable or non - rechargeable), or the devices may also be connected to specific aircraft power sources.

3.10 Software application developer The company responsible for developing, or for having developed a pa rticular software application.

3.11 Transmitting PED (T - PED ) PEDs that have intended radio frequency (RF) transmission capabilities.

4 SYSTEM DESCRIPTION AND CLASSIFICATION OF EFB SYSTEMS EFB hardware are classified in two categories: portable and in stalled.

4.1 Portable EFB A portable EFB is a portable EFB host platform, that is used on the flight deck, and that is not part of the certified aircraft configuration.

Except for installed components, portable EFBs are outside the scope of this document.

Any EFB component that is either not accessible in the flight crew compartment by the flight crew members or not removable by the flight crew, should be installed as ‘certified equipment’ covered by a type certificate (TC), changed TC or supplemental (S)TC .

4.2 Installed EFB Definition Installed EFB, means an EFB host platform that is installed in the aircraft and is considered as an aircraft part, covered, thus, by the aircraft airworthiness approval.

Complementary characteristics An installed EFB is managed under the aircraft type design configuration.

In addition to hosting EFB applications (refer to point CAT.GEN.MPA.141 for the definitions and characteristics of EFB applications), an installed EFB may host certified applications, provided that th e EFB meets the applicable certification specifications for hosting such applications, including assurance that the non - certified software applications do not adversely affect the certified application(s). For example, a robust partitioning mechanism is on e possible means to ensure the independence between certified applications and t he other types of applications.

Powered by EASA eRules Page 369 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 25A Products, Parts and Appliances (AMC - 20) 5 AIRWORTHINESS CONSIDERATIONS Airworthiness approval is necessary for installed EFB systems, as well as for EFB installed resources.

5.1 Hardware airworthiness approval 5.1.1 I nstalled resources Installed resources are the input/output components external to the EFB host platform itself, such as an installed remote display, a control device (e.g. a keyboard, pointing device, switches, et c.), or a docking station.

The installed resources should be dedicated to EFB functions only, or in the case of use of resources shared with avionics, this possibility shall be part of the approved type design. It should be demonstrated, using the appropri ate level of assessment, that the integration in the aircraft of the EFB and the EFB software applications does not jeopardise the compliance of the aircraft installed systems and equipment (including the shared resources) with the applicable certification specifications such as CS 25.1302 or 25.1309.

Installed resources require an airworthiness approval.

5.1.1.1 Mounting device The mounting device (or other securing mechanism) attaches or allows the mounting of the EFB system. The EFB system may include more than one mounting device if it consists of separate items (e.g. one docking station for the EFB host platform and one cradle for the remote display).

The mounting device should not be positioned in such a way that it creates a significant obstructio n to the flight crew’s view or hinders physical access to aircraft controls and/or displays, flight crew ingress or egress, or external vision. The design of the mounting device should allow the user easy access to any item of the EFB system, even if stowe d, and notably to the EFB controls and a clear view of the EFB display while in use. The following design practices should be considered: (a) The mounting device and associated mechanisms should not impede the flight crew in the performance of any task ( whether normal, abnormal, or emergency) that are associated with operating any aircraft system.

(b) When the mounting device is used to secure an EFB display (e.g.

portable EFB, installed EFB side display), the mount should be able to be locked in positi on easily. If necessary, the selection of positions should be adjustable enough to accommodate a range of flight crew member preferences. In addition, the range of available movement should accommodate the expected range of users’ physical abilities (i.e. anthropometrics constraints). Locking mechanisms should be of a low - wear type that will minimise slippage after extended periods of normal use.

(c) Crashworthiness considerations should be taken into account in the design of this device. This includes the appropriate restraint of any device when in use.

Powered by EASA eRules Page 370 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENER AL of Compliance for Airworthiness of AMC 20 - 25A Products, Parts and Appliances (AMC - 20) (d) When the mounting device is used to secure an EFB display (e.g. a portable EFB, an installed EFB side display), provision should be made to secure or lock the mounting device in a position out of the way of flight crew operations when it is not in use. When stowed, the device and its securing mechanism should not intrude into the flight crew compa rtment space to the extent that they cause either visual or physical obstruction of flight controls/displays and/or egress routes.

(e) Mechanical interference issues of the mounting device, either on the side panel (side stick controller) or on the control yoke, in terms of full and free movement under all operating conditions and non - interference with buckles, etc. For yoke mounted devic es, (supplemental) - type - certificate - holder data should be obtained to show that the mass inertia effect on column force has no adverse effect on the aircraft handling qualities.

(f) Adequate means should be provided (e.g. hardware or software) to shut do wn the portable EFB when its controls are not accessible by the flight crew when strapped in the normal seated position. This objective can be achieved through a dedicated installed resource certified according to 5.1.1 (e.g. a button accessible from th e f light crew seated position).

5.1.1.2 Characteristics and placement of the EFB display (a) Placement of the display The EFB display and any other element of the EFB system should be placed in such a way that they do not unduly impair the flight crew’s ex ternal view during any phase of the flight. Equally, they should not impair the view of or access to any flight - crew - compartment control or instrument.

The location of the display unit and the other EFB system elements should be assessed for their impact o n egress requirements.

When the EFB is in use (intended to be viewed or controlled), its display should be within 90 degrees on either side of each flight crew member’s line of sight.

Glare and reflection on the EFB display should not interfere with the normal duties of the flight crew or unduly impair the legibility of the EFB data.

The EFB data should be legible under the full range of lighting conditions expected in a flight crew compartment, including direct sunlight.

In addition, consideration shou ld be given to the potential for confusion that could result from the presentation of relative directions when the EFB is positioned in an orientation that is inconsistent with that information. For example, it may be misleading if the aircraft heading ind icator points to the top of the display and the display is not aligned with the aircraft longitudinal axis. This does not apply to charts that are presented in a static way (e.g. with no HMI Powered by EASA eRules Page 371 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 25A Products, Parts and Appliances (AMC - 20) mechanisation such as automatic repositioning), and that can be c onsidered to be similar to paper charts.

(b) Display characteristics Consideration should be given to the long - term degradation of a display as a result of abrasion and ageing. AMC 25 - 11 (paragraph 3.16a) can be used as appropriate guidance material to assess luminance and legibility aspects.

Users should be able to adjust the screen brightness of an EFB independently of the brightness of other displays in the flight crew compartment. In addition, when incorporating an automatic brightness adjustment, i t should operate independently for each EFB in the flight crew compartment. Brightness adjustment using software means may be acceptable providing that this operation does not affect adversely the crew workload.

Buttons and labels should have adequate ill umination for night use.

‘Buttons and labels’ refers to hardware controls located on the display itself.

The 90 - degree viewing angle on either side of each flight crew member’s line of sight may be unacceptable for certain EFB applications if aspects of t he display quality are degraded at large viewing angles (e.g. the display colours wash out or the displayed colour contrast is not discernible at the installation viewing angle).

(c) Applicable specifications In addition to the specifications of this se ction, each EFB system should be evaluated against CS 23.1321, CS 25.1321, CS 27.1321, or CS 29.1321, as applicable.

If the display is an installed resource, i t should be assessed against CS 25.1302 or in accordance with the applicable certification basis .

5.1.1.3 EFB data connectivity Portable EFBs that have data connectivity to aircraft systems, either wired or wireless, may receive or transmit data to and from aircraft systems, provided the connection (hardware and software for data connection provisions) and adequate interface protection devices are incorporated into the aircraft type design.

Connectivity p rovisions for a portable EFB may allow the EFB to receive any data from aircraft systems, but data transmission from EFBs to aircraft systems is limited to: (a) systems whose failures have no safety effect or a minor safety effect at the aircraft level ( e.g. printers); (b) aircraft systems that have been certified with the purpose of providing connectivity to non - certified devices such as PEDs or EFBs in accordance with the limitations established in the AFM; and Powered by EASA eRules Page 372 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 25A Products, Parts and Appliances (AMC - 20) (c) EFB system installed resources ac cording to Section 5.1.1.

EFB data connectivity should be validated and verified to ensure non - interference with and isolation from certified aircraft systems during data transmission and reception.

The safety assessment of the EFB data connectivity installation should include an analysis of vulnerabilities to new threats that may be introduced by the connection of the EFB to the aircraft systems (malware and unauthorised access) and their effect on s afety. This assessment should be independent and should not take any credit from the operational assessment of EFB system security, which is intended to protect EFB systems themselves.

For aircraft systems certified for the purpose of receiving data from PEDs or EFBs (case (b) above), their connectivity with PEDs/EFBs should be taken into account in their demonstration of compliance with requirements such as CS 25.1302 and 25.1309. The applicant should in particular, conduct a safety assessment demonstrati ng that the failure conditions associated with the reception of erroneous PED/EFB data have criticalities that are not higher than minor.

Adequate design measures such as preliminary flight crew review and acceptance of the imported parameters that mitigat e the risk for using erroneous data should be implemented if needed.

Any consequent airworthiness limitations should be included in the AFM (please refer to 5.2.1).

5.1.1.4 Connecting cables When cabling is installed to mate aircraft systems with an EF B, (a) if the cable is not run inside the mount, the cable should not hang loosely in such a way that compromises task performance and safety.

Flight crew should be able to easily secure the cables out of the way during operations (e.g., by using cable t ether straps); (b) cables that are external to the mounting device should be of sufficient length so that they do not obstruct the use of any movable device on the flight crew compartment; and (c) installed cables are considered electrical wiring interc onnection systems and, therefore, need to comply with CS - 25 Subpart H (FAA Part - 25, Transport Category Airplanes) or TGM/21/07 (FAA Part - 29, Transport Category Rotorcraft).

5.1.2 Installed EFB An installed EFB is considered to be a part of the aircraft, and, therefore, requires a full airworthiness approval. This host platform includes the operating system (OS).

The assessment of compliance with the airworthiness requirements would typically include two specific areas: (a) the safety assessment addressing failure conditions of the EFB system hardware of any certified application installed on the EFB, and the partition Powered by EASA eRules Page 373 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 25A Products, Parts and Appliances (AMC - 20) provided for uncertified applications and miscellaneous software applications; and (b) hardware and operat ing system software qualification conducted in accordance with the necessary development assurance level (DAL) for the system and its interfaces.

5.2 Certification documentation 5.2.1 Aircraft flight manual For installed EFBs and certified installed re sources, the AFM section or an aircraft flight manual supplement (AFMS) should contain: (a) a statement of the limited scope of the airworthiness approval of EFB provisions (e.g. these EFB provisions are only intended for EFB applications.

The airworthines s approval does not replace the operational assessment for the use of the EFB system).

(b) the identification of the installed equipment, which may include a very brief description of the installed system or resources; and (c) appropriate amendments or supplements to cover any limitations concerning: (1) the use of the EFB host platform for the installed EFB system; and (2) the use of the installed EFB provisions/resources for the portable EFB system.

For this purpose, the AFM(S) should refer to any guidelines (relevant to the airworthiness approval), intended primarily for EFB software application developers or EFB system suppliers.

5.2.2 Guidelines for EFB software application developers (installed EFB and certified installed resources) TC/STC holders for EFB installed resources or installed EFBs should compile and maintain guidelines to provide a set of limitations, considerations, and g uidance to design, develop, and integrate software applications into the installed EFB or with certified resources for portable EFB. The guidelines should address, at least, the following: (a) a description of the architecture of the EFB installed compon ents; (b) the development assurance level (DAL) of the EFB component and any assumptions, limitations, or risk mitigation means that are necessary to support this; (c) information necessary to ensure the development of a software application that is con sistent with the avionics interface and the human machine interface that is also accurate, reliable, secure, testable, and maintainable; (d) integration procedures between any new software application and those already approved; and (e) guidelines on h ow to integrate any new software application into the installed platform or installed resources.

Powered by EASA eRules Page 374 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 25A Products, Parts and Appliances (AMC - 20) The guideline document should be available at least to the aircraft operator, its competent authority, and EASA.

5.2.3 Guidelines for EFB system suppliers (installed resources for portable EFBs) TC/STC holders for installed resources of portable EFBs should provide a set of requirements and guidelines to integrate the portable EFB into the installed resources, and to desi gn and develop EFB software applications.

Guidelines that are intended primarily for use by the EFB system supplier should address, at least, the following: (a) A description of the EFB installed resources and associated limitations, if any.

For example , the: (1) intended function, limitations of use, etc.; (2) characteristics of the mounting devices, display units, control and pointing devices, printer, etc.; (3) maximum authorised characteristics (dimensions, weight, etc.) of the portable parts o f the EFB system that is supported by the mounting devices; (4) architectural description of the EFB provisions, including normal/abnormal/manual/automatic reconfigurations; and (5) normal/abnormal/emergency/maintenance procedures including the allowed phases of the flight.

(b) Characteristics and limitations, including safety and security considerations concerning: (1) the power supply; (2) the laptop battery; and (3) data connectivity.

The guidelines should be available at least to the operator , its competent authority, and EASA.

[Amdt 20/12] [Amdt 20/16] Powered by EASA eRules Page 375 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20)

AMC 20 - 29

AMC 20 - 29 Composite Aircraft Structure

ED Decision 2010/003/R 1. PURPOSE This AMC provides an acceptable means, but not the only means, for airworthiness certification of composite aircraft structures. Guidance information is also presented on the closely related design, manufacturing and maintenance aspects. This AMC primarily addresses carbon and glass fibre reinforced plastic structures, although many aspects of this doc ument are also applicable to other forms of structure, e.g. metal bonded structure, wooden structure, etc.

Note: When applying this guidance to other forms of structure, additional design considerations may be necessary and other appropriate references sho uld also be consulted.

2. OBJECTIVE AMC 20 - 29 standardises recognised good design practices common to composite aircraft structures in one document.

For rotorcraft, AMC 20 - 29 complements existing AMC to CS - 27 and CS - 29 (referring to FAA AC 27 - 1B MG8 and AC 29 - 2C MG8).

3. APPLICABILITY This AMC provides Acceptable Means of Compliance with the provisions of CS - 23, CS - 25, CS - 27 and CS - 29. Many of the concepts included in this AMC may also be applicable in part or in full to other CSs. However, when using this AMC as an Acceptable Means of Compliance for these other CSs, appropriate engineering judgement should be exercised and early agreement with the Agency sought.

This AMC applies to: applicants for a type - certificate, restricted type - certificate or supplemen tal type - certificate; certificate/approval holders; parts manufacturers; material suppliers; and maintenance and repair organisations.

Note: The technical content of this AMC is harmonised with FAA Advisory Circular AC 20 - 107B, dated 8 September 2009.

4. R ELATED REGULATIONS AND GUIDANCE a. Applicable paragraphs are listed in Appendix 1 .

b. Relevant guidance considered complementary to this AMC is provided in Appendix 1 .

5. GENERAL a. The procedures outlined in this AMC provide Acceptable Means of Compliance and Guidance Material for composite structures, particularly those that are essential in maintaining t he overall flight safety of the aircraft (“critical structure” as defined in Appendix 2 ). This AMC is published to aid in the evaluation of certification programmes for composite a pplications and to reflect the current status of composite technology. It is expected that this AMC will be modified periodically to reflect the continued evolution of composite technology and the data collected from service experien ce and expanding applic ations.

b. There are factors unique to the specific composite materials and processes used for a given application. For example, the environmental sensitivity, anisotropic properties, and Powered by EASA eRules Page 376 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) heterogeneous nature of composites can make the determination of str uctural failure loads, modes, and locations difficult. The reliability of such evaluation depends on repeatable structural details created by scaled manufacturing or repair processes. The extent of testing and/or analysis may differ for a structure dependi ng upon the criticality to flight safety, expected service usage, the material and processes selected, the design margins, the failure criteria, the database and experience with similar structures, and on other factors affecting a particular structure. It is expected that these factors will be considered when interpreting this AMC for use on a specific application.

c. Definitions of terms used in this AMC can be found in Appendix 2 .

6. MATERIAL AND FABRICATION DEVELOPMENT All composite materials and processes used in structures are qualified through enough fabrication trials and tests to demonstrate a reproducible and reliable design. One of the important features of composite constr uction is the degree of care needed in the procurement and processing of composite materials. The final mechanical behaviour of a given composite material may vary greatly depending on the processing methods employed to fabricate production parts. Special care needs to be taken in controlling both the materials being procured and how the material is processed once delivered to the fabrication facility. The CSs (namely paragraphs 2x.603 and 2x.605) specify the need to procure and process materials under appr oved material and process specifications that control the key parameters governing performance. These paragraphs outline a need to protect structures against the degradation possible in service. They also require that the design account for any changes in performance (e.g., environmental and variability effects) permitted by material and process specifications.

a. Material and Process Control (1) Specifications covering material, material processing, and fabrication procedures are established to ensure a ba sis for fabricating reproducible and reliable structure.

Material specifications are required to ensure consistent material can be procured, and batch acceptance testing or statistical process controls are used to ensure material properties do not drift ov er time. Specifications covering processing procedures should be developed to ensure that repeatable and reliable structure can be manufactured. The means of processing qualification and acceptance tests defined in each material specification should be rep resentative of the expected applicable manufacturing process. The process parameters for fabricating test specimens should match the process parameters to be used in manufacturing actual production parts as closely as possible. Both test and production par ts must conform to material and process specifications.

(2) Once the fabrication processes have been established, changes should undergo additional qualification, including testing of differences, before being implemented, (refer to Appendix 3 ). It is important to establish processing tolerances, material handling and storage limits, and key characteristics, which can be measured and tracked to judge part quality.

(3) Material requirements identified in procurement specifications should be based on the qualification test results for samples produced using the related process specifications. Qualification data must cover all properties important to the control of materia ls (composites and adhesives) and processes to be used for production of composite structure. Carefully selected physical, chemical, and mechanical qualification tests are used to demonstrate the formulation, stiffness, strength, durability, and reliabilit y of materials and processes for aircraft applications. It is Powered by EASA eRules Page 377 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) recommended that airframe designers and manufacturers work closely with material suppliers to properly define material requirements.

(4) T o provide an adequate design database, environmental eff ects on critical properties of the material systems and associated processes should be established.

In addition to testing in an ambient environment, variables should include extreme service temperature and moisture content conditions and effects of long - t erm durability. Qualification tests for environmental effects and long - term durability are particularly important when evaluating the materials, processes, and interface issues associated with structural bonding (refer to paragraph 6.c for related guidance ).

(5) Key characteristics and processing parameters should be specified and monitored for in - process quality control. The overall quality control plan required by the certifying agency should involve all relevant disciplines, i.e., engineering, manufactur ing, and quality control. A reliable quality control system should be in place to address special engineering requirements that arise in individual parts or areas as a result of potential failure modes, damage tolerance and flaw growth requirements, loadin gs, inspectability, and local sensitivities to manufacture and assembly.

(6) Tolerances permitted by the material and process specifications should be substantiated by analysis supported by test evidence, or tests at the coupon, element or sub - component le vel. For new production methods, repeatable processes should be demonstrated at sufficient structural scale in a way shown to be consistent with the material and process qualification tests and development of the associated specifications. This will requir e integration of the technical issues associated with product design and manufacturing details prior to a large investment in structural tests and analysis correlation. It will also ensure the relevance of quality control procedures defined to control mate rials and processes as related to the product structural details.

(7) Note that the Agency does not certify materials and processes. However, materials and processes specifications are part of the type - design subject to type - certification. Appropriate cert ification credit may be given to products and organisations using the same materials and processes in similar applications subject to substantiation and applicability. In some cases, material and processing information may become part of accepted shared da tabases used throughout the industry. New users of shared qualification databases must control the associated materials and processes through proper use of the related specifications and demonstrate their understanding by performing equivalency sampling te sts for key properties. Note that materials and processes used in European Technical Standard Order (ETSO) articles or authorisations must also be qualified and controlled.

b. Design Considerations for Manufacturing Implementation (1) Process specification s and manufacturing documentation are needed to control composite fabrication and assembly. The environment and cleanliness of facilities are controlled to a level validated by qualification and proof of structure testing.

Raw and ancillary materials are c ontrolled to specification requirements that are consistent with material and process qualifications. Parts fabricated should meet design drawing tolerances obtained from the production tolerances validated in qualification, design data development, and pr oof of structure tests. Some key Powered by EASA eRules Page 378 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) fabrication process considerations requiring such control include: (i) material handling and storage, (ii) laminate layup and bagging (or other alternate process steps for non - laminated material forms and advanced processes ), (iii) mating part dimensional tolerance control, (iv) part cure (thermal management), (v) machining and assembly, (vi) cured part inspection and handling procedures, and (vii) technician training for specific material, processes, tooling and equipment.

(2) Substantiating data is needed for design to justify all known defects, damage and anomalies allowed to remain in service without rework or repair. Adequate manufacturing records support the identification and substantiation of known defects, damage and anomalies.

(3) Additional substantiating design data is needed from new suppliers of parts previously certificated. This may be supported by manufacturing trials and quality assessments to ensure equivalent production and repeatability. Some destructive i nspection of critical structural details is needed for manufacturing flaws that are not end item inspectable and require process controls to ensure reliable fabrication.

c. Structural Bonding Bonded structures include multiple interfaces (e.g., composite - t o - composite, composite - to - metal, or metal - to - metal), where at least one of the interfaces requires additional surface preparation prior to bonding. The general nature of technical parameters that govern different types of bonded structures are similar. A q ualified bonding process is documented after demonstrating repeatable and reliable processing steps such as surface preparation. It entails understanding the sensitivity of structural performance based upon expected variation permitted per the process. Cha racterisation outside the process limits is recommended to ensure process robustness. In the case of bonding composite interfaces, a qualified surface preparation of all previously cured substrates is needed to activate their surface for chemical adhesion. For all bonding interfaces, regardless if on metallic or previously cured composite substrates, a qualified surface preparation is needed to activate their surface for chemical adhesion. Many technical issues for bonding require cross - functional teams for successful applications. Applications require stringent process control and a thorough substantiation of structural integrity.

(1) Many bond failures and problems in service have been traced to invalid qualifications or insufficient quality control of pro duction processes. Physical and chemical tests may be used to control surface preparation, adhesive mixing, viscosity, and cure properties (e.g., density, degree of cure, glass transition temperature). Lap shear stiffness and strength are common mechanical tests for adhesive and bond process qualification. Shear tests do not provide a reliable measure of long - term durability and environmental degradation associated with poor bonding processes (i.e., lack of adhesion). Some type of peel test has proven more reliable for evaluating proper adhesion. Without chemical bonding, the so - called condition of a “weak bond” exists when the bonded joint is either loaded by peel forces or exposed to the environment over a long period of time, or both.

Adhesion failures, w hich indicate the lack of chemical bonding between substrate and adhesive materials, are considered an unacceptable failure mode in all test types. Material or bond process problems that lead to adhesion failures are solved before proceeding with qualifica tion tests.

Powered by EASA eRules Page 379 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENE RAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) (2) Process specifications are needed to control adhesive bonding in manufacturing and repair. A “process control mentality”, which includes a combination of in - process inspections and tests, has proven to be the most reliable means of ensuring the quality of adhesive bonds. The environment and cleanliness of facilities used for bonding processes are controlled to a level validated by qualification and proof of structure testing. Adhesives and substrate materials are controlled to specif ication requirements that are consistent with material and bond process qualifications. The bonding processes used for production and repair meet tolerances validated in qualification, design data development, and proof of structure tests. Some key bond fa brication process considerations requiring such control include: (i) material handling and storage, (ii) bond surface preparation, (iii) mating part dimensional tolerance control, (iv) adhesive application and clamp - up pressure, (v) bond line thickness con trol, (vi) bonded part cure (thermal management), (vii) cured part inspection and handling procedures, and (vii) bond technician training for specific material, processes, tooling and equipment. Bond surface preparation and subsequent handling controls lea ding up to the bond assembly and cure must be closely controlled in time and exposure to environment and contamination.

(3) CS 23.573(a) sets the certification specification for primary composite airframe structures, including considerations for damage tol erance, fatigue, and bonded joints. Although this is a small aeroplane rule, the same performance standards are normally expected for large aeroplanes and rotorcraft (via special conditions and CRIs).

(a) For bonded j oints, CS 23.573(a)(5) states: "For any bonded joint, the failure of which would result in catastrophic loss of the aeroplane, the limit load capacity must be substantiated by one of the following methods: (i) The maximum disbonds of each bonded joint consistent with the capability to withstand the loads in paragraph (a)(3) of this section must be determined by analysis, tests, or both. Disbonds of each bonded joint greater than this must be pr evented by design features; or (ii) Proof testing must be conducted on each production article that wi ll apply the critical limit design load to each critical bonded joint; or (iii) Repeatable and reliable non - destructive inspection techniques must be established that ensure the strength of each joint."

(b) These options do not supersede the need for a qu alified bonding process and rigorous quality controls for bonded structures. For example, fail safety implied by the first option is not intended to provide adequate safety for the systematic problem of a bad bonding process applied to a fleet of aircraft structures. Instead, it gives fail safety against bonding problems that may occasionally occur over local areas (e.g., insufficient local bond contact pressure or contamination). Performing static proof tests to limit load, which is the second option, may not detect weak bonds requiring environmental exposure and time to degrade bonded joint strength. This issue should be covered by adequately demonstrating that qualified bonding materials and processes have long - term environmental durability. Finally, the third option Powered by EASA eRules Page 380 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) is open for future advancement and validation of non - destructive inspection (NDI) technology to detect weak bonds, which degrade over time and lead to adhesion failures. Such technology has not been reliably demonstrated at a production scale to date.

(4) Adhesion failures are an unacceptable failure mode for bonded structure that require immediate action by the responsible engineers to identify the specific cause and isolate all affected parts and assemblies for directed inspection and repair. Depending on the suspected severity of the bonding problem, an airworthiness directive may be required to restore the affected aircraft to an airworthy condition. Any design, manufacturing or repair details linked to the bonding problem should also be per manently corrected.

d. Environmental Considerations Environmental design criteria should be developed that identify the critical environmental exposures, including humidity and temperature, to which the material in the application under evaluation may be e xposed. Service data (e.g., moisture content as a function of time in service) can be used to ensure such criteria are realistic. In addition, the peak temperatures for composite structure installed in close proximity to aircraft systems that generate ther mal energy need to be identified for worst - case normal operation and system failure cases. Environmental design criteria are not required where existing data demonstrate that no significant environmental effects, including the effects of temperature and mo isture, exist for the material system and construction details, within the bounds of environmental exposure being considered.

(1) Experimental evidence should be provided to demonstrate that the material design values or allowables are attained with a high degree of confidence in the appropriate critical environmental exposures to be expected in service. It should be realised that the worst case environment may not be the same for all structural details (e.g., hot wet conditions can be critical for some fai lure modes, while cold dry conditions may be worse for others). The effect of the service environment on static strength, fatigue and stiffness properties and design values should be determined for the material system through tests, e.g., accelerated envir onmental tests, or from applicable service data. The maximum moisture content considered is related to that possible during the service life, which may be a function of a given part thickness, moisture diffusion properties and realistic environmental expos ures. The effects of environmental cycling (i.e., moisture and temperature) should be evaluated when the application involves fluctuations or unique design details not covered in the past. Existing test data may be used where it can be shown to be directly applicable to the material system, design details, and environmental cycling conditions characteristic of the application. All accelerated test methods should be representative of real - time environmental and load exposure. Any factors used for acceleratio n that chemically alter the material (e.g., high temperatures that cause post - cure) should be avoided to ensure behaviour representative of real environmental exposures.

(2) Depending on the design configuration, local structural details, and selected proc esses, the effects of residual stresses that depend on environment should be addressed (e.g., differential thermal expansion of attached parts).

Powered by EASA eRules Page 381 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) e. Protection of Structure Weathering, abrasion, erosion, ultraviolet radiation, and chemical environment (glycol, hydraulic fluid, fuel, cleaning agents, etc.) may cause deterioration in a composite structure. Suitable protection against and/or consideration of degradation in material properties should be provided for conditions expected in servic e and demonstrated by test and/or appropriate validated experience. Where necessary, provide provisions for ventilation and drainage. Isolation layers are needed at the interfaces between some composite and metal materials to avoid corrosion (e.g., glass p lies are used to isolate carbon composite layers from aluminium). In addition, qualification of the special fasteners and installation procedures used for parts made from composite materials need to address the galvanic corrosion issues, as well as the pot ential for damaging the composite (delamination and fibre breakage) in forming the faste ner.

f. Design Values Data used to derive design values must be obtained from stable and repeatable material that conforms to mature material and representative product ion process specifications.

This will ensure that the permitted variability of the production materials is captured in the statistical analysis used to derive the design values. Design values derived too early in the material’s development stage, before ra w material and composite part production processes have matured, may not satisfy the intent of the associated rules. Laminated material system design values should be established on the laminate level by either test of the laminate or by test of the lamina in conjunction with a test validated analytical method. Similarly, design values for non - laminated material forms and advanced composite processes must be established at the scale that best represents the material as it appears in the part or by tests of material substructure in conjunction with a test validated analytical method.

g. Structural Details For a specific structural configuration of an individual component (point design), design values may be established which include the effects of appropriat e design features (holes, joints, etc.). Specific metrics that quantify the severity of composite structural damage states caused by foreign impact damage threats are needed to perform analysis (i.e., the equivalent of a metallic crack length). As a result , testing will often be needed to characterise residual strength, including the structural effects of critical damage location and combined loads. Different levels of impact damage are generally accommodated by limiting the design strain levels for ultimat e and limit combined load design criteria. In this manner, rational analyses supported by tests can be established to characterise residual str ength for point design details.

7. PROOF OF STRUCTURE – STATIC The structural static strength substantiation of a composite design should consider all critical load cases and associated failure modes. It should also include effects of environment (including residual stresses induced during the fabrication process), ma terial and process variability, non - detectable defects or any defects that are allowed by the quality control, manufacturing acceptance criteria, and service damage allowed in maintenance documents of the end product.

The static strength of the composite d esign should be demonstrated through a programme of component ultimate load tests in the appropriate environment, unless experience with similar designs, material systems, and loadings is available to demonstrate the adequacy of the analysis supported by s ub - component, element and coupon tests, or component tests to accepted Powered by EASA eRules Page 382 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) lower load levels. The necessary experience to validate an analysis should include previous component ultimate load tests with similar designs, material systems, and load cases.

a. The effects of repeated loading and environmental exposure which may result in material property degradation should be addressed in the static strength evaluation. This can be shown by analysis supported by test evidence, by tests at the coupon, element or su b - component level, as appropriate, or alternatively by relevant existing data. Earlier discussions in this AMC address the effects of environment on material properties (paragraph 6.d) and protection of structure (paragraph 6.e). For critical loading condi tions, three approaches exist to account for prior repeated loading and/or environmental exposure in the full - scale static test.

(1) In the first approach, the full - scale static test should be conducted on structure with prior repeated loading and conditio ned to simulate the critical environmental exposure and t hen tested in that environment.

(2) The second approach relies upon coupon, element, and sub - component test data to determine the effect of repeated loading and environmental exposure on static stren gth. The degradation characterised by these tests should then be accounted for in the full - scale static strength demonstration test (e.g., overload factors), or in analysis of these results (e.g., showing a positive margin of safety with design values that include the degrading effects of environment and repeated load).

(3) In practice, aspects of the first two approaches may be combined to obtain the desired result (e.g., a full scale static test may be performed at critical operating temperature with a lo ad factor to account for moisture absorbed over the aircraft structure’s life). Alternate means to account for environment using validated tests and analyses (e.g., an equivalent temperature enhancement to account for the effect of moisture without chemica lly altering the material), may be proposed by the applicant.

b. The strength of the composite structure should be reliably established, incrementally, through a programme of analysis and a series of tests conducted using specimens of varying levels of com plexity. Often referred to in industry as the “building block” approach, these tests and analyses at the coupon, element, details, and sub - component levels can be used to address the issues of variability, environment, structural discontinuity (e.g., joint s, cut - outs or other stress risers), damage, manufacturing defects, and design or process - specific details. Typically, testing progresses from simple specimens to more complex elements and details over time. This approach allows the data collected for suff icient analysis correlation and the necessary replicates to quantify variations occurring at the larger structural scales to be economically obtained. The lessons learned from initial tests also help avoid early failures in more complex full - scale tests, w hich are more costly to conduct and often occur later in a ce rtification programme schedule.

(1) Figures 1 and 2 provide a conceptual schematic of tests typically included in the building block approach for a fixed wing and tail rotor blade structures, res pectively. The large quantity of tests needed to provide a statistical basis comes from the lowest levels (coupons and elements) and the performance of structural details are validated in a lesser number of sub - component and component tests.

Detail and sub component tests may be used to validate the ability of analysis methods to predict local strains and failure modes. Additional statistical considerations (e.g., repetitive point design testing and/or component overload Powered by EASA eRules Page 383 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) factors to cover material and process variability) will be needed when analysis validation is not achieved. The static strength substantiation programme should also consider all critical loading conditions for all Critical Structure. This includes an assessment of residual strength and stiffn ess requirements after a predetermined length of service, which takes into account damage and other degradation due to the service period.

Figure 1 - Schematic diagram of buildin g block tests for a fixed wing.

Figure 2 - Schematic diagram of building bloc k tests for a tail rotor blade.

Powered by EASA eRules Page 384 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) (2) Successful static strength substantiation of composite structures has traditionally depended on proper consideration of stress concentrations (e.g., notch sensitivity of details and impact damage), competing failure modes and out - of - plane loads. A complete building block approach to composite structural substantiation addresses most critical structural issues in test articles with increasing levels of complexity so that many areas of reliable performance can be demons trated prior to the component tests. The details and sub - component testing should establish failure criteria and account for impact damage in assembled composite structures.

Component tests are needed to provide the final validation accounting for combined loads and complex load paths, which include some out - of - plane effects.

When using the building block approach, the critical load cases and associated failure modes would be identified for component tests using the analytical methods, which ar e supported b y test validation.

c. The component static test may be performed in an ambient atmosphere if the effects of the environment are reliably predicted by building block tests and are accounted for in the static test or in the analysis of the results of the sta tic test.

d. The static test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structure including defects consistent with the limits establishe d by manufacturing acceptance criter ia.

e. The material and processing variability of the composite structure should be considered in the static strength substantiation. This is primarily achieved by establishing sufficient process and quality controls to manufacture structure and reliably substantiate the required strength by test and analysis. The scatter in strength properties due to variability in materials and processes are characterised by proper allowables or design values, which are deri ved in compliance with CS 2x.613. When the detail, sub - component and component tests show that local strains are adequately predicted and positive margins of safety exist using a validated analysis everywhere on the structure, then proof of static strength is said to be substantiated using analysis supported by test evidence.

Alternatively, in the absence of sufficient building block test data and analysis validation, overloads are needed in the component test to gain proof of static strength for the struct ure using an approach referred to as substantiated by tests. The overload factors applied in this case need to be substantiated either through tests or past experience and must account for the expected material and process variation.

f. It should be shown that impact damage that can be expected from manufacturing and service, but not more than the established threshold of detectability for the selected inspection procedure, will not reduce the structural strength below ultimate load capability. This can be shown by analysis supported by test evidence, or by a combination of tests at the coupon, element, sub - component and component levels. The realistic test assessment of impact damage requires proper consideration of the structural details and boundary condi tions. When using a visual inspection procedure, the likely impact damage at the threshold of reliable detection has been called barely visible impact damage (BVID).

Selection of impact sites for static strength substantiation should consider the criticali ty of the local structural detail, and the ability to inspect a location. The size and shape of impactors used for static strength substantiation should be consistent with likely impact damage scenarios that may go undetected for the life of an aircraft. N ote that it is possible for some designs to have detectable impact damage and still meet static strength Powered by EASA eRules Page 385 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) loads and other requirements without repair (refer to allowable damage discussions in paragraph 10.c(1)).

g. Major material and process changes on exis ting certified structure require additional static strength substantiation (e.g., refer to Appendix 3 ).

8. PROOF OF STRUCTURE – FATIGUE AND DAMAGE TOLERANCE The evaluation of composite structure should be based on the applicable certification specifications identified in the type - certification basis. Such evaluation must show that catastrophic failure due to fatigue, environmental effects, manufacturing defect s, or accidental damage will be avoided throughout the operational life of the aircraft. The nature and extent of analysis or tests on complete structures and/or portions of the primary structure will depend upon applicable previous fatigue/damage tolerant designs, construction, tests, and service experience on similar structures. In the absence of experience with similar designs, Agency - approved structural development tests of components, sub - components, and elements should be performed (following the same principles discussed in paragraph 7.b and Appendix 3 ). The following considerations are unique to the use of composite material systems and provide guidance for the method of subs tantiation selected by the applicant. When establishing details for the damage tolerance and fatigue evaluation, attention should be given to a thorough damage threat assessment, geometry, inspectability, good design practice, and the types of damage/degra dation of the structure under consideration.

— Composite damage tolerance and fatigue performance is strongly dependent on structural design details (e.g., skin laminate stacking sequence, stringer or frame spacing, stiffening element attachment details, dam age arrestment features, and structural redundancy).

— Composite damage tolerance and fatigue evaluations require substantiation in component tests unless experience with similar designs, material systems, and loadings is available to demonstrate the adequac y of the analysis supported by coupons, elements, and sub - component tests.

— Final static strength, fatigue, and damage tolerance substantiation may be gained in testing a single component test article if sufficient building block test evidence exists to ens ure that the selected sequence of repeated and static loading yield results representative of that possible in service or provide a conservative evaluation.

— Peak repeated loads are needed to practically demonstrate the fatigue and damage tolerance of compo site aircraft structure in a limited number of component tests. As a result, metal structures present in the test article generally require additional consideration and testing. The information contained in AMC 25.571 provides fatigue and damage tolerance guidance for metallic structures.

a. Damage Tolerance Evaluation (1) Damage tolerance evaluation starts with identification of structure whose failure would reduce the structural integrity of the aircraft. A damage threat assessment must be performed for the structure to determine possible locations, types, and sizes of damage considering fatigue, environmental effects, intrinsic flaws, and foreign object impact or other accidental damage (including discrete source) that may occur during manufacture, opera tion or maintenance.

(a) Currently, there are very few industry standards that outline the critical damage threats for particular composite structural applications with enough detail to establish the necessary design criteria or test and analysis protocol Powered by EASA eRules Page 386 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) for complete damage tolerance evaluation. In the absence of standards, it is the responsibility of individual applicants to perform the necessary development tasks to establish such data in support of product substantiation. Some factors to consider in dev elopment of a damage threat assessment for a particular composite structure include part function, location on the aircraft, past service data, accidental damage threats, environmental exposure, impact damage resistance, durability of assembled structural details (e.g., long - term durability of bolted and bonded joints), adjacent system interface (e.g., potential overheating or other threats associated with system failure), and anomalous service or maintenance handling events that can overload or damage the part. As related to the damage threat assessment and maintenance procedures for a given structure, the damage tolerance capability and ability to inspect for known damage threats should be developed.

(b) Foreign object impact is a concern for most composit e structures, requiring attention in the damage threat assessment. This is needed to identify impact damage severity and detectability for design and maintenance. It should include any available damage data collected from service plus an impact survey. An impact survey consists of impact tests performed with representative structure, which is subjected to boundary conditions characteristic of the real structure. Many different impact scenarios and locations should be considered in the survey, which has a go al of identifying the most critical impacts possible (i.e., those causing the most serious damage but are least detectable). When simulating accidental impact damage at representative energy levels, blunt or sharp impactors of different sizes and shapes sh ould be selected to cause the most critical and least detectable damage, according to the load conditions (e.g., tension, compression or shear). Until sufficient service experience exists to make good engineering judgments on energy and impactor variables, impact surveys should consider a wide range of conceivable impacts, including runway or ground debris, hail, tool drops, and vehicle collisions. This consideration is important to the assumptions needed for use of probabilistic damage threat assessments i n defining design criteria, inspection methods, and repeat inspection intervals for maintenance.

Service data collected over time can better define impact surveys and design criteria for subsequent products, as well as establish more rational inspection in tervals and maintenance practice. In review of such information, it should be realised that the most severe and critical impact damages, which are still possible, may not be part of the service database.

(c) Once a damage threat assessment is completed, va rious damage types can be classified into five categories of damage as described below (refer to figure 3). These categories of damage are used for communication purposes in this AMC. Other categories of damage, which help outline a specific path to fatigu e and damage tolerance substantiation, may be used by applicants in agreement with the regulatory authorities.

Powered by EASA eRules Page 387 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) Figure 3 - Schematic diagram showing design load levels versus categories of damage severity.

Category 1: Allowable damage that may go undete cted by scheduled or directed field inspection and allowable manufacturing defects. Structural substantiation for Category 1 damage includes demonstration of a reliable service life, while retaining ultimate load capability. By definition, such damage is s ubjected to the requirements and guidance associated with paragraph 7 of this AMC. Some examples of Category 1 damage include BVID and allowable defects caused in manufacturing or service (e.g., small delamination, porosity, small scratches, gouges, and mi nor environmental damage) that have substantiation data showing ultimate load is retained for the life of an aircraft structure.

Category 2: Damage that can be reliably detected by scheduled or directed field inspections performed at specified intervals. S tructural substantiation for Category 2 damage includes demonstration of a reliable inspection method and interval while retaining loads above limit load capability. The residual strength for a given Category 2 damage may depend on the chosen inspection in terval and method of inspection. Some examples of Category 2 damage include visible impact damage (VID), VID (ranging in size from small to large), deep gouges or scratches, manufacturing mistakes not evident in the factory, detectable delamination or debo nding, and major local heat or environmental degradation that will sustain sufficient residual strength until found. This type of damage should not grow or, if slow or arrested growth Powered by EASA eRules Page 388 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 2 0 - 29 Products, Parts and Appliances (AMC - 20) occurs, the level of residual strength retained for the inspection inter val is sufficiently above limit load capability.

Category 3: Damage that can be reliably detected within a few flights of occurrence by operations or ramp maintenance personnel without special skills in composite inspection. Such damage must be in a locati on such that it is obvious by clearly visible evidence or cause other indications of potential damage that becomes obvious in a short time interval because of loss of the part form, fit or function. Both indications of significant damage warrant an expande d inspection to identify the full extent of damage to the part and surrounding structural areas. In practice, structural design features may be needed to provide sufficient large damage capability to ensure limit or near limit load is maintained with easil y detectable, Category 3 damage.

Structural substantiation for Category 3 damage includes demonstration of a reliable and quick detection, while retaining limit or near limit load capability. The primary difference between Category 2 and 3 damages are the demonstration of large damage capability at limit or near limit load for the latter after a regular interval of time, which is much shorter than the former. The residual strength demonstration for Category 3 damage may be dependent on the reliable short ti me detection interval. Some examples of Category 3 damage include large VID or other obvious damage that will be caught during walk - around inspection or during the normal course of operations (e.g., fuel leaks, system malfunctions or cabin noise).

Category 4: Discrete source damage from a known incident such as flight manoeuvres is limited. Structural substantiation for Category 4 damage includes a demonstration of residual strength for loads specified in the regulations. It should be noted that pressurised structure will generally have Category 4 residual strength requirements at a level higher than shown in figure 3. Some examples of Category 4 damage include rotor burst, bird strikes (as specified in the regulations), tyre bursts, and severe in - flight hai l.

Category 5: Severe damage created by anomalous ground or flight events, which is not covered by design criteria or structural substantiation procedures. This damage is in the current guidance to ensure the engineers responsible for composite aircraft st ructure design and the Agency work with maintenance organisations in making operations personnel aware of possible damage from Category 5 events and the essential need for immediate reporting to responsible maintenance personnel. It is also the responsibil ity of structural engineers to design - in sufficient damage resistance such that Category 5 events are self - evident to the operations personnel involved. An interface is needed with engineering to properly define a suitable conditional inspection based on a vailable information from the anomalous event. Such action will facilitate the damage characterisation needed prior to repair. Some examples of Category 5 damage include severe service vehicle collisions with aircraft, anomalous flight overload conditions, abnormally hard landings, maintenance jacking errors, and loss of aircraft parts in flight, including possible subsequent high - energy, wide - area (blunt) impact with adjacent structure. Some Category 5 damage scenarios will not have clearly visual indicati ons of damage, particularly in composite structures. However, there should be knowledge of other evidence from the Powered by EASA eRules Page 389 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) related events that ensure safety is protected, starting with a complete report of possible damage by operations.

(d) The five categories of damage will be used as examples in subsequent discussion in this paragraph and in paragraphs 9 and 10. Note that Category 2, 3, 4 and 5 damages all have associated repair scenarios.

(2) Structure details, elements, and sub - components of Critical Structure should be tested under repeated loads to define the sensitivity of the structure to damage growth. This testing can form the basis for validating a no - growth approach to the damage tolerance requirements. The testing should assess the effect of t he environment on the flaw and damage growth characteristics and the no - growth validation. The environment used should be appropriate to the expected service usage. Residual stresses will develop at the interfaces between composite and metal structural ele ments in a design due to differences in thermal expansion. This component of stress will depend on the service temperature during repeated load cycling and is considered in the damage tolerance evaluation. Inspection intervals should be established, consid ering both the likelihood of a particular damage and the residual strength capability associated with this damage. The intent of this is to assure that structure is not exposed to an excessive period of time with residual strength less than ultimate, provi ding a lower safety level than in the typical slow growth situation, as illustrated in Figure 4. Conservative assumptions for capability with large damage sizes that would be detected within a few flights may be needed when probabilistic data on the likeli hood of given damage sizes does not exist.

Once the damage is detected, the component is either repaired to restore ultimate load capability or replaced.

Figure 4 - Schematic diagram of residual strength illustrating that significant accidental damage with “no - growth” should not be left in the structure w ithout repair for a long time.

(a) The traditional slow growth approach may be appropriate for certain damage types found in composites if the growth rate can be shown to be slow, stable and predictabl e. Slow growth characterisation should yield conservative and reliable results. As part of the slow growth approach, an inspection programme should be developed consisting of the frequency, Powered by EASA eRules Page 390 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) extent, and methods of inspection for inclusion in the maintenance plan.

Inspection intervals should be established such that the damage will have a very high probability of detection between the time it becomes initially detectable and the time at which the extent of the damage reduces the residual static strength to li mit load (considered as ultimate), including the effects of environment. For any detected damage size that reduces the load capability below ultimate, the component is either repaired to restore ultimate load capability or replaced. Should functional impai rment (such as unacceptable loss of stiffness) occur before the damage becomes otherwise critical, part repair or replacement will also be necessary.

(b) Another approach involving growth may be appropriate for certain damage types and design features adop ted for composites if the growth can be reliably shown to be predictable and arrested before it becomes critical.

Figure 5 shows schematic diagrams for all three damage growth approaches applied to composite structure. The arrested growth method is applica ble when the damage growth is mechanically arrested or terminated before becoming critical (residual static strength reduced to limit load), as illustrated in Figure 5. Arrested growth may occur due to design features such as a geometry change, reinforceme nt, thickness change, or a structural joint. This approach is appropriate for damage growth that is detectable and found to be reliably arrested, including all appropriate dynamic effects.

Structural details, elements, and sub - components of Critical Struct ure, components or full - scale structures, should be tested under repeated loads for validating an Arrested Growth Approach. As was the case for a “no - growth” approach to damage tolerance, inspection intervals should be established, considering the residual strength capability associated with the arrested growth damage size (refer to the dashed lines added to Figure 5 to conceptually show inspection intervals consistent with the slow growth basis). Again, this is intended to ensure that the structure does no t remain in a damaged condition with residual strength capability close to limit load for long periods of time before repair. For any damage size that reduces load capability below ultimate, the component is either repaired to restore ultimate load capabil ity or replaced.

(c) The repeated loading should be representative of anticipated service usage.

The repeated load testing should include damage levels (including impact damage) typical of those that may occur during fabrication, assembly, and in - service, consistent with the inspection techniques employed. The damage tolerance test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structure.

(3) T he extent of initially detectable damage should be established and be consistent with the inspection techniques employed during manufacture and in service. This information will naturally establish the transition between Category 1 and 2 damage types (i.e. , inspection methods used by trained inspectors in scheduled maintenance). For damage that is clearly detectable to an extent that it will likely be found before scheduled maintenance (i.e., allowing classification as Category 3 damage), detection over sho rter intervals and by untrained personnel may be permitted. Flaw/damage growth data should be obtained by repeated load cycling of intrinsic flaws or mechanically introduced damage. The number of cycles applied Powered by EASA eRules Page 391 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) to validate both growth and no - growth concept s should be statistically significant, and may be determined by load and/or life considerations and a function of damage size. The growth or no growth evaluation should be performed by analysis supported by test evidence or by tests at the coupon, e lement, or sub - component level.

Figure 5 - Illustrations of residual strength and damage size relationships for three different approaches to composite structural damage tolerance substantiation (4) The extent of damage for residual strength assessments shou ld be established, including considerations for the probability of detection using selected field inspection procedures. The first four categories of damage should be considered based on the damage threat assessment. In addition, Category 3 damage should b e detected in a walk - around inspection or through the normal course of operations. Residual strength evaluation by component or sub - component testing or by analysis supported by test evidence should be performed considering that damage. The evaluation shou ld demonstrate that the residual strength of the structure will reliably be equal to or greater than the strength required for the specified design loads (considered as ultimate), including environmental effects.

The statistical significance of reliable su b - component and detail residual strength assessments may include conservative methods and engineering judgment. It should be shown that stiffness properties have not cha nged beyond acceptable levels.

(a) For the no - growth, slow growth, arrested growth appr oaches, residual strength testing should be performed after repeated load cycling. All probabilistic analyses applied for residual strength assessments should properly account for the complex nature of damage defined from a thorough damage threat assessmen t. Conservative damage metrics are permitted in Powered by EASA eRules Page 392 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) such analyses assuming sufficient test data on repeated load and environmental exposure exists.

(b) Composite designs should afford the same level of fail - safe, multiple load path structure assurance as conve ntional metals design. Such is also the expectation in justifying the use of static strength allowables with a statistical basis of 90 percent probability with 95 percent confidence.

(c) Some special residual strength considerations for bonded structure a r e given in paragraph 6.c.(3).

(5) The repeated load spectrum developed for fatigue testing and analysis purposes should be representative of the anticipated service usage. Low amplitude load levels that can be shown not to contribute to damage growth may b e omitted.

Reducing maximum load levels is generally not accepted. Variability in repeated load behaviour should be covered by appropriate load enhancement or life scatter factors and these factors should take into account the number of specimens tested. T he use of such factors to demonstrate reliability in component tests should be consistent with the fatigue and damage tolerance behaviour characterised for the materials, processes and other design details of the str ucture in building block tests.

(6) An i nspection programme should be developed consisting of frequency, extent, and methods of inspection for inclusion in the maintenance plan. Inspection intervals should be established such that the damage will be reliably detected between the time it initiall y becomes detectable and the time at which the extent of damage reaches the limits for required residual strength capability. The potential for missed inspections should be considered.

(a) For the case of no - growth design concept, inspection intervals should be established as part of the maintenance programme. In selecting such intervals, the residual strength level associated with the assumed damages should be considered. This point was illustrated in Figures 4 and 5. Note that an acceptable inspection interval for the larger damages shown for the “no - growth” and “arrested growth” options in Figures 4 and 5 was conceptually shown as related to an acceptable slow growth basis in terms of the residual strength and time below ultimate load before damage was detected and repaired. Data on the probability of occurrence for different damage sizes also helps define an inspection interval.

(b) A thorough composite damage threat assessment and the separation of different damage sizes into categories, ea ch with associated detection methods, supports programmes using a rigorous damage tolerance assessment to avoid conservative design criteria with very large damage assumptions. In such cases, Category 2 damage types will require the structural substantiati on of well specified and reliable inspection methods applied by trained inspectors at scheduled maintenance intervals (by default, Category 1 damage is at the threshold of this evaluation). Those damages classified as Category 3 may take advantage of short er service time intervals provided sufficient structural substantiation exists with demonstrated proof that there will be early detection by untrained ramp maintenance or operations personnel. By definition, Category 4 damage will require residual strength substantiation to levels that complete a flight with Powered by EASA eRules Page 393 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) limited manoeuvres based on the associated regulatory loads. Due to the nature of service events leading to Category 4 damage, suitable inspections will need to be defined to evaluate the full extent of damage, prior to subsequent aircraft repair and return to service. By definition, Category 5 damages do not have associated damage tolerance design criteria or related structural substantiation tasks. Category 5 damage will require suitable inspections ba sed on engineering assessment of the anomalous service event, and appropriate structural repair and/or part replacement, prior to the aircraft re - entering service.

(7) The structure should be able to withstand static loads (considered as ultimate loads) wh ich are reasonably expected during a completion of the flight on which damage resulting from obvious discrete sources occur (i.e., uncontained engine failures, etc.). The extent of damage should be based on a rational assessment of service mission and pote ntial damage relating to each discrete source. Structural substantiation will be needed for the most critical Category 4 damage as related to the associated load cases. Some Category 4 damage may have high margins but will likely still require suitable ins pections since their detectability may not be consistent with the substantiations validated for Category 2 damage types.

(8) The effects of temperature, humidity, and other environmental or time - related aging factors, which may result in material property degradation, should be addressed in the damage tolerance evaluation. Unless tested in the environment, appropriate environmental factors should be derived and applied in the evaluation.

b. Fatigue Evaluation Fatigue substantiation should be accomplished by component fatigue tests or by analysis supported by test evidence, accounting for the effects of the appropriate environment.

The test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structures. Sufficient component, sub - component, element or coupon tests should be performed to establish the fatigue scatter and the environmental effects. Component, sub - component, and/or element tests may be use d to evaluate the fatigue response of structure with impact damage levels typical of those that may occur during fabrication, assembly, and in service, consistent with the inspection procedures employed. Other allowed manufacturing and service defects, whi ch would exist for the life of the structure, should also be included in fatigue testing. It should be demonstrated during the fatigue tests that the stiffness properties have not changed beyond acceptable levels.

Replacement lives should be established ba sed on the test results. By definition, Category 1 damage is subjected to fatigue evaluation and expected to retain ultimate load capability for the life of the aircraft structure.

c. Combined Damage Tolerance and Fatigue Evaluation Generally, it is approp riate for a given structure to establish both an inspection programme and demonstrate a service life to cover all detectable and non - detectable damage, respectively, which is anticipated for the intended aircraft usage. Extensions in service life should in clude evidence from component repeated load testing, fleet leader programmes (including NDI and destructive tear - down inspections), and appropriate statistical assessments of accidental damage and environment al service data considerations.

Powered by EASA eRules Page 394 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) 9. PROOF OF STRUCTURE – FLUTTER AND OTHER AEROELASTIC INSTABILITIES The aeroelastic evaluations including flutter, control reversal, divergence, and any undue loss of stability and control as a result of structural loading and resulting deformation, are required.

Flut ter and other aeroelastic instabilities must be avoided through design, quality control, mainte nance, and systems interaction.

a. The evaluation of composite structure needs to account for the effects of repeated loading, environmental exposure, and servic e damage scenarios (e.g., large Category 2, 3 or 4 damage) on critical properties such as stiffness, mass and damping. Some control surfaces exposed to large damage retain adequate residual strength margins, but the potential loss of stiffness or mass incr ease (e.g., sandwich panel disbond and/or water ingression) may adversely affect flutter and other aeroelastic characteristics. This is particularly important for control surfaces that are prone to accidental damage and environmental degradation. Other fac tors such as the weight or stiffness changes due to repair, manufacturing flaws, and multiple layers of paint need to be evaluated. There may also be issues associated with the proximity of high temperature heat sources near structural components (e.g., em pennage structure in the path of jet engine exhaust streams or engine bleed air pneumatics system ducting). These effects may be determined by analysis supported by test evidence, or by tests at the coupon, element or sub - component level.

10. CONTINUED AIR WORTHINESS The maintenance and repair of composite aircraft structure should meet all general, design and fabrication, static strength, fatigue/damage tolerance, flutter, and other considerations covered by this AMC as appropriate for the particular type o f structure and its application.

a. Design for Maintenance Composite aircraft structure should be designed for inspection and repair access in a field maintenance environment. The inspection and repair methods applied for structural details should recognis e the special documentation and training needed for critical damage types that are difficult to detect, characterise and repair. The inspection intervals and life limits for any structural details and levels of damage that preclude repair must be clearly d ocumented in the appropriate continued airworthiness documents.

b. Maintenance Practices Maintenance manuals, developed by the appropriate organisations, should include appropriate inspection, maintenance, and repair procedures for composite structures, in cluding jacking, disassembly, handling, part drying methods, and repainting instructions (including restrictions for paint colours that increase structural temperatures). Special equipment, repair materials, ancillary materials, tooling, processing procedu res, and other information needed for inspection or repair of a given part should be identified since standard field practices, which have been substantiated for different aircraft types and models, are not common.

(1) Damage Detection (a) Procedures used for damage detection must be shown to be reliable and capable of detecting degradation in structural integrity below ultimate load capability. These procedures must be documented in the appropriate sections of the instructions for continued airworthiness. This should be substantiated in static strength, environmental resistance, fatigue, and damage tolerance efforts as outlined in paragraphs 6, 7 and 8. Substantiated Powered by EASA eRules Page 395 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) detection procedures will be needed for all damage types identified by the threat assessmen t, including a wide range of foreign object impact threats, manufacturing defects, and degradation caused by overheating.

Degradation in surface layers (e.g., paints and coatings) that provide structural protection against ultraviolet exposure must be dete cted. Any degradation to the lightning strike protection system that affects structural integrity, fuel tank safety, and electrical systems must also be detected.

(b) Visual inspection is the predominant damage detection method used in the field and should be performed under prescribed lighting conditions. Visual inspection procedures should account for access, time relaxation in impact damage dent depth, and the colour, finish and cleanliness of part surfaces.

(2) Inspection. Visual indications of damage, which are often used for composite damage detection, provide limited details on the hidden parts of damage that require further investigation. As a result, additional inspection procedures used for complete composite damage characterisation will generally be different from those used for initial damage detection and need to be well documented. Non - destructive inspection performed prior to repair and destructive processing steps performed during repair must be shown to locate and determine the full extent o f the damage. In - process controls of repair quality and post - repair inspection methods must be shown to be reliable and capable of providing engineers with the data to determine degradation in structural integrity below ultimate load capability caused by t he process itself. Certain processing defects cannot be reliably detected at completion of the repair (e.g., weak bonds). In such cases, the damage threat assessment, repair design features and limits should ensure sufficient damage tolerance.

(3) Repair. All bolted and bonded repair design and processing procedures applied for a given structure shall be substantiated to meet the appropriate requirements. Of particular safety concern are the issues associated with bond material compatibilities, bond surface preparation (including drying, cleaning, and chemical activation), cure thermal management, composite machining, special composite fasteners, and installation techniques, and the associated in - process control procedures. The surface layers (e.g., paints a nd coatings) that provide structural protection against ultraviolet exposure, structural temperatures, and the lightning strike protection system must also be properly repaired.

(4) Documentation and Reporting. Documentation on all repairs must be added to the maintenance records for the specific part number. This information supports future maintenance damage disposition and repair activities performed on the same part. It is recommended that service difficulties, damage, and degradation occurring to compo site parts in service should be reported back to the design approval holder to aid in continuous updates of damage threat assessments to support future design detail and process improvements. Such information will also support future design criteria, analy sis, and test database development.

c. Substantiation of Repair (1) When repair procedures are provided in Agency approved documents or the maintenance manual, it should be demonstrated by analysis and/or test that the method and techniques of repair will restore the structure to an airworthy condition. Repairable damage limits (RDL), which outline the details for damage to Powered by EASA eRules Page 396 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) structural components that may be repaired based on existing data, must be clearly defined and documented. Allowable damage limits (ADL ), which do not require repair, must also be clearly defined and documented. Both RDL and ADL must be based on sufficient analysis and test data to meet the appropriate structural substantiation requirements and other considerations outlined in this AMC. A dditional substantiation data will generally be needed for damage types and sizes not previously considered in design development. Some damage types may require special instructions for field repair and the associated quality control.

Bonded repair is subj ected to the same structural bonding considerations as the base design (refer to paragraph 6.c).

(2) Operators and maintenance repair organisations (MRO) wishing to complete major repairs or alterations outside the scope of approved repair documentation should be aware of the extensive analysis, design, process, and test substantiation required to ensure the airworthiness of a certificated structure. Documented records and the certification approval of this substantiation should be retained in accordance with regulations to support any subsequent maintenance activities.

d. Damage Detection, Inspection and Repair Competency (1) All technicians, inspectors and engineers involved in damage disposition and repair should have the necessary skills to perform their supporting maintenance tasks on a specific composite structural part. The continuous demonstration of acquired skills goes beyond initial training (e.g., similar to a welder qualification). The repair design, inspection methods, and repair procedures used will require approved structural substantiation data for the particular composite part. Society of Automotive Engineers International (SAE) Aerospace Information Report (AIR) 5719 outlines training for an awareness of the safety issues for composite maintenance and repair. Additional training for specific skill building will be needed to execute particular engineering, inspection and repair tasks.

(2) Pilots, ramp maintenance, and other operations personnel that service aircraft should be t rained to immediately report anomalous ramp incidents and flight events that may potentially cause serious damage to composite aircraft structures.

In particular, immediate reporting is needed for those service events that are outside the scope of the dama ge tolerance substantiation and standard maintenance practices for a given structure. The immediate detection of Category 4 and 5 damages are dependent on the proper reaction of personnel that operate and service the aircraft.

11. ADDITIONAL CONSIDERATIONS a. Crashworthiness (1) The crashworthiness of the aircraft is dominated by the impact response characteristics of the fuselage. Regulations, in general, evolve based on either experience gained through incidents and accidents of existing aircraft or in an ticipation of safety issues raised by new designs. In the case of crashworthiness, regulations have evolved as experience has been gained during actual aircraft operations. For example, emergency load factors and passenger seat loads have been established to reflect dynamic conditions observed from fleet experience and from controlled FAA and industry research. Fleet experience has not demonstrated a need to have an aircraft level crashworthiness standard. As a result, the regulations reflect the capabiliti es of traditional aluminium aircraft structure under Powered by EASA eRules Page 397 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) survivable crash conditions. This approach was satisfactory as aircraft have continued to be designed using traditional construction methods. With the advent of composite fuselage structure and/or the us e of novel design, this historical approach may no longer be sufficient to substantiate the same level of protection for the passengers as provided by similar metallic designs.

(2) Airframe design should assure that occupants have every reasonable chance o f escaping serious injury under realistic and survivable crash impact conditions. A composite design should account for unique behaviour and structural characteristics, including major repairs or alterations, as compared with conventional metal airframe de signs. Structural evaluation may be done by test or analysis supported by test evidence. Service experience may also support substantiation.

(3) The crash dynamics of an aircraft and the associated energy absorption are difficult to model and fully define representative tests with respect to structural requirements. Each aircraft product type (i.e., large aeroplane, small aeroplane, and rotorcraft) has unique regulations governing the crashworthiness of particular aircraft structures. The regulations and guidance associated with each product type should be used accordingly. The regulations for large aeroplane and rotorcraft address some issues that go beyond thos e required of small aeroplanes.

( 4) Special conditions are anticipated for large aeroplane s with composite fuselage structure to address crashworthiness survivability. The impact response of a composite fuselage structure must be evaluated to ensure the survivability is not significantly different from that of a similar - sized aircraft fabricate d from metallic materials. Impact loads and resultant structural deformation of the supporting airframe and floor structures must be evaluated. Four main criteria areas should be considered in making such an evaluation.

( a) Occupants must be protected duri ng the impact event from release of items of mass (e.g., overhead bins).

(b) At least the minimum number of emergency egress paths must remain following a survivable crash.

(c) The acceleration and loads experienced by occupants during a survivable crash m ust not exceed cri tical thresholds.

(d) A survivable volume of occupant space must be retained following the impact event.

(5) The criticality of each of these four criteria will depend on the particular crash conditions. For example, the loads and acceler ations experienced by passengers may be higher at lower impact velocities where structural failures have not started to occur. As a result, validated analyses may be needed to practically cover all the crashworthiness criteria for a fuselage.

(6) Existing large aeroplane requirements also require that fuel tank structural integrity be addressed during a survivable crash impact event as related to fire safety (also refer to paragraph 11.b). As related to crashworthiness, composite fuel tank structure must no t fail or deform to the extent that fire becomes a greater hazard than with metal structure.

(7) Physics and mechanics of the crashworthiness for composite structures involve several issues. The local strength, energy absorbing characteristics, and multipl e Powered by EASA eRules Page 398 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) competing failure modes need to be addressed for composite structure subjected to a survivable crash. This is not simply achieved for airframe structures made from anisotropic, quasi - brittle, composite materials. As a result, the accelerations and load h istories experienced by passengers and equipment on a composite aircraft may differ significantly from that seen on a similar metallic aircraft unless specific considerations are designed into the composite structure. In addition, care should be taken when altering composite structure to achieve specific mechanical behaviours. (For example, where the change in behaviour of a metallic structure with a change in material thickness may be easily predicted, an addition or deletion of plies to a composite lamina te may also require data for the effects of laminate stacking sequence on the failure mode and energy absorption characteristics of a composite element).

( 8) Representative structure must be included to gain valid test and analysis results.

Depending on ai rcraft loading (requiring investigation of various aircraft passenger and cargo configurations), structural dynamic considerations, and progressive failures, local strain rates and loading conditions may differ throughout the structure. Sensitivity of the structural behaviour to reasonable impact orientation should also be considered for large aeroplane and rotorcraft applications. This can be addressed by analysis supported by test evidence.

(9) Considering a need for comparative assessments with metal str ucture and a range of crash conditions, analysis with sufficient structural test evidence is often needed for large aeroplane and rotorcraft applications. Analysis requires extensive investigation of model sensitivity to modelling parameters (e.g., mesh op timisation, representation of joints, element material input stress - strain data).

Test also requires investigation of test equipment sensitivity appropriate to composites (e.g., filter frequencies with respect to expected pulse characteristics in the struc ture). Model validation may be achieved using a building block approach, culminating in an adequately complex test (e.g., a drop test with sufficient structural details to properly evaluate the crashworthiness criteria).

b. Fire Protection, Flammability an d Thermal Issues (1) Fire and exposure to temperatures that exceed maximum operating conditions require special considerations for composite airframe structure. (Refer to note below). Requirements for flammability and fire protection of aircraft structure attempt to minimise the hazard to occupants in the event that flammable materials, fluids, or vapours ignite. The regulations associated with each aircraft product type (i.e., transport, small airplane, rotorcraft) should be used accordingly .

Compliance ma y be shown by tests or analysis supported by test evidence. A composite design, including repair and alterations, should not decrease the existing level of safety relative to metallic structure. In addition, maintenance procedures should be available to ev aluate the structural integrity of any composite aircraft structures exposed to fire and temperatures above the maximum operating conditions substantiated during design.

Note: Aircraft cabin interiors and baggage compartments have been areas of flammability concerns in protecting passenger safety. This revision of the AMC does not address composite materials used in aircraft interiors and baggage compartments. Please consult other Guidance Material for Acceptable Means of Compliance with flammabi lity rules for interiors.

Powered by EASA eRules Page 399 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) (2) Fire protection and flammability has traditionally been considered for engine mount structure, firewalls, and other powerplant structures that include composite elements. Additional issues critical to passenger safety have com e with the expanded use of composites in wing and fuselage structures for large aeroplanes. Existing regulations do not address the potential for the airframe structure itself to be flammable. Wing and fuselage applications should consider the effects of c omposite design and construction on the resulting passenger safety in the event of in - flight fires or emergency landing conditions, which combine with subsequent egress wh en a fuel - fed fire is possible.

(3) The results of fire protection and flammability t esting with structural composite parts indicate dependence upon overall design and process details, as well as the origin of the fire and its extent. For example, the overall effects of composite fuselage structures exposed to fire may be significantly dif ferent when the fire originates within the cabin, where it can be controlled by limiting the structure’s contribution to spreading the fire, than when the fire occurs exterior to the fuselage after a crash landing, where fuel is likely to be the primary so urce for maintaining and spreading the fire. The threat in each case is different, and the approach to mitigation may also be different. In - flight fire safety addresses a fire originating within the aircraft due to some fault, whereas post - crash fire safet y addresses a fuel fed pool fire external to the aircraft. Special conditions are anticipated for large aeroplanes with fuselage structure subjected to both in - flight and post - crash fire conditions. Large aeroplane wing structure will need to have special conditions for post - crash fire conditions.

(4) For an in - flight fire in large aeroplanes, it is critical that the fire not propagate or generate hazardous quantities of toxic by - products. In - flight fires have been catastrophic when they can grow in inacces sible areas. Composite fuselage structure could play a role different from traditional metal structure if the issue is not addressed.

(5) Metallic large aeroplane fuselage and wing structures have established a benchmark in fire protection that can be used to evaluate specific composite wing and fuselage structural details. Exterior fire protection issues associated with composite structure must include the effects of an exterior pool fire following a survivable crash landing. Fuselage structure should prov ide sufficient time for passenger egress, without fire penetration or the release of gasses and/or materials that are either toxic to escaping passengers or reduce visibility (smoke density) or could increase the fire severity. Furthermore, these considera tions must be extended to wing and fuel tank structure, which must also be prevented from collapse and release of fuel (including consideration of the influence of fuel load upon the structural behaviour. For large aeroplanes, the standards of CS 25.856(b) provide the benchmark to establish the required level of safety.

(6) The exposure of composite structures to high temperatures needs to extend beyond the direct flammability and fire protection issues to other thermal issues.

Many composite materials have glass transition temperatures, which mark the onset of reductions in strength and stiffness that are somewhat lower than the temperatures that can have a similar effect on equivalent metallic structure. The glass transition temperature of most composite m aterials is further reduced by moisture absorption. The reduced strength or stiffness of composites from high temperature exposures must be understood per the requirements of particular Powered by EASA eRules Page 400 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) applications (e.g., engine or other system failures). After a system f ailure and/or known fire, it may be difficult to detect the full extent of irreversible heat damage to an exposed composite structure. As a result, composite structures exposed to high temperatures may require special inspections, tests, and analysis for p roper disposition of heat damage. All appropriate damage threats and degradation mechanisms need to be identified and integrated into the damage tolerance and maintenance evaluation accordingly. Reliable inspections and test measurements of the extent of d amage that exists in a part exposed to unknown levels of high temperatures should be documented. Particular attention should be given to defining the maximum damages that likely could remain undetected by the selected inspection procedures.

c. Lightning Pr otection Lightning protection design features are needed for composite aircraft structures.

Current Carbon fibre composites are approximately 1,000 times less electrically conductive than standard aluminium materials, and composite resins and adhesives are traditionally non - conductive. Glass and aramid fibre composites are non - conductive. A lightning strike to composite structures can result in structural failure or large area damage, and it can induce high lightning current and voltage on metal hydraulic t ubes, fuel system tubes, and electrical wiring if proper conductive lightning protection is not provided. Aircraft lightning protection design guidance can be found in the FAA Technical Report “Aircraft Lightning Protection Handbook” (See Appendix 1 2.a). The lightning protection effectiveness for composite structures should be demonstrated by tests or analysis supported by tests. Such tests are typically performed on panels, coupon s, subassemblies, or coupons representative of the aircraft structure, or tests on full aircraft. The lightning test waveforms and lightning attachment zones are defined in EUROCAE ED - 84 and ED - 91. Any structural damage observed in standard lightning tests should be limited to Category 1, 2 or 3, depending on the level of detection. This damage is characterised and integrated into damage tolerance analyses and tests as appropriate.

Small simple aeroplanes certified under CS - 23 for VFR use only may be certif ied based on engineering assessment, according to AC 23 - 15A. The effects of composite structural repairs and maintenance on the lightning protection system should be evaluated. Repairs should be designed to maintain lightning protection.

(1) Lightning Prot ection for Structural Integrity (a) The composite structural design should incorporate the lightning protection when appropriate for the anticipated lightning attachment. The extent of lightning protection features depends on the lightning attachment zone designated for that area of the aircraft. Lightning protection features may include, but are not limited to, metal wires or mesh added to the outside surface of the composite structure where direct lightning attachment is expected.

(b) When lightning strik es an aircraft, very high currents flow through the airframe. Proper electrical bonding must be incorporated between structural parts. This is difficult to achieve for moveable parts (e.g., ailerons, rudders and elevators). The electrical bonding features must be sized to conduct the lightning currents or they can vaporise, sending the high currents through unintended paths such as control cables, control rods, or hydraulic tubes. Guidance for certification of lightning protection of aircraft structures can be found in EUROCAE ED - 113.

Powered by EASA eRules Page 401 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) (2) Lightning Protection for Fuel Systems (a) Special consideration must be given to the fuel system lightning protection for an aircraft with integral fuel tanks in a composite structure. Composite structure with integral fuel systems must incorporate specific lightning protection features on the external composite surfaces, on joints, on fasteners, and for structural supports for fuel system plumbing and components to eliminate structural penetration, arcing, sparks or other i gnition sources. AC 20 - 53B provides certification guidance for aircraft fuel system lightning protection.

(b) Large aeroplane regulations for fuel system ignition prevention in CS 25.981 require lightning protection that is failure tolerant. As a result, redundant and robust lightning protection for composite structure joints and fasteners in fuel tank structure is needed to ensure proper protection i n preventing ignition sources.

(3) Lightning Protection for Electrical and Electronic Systems (a) L ightning strike protection of composite structures is needed to avoid inducing high lightning voltages and currents on the wiring for electrical and electronic systems whose upset or damage could affect safe aircraft operation. The consequences from a ligh tning strike of unprotected composite structures can be catastrophic for electrical and electronic systems that perform highly critical functions, such as fly - by - wire flight controls or engine controls.

(b) Electrical shields over system wiring and robust circuit design of electrical and electronic equipment both provide some protection against system upset or damage due to lightning. Since most composite materials provide poor shielding, at best, metal foil or mesh is typically added to the composite struc ture to provide additional shielding for wiring and equipment. Electrical bonding between composite structure parts and panels should be provided for the shielding to be effective. EUROCAE ED - 81 and ED - 107 provide certification guidance for aircraft electr ical and electronic system lightning protection.

[Amdt 20/6]

Appendix 1 to AMC 20 - 29 – Applicable CSs and Relevant Guidance

ED Decision 2010/003/R 1. Applicable CSs. A list of applicable CS paragraphs is provided for subjects covered in this AMC (see notes). In most cases, these CS paragraphs apply regardless of the type of materia ls used in aircraft structures.

AMC Paragraphs CS - 23 CS - 25 CS - 27 CS - 29 1. Purpose of this AMC -------------- Not Applicable -------------- 2. To Whom this AMC Applies -------------- Not Applicable -------------- 3. Cancellation -------------- Not Applicable -------------- 4. Related Regulations and Guidance -------------- Not Applicable -------------- 5. General -------------- Not Applicable -------------- Powered by EASA eRules Page 402 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) 6. Material and Fabrication Development 603 603 603 603 605 605 605 605 609 609 609 609 613 613 613 613 619 619 619 619 7. Proof of Structure – Static 305 305 305 305 307 307 307 307 8. Proof of Structure – Fatigue and Damage 573 571 571 571 Tolerance 9. Proof of Structure – Flutter 629 629 629 629 10. Continued Airworthiness 1529 1529 1529 1529 App. G App. H App. H App. A 11. Additional Considerations a. Crashworthiness 561 561 561 561 (including impact dynamics) 562 562 562 562 601 601 601 601 631 631 721 721 783 783 783 783 785 785 785 785 787 787 787 787 789 789 801 801 801 807 807 809 809 963 963 963 965 965 965 967 967 967 967 Powered by EASA eRules Page 403 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) b. Fire Protection, Flammability and 609 609 609 609 Thermal Issues 853 853 853 853 855 855 855 855 859 859 859 859 861 861 863 863 863 863 865 865 903 903 903 1121 1121 1121 1121 1181 1181 1181 1182 1182 1183 1183 1183 1183 1185 1185 1185 1187 1187 1189 1189 1189 1189 1191 1191 1191 1191 1193 1193 1193 1193 1194 1194 c. Lightning Protection 581* 609 609 609 609 * see AMC 25.899 para.6 899* 954 954* 954 954 1309 981 1309 1309 Notes: (1) This list may not be all inclusive and there may be differences between certification agen cies (e.g.

FAA and the Agency).

(2) Special conditions may be issued in accordance with Part - 21 21 . A.16B for novel and unusual design features (e.g., new composite materials systems).

2. Guidance FAA issues guidance providing supportive information of showing compliance with regulatory requirements. Guidance may include the advisory circulars (AC) and policy statements (P S). In general, an AC presents information concerning acceptable means, but not the only means, of complying with regulations. The guidance listed below is deemed supportive to the purposes of this AMC. These FAA documents can be located via website: http://www.faa.gov/regulations_policies/ . In addition, EUROCAE have developed industry standards tha t are recognised by the Agency.

Note: Many of the FAA documents are har monised with EASA. Applicants should confirm with the Agency if in doubt regarding the status and acceptance of an y such documents by the Agency.

Powered by EASA eRules Page 404 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) a. FAA/EUROCAE guidance documents — AC 20 - 53B “Protection of Airplane Fuel Systems Against Fuel Vapor Ignition Due to Lightning” [6/06] — AC 20 - 135 "Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria" [2/90] — AC 21 - 26 "Quality Control for the Manufacture of Composite Structures" [6/89] — AC 21 - 31 "Qua lity Control for the Manufacture of Non - Metallic Compartment Interior Components" [11/91] — AC 23 - 15A “Small Airplane Certification Compliance Program” [12/03] — AC 23 - 20 "Acceptance Guidance on Material Procurement and Process Specifications for Polymer Mat rix Composite Systems" [9/03] — AC 25.571 - 1C “Damage Tolerance and Fatigue Evaluation of Structure” [4/98] — AC 29 MG 8 “Substantiation of Composite Rotorcraft Structure” [4/06] — AC 35.37 - 1A "Guidance Material for Fatigue Limit Tests and Composite Blade Fatigue Substantiation" [9/01] — AC 145 - 6 "Repair Stations for Composite and Bonded Aircraft Structure" [11/96] — RTCA DO - 160 / EUROCAE ED - 14 — EUROCAE ED - 81 “Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning” — EUROCAE ED - 84 “Aircraft Lightning Environment and Related Test Waveforms” — EUROCAE ED - 91 “Aircraft Lightning Zoning” — EUROCAE ED - 107 “Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF)” — EUROCAE ED - 113 Aircraft Lightning Direct Effects Cert ification — EUROCAE ED - 14E Environmental Conditions and Test Procedures for Airborne Equipment — FAA Technical Report “Aircraft Lightning Protection Handbook” (DOT/FAA/CT - 89/22).

b. FAA Policy Statements — "Static Strength Substantiation of Composite Airplan e Structure" [PS - ACE100 - 2001 - 006, December 2001] — "Final Policy for Flammability Testing per 14 CFR Part 23, Sections 23.853, 23.855 and 23.1359" [PS - ACE100 - 2001 - 002, January 2002] — “Material Qualification and Equivalency for Polymer Matrix Composite Mate rial Systems" [PS - ACE100 - 2002 - 006, September 2003] — “Bonded Joints and Structures - Technical Issues and Certification — Considerations” [PS - ACE100 - 2005 - 10038, September 2005] [Amdt 20/6] Powered by EASA eRules Page 405 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20)

Appendix 2 to AMC 20 - 29 – Definitions

ED Decision 2010/003/R The following definitions are applicable to AMC 20 - 29 and relevant CS paragraphs only.

Allowables : Material values that are determined from test data at the laminate or lamina le vel on a probability basis (e.g., A or B basis values, with 99% probability and 95% confidence, or 90% probability and 95% confidence, respectively). The amount of data required to derive these values is governed by the statistical significance (or basis) needed.

Anisotropic : Not isotropic; having mechanical and/or physical properties which vary with direction relative to natural reference axes inherent in the material.

Arrested Growth Approach : A method that requires demonstration that the structure, w ith defined flaws present, is able to withstand appropriate repeated loads with flaw growth which is either mechanically arrested or terminated before becoming critical (residual static strength reduced to limit load). This is to be associated with appropr iate inspection intervals and damage detectability.

Category of Damage : One of five categories of damage based on residual strength capability, required load level, detectability, inspection interval, damage threat and whether (or not) the event creatin g damage is self - evident (see Section 8(a)(1)(c)).

Component : A major section of the airframe structure (e.g., wing, body, fin, horizontal stabiliser) which can be tested as a complete unit to qualify the structure.

Coupon : A small test specimen (e.g., usually a flat laminate) for evaluation of basic lamina or l aminate properties or properties of generic structural features (e.g., bonded or mechanically fastened joints).

Critical Structure : A load bearing structure/element whose integrity is essential in maintaining the overall flight safety of the aircraft. Th is definition was adopted for this AMC because there are differences in the definitions of primary structure, secondary structure, and principle structural elements (PSE) when considering the different categories of aircraft. For example, PSE are critical structures for Large Aeroplanes.

Damage : A structural anomaly caused by manufacturing (processing, fabrication, assembly or handling) or service usage.

Debond : Same as Disbond.

Degradation : The alteration of material properties (e.g., strength, modulus , coefficient of expansion) which may result from deviations in manufacturing or from repeated loading and/or environmental exposure.

Delamination : The separation of the layers of material in a laminate. This may be local or may cover a large area of the laminate. It may occur at any time in the cure or subsequent life of the laminate and may arise from a wide variety of causes.

Design Values : Material, structural elements, and structural detail properties that have been determined from test data and ch osen to assure a high degree of confidence in the integrity of the completed structure. These values are most often based on allowables adjusted to account for actual structural conditions, and used in analysis to compute margins - of - safety.

Detail : A non - generic structural element of a more complex structural member (e.g., specific design configured joints, splices, stringers, stringer runouts, or major access holes).

Disbond : An area within a bonded interface between two adherends in which an adhesion failure or separation has occurred. It may occur at any time during the life of the substructure and may arise Powered by EASA eRules Page 406 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) from a wide variety of causes. Also, colloquially, an area of separation between two laminae in the finished laminate (in this case the term “del amination” is normally preferred).

Discrepancy : A manufacturing anomaly allowed and detected by the planned inspection procedure.

They can be created by processing, fabrication or assembly procedures.

Element : A generic part of a more complex structural member (e.g., skin, stringers, shear panels, sandwich panels, joints, or splices).

Environment : External, non - accidental conditions (excluding mechanical loading), separately or in combination, that can be expected in service and which may affect the st ructure (e.g., temperature, moisture, UV radiation, and fuel).

Factor(s) : — Life (or Load) Enhancement Factor : An additional load factor and/or test duration applied to structural repeated load tests, relative to the intended design load and life values, used to account for material variability. It is used to develop the require d level of confidence in data.

— Life Scatter Factor : Same as Life/Load Enhancement Factor.

— Overload Factor : A load factor applied to a specific structure test which is used to address parameters (e.g., environment, a short test pyramid, etc.) not d irectly addressed in that test.

This factor is usually developed from lower pyramid testi ng addressing such parameters.

Heterogeneous : Descriptive term for a material consisting o f dissimilar constituents separately identifiable; a medium consisting of regions of unlike properties separated by internal boundaries.

Intrinsic Flaw : Defect inherent in the composite material or resulting from the production process.

Manufacturing D efect : An anomaly or flaw occurring during manufacturing that can cause varying levels of degradation in structural strength, stiffness and dimensional stability. Those manufacturing defects (or permissible manufacturing variability) allowed by the qualit y control, manufacturing acceptance criteria are expected to meet appropriate structural requirements for the life of the aircraft part. Other manufacturing defects that escape detection in manufacturing quality control should be included in a damage threa t assessment and must meet damage tolerance requirements until detected and repaired.

No - Growth Approach : A method that requires demonstration that the structure, with defined flaws present, is able to withstand appropriate repeated loads without detrimen tal flaw growth for the life of the structure.

Primary Structure : The structure which carries flight, ground, or pressurisation loads, and whose failure would reduce the structu ral integrity of the aircraft.

Point Design : An element or detail of a speci fic design which is not considered generically applicable to other structure for the purpose of substantiation, e.g., lugs and major joints. Such a design element or detail can be qualified by test or by a combination of test and analysis.

Slow Growth App roach : A method that requires demonstration that the structure, with defined flaws present, is able to withstand appropriate repeated loads with slow, stable, and predictable flaw growth for the life of the structure, or beyond appropriate inspection inte rvals associated with app ropriate damage detectability.

Structural Bonding : A structural joint created by the process of adhesive bonding, comprising of one or more previously - cured composite or metal parts (referred to as adherends).

Powered by EASA eRules Page 407 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) Sub - component : A m ajor three - dimensional structure which can provide completed structural representation of a section of the full structure (e.g., stub - box, section of a spar, wing panel, body panel with frames).

Weak Bond : A bond line with mechanical properties lower than expected, but without any possibility to detect that by normal NDI procedures. Such situation is mainly due to a poor chemical bonding.

[Amdt 20/6]

Appendix 3 to AMC 20 - 29 – Change of Composite Material and/or

Process

ED Decision 2010/003/R 1. It is necessary to re - certify composite structures, which during production, incorporate substitutions of, or changes to, the materials and/or processes from those originally substantiated at the time of initial certification. For example, the original material supplier may either change its product, or cease production. Manufacturers may also find it necessary to modify their production processes to improve efficiency or correct product deficiencies. In either case, care must be taken to ensure that modification s and/or changes are adequately investigated to ensure the continued adequacy of already certificated composite structure. This appendix covers such material and/or process changes, but does not address other changes to design (e.g., geometry, loading). Th e definition of the materials and processes used is required in the specifications by Part 21 . A.31. Changes to the material and process specifications are often major changes in type design and must be addressed as such under Part - 21, subpart D or E a s app licable.

2. The qualification and structural substantiation of new or modified materials and/or processes used to produce parts of a previously certified aircraft product requires: a. The identification of the key material and/or process parameters governi ng performances; b. The definition of the appropriate tests able to measure these parameters; and c. The definition of pass/ fail criteria for these tests.

3. ‘Qualification’ procedures developed by every manufacturer include specifications covering: a . Phy sical and chemical properties, b. Mechanical properties (coupon level), and c. Reproducibility (by testing several batches).

4. Specifications and manufacturing quality procedures are designed to control specific materials and processes to achieve stable and repeatable structure for that combination of materials and processes. However, the interchangeability of alternate materials and processes for a structural application cannot be assumed if one only considers the properties outlined in those spe cifications (as it could be for materials that are much less process dependent, e.g., some metallic material forms). A structure fabricated using new or modified materials and/or processes, which meet the ‘qualification’ tests required for the original mat erial and process specifications, does not necessarily produce components that meet all the original engineering requirements for the p reviously certified structure.

5. Until improvements in identifying the complex relations between key material parameter s that govern composite processing occurs, there will be a need for extensive and diverse testing that Powered by EASA eRules Page 408 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) directly interrogates material performance using a range of representative specimens of increasing complexity in building block tests. Furthermore, failu re modes may vary from one material and/or process to another, and analytical models are sometimes insufficiently precise to reliably predict failure without sufficient empirical data. Therefore, a step - by - step test verification with more comp lex specimens may be required.

6. Classification of Material or Process Change Material and/or process changes require appropriate classification in order to aid the determination of the extent of investigation necessary. Some minor changes may only require material eq uivalency sampling tests to be completed at the base of the test pyramid, whilst more significant changes will require more extensive investigations, including possibly a new structural substantiation.

a. Any of the following situations requires further investigation of possible changes to a given composite structure: (1) Case A: A change in one or both of the basic constituents, resin, or fibre (including sizing or surface treatment alone) would yield an alternate material. Other changes that result in an alternate material include changes in fabric weave style, fibre aerial weight and resin content.

(2) Case B: Same basic constituents, but any change of the resin impregnation method.

Such changes include: (i) prepregging process (e.g., solvent bath to hot melt coating), (ii) tow size (3k, 6k, 12k) for tape material forms with the same fibre areal weight, (iii) prepregging machine at the same suppliers, (iv) supplier change for a same material (licensed sup plier).

(3) Case C: Same material, but modification of the processing route (if the modification to the processing route governs eventual composite mechanical properties).

Example process changes of significance include: (i) curing cycle, (ii) bond surface preparation, (iii) changes in the resin transfer moulding process used in fabricating parts from dry fibre forms, (iv) tooling, (v) lay - up method, (vi) environmental parameters of the material lay - up room, and (vii) major assembly procedures.

b. For each of the above cases, a distinction should be made between those changes intended to be a replica of the former material/process combination (Case B and some of Case C) and those which are “truly new material” (Case A and some of Case C). So, two classes ar e proposed: (1) “Identical materials/processes” in cases intended to create a replica structure.

(2) “Alternative materials/processes” in cases intended to create truly new structure.

c. Within the “identical materials/processes” class, a sub - classificat ion can be made between a change of the prepregging machine alone at the supplier and licensed production elsewhere. For the time being, a change to a new fibre produced under a licensed process and reputed to be a replica of the former one, will be dealt with as an “alternative material/process”.

d. Some minor changes within the class representing identical materials/processes may not interact with structural performances (e.g., prepreg release papers, some bagging materials, etc.) and should not be submit ted to the Agency as part of the change.

However, the manufacturers (or the supplier) should develop a proper system for screening those changes, with adequate proficiency at all relevant decision levels. Other Powered by EASA eRules Page 409 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) minor material changes that fall under Case B may warrant sampling tests to show equivalency only at lower levels o f building block substantiation .

e. Case C changes that may yield major changes in material and structural performance need to be evaluated at all appropriate levels of the building block tests to determine whether the manufacturing process change yields identical or alternate materials.

Engineering judgment will be needed in determining the extent of testing based on the proposed manufacturing change.

f. Case A (alternative material) should always be considered as an important change, which requires structural substantiation. It is not recommended to try a sub - classification according to the basic constituents being changed, as material behaviour (e.g., sensitivity to stress concentrations) may be governed by interfacial properties, which may be affected by either a fibre or a resin change.

7. Substantiation Method . Only the technical aspects of substanti ation are addressed below.

a. Compliance Philosophy . Substantiation shou ld be based on a comparability study between the structural performances of the material accepted for type certification, and the second material. Whatever the modification proposed for a certificated item, the revised margins of safety should remain adequ ate. Any reduction in the previously demonstrated margin sh ould be investigated in detail.

(1) Alternative Material/Process : New design values for all relevant properties should be determined for any alternate material/process combination. Analytical mode ls initially used to certify structure, including failure prediction models, should be reviewed and, if necessary, substantiated by tests. The procurement specification should be modified (or a new specification suited to the selected material should be de fined) to ensure key quality variations are adequately controlled and new acceptance criteria defined. For example, changing from first to second generation of carbon fibres may improve tensile strength properties by more than 20% and a new acceptability t hreshold will be needed in the specification of the alternate material to ensure the detection o f quality variations.

(2) Identical Material : Data should be provided that demonstrates that the original design values (whatever the level of investigation, m aterial or design) remain valid.

Statistical methods need to be employed for data to ensure that key design properties come from the same populations as the original material/process combination. Calculation models including failure prediction should remai n the same. The technical content of the procurement specification (Case B) should not need to be changed to properly control qual ity.

b. Testing.

(1) The extent of testing needed to substantiate a material change should address the inherent structural be haviour of the composite and will be a function of the airworthiness significance of the part and the material change definition. For example, the investigation level might be restricted to the generic specimens at the test pyramid base (refer to figures i n paragraph 7) for an identical material, but non - generic test articles from higher up the pyramid should be included for an alternative material. Care needs to be taken to ensure that the test methods used yield data compatible with data used to determine properties of the original structure.

Powered by EASA eRules Page 410 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 29 Products, Parts and Appliances (AMC - 20) (2) The testing that may be required for a range of possible material and/or process changes should consider all levels of structural substantiation that may be affected.

In some instances (e.g., a minor cure cycle c hange), possible consequences can be assessed by tests on generic specimens only. For other changes, like those involving tooling (e.g., from a full bag process to thermo - expansive cores), the assessment should include an evaluation of the component itself (sometimes called the “tool proof test”). In this case, an expanded NDI procedure should be required for the first items to be produced. This should be supplemented – if deemed necessary – by “cut up” specimens from a representative component, for physica l or mechanical investigations.

c. Number of Batches .

(1) The purpose for testing a number of batches is the demonstration of an acceptable reproducibility of material characteristics. The number of batches required should take into account: material cla ssification (identical or alternative), the investigation level (non - generic or generic specimen) the source of supply, and the property under investigation. Care should be taken to investigate the variation of both basic material and the manufacturing pro cess.

(2) Existing references (e.g., The Composite Materials Handbook (CMH - 17) Volumes 1 and 3, FAA Technical Report DOT/ FAA/AR - 03/19), addressing composite qualification and equivalence and the building block approach, provide more detailed guidance re garding batch and test numbers and the appropriate statistical analysis up to laminate level. Changes at higher pyramid levels, or those associated with other material forms, e.g., braided VARTM (Vacuum - Assisted Resin Transfer Moulding) structure, may requ ire use of other statistical proc edures or engineering methods.

d. Pass/Fail Criteria . Target pass/fail criteria should be established as part of the test programme. For strength considerations for instance, a statistical analysis of test data should demonstrate that new design values derived for the second material provide an adequate mar gin of safety. Therefore, provision should be made for a sufficient number of test specimens to allow for such analysis. At the non - generic level, when only one test article is used to assess a structural feature, the pass criteria should be a result accep table with respect to design ultimate loads. In the cases where test results show lower margins of safety, certification documentation will need to be revised.

e. Other Considerations . For characteristics other than static strength (all those listed in AMC 20 - 29 , paragraphs 8, 9, 10 and 11), the substantiation should also ensure an equivalent level of safety.

[Amdt 20/6] Powered by EASA eRules Page 411 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENE RAL of Compliance for Airworthiness of AMC 20 - 42 Products, Parts and Appliances (AMC - 20)

AMC 20 - 42

AMC 20 - 42 Airworthiness information security ri sk assessment

ED Decision 2020/006/R 1. PURPOSE (a) This AMC describes an acceptable means, but not the only means, to show compliance with the applicable rules for the certification of products and parts. Compliance with this AMC is not mandatory and, therefore, an applicant may elect to use an alternative means of compliance. However, any alternative means of compliance must meet the relevant requirements and be accepted by EASA.

(b) This AMC recognises as an acceptable means of complian ce the following European Organisation for Civil Aviation Equipment (EUROCAE) and Radio Technical Commission for Aeronautics (RTCA) documents: — EUROCAE ED - 202A, Airworthiness Security Process Specification, dated June 2014 / RTCA DO - 326A, dated August 2014; — EUROCAE ED - 203A, Airworthiness Security Methods and Considerations , dated June 2018 / RTCA DO - 356, dated June 2018; — EUROCAE ED - 204, Information Security Guidance for Continuing Airworthiness , dated June 2014 / RTCA DO - 355, dated June 2014.

(c ) This AMC establishes guidance to use ED - 202A, 203A and 204 in the different contexts of the initial and continued airworthiness of products and parts.

(d) The possibility to give credit for products developed using previous versions o f EUROCAE ED/RTCA DO documents may be discussed with and accepted by EASA.

Note: EUROCAE ED is hereinafter referred to as ‘ED’ and RTCA DO is hereinafter referred to as ‘DO’. Where the notation ‘ED - XXX/DO - XXX’ appears in this document, the referenced docum ents are recognised as being equivalent.

2 . APPLICABILITY This AMC applies to manufacturers of products and parts, and to design approval holders (DAHs) that apply for: — the type certification of a new product (i.e. an aircraft, engine or propeller); — a supp lemental type certificate (STC) to an e xisting type - certified product; — a change to a product; — the approval of a new item of equipment or a change to equipment to be used in an ETSO article. In such a case, an ETSO article may contain one or more security m easures. Those security measures may be assigned a security assurance level (SAL). Credit can be taken for those security measures and their associated SALs by the design organisation approval holder (DOAH), depending on the information system security ris k assessment of the product; — the certification of other systems or equipment that provide air service information whose certification is required by a nat ional regulation; Powered by EASA eRules Page 412 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 42 Products, Parts and Appliances (AMC - 20) — the approval of products and parts of information systems that are subject to potent ial information security threats and that could result in unacceptable safety risks.

3 . REPLACEMENT Reserved.

4 . GENERAL PRINCIPLES (a) The information systems of the products, parts or equipment identified in Section 2 should be assessed against any potential intentional unauthorised electronic interaction (IUEI) security threat and vulnerability that could result in an unsafe condition. This risk assessment is referred to as a ‘product information security risk assessment’ (PISRA) and is further desc ribed in Section 5 of this AMC.

(b) The result of this assessment, after any necessary means of mitigation have been identified, should be that either the systems of the product or part have no identifiable vulnerabilities, or those vulnerabilities cannot be exploited to create a hazard or generate a failure that would have an effect that is deemed to be unacceptable against the certification specification and the acceptable means of compliance including industry standards for the product or part considered .

(c) When a risk needs to be mitigated, the applicant should demonstrate, as described in Section 5, that the means of mitigation provide sufficient grounds for evaluating that the residual risk is acceptable. The means of mitigation should be provided to th e operators in a timely manner.

(d ) Once the overall risk has been deemed to be acceptable, the applicant should, if necessary, develop instructions as described in Section 9, to maintain the information security risk of the systems of the product or pa rt at an acceptable level, after the entry into service of the product or part.

5 . PRODUCT INFORMATION SECURITY RISK ASSESSMENT (a) The general product information security risk assessment (PISRA) should c over the following aspects: (i) determination of th e security environment for the infor mation security of the product ; (ii) identification of the assets; (iii) iden tification of the attack paths; (iv) assessment of the safety consequences of the threat to the affected assets; (v) evaluation, by considering the existing security protection means, of the level of threat that would have an impact on safety; (vi) determination of whether the risks, which are the result of the combination of the sever ities and the potentiality to attack (or, inversely, the difficulty of attacking), are acceptable: If they are acceptable, preparation of the justification for certification, including the means to maintain the risk at an ac ceptable level (see Section 9); To address the assumptions about external factors like organisations, processes, etc., see reference in ED - 202A.

Powered by EASA eRules Page 413 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 42 Products, Parts and Appliances (AMC - 20) If they are not acceptable, (A) analysis of the proposed means of mitigation to ensure an acceptable level of safety, (B) impleme ntation of means of mitigation, ( C) evaluation of the effectiveness of the means of mitigation as in Section 8 with respect t o the level of risk (combination of the level of threat and sev erity of the threat condition); (vii) iteration from point (vi) until all the residual risks are acce ptable.

(b) The process for the Security Risk Assessment identified in ED - 202A Section 2.1.1 is an acceptable means of compliance for performing the PISRA for products and parts under Annex I (Part 21) to Regulation (EU) No 748/2012 . Guidance material for the PISRA can be found in ED - 203A.

6 . RISK ACCEPTABILITY Acceptable/Unacceptable Risk: whether or not a risk is unacceptable depends on the context and the criteria that are considered for the certification of the affected product or part. The risk may be acceptable in some cases and unacceptable in others. For example, a threat condition that has a potential major safety effect, as defined in CS xx.1309, may be not acceptable in the context of CS - 25 products depending on the level of threat and the associated threat scenario.

The same safety risk may be acceptable for products that are certified under CS - 29.

7 . REPORTING The operator of a product or part should report any information security occurrences to the designer of this product or part or the aircraft TC/STC holder, in a manner that would allow a further impact analysis and corrective actions, if appropriate. If this impact analysis identifies the potential for an unsafe condition, the designer of that product or part should report it to the competent authorit y in a timely manner. For example, for organisati ons to which Regulation (EU) No 748/2012 applies, the reporting should be done in accorda nce with point 21.A.3A of Annex I (Part 21) to that Regulation.

8 . VALIDATION AND VERIFICATION OF THE SECURITY PROTECT ION If information security risks that are identified during the product information security risk assessment (PISRA) need to be mitigated, security verification should be used to evaluate the effectiven ess of the means of mitigation.

(a) This verification should be performed by a combination of analysis, security - oriented robustness testing , inspections, and reviews; and (b) When necessary, by security testing that addresses information security from the perspective of a potential adversary.

Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules for the airwor thiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and producti on organisations (OJ L 224, 21.8.2012, p. 1) ( https://eur - lex.europa.eu/legal - content/EN/TXT/?qid=1574094487050&uri=CELEX:32012R0748 ).

Powered by EASA eRules Page 414 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 42 Products, Parts and Appliances (AMC - 20) 9 . INSTRUCTIONS FOR THE CONTINUED PROTECTION OF PRODUCT AND PART INFORMATION SECURITY The applicant should identify the information security assets and protection mechanisms to be addressed by the Instructions for Continued Airworthiness (ICA) of the product or part (for example, physical and operational security procedures, auditing and monitoring of the security effectiveness, key management procedures that are used as assumptions in the security assurance process), and develop the appropriate procedures to maintain the security effectiveness after the produ ct or part enters into service.

When an in - service occurrence is reported, the applicant should consider the possibility that it originated from an IUEI and should take any required corrective action accor dingly. If an IUEI has generated an unsafe condition, then information about the occurrence, the investigation results and the recovery actions should be reported to EASA in accordance with point 21 .A.3A of Annex I (Part 21) to Regulation (EU) No 748/2012.

According to Article 2(7) of Regulation (EU) No 376/2014 , an occurrence is defined as any safety - related event which endangers, or which, if not corrected or addressed, could endanger an aircraft, its occupants or any other person, and includes, in particular, any accident or serious incident. Article 4 of the same Regulation requires the applicant to report to EASA any occurrence that represents a signi ficant risk to aviation safety.

The applicant should also assess the impact of new th reats that were not foreseen during previous product information security risk assessments (PISRAs) of the systems and parts of the product. If the assessment identifies an unacceptable threat condition, the applicant should notify the operators and the co mpetent authority in a timely manner of the need and the means to mitigate the new r isk (or the absence of a risk).

Guidance on continued airworthiness can be found in EUROCAE ED - 203A/RTCA DO - 356A and ED - 204/RTCA DO - 355.

1 0 . DEFINITIONS The terminology use d in this AMC is consistent with the glossary provided in document EUROCAE ER 013 AERONAUTICAL INFORMATION SYSTEM SECURITY GLOSSARY .

[Amdt 20/18] Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 201 4 on the reporting, analysis and follow - up of occurrences in civil aviation, amending Regulation (EU) No 996/2010 of the European Parliament and of the Council and repeali ng Directive 2003/42/EC of the European Parliament and of the Council and Commission Regulations (EC) No 1321/2007 and (EC) No 1330/2007 (OJ L 122, 24.4.2014, p. 18) ( https://eur - lex.europa.eu/legal - content/EN/TXT/?uri=CELEX%3A32014R0376 ).

Powered by EASA eRules Page 415 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20)

AMC 20 - 115D

AMC 20 - 115D Airborne Software Development Assurance Using

EUROCAE ED - 12 and RTCA DO - 178

ED Decis ion 20 17 / 02 0 /R 1. P URPOSE a. This AMC describes an acceptable means, but not the only means, for showing compliance with the applicable airworthiness regulations with regard to the software aspects of airborne systems and equipment in the domain of product certification or European technical standard orders (ETSOs) authorisation. Compliance with this AMC is not mandatory and therefore an applicant may elect to use an alternative means of compliance (AltMoC). However, the AltMoC must meet the relevant requir ements, ensure an equivalent level of software safety as this AMC, and be approved by the European Aviation Safety Agency (EASA) on a product or ETSO article basis.

b. This AMC recognises the following European Organisation for Civil Aviation Equipment (EUROCAE) and Ra dio Technical Commission for Aeronautics (RTCA) documents: 1. EUROCAE ED - 12C, Software Considerations in Airborne Systems and Equipment Certification, 1 January 2012, and RTCA DO - 178C, Software Considerations in Airborne Systems a nd Equipment Certification, 13 December 2011; 2. EUROCAE ED - 215, Software Tool Qualification Considerations, 1 January 2012, and RTCA DO - 330, Software Tool Qualification Considerations, 13 December 2011; 3. EUROCAE ED - 216, Formal Methods Supplement to ED - 1 2C and ED - 109A, 1 January 2012, and RTCA DO - 333, Formal Methods Supplement to DO - 178C and DO - 278A, 13 December 2011; 4. EUROCAE ED - 217, Object - Oriented Technology and Related Techniques Supplement to ED - 12C and ED - 109A, 1 January 2012, and RTCA DO - 332, Obj ect - Oriented Technology and Related Techniques Supplement to DO - 178C and DO - 278A, 13 December 2011; and 5. EUROCAE ED - 218, Model - Based Development and Verification Supplement to ED - 12C and ED - 109A, 1 January 2012, and RTCA DO - 331, Model - Based Development a nd Verification Supplement to DO - 178C and DO - 278A, 13 December 2011.

Note: EUROCAE ED is hereinafter referred to as ‘ED’; RTCA DO is hereinafter referred to as ‘DO’. Where the notation ‘ED - XXX/DO - XXX’ appears in this document, the referenced documents are recognised as being equivalent.

c. This AMC identifies the following as supporting documents: — ED - 94C, Supporting Information for ED - 12C and ED - 109A, 1 January 2012; and — DO - 248C, Supporting Information for DO - 178C and DO - 278A, 13 December 2011.

ED - 94C/DO - 248C contains a collection of frequently asked questions (FAQs) and discussion papers (DPs) compiled and approved by the authors of ED - 12C and DO - 178C to provide clarification of the guidance contained in ED - 12C/DO - 178C.

d. Refe rences to the use of ED - 12C/DO - 178C in this AMC include the use of ED - 215/DO - 330 and supplements ED - 216/DO - 333, ED - 217/DO - 332 and ED - 218/DO - 331, as applicable.

Powered by EASA eRules Page 416 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) e. This AMC establishes guidance for using existing ED - 12B/DO - 178B processes for new software de velopment.

f. This AMC also establishes guidance for transitioning to ED - 12C/DO - 178C when making modifications to software previously approved using ED - 12/DO - 178, ED - 12A/DO - 178A, or ED - 12B/DO - 178B.

2. A PPLICABILITY This AMC applies to applicants, design ap proval holders (DAHs), and developers of airborne systems and equipment containing software to be installed on type - certified aircraft, engines, and propellers, or to be used in ETSO articles.

3. R EPLACEMENT This AMC replaces and cancels AMC 20 - 115C, Softw are Considerations in Airborne Systems and Equipment Certification, 12 September 2013 .

4. B ACKGROUND a. ED - 12C/DO - 178C, Appendix A, Section 3, provides a summary of the differences between ED - 12C/DO - 178C and ED - 12B/DO - 178B. The EUROCAE and RTCA Inc. docume nts listed in subparagraph 1.b. of this AMC provide guidance for establishing software life cycle planning, development, verification, configuration management, quality assurance and certification liaison processes to be used in the development of software for airborne systems. The guidance provided in these documents is in the form of: 1. objectives for software life cycle processes; 2. activities that provide a means for satisfying the objectives; and 3. descriptions of the evidence indicating that the ob jectives have been satisfied.

b. The technical content of this AMC is, as far as practicable, harmonised with Federal Aviation Administration (FAA) AC 20 - 115D, which is also based on ED - 12C/DO - 178C.

5. U SING ED - 12B/DO - 178B PROCESSES AND PROCEDURES FOR NEW SOFTWARE DEVELOPMENT a. Applicants who have established software development assurance processes using ED - 12B/DO - 178B may continue to use those processes (including tool qualification processes) for new software development and certifica tion projects, provided that the following criteria are met: 1. The software development assurance processes are shown to have no known process deficiencies, such as those discovered during internal or external audits or reviews, or identified in open prob lem reports (OPRs), resulting in non - satisfaction of one or more ED - 12B/DO - 178B objectives. Evidence of resolution and closure of all process - related OPRs and of all process - related audit or review findings may be requested.

2. The processes were previousl y used to develop software that was used in a certified product at a software level at least as high as the software level of the software to be developed.

3. If model - based development (MBD), object - oriented technology (OOT), or formal methods (FMs) are t o be used, existing processes incorporating these methods should have been evaluated and found to be acceptable by EASA on a previous certified project. These processes should have been developed in accordance with Powered by EASA eRules Page 417 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) EASA guidance specific to the technique, such as that contained in an associated certification review item (CRI) or a published certification memorandum (CM) .

4. If configuration data is used, as defined in ED - 12C/DO - 178C under ‘Parameter data item’, existing processes for such data should have b een evaluated and found to be acceptable by EASA on a previous certified project. In the absence of processes for using configuration data, the applicant should establish new processes for using PDIs in accordance with ED - 12C/DO - 178C.

5. There are no signi ficant changes to the software processes described in the plans or to the software development environment. This should be supported through analysis of the changes to the previously accepted software development processes and environment.

6. The applicant does not intend to declare the proposed software as having satisfied ED - 12C/DO - 178C.

b. If the criteria of subparagraph 5.a. are not met, the applicant should upgrade their processes and develop the new software using ED - 12C/DO - 178C; tool qualification pr ocesses should be addressed in accordance with Section 12.2 of ED - 12C/DO - 178C and paragraph 10(c) of this AMC.

c. Applicants or developers should establish new software life cycl e processes in accordance with ED - 12C/DO - 178C.

6. U SING EUROCAE ED - 12C AND RTCA DO - 178C ED - 12C/DO - 178C is an acceptable means of compliance (AMC) with regard to the software aspects of product certification or ETSOs authorisation. When using ED - 12C/DO - 178C, the following should apply: a. The applicant should s atisfy all of the objectives associated with the software level assigned to the software, and develop all of the associated life cycle data to demonstrate compliance with the applicable objectives, as listed in the Annex A tables of ED - 12C/DO - 178C and, whe re applicable, of ED - 215/DO - 330, ED - 216/DO - 333, ED - 217/DO - 332, and ED - 218/DO - 331. The applicant should plan and execute activities that satisfy each objective.

b. The applicant should submit to EASA the life cycle data specified in Section 9.3 of ED - 12C/DO - 178C, and Section 9.0 a. of ED - 215/DO - 330, as applicable to tool qualification. It is the applicant’s responsibility to perform the planned activities and produce the life cycle data necessary to satisfy all the applicable objectives.

c. Section 9.4 of ED - 12C/DO - 178C specifies the software life cycle data related to the type design of the certified product. However, not all of the specified data applies to all software levels; specifically the design description and the source code are not part of the type design data for Level D software.

d. The applicant should make available to EASA, upon request, any of the data described in Section 11 of ED - 12C/DO - 178C, applicable tool qualification data, data outputs from any applicable supplements, and any other data needed to substantiate the satisfaction of all the applicable objectives.

e. EASA may publish an AMC to specific certification specifications (CSs), stating the required relationship between the criticality of the software - based systems and the software l evels, as defined in ED - 12C/DO - 178C. Such AMC takes precedence over the application of Section 2.3 of ED - 12C/DO - 178C.

Powered by EASA eRules Page 418 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) 7. R ESERVED 8. G UIDANCE APPLICABLE TO ED - 12B/DO - 178B OR ED - 12C/DO - 178C a. The use of supplements with ED - 12C/DO - 178C The applicant should apply the guidance of supplements to ED - 216/DO - 333, ED - 217/DO - 332 and ED - 218/DO - 331 when incorporating the addressed software development techniques. If the applicant intends to use multiple software development techniques together, more than one supplemen t applies. The applicant should not use supplements as stand - alone documents.

1. When using one or more supplements, the applicant’s plan for software aspects of certification (PSAC) should describe: a. how the applicant applies ED - 12C/DO - 178C and the supp lement(s) together; and b. how the applicant addresses the applicable ED - 12C/DO - 178C objectives and those added or modified by the supplement(s): which objectives from which documents apply to which software components, and how the applicant’s planned acti vities satisfy all the applicable objectives.

2. If the applicant intends to use any techniques addressed by the supplements to develop a qualified tool (for tool qualification levels (TQLs) 1, 2, 3, and 4 only), then the tool qualification plan (TQP) shou ld describe: a. based on supplement analysis, which tool qualification objectives are affected by the use of the technique(s); and b. how the planned activities satisfy the added or modified objectives.

3. The intent of this subparagraph is to provide clarification of Section MB.6.8.1 of ED - 218/DO - 331. If the applicant uses models as defined in Section MB.1.0 of ED - 218/DO - 331 as the basis for developing software, the applicant should apply the guidance of ED - 218/DO - 331. When applying Section MB. 6.8.1 of ED - 218/DO - 331, the applicant should do the following: a. identify which review and analysis objectives are planned to be satisfied by simulation alone or in combination with reviews and analyses; all other objectives should be satisfied by reviews and analyses, as described in Section MB.6.3 of ED - 218/DO - 331; and b. for each identified objective, justify in detail how the simulation activity, alone or in combination with reviews and analyses, fully satisfies the specific review and analysis objecti ve.

b. Guidance on field - loadable software (FLS) This Section supplements ED - 12C/DO - 178C and ED - 12B/DO - 178B. The applicant should use this guidance in addition to ED - 12C/DO - 178C and ED - 12B/DO - 178B when using FLS in their project.

1. As the developer, the a pplicant should provide the necessary information to support the system - level guidance identified in items a, b, c and d of ED - 12C/DO - 178C, Section 2.5.5, and items a, b, c and d of ED - 12B/DO - 178B, Section 2.5.

2. The FLS should be protected against corrup tion or partial loading at an integrity level appropriate for the FLS software level.

Powered by EASA eRules Page 419 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) 3. The FLS part number, when loaded in the airborne equipment, should be verifiable by appropriate means.

4. Protection mechanisms should be implemented to preve nt inadvertent enabling of the field - loading function during cruising or any other safety - critical phase.

c. Guidance on user - modifiable software (UMS) This Section supplements ED - 12C/DO - 178C and ED - 12B/DO - 178B. The applicant should use this guidance in ad dition to ED - 12C/DO - 178C and ED - 12B/DO - 178B when using UMS in their project.

1. As the developer, the applicant should provide the necessary information to support the system - level guidance identified in items a, b, c and f of ED - 12C/DO - 178C, Section 2.5.2 , and items a and b of ED - 12B/DO - 178B, Section 2.4.

2. The modifiable part of the software should be developed at a software level at least as high as the software level assigned to that software.

9. M ODIFYING AND REUSING SOFTWARE APPROVED USING ED - 12/DO - 1 78, ED - 12A/DO - 178A, OR ED - 12B/DO - 178B a. EASA previously approved the software for many airborne systems using ED - 12/DO - 178, ED - 12A/DO - 178A, or ED - 12B/DO - 178B as a means of compliance. In this AMC, reference to legacy software includes the previously appr oved software or component(s) that makes up the software used in legacy systems. In this subparagraph, it is described how to demonstrate compliance with the software aspects of certification for an application that includes modifications to legacy softwar e or the use of unmodified legacy software.

b. Figure 1 presents a flow chart for using legacy software. The applicant should use the flow chart while following the procedures in this subparagraph if the applicant modifies or reuses legacy software. Althou gh these procedures apply to the majority of projects, the applicant should coordinate with EASA any cases that do not follow this flow.

Powered by EASA eRules Page 420 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SU BPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) Figure 1 — Legacy software process flow chart Intent to use software previously shown to satisfy Conduct a CIA.

ED-12, ED-12A, or ED-12B.

See 9(b)(4).

Evaluate software usage history, SDs, ADs, OPRs, etc.

See 9(b)(1).

Will Determine tool qualification Yes there be new software tools or changes to tools? requirements.

See 9(b)(5). See Section 10.

Correct process Is the deficiencies and No No software usage history document plan for acceptable? resolving related See 9(b)(1). software deficiencies.

See 9(b)(1).

Did you upgrade the Yes Yes software baseline to ED-12C IAW paragraph 9(b)(2)(a), (b), or (c)?

See 9(b)(6).

Is the No software developed using No ED-12B?

See 9(b)(2).

If MBD, OOT, or FM will No Yes be used, do processes support the technique IAW applicable guidance?

See 9(b)(7)(a).

Is the Is the ED-12B ED-12 or Yes Yes software level ED-12A software level Yes acceptable?

acceptable?

See 9(b)(2).

See 9(b)(2).

Have the software plans No No No and environment been properly maintained?

See 9(b)(7)(b). Upgrade software baseline Upgrade software baseline including all processes & including all processes & procedures using ED-12B or use procedures using ED-12C Yes ED-12C and ED-215. and ED-215.

See 9(b)(2)(c). See 9(b)(2)(a) or (b).

Do you want Yes to declare equivalence to ED-12C?

See 9(b)(7)(c).

No Upgrade software baseline including all processes & Is procedures using ED-12C the legacy system Yes and ED-215.

software to be modified?

See 9(b)(9).

See 9(b)(3).

Change software and associated life cycle data using the Acronyms No same ED-12 version as the original ADs — airworthiness directives approval. For configuration CIA — change impact analysis data/PDI, use an approved process or Change software and FMs — formal methods establish new process using ED-12C. Original approval basis or associated life cycle data using IAW — in accordance with See 9(b)(8)(a) & (b). baseline upgrade to ED-12C MBD — model-based development ED-12C, Section 12.1, and applicable acceptable as approval basis.

supplements. OOT — object-oriented technology See 9(b)(3)(a) or (b).

See 9(b)(6) & (9). OPRs — open problem reports PDI — parameter data item SDs — service difficulties Note: references to RTCA documents are intentionally omitted for formatting purposes.

Powered by EASA eRules Page 421 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) 1. The applicant should assess the legacy software to be modified or reused for its usage history from previous installations. If the software has safety - related service difficulties, airworthiness directives, or OPRs with a potential safety impact on the proposed installation, the applican t should establish plans to resolve all related software deficiencies. Prior to modifying or reusing the legacy software, the applicant should correct any related development process deficiencies, such as those discovered during internal or external audits or reviews, or identified in OPRs resulting in non - satisfaction of one or more ED - 12B/DO - 178B objectives. Evidence of resolution and closure of all process - related OPRs and of all process - related audit or review findings may be requested.

2. The system sa fety process assigns the minimum development assurance level based on the severity classifications of failure conditions for a given function. The ED - 12B/DO - 178B software levels are consistent with the ED - 12C/DO - 178C software levels. However, ED - 12/DO - 178 and ED - 12A/DO - 178A were published prior to the establishment of the software levels addressed in ED - 12B/DO - 178B and ED - 12C/DO - 178C. The applicant should use Table 1 to determine whether their legacy software level satisfies the software level assigned by t he system safety process for the proposed installation. A ‘ ✓ ’ in the intersection of the row and column indicates that the legacy software level is acceptable. For example, legacy software with development assurance for ED - 12A/DO - 178A software Level 2 can be considered to satisfy software Levels B, C, and D. A blank indicates that the software level is not acceptable. Therefore, the ED - 12A/DO - 178A software developed for software Level 2 would not be acceptable where software Level A is required.

Table 1 — Software level relationships Assigned Legacy software level per Legacy software level per Legacy software Level software ED - 12B ED - 12A per ED - 12 level A B C D 1 2 3 Critical Essential Non - Essential A ✓ ✓ ✓ B ✓ ✓ ✓ ✓ ✓ C ✓ ✓ ✓ ✓ ✓ ✓ ✓ D ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ a. If the legacy software was developed at software level ‘Essential’ using ED - 12/DO - 178 and was previously accepted by the certification authority as acceptable for software Level B, it remains acceptable for the new project.

If the ED - 12/DO - 178 legacy software was not previously assessed, or the software level is not acceptable, then the applicant should upgrade the software development baseline, including all processes and procedures (as well as tool qualification processes), us ing Section 12.1.4 of ED - 12C/DO - 178C, and ED - 215/DO - 330.

b. If the legacy software was developed using ED - 12A/DO - 178A, and the software level is not acceptable, the applicant should upgrade the software development baseline, including all processes and pro cedures (as well as tool qualification processes), using Section 12.1.4 of ED - 12C/DO - 178C, and ED - 215/DO - 330.

Powered by EASA eRules Page 422 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) c. If the legacy software was developed using ED - 12B/DO - 178B, and the software level is not acceptable, the applicant should upgrade the software development baseline, including all processes and procedures (as well as tool qualification processes), using Section 12.1.4 of ED - 12B/DO - 178B or ED - 12C/DO - 178C, and ED - 215/DO - 330.

3. If the criteria of 9(b)(1) and 9(b)(2) are satisfied and modifications t o the software are not required, then: a. the original approval may serve as the basis for the software in the installation approval of the proposed system; and b. if the applicant upgraded the software development baseline using ED - 12C/DO - 178C and updated all processes and procedures, as well as tool qualification processes, to ED - 12C/DO - 178C and ED - 215/DO - 330, then the applicant may declare their software as equivalent to satisfying ED - 12C/DO - 178C; however, the applicant cannot d eclare their unmodified tools as equivalent to satisfying ED - 12C/DO - 178C and ED - 215/DO - 330. The applicant should make all subsequent modifications to all their software and tools using their processes and procedures that satisfy ED - 12C/DO - 178C and ED - 215/D O - 330.

4. If modifications to the software are required, the applicant should conduct a software change impact analysis (CIA) to determine the extent of the modifications, the impact of those modifications, and what verification is required to ensure that the modified software performs its intended function and continues to satisfy the identified means of compliance. The applicant should: a. identify the software changes to be incorporated and conduct a CIA consisting of one or more analyses associated with the software change, as identified in ED - 12C/DO - 178C, Section 12.1; b. conduct the verification, as indicated by the CIA; and c. summarise the results of the CIA in the plan for software aspects of certification (PSAC) or in the software accomplishment su mmary (SAS).

5. If new software tools or modifications to tools are needed, please refer to paragraph 10 of this AMC to determine the tool qualification requirements.

6. If the applicant upgraded the software baseline to ED - 12C/DO - 178C in accordance with s ubparagraph 9(b)(2), they should make all modifications to the software using ED - 12C/DO - 178C, Section 12.1. If the applicant wants to declare their software as equivalent to satisfying ED - 12C/DO - 178C, the applicant’s equivalence declaration applies to both modified and unmodified software and is valid even if the applicant uses unmodified tools that have not been qualified using ED - 12C/DO - 178C. However, the applicant cannot declare their unmodified tools as equivalent to satisfying ED - 12C/DO - 178C and ED - 215 /DO - 330. All subsequent modifications to all their software and tools are to be made using processes and procedures satisfying ED - 12C/DO - 178C and ED - 215/DO - 330.

7. If the applicant wants to use their existing processes to make modifications to their legacy software using the version of ED - 12/DO - 178 (i.e. ED - 12/DO - 178, ED - 12A/DO - 178A, or ED - 12B/DO - 178B) used for the original software approval, the applicant may do so, provided that all of the following conditions are met: Powered by EASA eRules Page 423 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) a. If MBD, OOT, or FMs are to be use d, existing processes incorporating these methods should have been evaluated and found to be acceptable by EASA on a previous certified project. These processes should have been developed in accordance with EASA guidance specific to the technique, such as that contained in an associated CRI or a published CM.

b. The applicant has maintained, and can still use, the software plans, processes, and life cycle environment, including improvements to processes or to the life cycle environment as captured in revise d plans.

c. The applicant does not intend to declare the proposed software as satisfying ED - 12C/DO - 178C.

8. If the conditions of subparagraph 9(b)(7) are satisfied: a. the applicant may accomplish all modifications to the software using the same ED - 12/DO - 178 version as for the original approval. However, the applicant may not declare their software as equivalent to satisfying ED - 12C/DO - 178C; and b. if configuration data is used, as defined under ‘Parameter data item’ in ED - 12C/DO - 178C, the applicant may use existing processes for such data if the processes were evaluated and found to be acceptable by EASA on a previous certified project; in the absence of processes for using configuration data, the applicant should establish new processes for using pa rameter data items (PDIs) in accordance with ED - 12C/DO - 178C.

9. If any of the conditions of subparagraph 9(b)(7) is not satisfied, the applicant should update all their processes and procedures, as well as tool qualification processes, using ED - 12C/DO - 178C and ED - 215/DO - 330, and make all modifications to the software using ED - 12C/DO - 178C, Section 12.1. If the applicant wants to declare their software as equivalent to satisfying ED - 12C/DO - 178C, their declaration applies to both the modified and unmodified so ftware and is valid even if the applicant uses unmodified tools that have not been qualified using ED - 12C/DO - 178C and ED - 215/DO - 330. However, the applicant cannot declare their unmodified tools as equivalent to satisfying ED - 12C/DO - 178C and ED - 215/DO - 330. The applicant should make all subsequent modifications to all their software and tools using their processes and procedures that satisfy ED - 12C/DO - 178C and ED - 215/DO - 330.

10. T OOL QUALIFICATION Sections 12.2 of ED - 12C/DO - 178C and ED - 215/DO - 330 provide an a cceptable method for tool qualification. ED - 215/DO - 330 contains its own complete set of objectives, activities, and life cycle data for tool qualification.

a. If the applicant’s legacy software was previously approved using ED - 12/DO - 178 or ED - 12A/DO - 178A, and the applicant intends to use a new or modified tool for modifications to the legacy software, they should use the criteria of ED - 12C/DO - 178C, Section 12.2 to determine whether tool qualification is needed. If the applicant needs to qualify the tool, th ey should use the software level assigned by the system safety assessment for determining the required TQL, and should use ED - 215/DO - 330 for the applicable objectives, activities, and life cycle data. The applicant may declare their qualified tool as satis fying ED - 215/DO - 330, but not the legacy software as equivalent to satisfying ED - 12C/DO - 178C.

Powered by EASA eRules Page 424 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERA L of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) b. If the applicant’s legacy software was previously approved using ED - 12B/DO - 178B, and they do not intend to declare equivalence to satisfying ED - 12C/DO - 178C, the applicant can either: 1. use their ED - 12B/DO - 178B tool qualification processes for qualifying new or modified tools in support of modifications to ED - 12B/DO - 178B legacy software, or 2. update their tool qualification processes and qualify the tool using E D 215/DO - 330, referring to Table 2 of this document for determining the required TQL; the applicant may then declare their qualified tool as satisfying ED - 215/DO - 330.

c. If the applicant’s legacy software was previously approved using ED - 12B/DO - 178B, the a pplicant intends to declare equivalence to satisfying ED - 12C/DO - 178C, and has ED - 12B/DO - 178B legacy tools that need to be qualified, the applicant should follow the guidance of this subparagraph.

1. ED - 12C/DO - 178C establishes five levels of tool qualificat ion based on the tool use and its potential impact on the software life cycle processes (see Section 12.2.2 and Table 12 - 1 of ED - 12C/DO - 178C). However, ED - 12C/DO - 178C does not address the use of tools previously qualified according to the ED - 12B/DO - 178B cr iteria. For a tool previously qualified as an ED - 12B/DO - 178B development tool or verification tool, the applicant should use Table 2 below to determine the correlation between the ED - 12B/DO - 178B tool qualification type and the ED - 12C/DO - 178C tool criteria and TQLs.

Table 2 — Correlation between ED - 12B/DO - 178B tool qualification type and ED - 12C/DO - 178C tool criteria and TQLs ED - 12B/DO - 178B Software ED - 12C/DO - 178C ED - 12C/ED - 215 Tool Qualification Type Level Tool Criteria TQL Development A 1 TQL - 1 Development B 1 TQL - 2 Development C 1 TQL - 3 Development D 1 TQL - 4 Verification A, B 2 TQL - 4 Verification C, D 2 TQL - 5 Verification All 3 TQL - 5 2. Development tools previously qualified using ED - 12B/DO - 178B a. If the ED - 12B/DO - 178B software level assigned to the tool correlates with or exceeds the required TQL established by ED - 12C/DO - 178C, the applicant may continue to use their ED - 12B/DO - 178B tool qualification processes. If there are changes to the tool’s operational environment or to the tool i tself, then the applicant should conduct a tool CIA in accordance with Section 11.2.2 or 11.2.3 of ED - 215/DO - 330, respectively, and perform changes using their ED - 12B/DO - 178B tool qualification processes.

b. If the ED - 12B/DO - 178B software level assigned to the tool does not satisfy the required TQL, the applicant should update their tool qualification processes and requalify the tool using ED - 215/DO - 330.

Powered by EASA eRules Page 425 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) c. The applicant may declare their tool as equivalent to satisfying ED - 215/DO - 330 if all the changes to the tool and to their tool qualification processes satisfy ED - 215/DO - 330.

3. Verification tools previously qualified using ED - 12B/DO - 178B a. If TQL - 5 is required, and the applicant’s verification tool was previously qualified using ED - 12B/DO - 178B: i. the applicant may continue to use their ED - 12B/DO - 178B tool qualification process; and ii. If there are changes to the tool or the tool’s operational environment, the applicant should conduct a tool CIA and reverify the tool using their ED - 12B/DO - 178B tool qua lification processes or requalify the tool using ED - 215/DO - 330.

b. If TQL - 4 is required, the applicant should requalify their verification tool using ED - 215/DO - 330.

c. The applicant may declare their tool as equivalent to satisfying ED - 215/DO - 330 if all c hanges to the tool (if applicable) and to their tool qualification processes satisfy ED - 215/DO - 330.

11. R ELATED REGULATORY, ADVISORY, AND INDUSTRY MATERIAL a. Related EASA CSs 1. Decision No. 2003/14/RM of the Executive Director of the Agency of 14 November 2003 on certification specifications, including airworthiness codes and acceptable means of compliance for normal, utility, aerobatic and commuter category aeroplanes (‘CS - 23’).

2. Decision No. 2003/2/RM of the Executive Director of the Agency of 17 October 2003 on certification specifications, including airworthiness codes and acceptable means of compliance, for large aeroplanes (‘CS - 25’).

3. Decision No. 2003/15/RM of the Executive Director of the Agency of 14 November 2003 on certifica tion specifications for small rotorcraft (‘CS - 27’).

4. Decision No. 2003/16/RM of the Executive Director of the Agency of 14 November 2003 on certification specifications for large rotorcraft (‘CS - 29’).

5. Decision No. 2003/9/RM of the Executive Director o f the Agency of 24 October 2003 on certification specifications, including airworthiness codes and acceptable means of compliance, for engines (‘CS - E’).

6. Decision No. 2003/7/RM of the Executive Director of the Agency of 24 October 2003 on certification s pecifications, including airworthiness codes and acceptable means of compliance, for propellers (‘CS - P’).

7. Decision No. 2003/10/RM of the Executive Director of the Agency of 24 October 2003 on certification specifications, including airworthiness codes a nd acceptable means of compliance, for European Technical Standard Orders (‘CS - ETSO’).

Powered by EASA eRules Page 426 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) 8. Decision No. 2003/5/RM of the Executive Director of the Agency of 17 October 2003 on certification specifications, including airworthiness codes and acceptable means of compliance, for auxiliary power units (‘CS - APU’).

9. Decision No. 2003/12/RM of the Executive Director of the Agency of 5 November 2003 on general acceptable means of compliance for airworthiness of products, parts and appliances (‘AMC - 20’).

b. FAA advi sory circulars (ACs) 1. AC 23.1309 - 1E, System Safety Analysis and Assessment for Part 23 Airplanes, 17 November 2011.

2. AC 27.1309A, Equipment, Systems, and Installations (included in AC 27 - 1B, Certification of Normal Category Rotorcraft), 4 February 2016 .

3. AC 29.1309A, Equipment, Systems, and Installations (included in AC 29 - 2C, Certification of Transport Category Rotorcraft), 4 February 2016.

c. Industry documents 1. EUROCAE ED - 12, Software Considerations in Airborne Systems and Equipment Certification , May 1982 (no longer in print).

2. EUROCAE ED - 12A, Software Considerations in Airborne Systems and Equipment Certification, October 1985 (no longer in print).

3. EUROCAE ED - 12B, Software Considerations in Airborne Systems and Equipment Certification, 1 De cember 1992.

4. EUROCAE ED - 12C, Software Considerations in Airborne Systems and Equipment Certification, 1 January 2012.

5. EUROCAE ED - 94C, Supporting Information for ED - 12C and ED - 109A, 1 January 2012.

6. EUROCAE ED - 215, Software Tool Qualification Consid erations, 1 January 2012.

7. EUROCAE ED - 216, Formal Methods Supplement to ED - 12C and ED - 109A, 1 January 2012.

8. EUROCAE ED - 217, Object - Oriented Technology and Related Techniques Supplement to ED - 12C and ED - 109A, 1 January 2012.

9. EUROCAE ED - 218, Model - Ba sed Development and Verific ation Supplement to ED - 12C and ED - 109A, 1 January 2012.

10. RTCA DO - 178, Software Considerations in Airborne Systems and Equipment Certification, January 1982 (no longer in print).

11. RTCA DO - 178A, Software Considerations in Airborne Systems and Equipment Certification, 1 March 1985 (no longer in print).

12. RTCA DO - 178B, Software Considerations in Airborne Systems and Equipment Certification, 1 December 1992.

13. RTCA DO - 178C, Software Considerations in Airb orne Systems and Equipment Certification, 13 December 2011.

14. RTCA DO - 248C, Supporting Information for DO - 178C and DO - 278A, 13 December 2011.

Powered by EASA eRules Page 427 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) 15. RTCA DO - 297, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations, 8 Nove mber 2005.

16. RTCA DO - 330, Software Tool Qualification Considerations, 13 December 2011.

17. RTCA DO - 331, Model - Based Development and Verification Supplement to DO - 178C and DO - 278A, 13 December 2011.

18. RTCA DO - 332, Object - Oriented Technology and Related Techniques Supplement to DO - 178C and DO - 278A, 13 December 2011.

19. RTCA DO - 333, Formal Methods Supplement to DO - 178C and DO - 278A, 13 December 2011.

12. A VAILABILITY OF DOCUMENTS — EASA CSs and AMC are available at: www.easa.europa.eu .

— FAA ACs are available at: www.faa.gov .

— EUROCAE are available on payment at: European Organisat ion for Civil Aviation Equipment 102 rue Etienne Dolet, 92240 Malakoff, France Telephone: +33 1 40 92 79 30; Fax +33 1 46 55 62 65 Email: eurocae@eurocae.net , website: www.eurocae.net .

— RTCA documents are available on payment at: RTCA, Inc.

th 1150 18 Street NW, Suite 910, Washington DC 20036, USA Email: info@rtca.org , website: www.rtca.org .

[Amdt 20/14]

GM1 to AMC 20 - 115D — Software change impact analyses (CIAs)

ED Decision 2017/020/R a. These practices provide complementary information to ED - 12C/DO - 178C and ED - 12B/DO - 178B, Sections 12.1.1, 12.1.2, and 12.1.3, and AMC 20 - 115D , subparagraph 9(b)(4). The applicant may use these practices when they need to conduct a software CIA.

b. A CIA identifies the released software baseline upon which the proposed software is to be built, providing: 1. a summary o f the changes and the impact of those changes; 2. a listing and descriptions of the problem reports to be corrected as part of the intended change and/or change requests related to those changes; and 3. a listing of new functions to be activated and/or imp lemented.

c. A CIA addresses changes to the following items, where applicable: 1. the software level; 2. the development or verification environment; 3. the software processes; Powered by EASA eRules Page 428 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) 4. the tools (e.g. when a new tool version is introduced or a tool’s use is modified); 5. the processor or other hardware components and interfaces; 6. the configuration data, especially when activating or deactivating functions; 7. the software interface characteristics and input/output (I/O) requirements; and 8. the software req uirements, design, architecture, and code components, where such changes are not limited to the modified life cycle data, but should also consider the items affected by the change.

d. For each applicable item of subparagraph 13(c) above, a CIA describes th e resulting impact of the change(s) and identifies the activities to be performe d to satisfy ED - 12C/DO - 178C or ED - 12B/DO - 178B and continue to satisfy the requirements for safe operation.

[Amdt 20/14]

GM2 to AMC 20 - 115D — Clarification of data coupling and control

coupling

ED Decision 2017/020/R These practices provide complementary information to ED - 94C/DO - 248C FAQ#67 for satisfying objective A - 7 (8) of ED - 12C/DO - 178C and ED - 12B/DO - 178B.

a. Data coupling analysis is of a different type and purpose than control coupling analysis. Both analyses are necessary to satisfy said objective.

b. Although they support a verification objective, data coupling and control coupling analyses rely on good practices in the software design phase, for example, through the s pecification of the interfaces (I/O) and of the dependencies between components.

[Amdt 20/14]

GM3 to AMC 20 - 115D — Error - handling at design level

ED Decision 2017/020/R a. These practices provide complementary information to ED - 12C/DO - 178C and ED - 12B/DO - 17 8B, Sections 6.3.2, 6.3.3, and 6.3.4. Section 6.3.4.f., and identifies potential sources of errors that require specific activities focused at the source code review level. However, in order to protect against foreseeable unintended software behaviour, it is beneficial and recommended to handle these sources of error at the design level.

b. The possibility of unintended software behaviour may be reduced by considering the following activities: 1. identification of foreseeable sources of software errors, whi ch include: a. runtime exceptions or errors, such as fixed/floating - point arithmetic overflow, stack/heap overflow, division by zero, or counter and timer overrun/wrap - around; b. data/memory corruption or timing issues, such as those caused by a lack of partitioning or improper interrupt management or cache management; and c. features leading to unpredictable programme executio n, such as dynamic allocation, out - of - order execution, or resource contention; 2. for each foreseeable source of software error, i dentification of the associated mitigation; Powered by EASA eRules Page 429 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 115D Products, Parts and Appliances (AMC - 20) 3. specification of protection mechanisms in the software requirements (high - level or low - level requirements) which should in particular include the specification of error - handling mechanisms; and 4. for software Levels A and B, it is recommended that consideration be given to incorporating runtime protection mechanisms since reliance on probabilistic approaches or static analyses alone may not be appropriate; it may be a good practice to implement such runtime pr otection mechanisms for the other software levels as well.

c. The use of FMs in accordance with ED - 216/DO - 333 may enhance the detection of runtime errors.

[Amdt 20/14] Powered by EASA eRules Page 430 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20)

AMC 20 - 128A

AMC 20 - 128A Design Considerations for Minimizing Hazards Caused

by Unconta ined Turbine Engine and Auxiliary Power Unit Rotor

Failure

ED Decision 2003/12/RM 1 PURPOSE.

This acceptable means of compliance (AMC) sets forth a method of complia nce with the requirements of CS 23.901(f), 23.903(b)(1), 25.903(d)(1) and 25A903(d)(1)of the EASA Certification Specifications (CS) pertaining to design precautions taken to minimise the hazards to an aeroplane in the event of uncontained engine or auxiliary power unit (APU) rotor failures.

The guidance provided within this AMC is harmonised with that of the Federal Aviation Administration (FAA) and is intended to provide a method of compliance that has been found acceptable. As with all AMC material, it is not mandatory and does not constitute a regulation.

2 RESERVED 3 APPLICAB ILITY.

T his AMC applies to CS - 23 and CS - 25 aeroplanes.

4 RELATED DOCUMENTS.

Paragraphs 23.903, and 25.903 of the CS and other paragraphs relating to uncontained engine failures.

a. Related Joint Aviation Requirements. Sections which prescribe requirements for the design, substantiation and certification relating to uncontained engine debris include: § 23.863, 25.863 Flammable fluid fire protection § 25.365 Pressurised compartment loads § 25.571 Damage - tolerance and fatigue evaluation of structure § 25.963 Fuel tanks: general § 25.1189 Shut - off means § 25.1461 Equipment containing high energy rotors CS - APU Auxiliary Power Units NOTE: The provisions of § 25.1461 have occasionally been used in the approval of APU installations regardless of protection from high energy rotor disintegration. However, the more specific requirements of CS 25.903(d)(1) and associated guidance described within this AMC take precedence over the requirements of CS 25.1461.

b. Other Documen ts ISO 2685:1992 Aircraft – Environmental conditions and test procedures for airborne equipment – Resistance to fire in designated fire zones AC 20 – 135 Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and C riteria.

Powered by EASA eRules Page 431 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) c. Society of Automotive Engineers (SAE) Documents.

AIR1537 Report on Aircraft Engine Containment, October, 1977.

AIR4003 Uncontained Turbine Rotor Events Data Period 1976 through 1983.

AIR4770 Uncontained Turbine Rotor Events Data Period 1984 (Draft) through 1989.

These documents can be obtained from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania, 15096.

5 BACKGROUND.

Although turbine engine and APU manufacturers are making efforts to r educe the probability of uncontained rotor failures, service experience shows that uncontained compressor and turbine rotor failures continue to occur. Turbine engine failures have resulted in high velocity fragment penetration of adjacent structures, fuel tanks, fuselage, system components and other engines on the aeroplane. While APU uncontained rotor failures do occur, and to date the impact damage to the aeroplane has been minimal, some rotor failures do produce fragments that should be considered. Sinc e it is unlikely that uncontained rotor failures c an be completely eliminated, CS - 23 and CS - 25 require that aeroplane design precautions be taken to minimise the hazard from such events.

a. Uncontained gas turbine engine rotor failure statistics are presen ted in the Society of Automotive Engineers (SAE) reports covering time periods and number of uncontained events listed in the table shown below. The following statistics summarise 28 years of service experience for fixed wing aeroplanes and do not include data for rotorcraft and APUs: No. of Events Report No. Period Total Category 3 Category 4 AIR1537 1962 – 75 275 44 5 AIR4003 1976 – 83 237 27 3 AIR4770 (Draft) 1984 – 89 164 22 7 TOTAL 676 93 15 The total of 676 uncontained events includes 93 events classified in Category 3 and 15 events classified in Category 4 damage to the aeroplane. Category 3 damage is defined as significant aeroplane damage with the aeroplane capable of continuing flight and making a safe landing. Category 4 damage is def ined as severe aeroplane damage involving a crash landing, critical injuries, fatalities or hull loss.

During this 28 year period there were 1,089.6 million engine operating hours on commercial transports. The events were caused by a wide variety of influe nces classed as environmental (bird ingestion, corrosion/erosion, foreign object damage (FOD)), manufacturing and material defects, mechanical, and human factors (maintenance and overhaul, inspection error and operational procedures).

b. Uncontained APU ro tor failure statistics covering 1962 through 1993 indicate that there have been several uncontained failures in at least 250 million hours of operation on transport category aeroplanes. No Category 3 or 4 events were reported and all failures occurred duri ng ground operation. These events were caused by a wide variety of influences such as corrosion, ingestion of de - icing fluid, manufacturing and material defects, mechanical, and human factors (maintenance and overhaul, inspection error and operational proc edures).

Powered by EASA eRules Page 432 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) c. The statistics in the SAE studies indicate the existence of many different causes of failures not readily apparent or predictable by failure analysis methods. Because of the variety of causes of uncontained rotor failures, it is difficult to an ticipate all possible causes of failure and to provide protection to all areas. However, design considerations outlined in this AMC provide guidelines for achieving the desired objective of minimising the hazard to an aeroplane from uncontained rotor failu res. These guidelines, therefore, assume a rotor failure will occur and that analysis of the effects of this failure is necessary. These guidelines are based on service experience and tests but are not necessarily the only means available to the designer.

6 TERMINOILOGY.

a. Rotor. Rotor means the rotating components of the engine and APU that analysis, test, and/or experience has shown can be released during uncontained failure. The engine or APU manufacturer should define those components that constitute t he rotor for each engine and APU type design. Typically rotors have included, as a minimum, discs, hubs, drums, seals, impellers, blades and spacers.

b. Blade. The airfoil sections (excluding platform and root) of the fan, compressor and turbine.

c. Uncont ained Failure. For the purpose of aeroplane evaluations in accordance with this AMC, uncontained failure of a turbine engine is any failure which results in the escape of rotor fragments from the engine or APU that could result in a hazard. Rotor failures which are of concern are those where released fragments have sufficient energy to create a hazard to the aeroplane.

d. Critical Component. A critical component is any component whose failure would contribute to or cause a failure condition which would prev ent the continued safe flight and landing of the aeroplane. These components should be considered on an individual basis and in relation to other components which could be damaged by the same fragment or by other fragments from the same uncontained event.

e. Continued Safe Flight and Landing. Continued safe flight and landing means that the aeroplane is capable of continued controlled flight and landing, possibly using emergency procedures and without exceptional pilot skill or strength, with conditions of considerably increased flightcrew workload and degraded flight characteristics of the aeroplane.

f. Fragment Spread Angle. The fragment spread angle is the angle measured, fore and aft from the centre of the plane of rotation of an individual rotor stage, initiating at the engine or APU shaft centreline (see Figure 1).

Powered by EASA eRules Page 433 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) FIGURE 1 – ESTIMATED PATH OF FRAGMENTS g. Impact Area. The impact area is that area of the aeroplane likely to be impacted by uncontained fragments generated during a rotor failure ( see Paragraph 9).

h. Engine and APU Failure Model. A model describing the size, mass, spread angle, energy level and number of engine or APU rotor fragments to be considered when analysing the aeroplane design is presented in Paragraph 9.

7 DESIGN CONSIDER ATIONS.

Practical design precautions should be used to minimise the damage that can be caused by uncontained engine and APU rotor fragments. The most effective methods for minimising the hazards from uncontained rotor fragments include location of critical components outside the fragment impact areas or separation, isolation, redundancy, and shielding of critical aeroplane components and/or systems. The following design considerations are recommended: a. Consider the location of the engine and APU rotors re lative to critical components, systems or areas of the aeroplane such as: (1) Any other engine(s) or an APU that provides an essential function; (2) Pressurised sections of the fuselage and other primary structure of the fuselage, wings and empennage; (3) Pilot compartment areas; (4) Fuel system components, piping and tanks; (5) Control systems, such as primary and secondary flight controls, electrical power cables, wiring, hydraulic systems, engine control systems, flammable fluid shut - off valves, and the associated actuation wiring or cables; Powered by EASA eRules Page 434 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) (6) Any fire extinguisher system of a cargo compartment, an APU, or another engine including electrical wiring and fire extinguishing agent plumbing to these systems; (7) Engine air inlet attachments and effects of engine case deformations caused by fan blade debris resulting in attachment failures; (8) Instrumentation essential for continued safe flight and landing; (9) Thrust reverser systems where inadvertent deployment could be catastrophic; and (10) O xygen systems for high altitude aeroplanes, where these are critical due to descent time.

b. Location of Critical Systems and Components. Critical aeroplane flight and engine control cables, wiring, flammable fluid carrying components and lines (including vent lines), hydraulic fluid lines and components, and pneumatic ducts should be located to minimise hazards caused by uncontained rotors and fan blade debris. The following design practices should be considered: (1) Locate, if possible, critical components or systems outside the likely debris impact areas.

(2) Duplicate and separate critical components or systems, or provide suitable protection if located in debris impact areas.

(3) Protection of critical systems and components can be provided by using airframe structure or supplemental shielding.

These methods have been effective in mitigating the hazards from both single and multiple small fragments within the ± 15 impact area. Separation of multiplicated critical systems and components by at l east a distance equal to the 1/2 blade fragment dimension has been accepted for showing minimisation from a single high energy small fragment when at least one of the related multiplicated critical components is shielded by significant structure such as al uminium lower wing skins, pylons, aluminium skin of the cabin pressure vessel, or equivalent structures.

Multiplicated critical systems and components positioned behind less significant structures should be separated by at least a distance equal to the 1/2 blade fragment dimension, and at least one of the multiplicated critical systems should be: (i) Located such that equivalent protection is provided by other inherent structures such as pneumatic ducting, interiors, bulkheads, stringers, or (ii) Protected by an additional shield such that the airframe structure and shield material provide equivalent shielding.

(4) Locate fluid shut - offs and actuation means so that flammable fluid can be isolated in the event of damage to the system.

(5) Minimise the flammab le fluid spillage which could contact an ignition source.

(6) For airframe structural elements, provide redundant designs or crack stoppers to limit the subsequent tearing which could be caused by uncontained rotor fragments.

(7) Locate fuel tanks and othe r flammable fluid systems and route lines (including vent lines) behind aeroplane structure to reduce the hazards from spilled fuel or from Powered by EASA eRules Page 435 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) tank penetrations. Fuel tank explosion - suppression materials, protective shields or deflectors on the fluid lines, h ave been used to minimise the damage and hazards.

c. External Shields and Deflectors. When shields, deflection devices or aeroplane structure are proposed to be used to protect critical systems or components, the adequacy of the protection, including mount ing points to the airframe structure, should be shown by testing or validated analyses supported by test data, using the fragment energies supplied by the engine or APU manufacturer or those defined in Paragraph 9. For protection against engine small fragm ents, as defined in Paragraph 9, no quantitative validation as defined in Paragraph 10 is required if equivalency to the penetration resistant structures listed (e.g. pressure cabin skins, etc.) is shown.

8 ACCEPTED DESIGN PRECAUTIONS.

Design practices cu rrently in use by the aviation industry that have been shown to reduce the overall risk, by effectively eliminating certain specific risks and reducing the remaining specific risks to a minimum level, are described within this paragraph of the AMC. Aeropla ne designs submitted for evaluation by the regulatory authorities will be evaluated against these proven design practices.

a. Uncontrolled Fire.

(1) Fire Extinguishing Systems. The engine/APU fire extinguishing systems currently in use rely on a fire zone with a fixed compartment air volume and a known air exchange rate to extinguish a fire. The effectiveness of this type of system along with firewall integrity may therefore be compromised for the torn/ruptured compartment of the failed engine/APU. Protecti on of the aeroplane following this type of failure relies on the function of the fire warning system and subsequent fire switch activation to isolate the engine/APU from airframe flammable fluid (fuel and hydraulic fluid) and external ignition sources (pne umatic and electrical). Fire extinguishing protection of such a compromised system may not be effective due to the extent of damage. Continued function of any other engine, APU or cargo compartment fire warning and extinguisher system, including electrical wiring and fire extinguishing agent plumbing, should be consi dered as described in Paragraph 7.

(2) Flammable Fluid Shut - off Valve. As discussed above, shut - off of flammable fluid supply to the engine may be the only effective means to extinguish a fire f ollowing an uncontained failure, therefore the engine isolation/flammable fluid shut - off function should be assured following an uncontained rotor failure. Flammable fluid shut - off valves should be located outside the uncontained rotor impact area. Shut - of f actuation controls that need to be routed through the impact area should be redundant and appropriately separated in relation to the one - third disc maximum dimension.

(3) Fire Protection of Critical Functions. Flammable fluid shut - off and other critical controls should be located so that a fire (caused by an uncontained rotor event) will not prevent actuation of the shut - off function or loss of critical aeroplane functions. If shut - off or other critical controls are located where a fire is possible follo wing an uncontained rotor failure (e.g. in compartments adjacent to fuel tanks) then these items should meet the applicable fire protection guidelines such as ISO 2685:1992 or AC 20 - 135.

Powered by EASA eRules Page 436 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) (4) Fuel Tanks. If fuel tanks are located in impact areas, the foll owing precautions should be implemented: (i) Protection from the effects of fuel leakage should be provided for any fuel tanks located above an engine or APU and within the one - third disc and intermediate fragment impact areas. Dry bays or shielding are acceptable means. The dry bay should be sized based on analysis of possible fragment trajectories through the fuel tank wall and the subsequent fuel leakage from the damaged fuel tank so that fuel will not migrate to an engine, APU or other i gnition source during either – flight or ground operation. A minimum drip clearance distance of 10 inches (254 mm) from potential ignition sources of the engine nacelle, for static conditions, has been acceptable (see Figure 2).

Powered by EASA eRules Page 437 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPAR T A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) FIGURE 2 – DRY BAY SIZING DETERMINATION EXAMPLE Powered by EASA eRules Page 438 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) (ii) Fuel tank penetration leak paths should be determined and evaluated for hazards during flight and ground phases of operation. If fuel spills into the airstream away from the aeroplane no additional protection is needed.

Additional protection should be considered if fuel could spill, drain or migrate into areas housing ignition sources, such as engine or APU inlets or wheel wells. Damage to adjacent systems, wiring etc., should be evaluated regarding the potential that an uncontained fragment will create both an ignition source and fuel source. Wheel brakes may be considered as an ignition source during take - off and initial climb. Protection of the wheel wells may be provided by airflow discharging from gaps or openings, pr eventing entry of fuel, a ventilation rate precluding a combustible mixture or other provisions indicated in CS 23.863 and CS 25.863.

(iii) Areas of the aeroplane where flammable fluid migration is possible that are not drained and vented and have ignition sources or potential ignition sources should be provided with a means of fire detection and suppression and be explosion vented or equivalently protected.

b. Loss of Thrust.

(1) Fuel Reserves. The fuel reserves should be isolatable such that damage from a disc fragment will not result in loss of fuel required to complete the flight or a safe diversion. The effects of fuel loss, and the resultant shift of centre of gravity or lateral imbalance on aeroplane controllability should also be considered.

(2) Engi ne Controls. Engine control cables and/or wiring for the remaining powerplants that pass through the impact area should be separated by a distance equal to the maximum dimension of a one - third disc fragment or the maximum extent possible.

(3) Other Engine Damage. Protection of any other engines from some fragments should be provided by locating critical components, such as engine accessories essential for proper engine operation (e.g., high pressure fuel lines, engine controls and wiring, etc.), in areas w here inherent shielding is provided by the fuselage, engine or nacelle (including thrust reverser) structure (see Paragraph 7).

c. Loss of Aeroplane Control (1) Flight Controls. Elements of the flight control system should be adequately separated or protec ted so that the release of a single one - third disc fragment will not cause loss of control of the aeroplane in any axis. Where primary flight controls have duplicated (or multiplicated) elements, these elements should be located to prevent all elements in any axis being lost as a result of the single one - third disc fragment. Credit for maintaining control of the aeroplane by the use of trim controls or other means may be obtained, providing evidence shows that these means will enable the pilot to retain co ntrol.

(2) Emergency Power. Loss of electrical power to critical functions following an uncontained rotor event should be minimised. The determination of electrical system criticality is dependent upon aeroplane operations. For example, aeroplanes approved for Extended Twin Engine Operations (ETOPS) that rely on alternate power sources such as hydraulic motor generators or APUs may be configured with the electrical wiring separated to the maximum extent possible within the one - third disc impact zone.

Powered by EASA eRules Page 439 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) (3) Hy draulic Supply. Any essential hydraulic system supply that is routed within an impact area should have means to isolate the hydraulic supply required to maintain control of the aeroplane. The single one - third disc should not result in loss of all essential hydraulic systems or loss of all flight controls in any axis of the aeroplane.

(4) Thrust reverser systems. The effect of an uncontained rotor failure on inadvertent in - flight deployment of each thrust reverser and possible loss of aeroplane control shall be considered. The impact area for components located on the failed engine may be different from the impact area defined in Paragraph 6. If uncontained failure could cause thrust reverser deployment, the engine manufacturer should be consulted to establis h the failure model to be considered. One acceptable method of minimisation is to locate reverser restraints such that not all restraints can be made ineffective by the fragments of a single rotor.

d. Passenger and Crew Incapacitation.

(1) Pilot Compartmen t. The pilot compartment of large aeroplanes should not be located within the ± 15 ° spread angle of any engine rotor stage or APU rotor stage that has not been qualified as contained, unless adequate shielding, deflectors or equivalent protection is provid ed for the rotor stage in accordance with Paragraph 7c. Due to design con straints inherent in smaller CS - 23 aeroplanes, it is not considered practical to locate the pilot compartment outside the ±15 ° spread angle. Therefore for o ther aeroplanes (such as ne w CS - 23 commuter category aeroplanes) the pilot compartment area should not be located within the ±5 ° spread angle of any engine rotor stage or APU rotor stage unless adequate shielding, deflectors, or equivalent protection is provided for the rotor stage in accordance with Paragraph 7c of this AMC, except for the following: (i) For derivative CS - 23 category aeroplanes where the engine location has been previously established, the engine location in relation to the pilot compartment need not be changed.

(ii) For no n - commuter CS - 23 category aeroplanes, satisfactory service experience relative to rotor integrity and containment in similar engine installations may be considered in assessing the acceptability of installing engines in line with the pilot compa rtment.

(iii) For non - commuter new CS - 23 category aeroplanes, where due to size and/or design considerations the ± 5 ° spread angle cannot be adhered to, the pilot compartment/engine location should be analysed and accepted in accordance with Paragraphs 9 a nd 10.

(2) Pressure Vessel. For aeroplanes that are certificated for operation above 41,000 feet, the engines should be located such that the pressure cabin cannot be affected by an uncontained one - third or intermediate disc fragment. Alternatively, it ma y be shown that rapid decompression due to the maximum hole size caus ed by fragments within the ± 15 ° zone and the associated cabin pressure decay rate will allow an emergency descent without incapacitation of the flightcrew or passengers. A pilot reaction time of 17 seconds for initiation of the emergency decent has been accepted. Where the pressure cabin could be affected by a one - third disc or intermediate fragments, design precautions should be taken to preclude incapacitation of crew and passengers. Ex amples of design precautions that have been previously accepted are: Powered by EASA eRules Page 440 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) (i) Provisions for a second pressure or bleed down bulkhead outside the impact area of a one - third or intermediate disc fragment.

(ii) The affected compartment in between the primary and secondary bulkhead was made inaccessible, by operating limitations, above the minimum altitude where incapacitation could occur due to the above hole size.

(iii) Air supply ducts running through this compartment were provided with non - return valves to pre vent pressure cabin leakage through damaged ducts.

NOTE: If a bleed down bulkhead is used it should be shown that the rate of pressure decay and minimum achieved cabin pressure would not incapacitate the crew, and the rate of pressure decay would not precl ude a safe emergency descent.

e. Structural Integrity. Installation of tear straps and shear ties within the uncontained fan blade and engine rotor debris zone to prevent catastrophic structural damage has been utilised to address this threat.

9. ENGINE AND APU FAILURE MODEL.

The safety analysis recommended in Paragraph 10 should be made using the following engine and APU failure model, unless for the particular engine/APU type concerned, relevant service experience, design data, test results or o ther evidence justify the use of a different model.

a. Single One - Third Disc fragment. It should be assumed that the one - third disc fragment has the maximum dimension corresponding to one - third of the disc with one - third blade height and a fragment spread angle of ± 3 ° . Where energy considerations are relevant, the mass should be assumed to be one - third of the bladed disc mass and its energy, the translational energy (i.e., neglecting rotational energy) of the sector travelling at the speed of its c.g. loca tion as defined in Figure 3.

b. Intermediate Fragment. It should be assumed that the intermediate fragment has a maximum dimension corresponding to one - third of the bladed disc radius and a fragment spread angle of ± 5 ° . Where energy considerations are rel evant, the mass should be assumed to be 1/30 of the bladed disc mass and its energ y the transitional energy (i.e. neglecting rotational energy) of the piece travelling at rim speed (see Figure 4).

Powered by EASA eRules Page 441 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) FIGURE 3 – SINGLE ONE - THIRD ROTOR FRAGMENT FIGURE 4 – INTERMEDIATE FRAGMENT Powered by EASA eRules Page 442 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) c. Alternative Engine Failure Model. For the purpose of the analysis, as an alternative to the engine failure model of Paragraphs 9a and b, the use of a single one - third piece of disc having a fragment spread angle ± 5 ° would be accep table, provided the objectives of Paragraph 10c are satisfied.

d. Small Fragments. It should be assumed that small fragments (shrapnel) range in size up to a maximum dimension corresponding to the tip half of the blade airfoil (with exception of fan blades ) and a fragment spread angle of ± 15 ° . Service history has shown that aluminium lower wing skins, pylons, and pressure cabin skin and equivalent structures typically resist penetration from all but one of the most energetic of these fragments. The effects of multiple small fragments should also be considered. Penetration of less significant structures such as fairings, empennage, control surfaces and unpressurised unpressurized skin has typically occurred at the rate of 2½ percent of the number of blades o f the failed rotor stage. Refer to paragraph 7b and 7c for methods of minimisation of the hazards. Where the applicant wishes to show compliance by considering the energy required for penetration of structure (or shielding) the engine manufacturer should b e consulted for guidance as to the size and energy of small fragments within the impact area.

For APUs, where energy considerations are relevant, it should be assumed that the mass will correspond to the above fragment dimensions and that it has a translat ional energy level of one percent of the total rotational energy of the original rotor stage.

e. Fan Blade Fragment. It should be assumed that the fan blade fragment has a maximum dimension corresponding to the blade tip with one - third the blade airfoil he ight and a fragment spread angle of ± 15 ° . Where energy considerations are relevant the mass should be assumed to be corresponding to the one - third of the airfoil including any part span shroud and the transitional energy (neglecting rotational energy) of the fragment travelling at the speed of its c.g. location as defined in Figure 5. As an alternative, the engine manufacturer may be consulted for guidance as to the size and energy of the fragment.

Powered by EASA eRules Page 443 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) FIGURE 5 – FAN BLADE FRAGMENT DEFINITION f. Critical En gine Speed. Where energy considerations are relevant, the uncontained rotor event should be assumed to occur at the engine or APU shaft red line speed.

g. APU Failure Model. For all APU's, the installer also needs to address any hazard to the aeroplane ass ociated with APU debris (up to and including a complete rotor where applicable) exiting the tailpipe. Paragraphs 9g(1) or (2) below or applicable service history provided by the APU manufacturer may be used to define the size, mass, and energy of debris ex iting that tailpipe. The APU rotor failure model applicable for a particular APU installation is depe ndent upon the provisions of CS - APU that were utilised for receiving approval: (1) For APU's where rotor integrity has been dem onstrated in accordance with CS - APU, i.e. without specific containment testing, Paragraphs 9a, b, and d, or Paragraphs 9c and 9d apply.

(2) For APU rotor stages qualified as contained in accordance with CS - APU, historical data shows that in - service uncontained failures have occurred. These failure Powered by EASA eRules Page 444 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) modes have included bi - hub, overspeed, and fragments missing the containment ring wh ich are not addressed by the CS - APU containment test. In order to address these hazards, the installer should use the APU small fragment definition of Paragr aph 9d or substantiated in - service data supplied by the APU manufacturer.

10 SAFETY ANALYSIS.

The numerical assessment requested in Paragraph 10c(3) is derived from methods previously prescribed in ACJ No. 2 to CS 25.903(d)(1). The hazard ratios provided are based upon evaluation of various configurations of large aeroplanes, made over a period of time, incorporating practical methods of minimising the hazard to the aeroplane from uncontained engine debris.

a. Analysis. An analysis should be made using the engine/APU model defined in Paragraph 9 to determine the critical areas of the aeroplane likely to be damaged by rotor debris and to evaluate the consequences of an uncontained failure. This analysis should be conducted in relation to all normal phases of flight, or portions thereof.

NOTE: APPENDIX 1 provides additional guidance for completion of the numerical analysis requested by this paragraph.

(1) A delay of at least 15 seconds should be assumed before start of the emergency engine shut down. The extent of the delay is dependent upon circumstances resulting from the uncontained failure including increased flightcrew workload stemming from multiplicity of warnings which require analysis by the flightcrew.

(2) Some degradation of the flight characteristics of the aeroplane or operation of a system is permissible, provided the aeroplane is capable of continued safe flight and landing. Account should be taken of the behaviour of the aeroplane under asymmetrical engine thrust or power condition s together with any possible damage to the flight control system, and of the predicted aeroplane recovery manoeuvre.

(3) When considering how or whether to mitigate any potential hazard identified by the model, credit may be given to flight phase, service experience, or other data, as noted in Paragraph 7.

b. Drawings. Drawings should be provided to define the uncontained rotor impact threat relative to the areas of design consideration defined in Paragraphs 7a(1) through (10) showing the trajectory paths o f engine and APU debris relative to critical areas. The analysis should include at least the following: (1) Damage to primary structure including the pressure cabin, engine/APU mountings and airframe surfaces.

NOTE: Any structural damage resulting from unc ontained rotor debris should be considered catastrophic unless the residual strength and flutter criteria of ACJ 25.571(a) subparagraph 2.7.2 can be met without failure of any part of the structure essential for completion of the flight. In addition, the p ressurised compartment loads of CS 25.365(e)(1) and (g) must be met.

(2) Damage to any other engines (the consequences of subsequent uncontained debris from the other engine(s), need not be considered).

(3) Damage to services and equipment essential for sa fe flight and landing (including indicating and monitoring systems), particularly control systems for flight, engine power, engine fuel supply and shut - off means and fire indication and extinguishing systems.

Powered by EASA eRules Page 445 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) (4) Pilot incapacitation, (see also paragraph 8 d(1)).

(5) Penetration of the fuel system, where this could result in the release of fuel into personnel compartments or an engine compartment or other regions of the aeroplane where this could lead to a fire or explosion.

(6) Damage to the fuel system, e specially tanks, resulting in the release of a large quantity of fuel.

(7) Penetration and distortion of firewalls and cowling permitting a spread of fire.

(8) Damage to or inadvertent movement of aerodynamic surfaces (e.g.. flaps, slats, stabilisers, aile rons, spoilers, thrust reversers, elevators, rudders, strakes, winglets, etc.) and the resultant effect on safe flight and landing.

c. Safety Analysis Objectives. It is considered that the objective of minimising hazards will have been met if: (1) The prac tical design considerations and precautions of Paragraphs 7 and 8 have been taken; (2) The safety analysis has been completed using the engine/APU model defined in Paragraph 9; (3) Fo r CS - 25 large aeroplanes and CS - 23 commuter category aeroplanes, the foll owing hazard ratio guidelines have been achieved: (i) Single One - Third Disc Fragment. There is not more than a 1 in 20 chance of catastrophe resulting from the release of a single one - third disc fragment as defined in Paragraph 9a.

(ii) Intermediate Fragme nt. There is not more than a 1 in 40 chance of catastrophe resulting from the release of a piece of debris as defined in Paragraph 9b.

(iii) Multiple Disc Fragments. (Only applicable to any duplicated or multiplicated system when all of the system channels contributing to its functions have some part which is within a distance equal to the diameter of the largest bladed rotor, measured from the engine centreline). There is not more than 1 in 10 chance of catastrophe resulting from the release in three rando m directions of three one - third fragments of a disc each having a uniform probability of ejection over the 360 ° (assuming an angular spread of ±3 ° relative to the plane of the disc) causing coincidental damage to systems which are duplicated or multiplicat ed.

NOTE: Where dissimilar systems can be used to carry out the same function (e.g.

elevator control and pitch trim), they should be regarded as duplicated (or multiplicated) systems for the purpose of this subparagraph provided control can be maintained.

The numerical assessments described above may be used to judge the relative values of minimisation. The degree of minimisation that is feasible may vary depending upon aeroplane size and configuration and this variation may prevent the specific hazard rati o from being achieved. These levels are design goals and should not be treated as absolute targets. It is possible that any one of these levels may not be practical to achieve.

Powered by EASA eRules Page 446 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) (4) For newly designed non - commuter CS - 23 aeroplanes the chance of catastrophe is not more than twice that of Paragraph 10(c)(3)(i), (ii) and (iii) for each of these fragment types.

(5) A numerical risk assessment is not requested for the single fan blade fragment, small fragments, and APU and engine rotor stages which ar e qualified as contained.

d. APU Analysis For APU's that are located where no hazardous consequences would result from an uncontained failure, a limited qualitative assessment showing the relative location of critical systems/components and APU impact area s is all that is needed. If critical systems/components are located within the impact area, more extensive analysis is needed. For APUs which have demonstrated rotor integrity only, the failure model outlined in Paragraph 9g(1) should be considered as a ba sis for this safety assessment.

For APU rotor stages qualified as contained per CS – APU, the aeroplane safety analysis may be limited to an assessment of the effects of the failure model outlined in Paragraph 9g(2).

e. Specific Risk The aeroplane risk levels specified in Paragraph 10c, resulting from the release of rotor fragments, are the mean values obtained by averaging those for all rotors on all engines of the aeroplane, assuming a typical flight. Individual rotors or engines need not meet these ri sk levels nor need these risk levels be met for each phase of flight if either: (1) No rotor stage shows a higher level of risk averaged throughout the flight greater than twice those stated in Paragraph 10c.

NOTE: The purpose of this Paragraph is to ensur e that a fault which results in repeated failures of any particular rotor stage design, would have only a limited effect on aeroplane safety.

FIGURE 6 – ALL NON - CONTAINMENTS BY PHASE OF FLIGHT (2) Where failures would be catastrophic in particular porti ons of flight, allowance is made for this on the basis of conservative assumptions as to the proportion of failures likely to occur in these phases. A greater level of risk could be accepted if the exposure exists only during a particular phase of flight e .g., during take - off. The Powered by EASA eRules Page 447 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) proportional risk of engine failure during the particular phases of flight is given in SAE Papers referenced in Paragraph 4d. See also data contained in the CAA paper "Engine Non - Containments – The CAA View", which includes Figure 6. This paper is published in NASA Report CP - 2017, "An Assessment of Technology for Turbo - jet Engine Rotor Failures", dated August 1977.

Appendix 1 to AMC 20 - 128A User’s Manual

ED Decision 2003/12/RM RISK ANALYSIS METHODOLOGY for UNCONTAINED ENGINE/APU FA ILURE INDEX 1.0 GENERAL 2.0 SCOPE 3.0 FUNDAMENTAL COMPONENTS OF A SAFETY AND RISK ANALYSIS 4.0 ASSUMPTIONS 5.0 PLOTTING 6.0 METHODOLOGY – PROBABILITY ASSESSMENT 7.0 RESULTS ASSESSMENT FIGURE 1 EXAMPLE – HAZARD TREE FIGURE 2 EXAMPLE – SYSTEM LOADING MATRIX FIGURE 3 TRI - SECTOR ROTOR BURST FIGURE 4 TYPICAL LAYOUT OF SYSTEMS IN ROTOR PLANE FIGURE 5 TRAJECTORY RANGE PLOTTING FIGURE 6 TYPICAL TRAJECTORY PLOTTING FIGURE 7 DEFINITION – THREAT WINDOW FIGURE 8 SAMPLE ROTOR STAGE PLOTTING CHART 1.0 GENERAL 1.1 The design of aeroplane and engine systems and the location of the engines relative to critical systems and structure have a significant impact on survivability of the aeroplane following an uncontained engine failure. CS 23.903(b)(1) and 25.90 3(d)(1) of the EASA Certification Specifications (CS) require that design precautions be taken to minimise the hazard to the aeroplane due to uncontained failures of engine or auxiliary power unit (APU). AMC 20 - 128A provides guidance for demonstrating compliance with these requirements.

1.2 As a part of this compliance demonstration, it is necessary to quantitatively assess the risk of a catastrophic failure in the event of an uncon tained engine failure. This User’s Manual describes an acceptable method for this purpose.

1.3 The objective of the risk analysis is to measure the remaining risk after prudent and practical design considerations have been taken. Since each aeroplane would have unique features which must be considered when applying the methods described in this manual, there should be some flexibility in the methods and procedures.

1.4 It is a preferred approach to use these methods throughout the development of an aeroplan e design to identify problem areas at an early stage when appropriate design changes are least disruptive. It is also advisable to involve the European Aviation Safety Powered by EASA eRules Page 448 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) Agency (EASA) in this process at an early stage when appropriate interpretation of the m ethodology and documentation requirements can be established.

1.5 It should be noted that although the risk analysis produces quantitative results, subjective assessments are inherent in the methods of the analysis regarding the criticality of specific typ es of aeroplane component failures. Assumptions for such assessments should be documented along with the numerical results.

1.6 Aeroplane manufacturers have each developed their own method of assessing the effects of rotor failure, as there are many ways t o get to the same result. This User’s Manual identifies all the elements that should be contained in an analysis, so that it can be interpreted by a person not familiar with such a process.

1.7 The intent of this manual therefore is to aid in establishing how an analysis is prepared, without precluding any technological advances or existing proprietary processes.

1.8 AMC 20 - 128A makes allowance for the broad configuration of the aeroplane as such damage to the structure due to rotor failure generally allows for little flexibility in design.

System lay - out within a rotor burst zone, however, can be optimized.

1.9 Damage to structure, which may involve stress analysis, generally can be analyzed separately, and later coordinated with simultaneous system effects .

1.10 For an analysis of the effects on systems due to a rotor failure the aeroplane must be evaluated as a whole; and a risk analysis must specifically highlight all critical cases identified which have any potential to result in a catastrophe.

1.11 Such an analysis can then be used to establish that reasonable precautions have been taken to minimise the hazards, and that the remaining hazards are an acceptable risk.

1.12 A safety and a risk analysis are interdependent, as the risk analysis must be based on the safety analysis.

The safety analysis therefore is the starting point that identifies potential hazardous or catastrophic effects from a rotor failure and is the basic tool to minimise the hazard in accordance with the guidelines of AMC 20 - 128A .

1.13 The risk analysis subsequently assesses and quantifies the residual risk to the aeroplane.

2.0 SCOPE The following describes the scope of analyses required to assess the aeroplane risk levels against the criteria set forth in Paragraph 10 of AMC 20 - 128A .

2.1 Safety Analysis is re quired to identify the critical hazards that may be numerically analyzed (hazards remaining after all practical design precautions have been taken).

Functional criticality will vary by aeroplane and may vary by flight phase.

Thorough understanding of each aeroplane structure and system functions is required to establish the criticality relative to each fragment trajectory path of the theoretical failure.

Assistance from experts within each discipline is typically required to assure accuracy of the analysis in such areas as effects of fuel tank penetration on leakage paths and ignition hazards, thrust level control (for loss of thrust assessment), structural capabilities (for fuselage impact assessment), aeroplane controllability (for control cables impact as sessment), and fuel asymmetry.

Powered by EASA eRules Page 449 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) 2.2 Risk For each remaining critical hazard, the following assessments may be prepared using the engine/APU failure models as defined in Paragraph 9 of AMC 20 - 128A : a. Flight mean risk for single 1/3 disc fragment.

b. Flight mean risk for single intermediate fragment.

c. Flight mean risk for alternate model (when used as an alternate to the 1/3 disc fragment and intermediate fragment).

d. Multiple 1/3 disc fragments for duplicated or multiplicated systems.

e. Specific risk for single 1/3 disc fragment and single intermediate fragment.

f. Specific risk for any single disc fragment that may result in catastrophic structural damage.

The risk level criteri a for each failure model are defined in Paragraph 10 of AMC 20 - 128A .

3.0 FUNDAMENTAL COMPONENTS OF A SAFETY AND RISK ANALYSIS 3.1 The logical steps for a complete analysis are: a. Establish at the design definition the functional hazards that can arise from the combined or concurrent failures of individual systems, including multiplicated systems and critical structure.

b. Establish a Functional Hazard Tree (see Figure 1), or a Syst em Matrix (see Figure 2) that identifies all system interdependencies and failure combinations that must be avoided (if possible) when locating equipment in the rotor burst impact area.

In theory, if this is carried out to the maximum, no critical system h azards other than opposite engine or fuel line hits would exist.

c. Establish the fragment trajectories and trajectory ranges both for translational and spread risk angles for each damage. Plot these on a chart or graph, and identify the trajectory ranges that could result in hazardous combinations (threats) as per the above system matrix or functional hazard analysis.

d. Apply risk factors, such as phase of flight or other, to these threats, and calculate the risk for each threat for each rotor stage.

e. T abulate, summarize and average all cases.

3.2 In accordance with AMC 20 - 128A the risk to the aeroplane due to uncontained rotor failure is assessed to the effects, once such a failure has occurred.

The probability of occurrence of rotor failure, as analyzed with the probability methods of AMC 25.1309 (i.e. probability as a function of critical uncontained rotor failure rate and exposure time), does not apply.

3.3 The total risk level to the aeroplane, as identified by the risk analysis, is the mean value obtained by averaging the values of all rotor stages of all engines of the aeroplane, expressed as Flight Mean Risk.

Powered by EASA eRules Page 450 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) 4.0 ASSUMPTIONS 4.1 The following conservative assumptions, in addition to those in Paragraphs 10(a)(1), (2) and (3) of AMC 20 - 128A , have been made in some previous analyses. However, each aeroplane design may have unique characteristics and therefore a unique basis for the safety assessment leading to the possibility of different assumptions. All assump tions should be substantiated within the analysis: a. The 1/3 disc fragment as modeled in Paragraph 9(a) of the AMC 20 - 128A travels along a trajectory path that is tangential to th e sector centroid locus, in the direction of rotor rotation (Refer to Figure 3).

The sector fragment rotates about its centroid without tumbling and sweeps a path equal to twice the greatest radius that can be struck from the sector centroid that intersect s its periphery.

The fragment is considered to possess infinite energy, and therefore to be capable of severing lines, wiring, cables and unprotected structure in its path, and to be undeflected from its original trajectory unless deflection shields are fi tted.

However, protective shielding or an engine being impacted may be assumed to have sufficient mass to stop even the most energetic fragment.

b. The probability of release of debris within the maximum spread angle is uniformly distributed over all direc tions.

c. The effects of severed electrical wiring are dependent on the configuration of the affected system. In general, severed wiring is assumed to not receive inadvertent positive voltage for any significant duration.

d. Control cables that are struck by a fragment disconnect.

e. Hydraulically actuated, cable driven control surfaces, which do not have designated “fail to” settings, tend to fail to null when control cables are severed.

Subsequent surface float is progressive and predictable.

f. Systems c omponents are considered unserviceable if their envelope has been touched. In case of an engine being impacted, the nacelle structure may be regarded as engine envelope, unless damage is not likely to be hazardous.

g. Uncontained events involving in - flight penetration of fuel tanks will not result in fuel tank explosion.

h. Unpowered flight and off - airport landings, including ditching, may be assumed to be not catastrophic to the extent validated by accident statistics or other accepted factors.

i. Damage t o structure essential for completion of flight is catastrophic (Ref. AMC 20 - 128A , Paragraph 10.b(1)).

j. The flight begins when engine power is advanced for takeoff and ends after landing when turning off the runway.

5.0 PLOTTING 5.1 Cross - section and plan view layouts of the aeroplane systems in the ranges of the rotor burst impact areas should be prepared, either as drawings, or as computer models These layouts should plot the pr ecise location of the critical system components, including fuel and hydraulic lines, flight control cables, electric wiring harnesses and Powered by EASA eRules Page 451 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) junction boxes, pneumatic and environmental system ducting, fire extinguishing; critical structure, etc.

5.2 For ever y rotor stage a plane is developed. Each of these planes contains a view of all the system components respective outer envelopes, which is then used to generate a cross - section. See Figure 4.

5.3 Models or drawings representing the various engine rotor sta ges and their fore and aft deviation are then generated.

5.4 The various trajectory paths generated for each engine rotor stage are then superimposed on the cross - section layouts of the station planes that are in the range of that potential rotor burst in order to study the effects (see Figure 5). Thus separate plots are generated for each engine rotor stage or rotor group.

To reduce the amount of an analysis the engine rotor stages may also be considered as groups, as applicable for the engine type, using the largest rotor stage diameter of the group.

5.5 These trajectory paths may be generated as follows and as shown in Figure 6: a. Two tangent lines T1 are drawn between the locus of the centroid and the target envelope.

b. At the tangent line touch points, lines N1 and N2 normal to the tangent lines, are drawn with the length equal to the radius of the fragment swept path (as also shown in Figure 1).

c. Tangent lines T2 are drawn between the terminal point of the normal lines and the locus of the cen troid. The angle between these two tangent lines is the translational risk angle.

5.6 The entry and exit angles are then calculated.

5.7 The initial angle of intersection and the final angle of intersection are recorded, and the trajectories in between are considered to be the range of trajectories in which this particular part would be impacted by a rotor sector, and destroyed (i.e. the impact area).

The intersections thus recorded are then entered on charts in tabular form so that the simultaneous effects can be studied. Refer to Figure 8.

Thus it will be seen that the total systems’ effects can be determined and the worst cases identified.

5.9 If a potentially serious multiple system damage case is identified, then a more detailed analysis of the trajectory range will be carried out by breaking the failure case down into the specific fore - aft spread angle, using the individual rotor stage width instead of combined groups, if applicable.

6.0 METHODOLOGY – PROBABILITY ASSESSMENT 6.1 Those rotor burst cases that have some potential of causing a catastrophe are evaluated in the analysis in an attempt to quantify an actual probability of a catastroph e, which will, in all cases, depend on the following factors: a. The location of the engine that is the origin of the fragment, and its direction of rotation.

b. The location of critical systems and critical structure.

Powered by EASA eRules Page 452 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) c. The rotor stage and the fragment m odel.

d. The translational trajectory of the rotor fragment, e. The specific spread angle range of the fragment.

f. The specific phase of the flight at which the failure occurs.

g. The specific risk factor associated with any particular loss of function.

6 .2 Engine Location The analysis should address the effects on systems during one flight after a single rotor burst has occurred, with a probability of 1.0. As the cause may be any one of the engines, the risk from each engine is later averaged for the numb er of engines.

The analysis trajectory charts will then clearly show that certain system damage is unique to rotor fragments from a particular engine due to the direction of rotation, or, that for similar system damage the trajectory range varies considera bly between engines.

A risk summary should table each engine case separately with the engine location included.

6.3 Rotor Element The probability of rotor failure is assumed to be 1.0 for each of all rotor stages. For the analysis the individual risk(s) fr om each rotor stage of the engine should be assessed and tabled.

6.4 Translational Risk Angle The number of degrees of included arc (out of 360) at which a fragment intersects the component/structure being analyzed. Refer to Figure 6 and Figure 7.

6.5 Traj ectory Probability (P) The probability of a liberated rotor fragment leaving the engine case is equal over 360 , thus the probability P of that fragment hitting a system component is the identified Translational Risk Angle ɸ in degrees °, divided by 360, i.e.

𝑃 = 𝜙 / 360 or 𝜙 1 − 𝜙 2 6.6 Spread Angle If the failure model of the analysis assumes a (fore and aft) s pread of ± 5°, then the spread angle is a total of 10°. If a critical component can only be hit at a limited position within that spread, then the exposure of that critical component can then be factored according to the longitudinal position within the sp read angle, e.g.: 𝜓 2 − 𝜓 1 𝑠𝑝𝑟𝑒𝑎𝑑 𝑎𝑛𝑔𝑙𝑒 If a component can only be hit at the extreme forward range of +4° to +5°, then the factor is .1 (for one degree out of 10).

6.7 Threat Window The definition of a typical threat window is shown in Figure 7.

Powered by EASA eRules Page 453 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) 6.8 Phase of Flight Certain types of system damage may be catastrophic only during a specific portion of the flight profile, such as a strike on the opposite engine during take - off after V 1 (i.e. a probability of 1.0), while with altitude a straight - ahead landing may be possible under certain favourable conditions (e.g. a probability of less than 1.0). The specific case can then be factored accordingly.

6.8.1 The most likely time for an uncontained rotor failure to occur is during take - off, when the engine is under highest stress. Using the industry accepted standards for the percentage of engine failures occurring within each flight phase, the following probabilities are assumed: Take - off before V 1 35% V 1 to first power reduction 20% Climb 22% Cruise 14% Descent 3% Approach 2% Landing/Reverse 4% 6.8.2 The flight phase failure distribution above is used in the calculations of catastrophic risk for all cases where this risk varies with flight phase.

𝐷𝑝 = 𝑃 𝑓𝑙𝑖𝑔 ℎ 𝑡 𝑝 ℎ 𝑎𝑠𝑒 % 6.9 Othe r Risk Factors Risks such as fire, loss of pressurization, etc., are individually assessed for each case where applicable, using conservative engineering judgment. This may lead to a probability of catastrophe (i.e., risk factor) smaller than 1.0.

6.9.1 Th e above probabilities and factors are used in conjunction with the critical trajectory range defined to produce a probability of the specific event occurring from any random rotor burst.

This value is then factored by the "risk" factor assessed for the cas e, to derive a calculated probability of catastrophe for each specific case.

Typical conditional probability values for total loss of thrust causing catastrophic consequences are: Phase Dp Risk T.O. – V 1 to first power reduction 0.20 1.0 Climb 0.22 0.4 Cruise 0.14 0.2 Descent 0.03 0.4 Approach 0.02 0.4 6.10 All individual case probabilities are then tabled and summarised.

Powered by EASA eRules Page 454 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) 6.11 The flight mean values are obtained by averaging those for all discs or rotor stages on all engines across a nominal flight profile.

The following process may be used to calculate the flight mean value for each Failure Model: a. Establish from the table in Figure 8 the threat windows where, due to combination of individual damages, a catastrophic risk exists.

b. For each stage case calculate the risk for all Critical Hazar ds c. For each stage case apply all risk factors, and, if applicable, factor for Flight Phase - Failure distribution d. For each engine, average all stages over the total number of engine stages e. For each aeroplane, average all engines over the number of e ngines.

7.0 RESULTS ASSESSMENT 7.1 An applicant may show compliance with CS 23.903(b)(1) and CS 25.903(d)(1) using guidelines set forth in AMC 20 - 128A . The criteria contained in t he AMC may be used to show that: a. Practical design precautions have been taken to minimise the damage that can be caused by uncontained engine debris, and b. Acceptable risk levels, as specified in AMC 20 - 128A , Paragraph 10, have been achieved for each critical Failure Model.

7.2 The summary of the applicable risk level criteria is shown in Table 1 below.

Table 1 Summary of Acceptable Risk Level Criteria Requirement Criteria Aver age 1/3 Disc Fragment 1 in 20 Average Intermediate Fragment 1 in 40 Average Alternate Model 1 in 20 @ ± 5 degree Spread Angle Multiple Disc Fragments 1 in 10 Any single fragment (except for structural damage) 2 x corresponding average criterion Powered by EASA eRules Page 455 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) EXAMPLE – HAZARD TREE FIGURE 1 Powered by EASA eRules Page 456 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) LOC COMPONENT DAMAGE TO SYSTEM LOADED DETAIL LEFT AILERON CABLES/SURFACE HYDRAULIC POWER #1 & #3 RIGHT AILERON CABLES/SURFACE HYDRAULIC POWER #2 & #3 LEFT SPOILER - OUTBD CONTROL/SURFACE HYDRAULIC POWER #1 MULTI - FUNCTION RIGHT SPOILER - OUTBD CONTROL/SURFACE HYDRAULIC POWER #1 MULTI - FUNCTION LEFT FLAP - OUTBD TRACK/SURFACE ELECTRICAL POWER AC BUS1 AC ESS RIGHT FLAP - OUTBD TRACK/SURFACE ELECTRICAL POWER AC BUS1 AC ESS LEFT RUDDER CABLE HYDRAULIC POWER #1,#2&#3 RIGHT RUDDER CABLE HYDRAULIC POWER #1,#2&#3 LEFT ELEVATOR CABLES HYDRAULIC POWER #1 & #3 Note 1 RIGHT ELEVATOR CABLES HYDRAULIC POWER #2 & #3 Note 1 CHAN1 PITCH TRIM CONTROL/POWER ELECTRICAL POWER AC BUS1 Note 2 DC BUS1 CHAN2 PITCH TRIM CONTROL/POWER ELECTRICAL POWER AC ESS Note 2 DC ESS FLIGHT CONTROLS – SYSTEM LOADING Note 1: Same fragment path must not sever: ON - SIDE cables + OFF - SIDE hydraulic system + HYDRAULIC PWR #3 e.g.: Left elevator cable and HYDRAULIC PWR #2 and #3 or, Right elevator cable and HYDRAULIC PWR # 1 and # 3 Note 2: Same fragment path must not sever: — Both CHAN1 and CHAN2 circuits — ON - SIDE control circuit + OFF - SIDE power circuit — OFF - SIDE control circuit + ON - SIDE power circuit EXAMPLE – SYSTEM LOADING MATRIX FIGURE 2 Powered by EASA eRules Page 457 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) TRI - SECTOR ROTOR BURST FIGURE 3 Powered by EASA eRules Page 458 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) TYPICAL LAYOUT OF SYSTEMS IN ROTOR PLANE FIGURE 4 Powered by EASA eRules Page 459 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) TRAJECTORY RANGE PLOTTING FIGURE 5 Powered by EASA eRules Page 460 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) TYPIC AL TRAJECTORY PLOTTING FIGURE 6 Powered by EASA eRules Page 461 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) DEFINITION - THREAT WINDOW FIGURE 7 Powered by EASA eRules Page 462 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 128A Products, Parts and Appliances (AMC - 20) Powered by EASA eRules Page 463 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20)

AMC 20 - 136A

AMC 20 - 136A Aircraft Electrical and Electronic System Lightning

Protection

ED Decision 2022/001/R 1. PURPOSE a. This AMC d escribes an acceptable means, but not the only means, for demonstrating compliance with the applicable certification specifications (CSs) related to system lightning protection (CS 23.1306/2515, CS 25.1316, CS 27.1316, and CS 29.1316).

Compliance with this AMC is not mandatory, and an applicant may elect to use an alternative means of compliance. However, the alternative means of compliance must meet the relevant requirements, ensure an equivalent level of safety, and be approved by EASA on a product or ETS O article basis.

b. The modal verb ‘must’ is used to indicate which means are necessary to demonstrate compliance with the applicable CSs by using this AMC. The modal verb ‘should’ is used when following th is AMC to indicate that an action is recommended b ut is not necessary to demonstrate compliance with the applicable CS s when using this AMC.

c. Appendix 1 addresses definitions and acronyms. Appendix 2 contains examples.

2. SCOPE AND APPLICABILITY a. This AMC provides possible means to demonstrate complia nce with CS 23.1306/2515, 25.1316, 27.1316, and 29.1316 for the effects on electrical and electronic systems due to lightning transients induced or conducted onto equipment and wiring. This AMC may be used by applicants for a new type certificate (TC) or a change to an existing TC when the certification basis requires to address the above - mentioned CS s.

Note : For CS - 23 Amendment 5 and higher, there is a new specification, i.e. CS 23.2515, which is similar to CS 23.1306. The associated AMC for CS 23.2515 is published separately in the AMC & GM to CS - 23, based on ASTM F3061/F3061M - 17. The present AMC 20 - 136A can still be used as guidance for CS 23.2515, which would be acceptable as equivalent means of compliance as AMC/GM CS - 23.

b. Applicants must also comply with CS 23.1306/2515, 25.1316, 27.1316, and 29.1316 for the effects on aircraft electrical and electronic systems when lightning directly attaches to equipment, components, or wiring. This AMC addresses the functional aspects of these effects on aircraft e lectrical and electronic equipment, components, or wiring. However, this AMC does not address lightning effects such as burning, eroding, and blasting of aircraft equipment, components, or wiring. Compliance for these effects is demonstrated by meeting the applicable CS 23.867/2335, 25.581, 27.610, 27.865, 29.610, and 29.865 and following the associated AMC.

c. For information on fuel ignition hazards due to lightning, see AMC 25.954, Fuel System Lightning Protection , FAA ACs 20 - 53C, Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Caused By Lightning , and 25.954 - 1, Transport Airplane Fuel System L ightning Protection .

d. This AMC does not address lightning zoning methods, lightning environment definition, or lightning test methods. For information on these topics, appropriate EUROCAE/SAE Powered by EASA eRules Page 464 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) guidance material can be used. For information on f uel s tructu ral l ightning p rotection, see EUROCAE policy ER - 002 and ER - 006.

3. DOCUMENT HISTORY This AMC supersedes AMC 20 - 136 , Aircraft Electrical and Electronic System Lightning Protection, dated 15 July 2015.

4. RELATED MATERIAL a. European Union Aviation Safety Agency (EASA) (in this document also referred to as ‘ the Agency’ ) Certification Specifications: 1. CS 23.867/2335 , 23.901/2400, 23.954/2430, 23.1301/2500, 23.1306/2515, 23.1309/2510, 23.1529/2625 ; 2. CS 25.581, 25.901, 25.954, 25.1301, 25.1309, 25.1316, 25.1529, 25.1705 ; 3. CS 27.610, 27.901, 27.954, 27.1301, 27.1309, 27.1316, 27.1529 ; and 4. CS 29.610, 29.901, 29.954, 29.1301, 29.1309, 29.1316, 29.1529.

EASA Certification Specifications (CSs) and Acceptable Means of Compliance (AMC) may be downloaded from the EASA website at www.easa.europa.eu .

b. FAA Advisory Circulars (ACs) 1. AC 20 - 155, SAE Documents to Support Aircraft Lightning Protection Certification 2. AC 21 - 16, RTCA Document DO - 160 Versions D, E, F, and G, Environmental Conditions and Test Procedures for Airborne Equipment 3. AC 23 - 17, Systems and Equipment Guide for Certification of Part 23 Airplanes and Airships 4. AC 23.1309 - 1E, System Safety Analysis and Assessment for Part 23 Airplanes 5. AC 27 - 1B, Certification of Normal Category Rotorcraft 6. AC 29 - 2C, Certification of Transport Category Rotorcraft The applicant can view and download copies from the FAA web - based Regulatory and Guidance Library (RGL) at http://www.airweb.faa.gov . On the RGL website, the applicant should select ‘Advisory Circular’, then select ‘By Number’. ACs are also available on the FAA website at http://www.faa.gov/regulations_pol icies/advisory_circulars/ .

c. European Organisation for Civil Aviation Equipment (EUROCAE) 1. EUROCAE ED - 79A, Guidelines for Development of Civil Aircraft and Systems 2. EUROCAE ED - 14G, Environmental Conditions and Test Procedures for Airborne Equipment 3. EUROCAE ED - 84A, Aircraft Lightning Environment and Related Test Waveforms 4. EUROCAE ED - 91A, Aircraft Lightning Zoning 5. EUROCAE ED - 105A, Aircraft Lightning Test Methods 6. EUROCAE ED - 113, Aircraft Lightning Direc t Effects Certification Powered by EASA eRules Page 465 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) 7. EUROCAE ED - 158, User Manual for Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning 8. EUROCAE ED - 234, User Guide Supplement to ED - 14G EUROCAE documents may be purchased from: European O rganisation for Civil Aviation Equipment 9 - 23 rue Paul Lafargue "Le Triangle" building 93200 Saint - Denis, France Telephone: +33 1 49 46 19 65 (Email: eurocae@eurocae.net , website: www.eurocae.net d. Radio Technical Commission for Aeronautics (RTCA) 1. DO - 160, Environmental Conditions and Test Procedures for Airborne Equipment .

This document is technically equivalent to EUROCAE ED - 14. Anywhere there is a reference to RTCA/DO - 160, EUROCAE ED - 14 may be used.

2. DO - 357, User Guide Supplement to DO - 160 . T his document is technically equivalent to EUROCAE ED - 234. Anywhere there is a reference to RTCA/D O - 357, EUROCAE ED - 234 may be used.

RTCA documents may be purchased from: RTCA, Inc. , 1150 18th Street NW, Suite 910, Washington D . C . 20036, USA (Email: info@rtca.org , website: www.rtca.org e. Society of Automotive Engineers (SAE International) 1. SAE Aerospace Recommended Practice (ARP) 4754A, Guidelines for Develo pment of Civil Aircraft and Systems , December 2010. This document is technically equivalent to EUROCAE ED - 79A. Anywhere there is a reference to ARP 4754A, EUROCAE ED - 79A may be used.

2. SAE ARP 4761, Guidelines and Methods for Conducting the Safety Assessm ent Process on Civil Airborne Systems and Equipment , December 1996.

3. SAE ARP 5412B, Aircraft Lightning Environment and Related Test Waveforms . This document is technically equivalent to EUROCAE ED - 84A. Anywhere there is a reference to ARP 5412A, EUROCAE ED - 84A may be used.

4. ARP 5414B, Aircraft Lightning Zoning . This document is technically equivalent to EUROCAE ED - 91A. Anywhere there is a reference to ARP 5414B, EUROCAE ED - 91A may be used.

5. ARP 5415B, User’s Manual for Certification of Aircraft Electr ical/Electronic Systems for the Indirect Effects of Lightning . This document is technically equivalent to EUROCAE ED - 158.

6. ARP 5416A, Aircraft Lightning Test Methods . This document is technically equivalent to EUROCAE ED - 105A. Anywhere there is a referen ce to ARP 5416A, EUROCAE ED - 105A may be used.

Powered by EASA eRules Page 466 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) 7. ARP 5577, Aircraft Lightning Direct Effects Certification . This document is technically equivalent to EUROCAE ED - 113. Anywhere there is a reference to ARP 5577, EUROCAE ED - 113 may be used.

SAE International documents may be purchased from: SAE Customer Service 400 Commonwealth Drive Warrendale, PA 15096 - 0001, USA Website: http://www.sae.org f. ASTM F3061/F3061M - 17, Standard Specification for Systems and Equipment in Small Aircraft ASTM documents may be purchased from: ASTM International 100 Barr Harbor Drive PO Box C700 West Conshohocken, PA 19428 - 2959, USA Website: https://www.astm.org 5. BACKGROUND a. Regulatory a pplicability . The CS s for aircraft electrical and electronic system lightning protection are based on the aircraft’s potential for lightning exposure and the consequences of system failures. The CSs require lightning protection of aircraft electrical and electronic systems with catastrophic, hazardous, or major failure conditions for aircraft certified under C S - 25. The specifications also apply to CS - 23 (at Am en d men t 4 or earlier) aeroplanes, and CS - 27 and CS - 29 rotorcraft approved for operations under instrument flight rules (IFR) . Those CS - 23 aeroplanes, and CS - 27 and CS - 29 rotorcraft approved solely for oper ations under visual flight rules (VFR) , require lightning protection of electrical and/ or electronic systems that have catastrophic failure conditions.

For CS - 23 Am en d men t 5, the electrical and electronic systems with catastrophic and hazardous failure con ditions must be protected against the effects of lightning where exposure to lightning is likely.

b. Regulatory r equirements . Protection against the effects of lightning for aircraft electrical and electronic systems, regardless of whether these are ‘indi rect’ or ‘direct’ effects of lightning, is addressed under CS 23.1306/2515, 25.1316, 27.1316, and 29.1316. The terms ‘indirect’ and ‘direct’ are often used to classify the effects of lightning. However, the CS s do not, and are not intended to, differentiat e between the effects of lightning. The focus is to protect aircraft electrical and electronic systems from the effects of lightning.

Powered by EASA eRules Page 467 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) 6. APPROACHES TO COMPLIANCE a. General . The following activities describe how compliance with CS 23.1306/2515, 25.1316, 27.1316, and 29.1316 may be demonstrated. Adherence to the sequence shown is not necessary. More detailed information on lightning certification compliance is provided in the User ’ s Manual referred to in SAE ARP 5415B / EUROCAE ED - 158.

The applicant shou ld: 1. identify the systems to be assessed (see Section 6 (c)) ; 2. determine the lightning strike zones for the aircraft (see Section 6 ( d )) ; 3. establish the aircraft lightning environment for each zone (see Section 6 (e)) ; 4. determine the lightning transient environment associated with the systems (see Section 6 ( f )) ; 5. establish e quipment t ransient d esign l evels (ETDLs) and aircraft a ctual t ransient l evels (ATLs) (see Section 6 ( g ) ) ; 6. verify compliance with the applicable requirements (see Section 6 ( h )) ; and 7. take corrective measures (if needed) (see Section 6 ( i ) ).

Sections 7 and 8 give more details on these steps for the compliance of Level A systems as well as of Level B and Level C systems respectively.

b. Lightning effect consideratio ns . The steps above should be performed to address lightning transients induced in electrical and electronic system wiring and equipment, and lightning damage to aircraft external equipment and sensors that are connected to electrical and electronic system s, such as radio antennas and air - data probes. Additional guidance on lightning protection against lightning damage for external equipment and sensor installations can be found in EUROCAE ED - 113.

Lightning causes voltage and current transients to appear on equipment circuits.

Equipment circuit impedances and configurations will determine whether lightning transients are primarily voltage or current. These transient voltages and currents can degrade system performance permanently or temporarily. The two prim ary types of degradation are component damage and system functional upsets.

1. Component damage This is a permanent condition in which transients alter the electrical characteristics of a circuit. Examples of devices that may be susceptible to component da mage include the following : (a) active electronic devices, especially high - frequency transistors, integrated circuits, microwave diodes, and power supply components ; (b) passive electrical and electronic components, especially those of very low power or voltage rating ; (c) electro - explosive devices, such as squibs and detonators ; (d) electromechanical devices, such as indicators, actuators, relays, and motors ; and (e) insulating materials (for example, insulating materials in printed circuit boards and co nnectors) and electrical connections that can burn or melt.

Powered by EASA eRules Page 468 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) 2. System functional upset (a) Functional upset is mainly a system problem caused by electrical transients.

They may permanently or momentarily upset a signal, circuit, or a system component, whic h can adversely affect system performance enough to compromise flight safety. A functional upset is a change in digital or analogue state that may or may not require a manual reset. In general, functional upset depends on circuit design and operating volta ges, signal characteristics and timing, and the system and software configuration.

(b) Systems or devices that may be susceptible to functional upsets include computers and data/signal processing systems, electronic engine and flight controls, and power ge nerating and distribution systems.

c. Identify the systems to be assessed 1. General . The aircraft systems that require a lightning safety assessment should be identified. The applicant should define the elements of the system performing a function, consid ering similar and/or dissimilar redundant channels that make up the system. The process used for identifying these systems should be similar to the process for demonstrating compliance with CS 23.1309, 25.1309, 27.1309, and 29.1309, as applicable. These po ints address any system failure that may cause or contribute to an effect on the safety of flight of an aircraft. The effects of a lightning should be assessed to determine the degree to which the safety of the aircraft and its systems may be affected.

The operation of the aircraft systems should be assessed separately and in combination with, or in relation to, other systems. This assessment should cover the following : (a) all normal aircraft operating modes, phases of flight, and operating conditions; (b) all lightning - related failure conditions and their subsequent effects on aircraft operations and the flight crew; and (c) any corrective actions required by the flight crew during or after occurrence of a l ightning - related failure.

2. Lightning safety ass essment . A safety assessment related to lightning must be performed to establish and classify the equipment or system failure conditions.

Table 1 provides the corresponding failure condition classification and system lightning certification level (LCL) for the appropriate lightning regulations. The failure condition classifications and terms used in this AMC are similar to those used in AC 23.1309 - 1E, AMC 25.1309, AC - 27 - 1B, and AC - 29 - 2C, as applicable. Only those systems identified as performing or contribu ting to functions whose failure would result in catastrophic, hazardous, or major failure conditions are subject to lightning regulations. Based on the safety classification of the failure condition established by the safety assessment, the systems should be assigned appropriate system LCLs, as shown in Table 1. The lightning safety assessment should consider the common - cause effects of lightning, particularly for highly integrated systems and systems with redundant elements. The lightning safety assessment determines the consequences of failures for the aircraft functions that are performed by the system. The system LCL classification assigned to the systems and functions can be different from the d evelopment a ssurance l evel (DAL) (ED - 79A/ARP 4754A) / Powered by EASA eRules Page 469 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) d esig n a ssurance l evel (DAL) (ED - 80/DO - 254 , ED - 12C/DO - 178C ) assigned for equipment redundancy, software, and airborne electronic hardware (AEH). This is because lightning is an environment that can cause common - cause effects. The term ‘design assurance level’ or ‘ development assurance level’ ( both abbreviated to ‘ DAL ’ ) should not be used to describe the system LCL because of the potential differences in the assigned classifications for software, AEH, and equipment redundancy. The lightn ing safety assessment must include all electrical and electronic equipment, components and electrical interconnections, assuming that they are potentially affected by lightning. It is not appropriate to use the lightning immunity data for electrical and el ectronic equipment, components and electrical interconnections as an information input to the lightning safety assessment. This information should only be used in the next phase, to show compliance with the applicable subpart of the lightning regulation, a fter the required LCL for the system is defined by the lightning safety assessment. The lightning safety assessment results from inputs coordinated between the safety specialist, the system specialist, and the HIRF/ l ightning specialist. This process may va ry from applicant to applicant. Further details on performing the safety assessment can be found in AC 23.1309 - 1E, AMC 25.1309, AC - 27 - 1B, AC - 29 - 2C, EUROCAE ED - 79A, SAE ARP 4761, and EUROCAE ED - 158.

N ote : Considering that lightning and HIRF environments may have similar effects on electro - electronic systems (disturbing electrical signals, causing upsets or damage to circuits) and that the applicable regulations are similarly structured, in many cases the system LCL and corresponding HIRF c ertification l evel (see AMC 20 - 158A ) should be the same.

Table 1: Indirect effect of lightning most severe failure conditions of th e function and system lightning certification levels LIGHTNING REQUIREMENTS EXCERPTS FROM MOST SEVERE FAILURE SYSTEM LIGHTNING CS 23.1306/2515, CS 25.1316, CS 27.1316, AND CONDITION OF THE CERTIFICATION LEVEL CS 29.1316 FUNCTION (LCL) (a) Each electrical and electronic system that performs a function whose failure would prevent Catastrophic A the continued safe flight and landing of the aircraft.

(b) Each electrical and electronic system that performs a function , for which failure would reduce the capability of the aircraft or the ability Hazardous/ Major B/C of the flight crew to respond to an adverse operating condition.

Note: Requirement applicable for small aircraft and rotorcraft approved for instrument fligh t rule (IFR) operation s Powered by EASA eRules Page 470 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) 3. Level A systems . The specifications in CS 23.1306/2515(a), 25.1316(a), 27.1316(a), and 29.1316(a) address the adverse effects on the aircraft functions and systems that perform functions whose failure would prevent the continued safe flight and landing of the aircraft. When demonstrating compliance with CS 23.1306(a), 25.1316(a), 27.1316(a), and 29.1316(a), the electrical and electronic system is the one required to perfo rm the function whose failure would prevent continued safe flight and landing. This electrical and electronic system must also automatically recover normal operation of the L evel A functions in a timely manner to comply with CS 23.1306(a)(2), 25.1316(a)(2), 27.1316(a)(2), and 29.1316(a)(2). If all equipment and components of the system required for the normal operation of the L evel A functions are not susceptible when complying with paragraphs (a)(1) and (a) (2), then it is acceptable that the equipment and c omponents only for non - normal situations do not show compliance with the requirements of paragraph (a).

In this case, it is considered acceptable that equipment and components of the system required only for non - normal situations show compliance at least w ith the requirements of paragraph (b) as a L evel B system.

The lightning safety assessment should consider the effects of lightning - related failures or malfunctions on systems with lower failure classifications that may affect the function of Level A syste ms. The applicant should demonstrate that any system with wiring connections to a Level A system will not adversely affect the functions with catastrophic failure conditions performed by the Level A system when the aircraft is exposed to lightning. Redunda ncy alone cannot protect against lightning because the lightning - generated electromagnetic fields, conducted currents and induced currents in the aircraft can simultaneously induce transients in all the electrical wiring on an aircraft.

4. Level B or Level C systems . Simultaneous and common - cause failures due to lightning exposure generally do not have to be assumed for systems, incorporating redundant, spatially separated installations in the aircraft. If such systems were assigned a Level B or C, the fail ure of these systems would reduce the capability of the a e r o plane or the ability of the flight crew to respond to an adverse operating condition. This is because aircraft transfer function tests and in - service experience have shown that these redundant and spatially separated installations are not simultaneously exposed to the maximum lightning - induced transients. Therefore, the simultaneous loss of all these redundant and spatially separated Level B or Level C systems due to lightning exposure does not nee d to be considered.

However, if multiple systems and their wirings, wh ose failure would reduce the capability of the a e r o plane or the ability of the flight crew to respond to an adverse operating condition, are installed within the same location in the air craft, or share a common wiring connection, then the combined failure due to lightning exposure should be assessed to determine whether the combined failures are catastrophic.

If so, these systems should be designated as Level A systems.

5. Failure conditi ons . The lightning safety assessment should consider all the potential adverse effects due to system failures, malfunctions, or misleading information. The lightning safety assessment may show that some systems have different failure conditions in differen t phases of flight; therefore, the system LCL corresponds to the most severe failure condition. For example, an automatic flight control system may have a catastrophic failure condition for autoland, while automatic flight control system operations in crui se may have a hazardous failure condition.

Powered by EASA eRules Page 471 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GE NERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) d. Determine the lightning strike zones for the aircraft The purpose of lightning zoning is to determine those areas of the aircraft that are likely to experience lightning channel attachment, and those structures that may conduct lightning current between lightning attachment points. The lightning attachment zones for the aircraft configuration should be determined, since the zones will be dependent upon the aircraft’s geometry and materials, and upon operational factors. Lightning attachment zones often vary from one aircraft type to another.

Note : EUROCAE ED - 91A provides guidance to determine the lightning attachment zones for aircraft.

e. Establish the aircraft lightning environment for each zone Zones 1 and 2 i dentify where lightning is likely to attach and, as a result, the entrance and exit points for current flow through the aircraft. The appropriate voltage waveforms and current components to apply in those zones should be identified. By definition, Zone 3 a reas carry lightning current flows between initial (or swept stroke) attachment points, so they may include contributions from all the current components. The Agency accepts analysis to estimate Zone 3 current levels that result from the external environme nt. The external lightning environment is: 1. caused by the lightning flash interacting with the exterior of the aircraft; and 2. represented by the combined waveforms of the lightning current components at the aircraft surface.

Note : EUROCAE ED - 84A provides guidance for selecting the lightning waveforms and their applications.

f. Determine the lightning transient environment associated with the systems 1. The lightning environment, as seen by electrical and electronic systems, consists of voltages an d currents produced by lightning currents flowing through the aircraft.

The voltages and currents that appear at system wiring interfaces result from aperture coupling, structural voltages, or conducted currents resulting from direct attachments to equipme nt and sensors.

2. Applicants should determine the lightning voltage and current transient waveforms and amplitudes that can appear at the electrical and electronic equipment interface circuits for each system identified in paragraph 6 ( c. The lightning tra nsients may be determined in terms of the wire - bundle current, or the open - circuit voltage and the short - circuit current appearing at system wiring and equipment interface circuits. The voltage and current transient waveforms and amplitudes are dependent u pon the loop impedances of the system and its interconnecting wiring.

g. Establish equipment transient design levels (ETDLs) and aircraft actual transient levels (ATLs) CS 23.1306/2515, 25.1316, 27.1316, and 29.1316 define the specifications in terms of fu nctional effects that are performed by aircraft electrical and electronic systems. From a design point of view, lightning protection for systems is shared between protection incorporated into the aircraft structure and wiring, and protection incorporated i nto the equipment. Therefore, the requirement allocations for electrical and electronic system lightning protection can be based on the concept of ETDLs and ATLs.

Powered by EASA eRules Page 472 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) 1. The applicant should determine and specify the ETDLs for the electrical and electronic equ ipment that make up the systems to be assessed. The ETDLs set qualification test levels for the systems and equipment. They define the voltage and current amplitudes and waveforms that the systems and equipment must withstand without any adverse effects. T he ETDLs for a specific system depend on the anticipated system and wiring installation locations on the aircraft, the expected shielding performance of the wire bundles and structure, and the system criticality.

2. The ATLs are the voltage and current amp litudes and waveforms actually generated on the aircraft wiring when the aircraft is exposed to lightning, as determined by aircraft test, analysis, or similarity. The difference between an ETDL and an ATL is the margin. Figure 1 shows the relationship bet ween the ATL and the ETDL. The aircraft, interconnecting wiring, and equipment protection should be evaluated to determine the most effective combination of ATLs and ETDLs that will provide acceptable margin. Appropriate margins to account for uncertaintie s in the verification techniques may be necessary as mentioned in paragraph 7 of this AMC.

3. Typically, the applicant should specify the ETDLs prior to aircraft certification lightning tests or analyses to determine the aircraft ATLs. Therefore, the expec ted aircraft transients must be based upon results of lightning tests on existing aircraft, engineering analyses, or knowledgeable estimates. These expected aircraft lightning transient levels are termed transient control levels (TCLs) Figure 1 : Relationsh ips between transient levels Powered by EASA eRules Page 473 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) h. Verify compliance with the applicable specifications 1. The applicant should demonstrate that the systems comply with the applicable specifications of CS 23.1306/2515, 25.1316, 27.1316, and 29.1316.

2. The applicant should demonstrate that the ETDLs exceed the ATLs by the margin established in their certification plan.

3. Verification may be accomplished by tests, analyses, or by demonstrating similarity to previously certified aircraft and systems. The cert ification process for Level A systems is contained in Section 7. The certification process for Level B and Level C systems is contained in Section 8.

4. The applicant should submit their compliance plan in the early stages of the programme to the Agency fo r review (see details in paragraph 7 ( a ) ). Experience shows that, particularly with aircraft using new technology or those that have complex systems, early agreement on the compliance plan benefits the certification of the product. The plan should define ac ceptable ways to resolve critical issues during the certification process. Analyses and test results during the certification process may warrant modifications to the design or verification methods. When significant changes are necessary, the certification plan should be updated accordingly.

i. Take corrective measures (if needed) If tests and analyses show that the system did not meet the pass/fail criteria, review the aircraft, installation or system design and improve protection against lightning.

Powered by EASA eRules Page 474 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) Figu re 2 : Routes to lightning compliance — Level A systems (n) = Step number as described in Section 7 of this AMC Powered by EASA eRules Page 475 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) 7. STEPS TO ‘ LEVEL A ’ SYSTEM LIGHTNING COMPLIANCE Figure 2 illustrates a process that the applicant can use to demonstrate that their Level A system complies with CS 23.1306(a)/2515(a), 25.1316(a), 27.1316(a), and 29.1316(a).

a. Step 1 — Identify Level A systems 1. Level A systems should be identified as described in paragraph 6 ( c ) . The detailed system performance pass/fail criteria shou ld be defined. The applicant should not begin testing or analysing their Level A system before the Agency has concurred on these criteria. Specific equipment, components, sensors, power systems and wiring associated with each Level A system should be ident ified in order to perform the ETDL verification mentioned in paragraphs 7 ( g ) and 7 ( h ) .

2. The system defined for paragraph (a) of CS 23.1306/2515, 25.1316, 27.1316, and 29.1316 is not required to include: (a) equipment, components or electrical interconnec tions required only for non - normal situations ; or (b) equipment, components or electrical interconnections required only for dispatching under m aster m inimum e quipment l ists (MMELs) (when o perational s uitability d ata (OSD) is applicable).

3. Some system s include mechanical, hydraulic, and/or pneumatic channels as well as electrical and electronic channel(s) to perform functions whose failure would prevent continued safe flight and landing. The lightning safety assessment for CS 23.1306/2515(a), 25.1316(a ), 27.1316(a), and 29.1316(a) only applies to functions performed by electrical and electronic systems. The lightning safety assessment should consider electrical or electronic failures that would adversely affect the function of the mechanical, hydraulic, and/or pneumatic channel(s). If electrical or electronic equipment and components , as well as electrical interconnections are used to assist, augment, or monitor for control loop feedback, the mechanical, hydraulic, and/or pneumatic channels in performing the normal operation of functions with potential failures that would prevent continued safe flight and landing, then the electrical and electronic channel(s) must comply with CS 23.1306/2515(a), 25.1316(a), 27.1316(a), and 29.1316(a).

4. CS 23.1306/2515( a), 25.1316(a), 27.1316(a), and 29.1316(a) do not require the applicant to assume pre - existing failure conditions when classifying the functional failure conditions and the scope of Level A systems. The applicant should consider total or partial loss of th e systems and malfunctions of the systems, including hazardously misleading information presented to the flight crew during and after the aircraft is exposed to lightning.

5. CS 23.1306(a)(2), 25.1316(a)(2), 27.1316(a)(2), and 29.1316(a)(2) require that Le vel A systems automatically recover normal operation of the L evel A functions in a timely manner after exposure to lightning. Automatic recovery applies to all redundant active channels of the Level A system required for normal operation unless its recovery conflicts with other operational or functional requirements of the system. The exception for automatic recovery conflicts must be based on aircraft operational or functional requirements independent of lightning exposure.

6. Appendix 2 Examples of l ightning s afety a ssessment considerations — Level A s ystems provides examples of s ystem s’ scope based on the guidance above.

Powered by EASA eRules Page 476 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) b. Step 2 — Define aircraft and system lightning protection . The applicant should define the lightning protection features to be incorporated into the aircraft and system designs, based on the lightning environmen ts that are applicable to their aircraft and its Level A systems. Equipment, system, and aircraft lightning protection design may occur before aircraft - level tests are performed, and before the actual internal lightning environment is determined. Therefore , the equipment, system and aircraft lightning protection design should be based on an estimate of the expected internal lightning environment.

c. Step 3 — Establish the system’s ETDLs . The applicant should establish the aircraft system’s ETDLs from an eva luation of expected lightning transient amplitudes and waveforms for the system installation, structure and wiring configuration on a specific aircraft. ETDLs that exceed the ATLs by an acceptable margin should be established. In general, the ETDLs for equ ipment in a complex system will not be the same for all wire bundles connecting them to other equipment in the system. The applicant may use the results of lightning tests on existing similar aircraft, engineering analyses, or knowledgeable estimates to es tablish the appropriate system’s ETDLs. While specific aircraft configurations and system installations may lead to ETDLs that have amplitudes and waveforms different from those defined in EUROCAE ED - 14G Section 22, ETDLs are often specified using the info rmation from Section 22. The ETDLs must exceed the ATLs by an acceptable margin.

d. Step 4 — Select the ETDL verification method . The applicant should determine whether to perform system qualification tests on the Level A system, or whether to base the sys tem verification on previous system qualification tests performed on a similar system.

e. Step 5 — Verify the system’s ETDLs using system qualification tests 1. Equipment t est . Lightning i nduced t ransient s usceptibility tests ( Tolerance Damage and Function al Upset ) of RTCA / DO - 160G / EUROCAE ED - 14G (or latest version) Section 22 may be used to build confidence in the equipment ’ s l ightning immunity before conducting integrated system qualification tests. Equipment tests may be used to augment the system qualification tests where appropriate. For equipment whose l ightning immunity is evaluated as part of the system qualification test s, the individual equipment’s lightning testing described in this step is optional.

2. The applicant should identify the equipment, components, sensors, power systems, and wiring associated with the Level A system undergoing ETDL verification tests, specif ically considering the system functions whose failures would have catastrophic consequences. For complex Level A systems, the system configuration may include redundant equipment, multiple power sources, multiple sensors and actuators, and complex wire bun dles. The applicant should define the system configuration used for the ETDL verification tests. The applicant should obtain the Agency ’s acceptance of their system configuration for ETDL verification tests.

3. If the Level A System consists of multiple si milar channels, the applicant can propose using one or more channels in the laboratory test set - up for the integrated system, instead of all similar channels. The applicant should demonstrate that the laboratory test set - up adequately performs the function s that must demonstrate compliance with CS 23.1306/2515(a), 25.1316(a), 27.1316(a), and 29.1316(a). The applicant should ensure that the laboratory test set - up represents and monitors Powered by EASA eRules Page 477 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) any cross - channel interactions, such as cross - channel data links, redund ancy management, and system health monitoring.

Note : Similar channels are composed of equipment that ha s the same hardware but not necessarily the same part number; if Pin Programming and/or Software are used to identify or configure equipment of similar c hannels, it must be assessed whether these differences have an impact on the functions performed.

4. The applicant should verify the ETDLs using single - stroke, multiple - stroke, and multiple - burst tests on the system wire bundles. The applicant should use w aveform sets and test levels for the defined ETDLs, and demonstrate that the system operates within the defined pass/fail criteria during these tests. No equipment damage that adversely affects the function or system should occur during these system tests or during single - stroke pin injection tests using the defined ETDLs. It could be verified during system test that the equipment ETDL declared by the supplier is not exceeded. EUROCAE ED - 14G Section 22 provides acceptable test procedures and waveform set de finitions. In addition, EUROCAE ED - 105A provides acceptable test methods for complex and integrated systems.

5. The applicant should evaluate any system effects observed during the qualification tests to ensure they do not adversely affect the system’s con tinued performance.

The Level A system performance should be evaluated for functions wh ose failures or malfunctions would prevent the continued safe flight and landing of the aircraft.

Other functions performed by the system wh ose failures or malfunctions would reduce the capability of the aircraft or the ability of the flight crew to respond to an adverse operating condition should be evaluated using the guidance provided in Section 10 of this AMC . The applicant should obtain the Agency ’s acceptance of the ir evaluation.

f. Step 6 — Verify the system’s ETDLs using existing system data (similarity) 1. The applicant may base their ETDL verification on similarity to previously certified systems without performing more tests. This may be done when: (a) there are only minor differences between the previously certified system and installation and the system and installation to be certified ; (b) there are no unresolved in - service system problems related to lightning strikes on the previously certified system ; and (c ) the previously certified system ETDLs were verified by qualification tests.

2. To use similarity to previously certified systems, the applicant should assess the differences between the previously certified system and installation and the system and installation to be certified that can adversely affect the system’s susceptibility.

The assessment should cover the following : (a) system interface circuits ; (b) wire size, routing, arrangement (parallel or twisted wires), connector types, wire shields, and shield terminations ; (c) lightning protection devices , such as transient suppressors and lightning arrestors ; (d) grounding and bonding ; and Powered by EASA eRules Page 478 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) (e) system software and AEH.

3. If the applicant is unsure how the differences will affect the systems and installations, the y should perform more tests and analyses to resolve the open issues.

4. The applicant should assess every system, even if it uses equipment and installation techniques that have a previous certification approval.

5. The use of similarity should not be used for a new aircraft design with new systems.

g. Step 7 — Select the aircraft verification method 1. Level A systems require an aircraft assessment. The aircraft assessment should determine the ATLs where Level A systems are installed in the aircraft. The applicant should choose whether to use aircra ft tests or previous data from similar aircraft types (similarity). For level A display systems only, the applicant could select the ETDLs as proposed in Table 3.

2. If analysis is used to determine the ATLs, test data should be provided to support this an alysis. Any analysis results should take into account the quality and accuracy of the analysis. Significant testing, including aircraft - level testing, may be required to support the analysis.

h. Step 8 — Determine the ATLs using aircraft tests . See SAE ARP 5415B / EUROCAE ED - 158, User Manual for certification of aircraft Electrical and Electronic systems for the indirect effects of lightning , and EUROCAE ED - 105A Aircraft Lightning Test Method for guidance on how to determine the ATLs.

i. Step 9 — Determine the ATLs using analysis . See SAE ARP 5415B / EUROCAE ED - 158 for guidance on how to analyse aircraft to determine the ATLs. Acceptance of the analysis method chosen will depend on the accuracy of the method. The applicant should confirm their analysis metho d accuracy using experimental data, and gain agreement of their analysis approach from the Agency.

j. Step 10 — Determine the ATLs using similarity 1. The use of similarity to determine the ATLs may be used when: (a) there are only minor differences betwee n the previously certified aircraft and system installation and the aircraft and system installation to be certified; and (b) there is no unresolved in - service history of problems related to lightning strikes to the previously certified aircraft.

2. If significant differences are found that will affect the aircraft ATLs, the applicant should perform more tests and analyses to resolve the open issues.

3. To use similarity, the applicant should assess the aircraft, wiring, and system installation differenc es that can adversely affect the system’s susceptibility. When assessing a new installation, the applicant should consider the differences affecting the internal lightning environment of the aircraft and its effects on the system.

Powered by EASA eRules Page 479 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) The assessment should cover the following : (a) the aircraft type, equipment locations, airframe construction, structural materials, and apertures that could affect attenuation of the external lightning environment ; (b) the system wiring size, length, and routing; wire types (whether parallel or twisted wires), connectors, wire shields, and shield terminations ; (c) lightning protection devices , such as transient suppressors and lightning arrestors ; and (d) grounding and bonding.

4. Similarity cannot be used for a new air craft design with new systems.

k. Step 11 — Determine the transient levels using RTCA / DO - 160G / EUROCAE ED - 14G, Section 22, Guidance for Level A displays only 1. The applicant may select ETDLs for their Level A display system using the guidance in this s ection, without specific aircraft test or analysis. Level A displays involve functions for which the pilot will be in the loop through pilot – system information exchanges. Level A display systems typically include the displays, symbol generators, data conce ntrators, sensors (such as attitude, air data, and heading sensors), interconnecting wiring, and the associated control panels.

2. This approach should not be used for other Level A systems, such as control systems, because failures and malfunctions of tho se systems can more directly and abruptly contribute to a catastrophic failure event than display system failures and malfunctions. Therefore, other Level A systems require a more rigorous lightning transient compliance verification programme.

3. The infor mation in Table 3 should be used to evaluate aircraft and system installation features in order to select the appropriate ETDLs for the system. Table 3 defines test levels for ETDLs, based on EUROCAE ED - 14G Section 22, Tables 22 - 2 and 22 - 3.

The applicant should provide the Agency with a description of their aircraft and display system installation features and compare these with the information in Table 3 to substantiate the ETDL selected for their aircraft and Level A display system installation. When sel ecting the ETDLs using the guidance provided in this step, an acceptable margin between the anticipated ATLs for display system installations is incorporated in the selected ETDLs.

Powered by EASA eRules Page 480 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) Table 3 : Equipment transient design levels — Level A displays EUROCAE ED - 14G Level A display system installation location Section 22 l evels The applicant should use this level when the equipment under consideration, its associated wire bundles, or other components connected by wiring to the equipment are in aircraft areas exposed to very severe lightning transients.

These are: — areas with co mposite materials whose shielding is not very effective; — areas where there is no guarantee of structural bonding; and Level 5 — other open areas where there is little shielding.

The applicant can also use this level to cover a broad range of installations.

The a pplicant may need higher ETDLs when there are high - current density regions on mixed conductivity structures (such as wing tips, engine nacelle fins, etc.) because the system wiring may divert some of the lightning current. If the applicant is the system de signer, measures should be applied to reduce the need for higher ETDLs.

The applicant should describe how to verify compliance. Typically, the verification method chosen uses this level when the equipment under consideration, its associated wire bundles, or other components connected by wiring to the equipment are in aircraft areas Level 4 exposed to severe lightning transients. These areas are defined as outside the fuselage (such as wings, fairings, wheel wells, pylons , control surfaces, etc.).

The applicant should use this level when the equipment under consideration, its associated wire bundles, and other components connected by wiring to the equipment are entirely in aircraft areas with moderate lightning transients. T hese areas are defined as the inside metal aircraft structure or composite aircraft structure whose shielding is as Level 3 effective as metal aircraft structure, and without additional measures to reduce lightning coupling to wires. Examples of such areas are avionics bays not enclosed b y bulkheads, cockpit areas, and locations with large apertures (that is, doors without electromagnetic interference (EMI) gaskets, windows, access panels, etc.).

Current - carrying conductors in these areas (such as hydraulic tubing, control cables, wire bun dles, metal wire trays, etc.) are not necessarily electrically grounded at bulkheads.

When few wires exit the areas, applicants should either use a higher level (that is, Level 4 or 5) for these wires or offer more protection for these wires.

The applicant should use this level when the equipment under consideration, its associated wire bundles, and other components connected by wiring to the equipment are entirely in partially protected areas. T hese areas are defined as the inside of a metalli c or composite aircraft structure whose shielding is as effective as metal aircraft structure, if Level 2 the applicant takes additional measures to reduce the lightning coupling to wires.

Wire bundles in these areas pass through bulkheads and have shields that en d at the bulkhead connector. When a few wires exit these areas, the applicant should use either a higher level (that is, Level 3 or 4) or provide more protection for these wires. The a pplicant should install wire bundles close to the ground plane to take a dvantage of other inherent shielding from metallic structures. Current - carrying conductors (such as hydraulic tubing, control cables, metal wire trays, etc.) are electrically grounded at all bulkheads.

The applicant should use this level when the equipment under consideration, its Level 1 associated wire bundles, and other components connected by wiring to the equipment are entirely in well - protected aircraft areas. T hese areas are defined as electromagnetically enclosed.

Powered by EASA eRules Page 481 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) l. Step 12 — Verify compliance with the applicable requirements The applicant should compare the verified system ETDLs with the aircraft ATLs and determine whether an acceptable margin exists between the ETDLs and the ATLs.

Margins account for uncertainty in the verification method. As confidence in the verification method increases, the margin can decrease. An ETDL exceeding the ATL by a factor of two is an acceptable margin for Level A systems, if this margin is verified by aircraft test or by analysis supported by aircraft - level tests. For Level A display systems where the ETDLs are determined using the guidance provided in Table 3, an acceptable margin is already incorporated in the selected ETDLs. For other verification m ethods, the margin should be agreed upon with the Agency.

m. Step 13 — Corrective measures 1. When a system fails to meet the certification requirements, corrective actions should be selected. Any changes or modifications made to the aircraft, system installation or the equipment may require more testing and analysis.

2. To meet the certification requirements, the applicant may need to repeat system qualification testing, or aircraft - level testing and analysis (in whole or in part). This may include mo dification to the system or installation to obtain certification. The applicant should review these changes or modifications with the Agency to determine whether they are significant. If these changes or modifications are significant, the applicant should update their lightning certification plan accordingly. The updated certification plan shall be resubmitted to the Agency in accordance with point 21 . A.15(c) for acceptance.

Powered by EASA eRules Page 482 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) Figure 3 : Routes to lightning compliance — Level B and Level C systems (n) = St ep number as described in Section 9 of this AMC Powered by EASA eRules Page 483 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) 8. STEPS TO ‘ LEVEL B ’ AND ‘ LEVEL C ’ SYSTEM LIGHTNING COMPLIANCE Figure 3 illustrates a process that the applicant can use to demonstrate that their Level B and Level C systems comply with CS 23.1306(b)/2515(b), 25.1316(b), 27.1316(b), and 29.1316(b).

a. Step 1 — Identify Level B and Level C systems 1. The applicant should identify their Level B and Level C systems as described in paragraph 6 ( c ) .

2. The applicant should define the detailed syst em performance pass/fail criteria. The applicant should obtain the Agency’s concurrence on this criterion before starting tests or analyses of Level B and C systems.

b. Step 2 — Define system lightning protection . The applicant should define the lightning protection features incorporated into the system designs applicable to Level B and Level C systems. The design of equipment and system lightning protection may occur before aircraft - level tests are performed, and before the actual internal lightning enviro nment is determined. Therefore, the equipment system lightning protection design should be based on an estimate of the expected internal lightning environment.

c. Step 3 — Establish the ETDLs 1. The applicant may use the ATLs determined during aircraft - lev el tests or analyses performed for Level A systems to establish the appropriate ETDLs for Level B and Level C systems.

2. Alternatively, the applicant may use the definitions in EUROCAE ED - 14G Section 22 to select the appropriate ETDL s for their Level B an d Level C systems. The following should be considered when selecting an appropriate level: (a) The applicant can use EUROCAE ED - 14G Section 22 Level 3 for most Level B systems.

(b) For Level B systems and the associated wiring installed in aircraft areas w ith more severe lightning transients, the applicant can use EUROCAE ED - 14G Section 22 Level 4 or 5 , as appropriate to the environment. Examples of aircraft areas with more severe lightning transients are those external to the fuselage, areas with composit e structures showing poor shielding effectiveness, and other open areas.

(c) The applicant should use EUROCAE ED - 14G Section 22 Level 2 for most Level C systems.

(d) For Level C systems installed in aircraft areas with more severe lightning transients, the applicant should use EUROCAE ED - 14G Section 22 Level 3.

Examples of aircraft areas with more severe lightning transients are those external to the fuselage, areas wi th composite structures showing poor shielding effectiveness, and other open areas.

(e) The applicant should provide the Agency with a description of their aircraft and system installation features to substantiate the EUROCAE ED - 14G Section 22 levels selec ted for their system.

d. Step 4 — Select the ETDL verification method . The applicant should determine whether they will perform equipment lightning tests on the Level B and Level C systems, or whether they will base the compliance on previous equipment tests performed for a similar system.

Powered by EASA eRules Page 484 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SU BPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) e. Step 5 — Verify the system’s ETDL using equipment qualification tests 1. Equipment qualification tests should be performed using the selected test levels and single - stroke, multiple - stroke, and multiple - b urst waveform sets. It should be demonstrated that the equipment operates within the defined pass/fail criteria during these tests. No equipment damage should occur during these equipment qualification tests or during single - stroke pin injection tests usin g the defined ETDLs. EUROCAE ED - 14G Section 22 provides acceptable test procedures and waveform set definitions.

2. Any equipment effects observed during the qualification tests should be evaluated to ensure that they do not adversely affect the system’s c ontinued performance.

The applicant should obtain the Agency’s acceptance of their evaluation.

3. Multiple - stroke and multiple - burst testing is not required if an analysis shows that the equipment is not susceptible to upsets, or that the equipment may be susceptible to upsets but a reset capability exists so that the system recovers in a timely manner.

f. Step 6 — Verify the system’s ETDL using existing equipment data (similarity) 1. ETDLs may be verified by similarity to previously certified systems witho ut performing more tests. The applicant may do this when: (a) there are only minor differences between the previously certified system and installation and the system and installation to be certified ; (b) there are no unresolved in - service system problems related to lightning strikes on the previously certified system ; and (c) the previously certified system ETDLs were verified by qualification tests.

2. The assessment should cover the following : (a) equipment interface circuits ; (b) the wire sizes, routing , arrangement (parallel or twisted wires), connector types, wire shields, and shield terminations ; (c) lightning protection devices , such as transient suppressors and lightning arrestors ; (d) grounding and bonding ; and (e) equipment software, firmware, and hardware.

3. If significant differences are found that will affect the systems and installations, the applicant should perform more tests and analyses to resolve the open issues.

g. Step 7 — Verify compliance with the applicable requirements The applicant should demonstrate that the Level B and Level C systems meet their defined acceptance criteria during the qualification tests at the selected system ETDLs.

h. Step 8 — Corrective measures When a system fails to meet the certification requirements, the app licant should decide on corrective actions. If the system or installation is changed or modified, the equipment qualification testing may need to be repeated. The applicant should review these changes or modifications with the Agency to determine whether t hey are significant. If these changes or modifications are significant, the applicant should update their lightning Powered by EASA eRules Page 485 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) certification plan accordingly. The updated certification plan shall be resubmitted in accordance with point 21.A.15(c) to the Agency for ac ceptance.

9. LIGHTNING COMPLIANCE DEMONSTRATION a. Lightning compliance plan. An overall lightning compliance plan should be established to clearly identify and define lightning certification specifications, lightning protection development, and the design , test, and analysis activities intended to be part of the compliance effort. This plan should provide definitions of the aircraft systems, installations, and protective features against which lightning compliance will be assessed.

The lightning compliance plan should be discussed with, and submitted to, the Agency for acceptance before initiating lightning compliance activities. If the aircraft, system, or installation design changes after approval, a revised lightning compliance plan should be submitted t o the Agency for acceptance. The lightning compliance plan should include the following: 1. a lightning compliance plan summary ; 2. identification of the aircraft systems, with their classifications based on the safety assessment as it relates to lightning (see paragraph 6 ( c ) (2)) ; 3. the planned or expected lightning environment for installed systems ; and 4. the verification methods, such as test, analysis, or similarity.

b. Methods of compliance verification 1. Various methods are available to aid in demonstrating lightning compliance.

Methods acceptable to the Agency are described in Sections 7 and 8 of this AMC.

Figure 2 above outline s the steps to lightning compliance for systems requiring L evel A lightning certification. Figure 3 above outlines the steps to lightning compliance for systems requiring L evel B or Level C lightning certification. The steps in these figures are not necessarily accomplished sequentially. Wherever a decision point is indicated on these figures, the applicant should com plete the steps in that path as described in Sections 7 and 8 of this AMC.

2. Other lightning compliance techniques may be used to demonstrate system performance in the lightning environment; however, those techniques should be accepted by the Agency befor e using them.

c. Lightning verification test, analysis, or similarity plan. Test, analysis and similarity are all acceptable methods. The applicant must choose the method or the combination of methods most appropriate for their project. See Sections 7 a nd 8 of this AMC, and SAE ARP 5415B / EUROCAE ED - 158 for additional guidance for selecting the appropriate method. Specific lightning test, analysis, or similarity plans could be prepared to describe specific verification activities. A single verification pla n combining various methods for all the selected systems or dedicated verification plans may be necessary. For example, there may be several systems or equipment laboratory test plans, an aircraft test plan, or a similarity plan for selected systems on an aircraft.

Powered by EASA eRules Page 486 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) 1. Test plan (a) A lightning compliance test plan may include the equipment, system, and aircraft test objectives for the acquisition of data to support lightning compliance verification. The plan should provide an overview of the factors to be addressed for each system test specification. The test plan should include the following : (1) the purpose of the test ; (2) a description of the aircraft and/or the system to be tested ; (3) system configuration drawings ; (4) the proposed test set - up and methods ; (5) the intended test levels ; (6) pass/fail criteria ; and (7) the test schedule and test location.

(b) The test plan should cover Level A, B, and C systems and equipment, as appropriate. Level A systems may require both systems qualification labor atory tests and aircraft tests. Level B and Level C systems and equipment require only equipment qualification laboratory testing.

(c) The test plan should describe the appropriate aspects of the systems to be tested and their installation. Additionally, t he test plan should reflect the results of any analysis performed in the overall process of the lightning compliance evaluation.

2. Analysis plan . A lightning compliance analysis plan should include the objectives, at both system and equipment level, for g enerating data to support lightning compliance verification. Comprehensive modelling and analysis for voltage and current transients to aircraft systems and structures is an emerging technology; therefore, the analysis plan should be coordinated with the A gency to determine an acceptable scope for the analysis. The analysis plan should include the following : (a) the purpose and scope of the analysis ; (b) a description of the aircraft and/or the system addressed by the analysis ; (c) system configuration desc riptions ; (d) the proposed analysis methods ; (e) the approach for validating the analysis results ; and (f) pass/fail criteria, including margins to account for analysis uncertainty.

3. Similarity plan . A similarity plan should describe the approach undertaken to use the certification data from previously certified systems, equipment, and aircraft in the proposed lightning compliance programme. The similarity plan should include the following : (a) the purpose and scope of the similarity assessment ; (b ) the specific systems addressed by the similarity assessment ; (c) the data used from previously certified systems, equipment, and aircraft ; Powered by EASA eRules Page 487 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) (d) details on significant differences between the aircraft and the system to be certified and the similar aircraft and the system from which the data will be used ; and (e) when data has limited substantiation, a description and justification for margins to account for similarity uncertainty.

d. Compliance reports. One or more compliance reports may be necessary to do cument the results of the test, analysis, or similarity assessments. For new or significantly modified aircraft, lightning compliance reports may include many system and equipment test reports, aircraft test reports, and lightning vulnerability analysis re ports. For these types of lightning certification programmes, a compliance summary report may be useful to summarise the results of tests and analys e s. For lightning certification programmes of relatively simple systems, a single compliance report is adequate.

1. Test reports. Comprehensive test reports should be produced at the conclusion of lightning compliance testing. The test reports should include descriptions of the salient aspects of equipment or system performance during the test, details of a ny area of non - compliance with lightning requirements, actions taken to correct the non - compliance, and any similarity declarations. The applicant should also provide the supporting rationale behind any deviations from the system performance observed durin g testing.

2. Analysis reports. Analysis reports should describe the details of the analytical model, the methods used to perform the analysis, and the results of the analysis.

The reports should identify any modelling uncertainty and justify the margins e stablished in the analysis plan.

3. Similarity reports. Similarity reports should document the significant aircraft, system, equipment, and installation features that are common between the aircraft or system that is the subject of the similarity analysis and the aircraft or system that was previously certified for lightning. The applicant should identify all the significant differences encountered, along with the assessment of the impact of these differences on lightning compliance. These reports should al so justify the margins established in the similarity plan.

10. MAINTENANCE, PROTECTION ASSURANCE, AND MODIFICATIONS a. The minimum maintenance required to support lightning certification should be identified in the instructions for continued airworthiness (ICAs) as specified in CS 23.1529/2625, 25.1529, 25.1729, 27.1529, and 29.1529, as appropriate. Dedicated devices or specific features may be required to provide lightning protection for the installation of a system or equipment. Appropriate maintenance pr ocedures should be defined for these devices and features to ensure in - service protection integrity. A lightning protection assurance programme should be proposed in the certification plan to identify all actions necessary to justify or to verify that the maintenance procedures are adequate. This assurance programme may propose a surveillance programme based on a sampling of the fleet for monitoring the effectiveness of the protection features and/or maintenance procedures. See SAE ARP 5415B / EUROCAE ED - 15 8 for more information on these topics.

b. The maintenance procedures should consider the effects of corrosion, fretting, flexing cycles, or other causes that could degrade these lightning protection devices. Whenever applicable, specific replacement times of these devices and features should be identified.

Powered by EASA eRules Page 488 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERA L of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) c. Aircraft or system modifications should be assessed for the impact that any changes will have on the lightning protection. This assessment should be based on analysis and/or measurement .

[Amdt 20/2 3 ]

Appendix 1 to AMC 20 - 136A — Definitions and acronyms

ED Decision 2022/001/R a. Definitions Adverse effect: a response of a system that results in an unexpected and unacceptable operation of an aircraft system, or unexpected and unacceptable operation of the function performed by the system.

Actual transient level (ATL): t he level of transient voltage or transien t current that appears at the equipment interface circuits because of the external environment. This level may be less than or equal to the transient control level but should not be greater.

Aperture: a n electromagnetically transparent opening.

Attachment point: a point where the lightning flash contacts the aircraft.

Automatically recover: r eturn to normal operations without pilot action.

Channel: a s ubset of a system consist ing of equipment, components, elements and electrical interconnections , which performs an aircraft function provided by the system. A system could be composed of redundant similar or dissimilar channels in order to maintain the function at aircraft level in c ase of failure on one or several channels.

Component damage: a condition in which transients permanently alter the electrical characteristics of a circuit. Because of this, the component can no longer perform to its specifications.

Continued safe flight an d landing: t he capability for continued controlled flight and landing at a suitable location, possibly using emergency procedures, but without requiring exceptional pilot ing skill or strength. For CS - 25 aeroplanes, the pilot must be able to land safely at a suitable airport. For CS - 23 aeroplanes, it is not necessary to land at an airport. For rotorcraft, the rotorcraft must continue to cope with adverse operating conditions, and the pilot must be able to land safely at a suitable site. Some aircraft damage may be associated with a failure condition during flight or upon landing.

Direct effects: p hysical damage to the aircraft or to its electrical and electronic systems. Direct attachment of lightning to the system’s hardware or components causes the damage. Examples of direct effects include tearing, bending, burning, vaporisation, or blasting of aircraft surfaces and structures, and damage to the electrical and electronic systems.

Electrical and electronic system: a n electrical or electronic system includes all electrical and electronic equipment, components, elements , and the electrical interconnections that are required to perform a particular function.

Equipment: a component of an electrical or electronic system with interconnecting electrical conductors.

Equipment electrical interface: a location on a piece of equipment where an electrical connection is made to the other equipment in a system of which it is a part. The electrical interface may consist of individual wires or wire bundles that connect the eq uipment.

Powered by EASA eRules Page 489 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) Equipment transient design level (ETDL): t he peak amplitude of transients to which equipment is qualified.

Function: t he specific action of a system, equipment, and flight crew performance aboard the aircraft that, by itself, provides a completely recognisable operational capability. For example, ‘display aircraft heading to the pilots’ is a function. One or more systems may perform a specific function, or one system may perform multiple functions.

External environment: t he natural lightn ing environment, outside the aircraft, for design and certification purposes. See SAE ARP 5412B / EUROCAE ED - 84A, which references documents that provide additional guidance on aircraft lightning environments and the related waveforms.

Immunity: t he capaci ty of a system or piece of equipment to continue to perform its intended function, in an acceptable manner, in the presence of RF fields.

Indirect effects: e lectrical transients induced by lightning in aircraft electrical or electronic circuits.

Internal e nvironment: t he electric and magnetic fields, currents, and voltages on and within the aircraft produced by a lightning strike to the aircraft.

Lightning flash: t he total lightning event. It may occur in a cloud, between clouds, or between a cloud and the ground. It can consist of one or more return strokes, plus intermediate or continuing currents.

Lightning strike: a ttachment of the lightning flash to the aircraft.

Lightning strike zones: a ircraft surface areas and structures that are susceptible to light ning attachment, dwell times, and current conduction. See SAE ARP 5414B / EUROCAE ED - 91A, which references documents that provide additional guidance on aircraft lightning zoning.

Lightning stroke (return stroke): a lightning current surge that occurs when the lightning leader (the initial current charge) makes contact with the ground or another charge centre. A charge centre is an area of high potential of opposite charge.

Margin: t he difference between the equipment transient design levels and the actual transient level.

Multiple burst: a randomly spaced series of bursts of short duration, low - amplitude current pulses, with each pulse characterised by rapidly changing currents. These bursts may result as the lightning leader progresses or branches, and are associated with the cloud - to - cloud and intra - cloud flashes. The multiple bursts appear most intense when the initial leader attaches to the aircraft. See SAE ARP 5412B / EUROCAE ED - 84A.

Multiple stroke: t wo or more lightning return strokes during a single lightning flash. See SAE ARP 5412B / EUROCAE ED - 84A.

Non - normal situation: a ny situation that requires non - normal, abnormal, emergency, or unusual procedures, or configurations for operating an aircraft.

Normal operation: a status where the system is perf orming its intended function. When addressing compliance with CS 23.1306/2515(a)(2), 25.1316(a)(2), 27.1316(a)(2), and 29.1316(a)(2), the function whose failure would prevent the continued safe flight and landing should be in the same undisturbed state as before exposure to the lightning threat while other functions, performed by the same system, subject to CS 23.1306/2515(b), 25.1316(b ), 27.1316(b), and 29.1316(b), are not required to be recovered. The system that performs the function may be nevertheless in a different state as long as the function is not adversely affected.

Powered by EASA eRules Page 490 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) Timely manner: t imely recovery has been introduced to account for the necessary period for complex systems to reconfigure safely after a disruption. The meaning of ‘in a timely manner’ depends upon the function performed by the system to be evaluated, the specific system design, interaction between that system and o ther systems, and interaction between the system and the flight crew, or the phase of flight, which must be considered in the safety assessment. Therefore, the definition of ‘in a timely manner’ must be determined for each specific function performed by th e system. The applicable definition could be included in the l ightning compliance plan for review and concurred with the Agency.

Transient control level (TCL): t he maximum allowable level of transients that appear at the equipment interface circuits becaus e of the defined external environment.

Upset: i mpairment , either permanent or momentary, of the system ’s operation. For example, a change of digital or analogue state that may or may not require a manual reset.

b. Acronyms 14 CFR: Title 14 of the Code of Federal Regulations AC: advisory circular AMC: acceptable means of compliance ARP: aerospace recommended practice ATL: actual transient level CS: certification specification DAL: development assurance level (ED - 79A / ARP 4754A) / design assurance level (ED - 80 / DO - 254 , ED - 12C / DO - 178C ) DEL: direct effect of lightning ETDL: equipment transient design level EASA: European Union Aviation Safety Agency EUROCAE: European Organisation for Civil Aviation Equipment FAA: Federal Aviation Administration ICA s : instructions for continued airworthiness IEL: indirect effect of lightning TCL: transient control level [Amdt 20/2 3 ] Powered by EASA eRules Page 491 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20)

Appendix 2 to AMC 20 - 136A — Examples of lightning safety

assessment considerations — Level A systems on large aeroplanes

ED Decision 2022/001/R a. Establishing appropriate pass/fail criteria for complying with CS 25.1316(a) could only be achieved through a comprehensive review of the system design using an acceptable lightning functional hazard assessment process. The following paragraphs summarise a pproaches whereby pass/fail criteria for compliance with CS 25.1316(a) could be specified on the merit of specific system architecture attributes.

b. For the purposes of discussion and evaluation of the examples, the architectural strategies used in the s ystem implementation need to be defined. Therefore, the additional definitions below should be considered: (1) s imilar r edundant c hannels : t he multiple channels consist of equipment, components, electrical interconnections and configurations that are simil ar, typically with equipment that ha s identical part numbers. The channels should be independent. They may be configured in active, active - backup , or passive - backup modes.

(2) d issimilar r edundant c hannels : e ach channel is unique and independent of the oth ers.

They may be configured in active, active - backup , and passive - backup modes.

(3) c ombination of s imilar and d issimilar r edundant c hannels : t he combination of similar and dissimilar channels , as defined above , with independence between channels. They may be configured in active, active - backup , and passive - backup modes.

Notes : (1) Active mode means the channel performs the aircraft function in normal operation.

(2) Active - backup mode means the channel is operational but not used to perform the aircraft function until switched to active mode either automatically or by flight crew action.

(3) Passive - backup mode means the channel is not operational; switching to active mode is either au tomatic or by flight crew action upon failure recognition.

(4) Combination of e lectrical/ e lectronic and m echanical, h ydraulic and/or p neumatic c hannels: c ertain architectures combine electrical and electronic channels with mechanical, hydraulic and/or pneu matic channels. These combinations of electrical/electronic and mechanical, hydraulic or pneumatic channels may be configured in active, active - backup , and passive - backup modes.

(5) These examples are theoretical and intended to facilitate a discussion fr om which universal guidelines may be derived to help develop useful guidance material. It is not the intention to account for all possible configurations, but only to represent the common system architectures or some that present unique challenges.

c. This Appendix presents examples of l arge a eroplane systems with multiple independent and redundant channels performing a function whose failure would prevent continued safe flight and landing.

These examples could also be used for other types of aircraft.

Powered by EASA eRules Page 492 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) Example 1 25.1316(a) System Function Channel Channel Channel Display of attitude, altitude, and Active Active Active - backup airspeed information to the pilots during IFR operations ( D issimilar standby (e.g. primary display system and (Pilot displays and (Co - pilot displays display and associated sensors, with dissimilar associated sensors) and associated associated sensors) standby display system and sensors) sensors) Requirements for compliance (a)(1), (a) (2) (a)(1), (a) (2) (b) demonstration (CS 25.1316) Discussion: This example depicts the requirement of CS 25.1333 for independent displays of information essential to the safety of flight at each pilot station. The standby display is required in order to achieve the safety objectives of CS 25.1309. Either the pilot or the co - pilot can be the pilot flying (PF) or pilot monitoring (PM) during normal operations, so both the pilot and co - pilot display systems should be considered as active systems.

Compliance with CS 25.1316(a)(1) and (a)(2) should demonstrate that neither pilot display of aircraft attitude, altitude, and airspeed is adversely affected and that each of them recovers normal operation of these L evel A functions when the aircraft is exposed to lightning. It is acceptable that th e dissimilar standby display demonstrates compliance with the CS 25.1316(b) requirements with LCL B. The adverse effects must include both a loss of, and hazardously misleading, attitude, altitude, and airspeed information.

Example 2 25.1316(a) System Function Channel Channel Channel Full authority control of pitch, yaw, Active or Active or Active or and roll using electrical and active - backup active - backup active - backup electronic flight control systems (Flight control (Flight control (Flight control system #1) system #2) System #3) Requirements for compliance (a)(1), (a) (2) (a)(1), (a) (2) (a)(1), (a) (2) demonstration (CS 25.1316) Discussion: This example depicts an electronic flight control system comprising three independent channels to meet the safety objectives of CS 25.1309. At any time, any one of the three channels can operate as the active channel.

Only one channel operates in an active mode while the others are in active - backup mode. Any channel can perform the control function at any time; therefore, all the channels must comply with CS 25.1316(a)(1) and (a)(2).

Example 3 25.1316(a) System Function Channel Channel Channel Provide engine overspeed protection Active Active or Active (Electronic engine a ctive - backup (Independent control system) (Electronic engine mechanical control system) overspeed protection) (Normal speed (Overspeed control) protection) Requirements for compliance (b) (b) Not subject to demonstration (CS 25.1316) CS 25.1316 Powered by EASA eRules Page 493 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) Example 3 25.1316(a) System Function Channel Channel Channel Discussion: This example depicts the function of engine overspeed protection performed by a combination of active electrical and electronic control and mechanical system control. The mechanical channel must provide overspeed pro tection during normal operations, and be independent of the active electronic control channels. The mechanical channel must not rely on electrical or electronic components to assist, augment, or monitor the overspeed protection. If the mechanical channel i s independent of the electronic engine control speed control and overspeed protection, and has no electrical or electronic components that have failure modes that could prevent overspeed protection, then the engine overspeed protection function is not adve rsely affected when the aircraft is exposed to lightning. The system is , therefore , not subject to CS 25.1316(a). The electronic engine control channels should comply with CS 25.1316(b) with LCL B.

This example only considers the overspeed protection feature implemented by the system. Other functions whose failure may be classified as catastrophic, like the loss of thrust control function where the function may be implemented by electronic control channels, should comply with CS 25.1316(a).

Example 4 25.1316(a) System Function Channel Channel Channel Provide electrical power for electrical Active Active Passive - Backup and electronic systems including those with catastrophic failure conditions (Left engine (Right engine (Emergency power generator system) generator system) supply system driven by a ram - air turbine) Requirements for compliance (a)(1), (a) (2) (a)(1), (a) (2) (b) demonstration (CS 25.1316) Discussion: This example depicts a typical transport category aircraft electrical system on a twin - engined aircraft where two or more independent sources of electrical power are required by CS 25.1307(b) and a ram - air turbine is necessary to meet the safety objectives of CS 25.1309 and CS 25.1351(d).

For this example , the electrical system consists of two active channels provided by a single main engine - driven generator on each engine with the associated distribution and controls, and a third passive - backup channel provided by a ram - air turbine electrical power system . The ram - air turbine electrical power system is stowed during normal operation and deployed either automatically and/or manually when power from the two main engine - driven generators is lost.

The active engine generator system channels must not be adverse ly affected when the aircraft is exposed to lightning, and comply with CS 25.1316(a)(1) and (a) (2). The passive - backup ram - air turbine electrical power system does not mitigate adverse effects for compliance with CS 25.1316(a). It is acceptable that the ra m - air turbine electrical power system demonstrates compliance with the CS 25.1316(b) specifications with LCL B.

Example 5 25.1316(a) System Function Channel Channel Channel Channel Provide electrical power Active Active Active Passive - backup for electrical and (APU - driven electronic systems (Left engine (Right engine generator system (Emergency including those with generator generator required for power supply catastrophic failure system) system) ETOPS flight drive n by a conditions beyond 180 ' ) ram - air turbine) Powered by EASA eRules Page 494 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) Example 5 25.1316(a) System Function Channel Channel Channel Channel Requirements for (a)(1), (a) (2) (a)(1), (a) (2) (a)(1), (a) (2) (b) compliance demonstration (CS 25.1316) Discussion: This example depicts a twin - engined transport category aircraft electrical system where two or more independent sources of electrical power are required by CS 25.1307(b) , and an alternate source (driven by a ram - air turbine) is necessary to meet the safety objectives of CS 25.1309 and CS 25.1351(d). This configuration includes a third electrical power so urce driven by an auxiliary power unit (APU). This third source is required ( a ctive channel) for ETOPS beyond 180 minutes. As in Example 4, the emergency power source is a passive - backup channel provided by a ram - air turbine that remains stowed during norm al flight and is deployed either automatically and/or manually when power from all other channels is lost.

All active electrical power generation channels should comply with CS 25.1316(a)(1) and (a)(2). The passive - backup electrical power generation channe l does not mitigate the adverse effects due to lightning exposure to meet the intent of the lightning requirement . It is acceptable that the passive - backup channel demonstrates compliance with the CS 25.1316(b) requirements with LCL B.

Note : For non - ETOPS or for ETOPS up to 180 ' aircraft, the APU LCL should be defined based on the specific aircraft safety assessment.

Example 6 25.1316(a) System 25.1316 System 25.1316 System System Function Channel Channel Channel Channel Reduce aircraft speed Active Active Active Active on ground in a controlled manner Main brake system (Electronic engine (Electronic spoiler (Independent using thrust reverser (Electro - thrust reverse deployment mechanical control system, spoiler mechanical) control with control with wheel braking) deployment system, associated associated wheel braking system sensors) sensors) Requirements for (a)(1), (a) (2) 25.1316(a) or (b) 25.1316(a) or (b) Not subject to compliance depending on depending on CS 25.1316 demonstration specific aircraft specific aircraft (CS 25.1316) safety assessment safety assessment Discussion: This example depicts an aircraft - level function that is performed by a combination of independent systems each contributing in part to the function during a specific phase of flight. In this case, each system implements very distinct aircraft - level functions that serve in a complementary manner to decelerate the aircraft duri ng the landing roll. The mechanical wheel braking system is assumed to be independent of the other channels, with no associated electrical or electronic equipment to assist, augment, or monitor the mechanical wheel braking system.

In this example, it is as sumed that the main brake system includes failure conditions that are catastrophic.

For the electronic engine thrust reverser control and the electronic spoiler control systems, the applicable parts of CS 25.1316 would depend on the specific failure condit ions. The effectiveness, authority, and malfunctions associated with each system should be considered. Additionally, the interaction between the systems has also to be considered. Issues such as asymmetrical thrust reverser activation or spoiler deployment could adversely affect the main brake and mechanical wheel braking functions and could affect the safety classification for the thrust reverser and spoiler controls.

An aircraft safety assessment must be carried out for each of these systems performing a specific aircraft - level function to identify and classify their failure conditions. The failure hazard classifications and the decomposition of each system into the constituent channels would then dictate which paragraphs of CS 25.1316 are needed.

Powered by EASA eRules Page 495 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 136A Products, Parts and Appliances (AMC - 20) Example 7 25.1316(a) System Function Channel Channel Channel Provide altitude information to be Active Active Active - Backup display ed in IFR flight, using air - data computer connected to the primary (Air - data computer (Air - data computer (Pneumatic standby flight display ( PFD ) , and pneumatic 1 with static port) 2 with s tatic p ort) altimeter with standby instrument with alternate alternate static static port port) Requirements for compliance (a)(1), (a) (2) (a)(1), (a) (2) Not subject to demonstration (CS 25.1316) CS 25.1316 Discussion: This example depicts the function to provide altitude information in IFR . The main sources are two air - data computers (ADCs) coupled to static ports and a backup source from a standby pneumatic altimeter coupled to an alternate static port independent from the main static ports.

In such a case, the standby altimeter does not mitigate compliance with CS 25.1316(a) for the active ADC channels. The standby altimeter does not mitigate the c ommon hazardously misleading altitude information from the active ADC channels for compliance with CS 25.1316(a).

Example 8 25.1316(a) System Function Channel Channel Channel Control and protection of the aircraft Active Active Passive - backup pneumatic (bleed) system (Pneumatic system (Pneumatic system (High pressure (Top - level failure condition controller #1) controller #2) switch + valve) classification: catastrophic) FDAL B / IDAL B FDAL B / IDAL B FDAL C / IDAL C Requirements for compliance (a)(1), (a) (2) (a)(1), (a) (2) (b) demonstration (CS 25.1316) Discussion: This is a generic example with the objective to show that it is not uncommon for the LCL of a given system to be different from the f unctional d evelopment a ssurance l evel (FDAL) and i tem d evelopment a ssurance l evel (IDAL), defined according to SAE ARP 4754 A / EUROCAE ED - 79A Guidelines for Development of Civil Aircraft and Systems .

Therefore, it is important to use the proper nomenclature and avoid using the SAE ARP 4754A / EUROCAE ED - 79A DAL or similar terms when referring to the LCL.

In this example, the pneumatic control system is composed of two main a ctive controllers and a simpler passive - backup channel that can perform the function, preventing the catastrophic event from occurring in case of failure of both controllers.

The FDAL for each channel or me mber (SAE ARP 4754A / EUROCAE ED - 79A nomenclature) was defined for a catastrophic top - level failure condition based on the ‘Option 2’ column 4 of Table 3 DEVELOPMENT ASSURANCE LEVEL ASSIGNMENT TO MEMBERS OF A FUNCTIONAL FAILURE SET of SAE ARP 4754A / EUROC AE ED - 79A, which allows the combination of FDALs B+B+C for independent channels. In contrast, the respective LCLs would be A+A+B.

Considering that lightning can simultaneously affect all channels, the considerations used for the IDAL assignment cannot be u sed, and compliance with CS 25.1316(a) is required for both the a ctive channels performing a function with the catastrophic top - level failure condition.

In this example, the IDAL for the passive - backup channel may be C. However, for lightning, the applicab le part of CS 25.1316 is (b), similarly to Example 5.

[Amdt 20/2 3 ] Powered by EASA eRules Page 496 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20)

AMC 20 - 152A

AMC 20 - 152A Development Assurance for Airborne Electronic

Hardware (AEH)

ED Decision 2020/010/R 1 PURPOSE 1.1 This AMC describes an acceptable means, but not the only means, for showing compliance with the applicable airworthiness regulations for the electronic hardware aspects of airborne systems and equipment in product certification or ETSO authorisation. Compliance with this AMC is not mandatory, and an applicant ma y elect to use an alternative means of compliance. However, the alternative means of compliance must meet the relevant requirements, ensure an equivalent level of safety, and be approved by EASA on a product or ETSO article basis.

1.2 This AMC recognises E UROCAE ED - 80, Design Assurance Guidance for Airborne Electronic Hardware, dated April 2000, and RTCA DO - 254, Design Assurance Guidance for Airborne Electronic Hardware, dated 19 April 2000.

1.3 This AMC describes when to apply EUROCAE ED - 80/RTCA DO - 254, an d it supplements EUROCAE ED - 80/RTCA DO - 254 with additional guidance and clarification for the development of custom devices, including the use of commercial off - the - shelf (COTS) intellectual property (IP), for the use of COTS devices and for the developmen t of c ircuit board assemblies (CBAs).

The additional guidance and clarifications are provided in the form of objectives. The applicant is expected to describe the process and activities to sati sfy the objectives of this AMC.

Note: EUROCAE ED is hereafter r eferred to as ‘ED’; RTCA DO is hereafter referred to as ‘DO’. Where the notation ‘ED - 80/DO - 254’ appears in this document, the referenced documents are recognised as being equivalent.

1.4 This AMC does not address the Single Event Effects (SEE) aspects or t he assessment of the hardware susceptibility to SEE. AMC SEE aspects are usually addressed through a certification review item (CRI), and further guidance may be found in EASA CM - AS - 004 Issue 01, issued 8 January 2018.

However, the Plan for Hardware Aspect s of Certification may still be used to document the certification considerations for SEE.

2 APPLICABILITY This AMC may be used by applicants, design approval holders, and developers of airborne systems and equipment containing airborne electronic hardware (AEH) to be installed on type - certified aircraft, engines, and propellers. This applicability includes t he developers of ETSO articles.

This AMC is applicable to AEH that contributes to hardware development assurance level (DAL) A, DAL B, or DAL C functio ns.

When an objective is not applicable to a specific hardware DAL, the applicability restriction is directly indicated within the objective text with the following convention, for instance ‘For DAL A hardware, …’ For AEH contributing to hardware DAL C fun ctions, only a limited set of objectives applies.

Even though there is a benefit in having a structured development process that ensures a proper flow - down of requirements to the hardware and the fulfilment by the hardware of the intended function, the use of this AMC is not required for AEH contributing to hardware DAL D functions. Appendix B provides some clarifications that may be used to ensure that the DAL D hardware performs its intended function.

Powered by EASA eRules Page 497 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) 3 DOCUMENT HISTORY This docum ent is the initial issue of AMC 20 - 152. This initial issue, jointly developed with FAA, is intentionally set at Revision A.

4 BACKGROUND This AMC is related to the development of custom devices in AEH, including the use of commercial off - the - shelf intellectual pr operty (COTS IP) within custom devices, the use of COTS devices, and the development of circuit board assemblies (CBAs). Each of these topics is organised with: background information dedicated to each major topic, — applicability, and — sections where obj ectives are described and uniquely identified.

A unique identifier for each objective is defined with a prefix and an index number (i) as follows: — for the development of custom devices, the identifier is ‘CD - i’; — for the use of COTS IP in custom devices , the identifier is ‘IP - i’; — for the use of COTS devices, the identifier is ‘COTS - i’; — for the development of CBAs, the identifier is ‘CBA - i’.

Objectives are also differentiated from the rest of the text by formatting in italics.

The applicant should doc ument in the Plan for Hardware Aspects of Certification (PHAC), or any other related planning document, the process and activities that the applicant intends to perform to satisfy the objectives of this AMC. The PHAC, as well as those related planning docu ments, should be submitted for certification.

5 CUSTOM DEVICE DEVELOPMENT This section provides guidance for the development assurance of programmable logic devices (PLDs), field - programmable gate arrays (FPGAs), or application - specific integrated circuits (ASICs), which are collectively referred to as ‘custom devices’. These custom devices are addressed in ED - 80/DO - 254, Section 1.2, Item 3 as ‘custom micro - coded components’.

Developing a custom device demands a well - defined development process. However, it is understood that the process to develop complex custom devices requires more comprehensive activities and artefacts than for a simple device.

Section 5.1 identifies custom devices that are within the scope of this AMC.

Section 5.2 provides guidance on s imple/complex classification for custom devices.

Section 5.3 provides guidance on development assurance for complex custom devices.

Section 5.4 provides guidance on development assurance for simple custom devices. In particular, Section 5.4 defines which s ections from 5.5 to 5.11 are applicable to the development assurance of simple electronic devices.

Sections 5.5 to 5.10 provide clarifications on ED - 80/DO - 254.

Section 5.11 provides background information and guidance specific to COTS IP used in custom dev ices.

Powered by EASA eRules Page 498 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) 5.1 Applicability to Custom Devices Section 5 is applicable to a digital - or mixed - signal custom device that contributes to hardware DAL A, B or C functions.

Appendix A to ED - 80/DO - 254 modulates the ED - 80/DO - 254 life - cycle data based on the DAL allocated to the hardware function. This document recognises Appendix A for the modulation of the life - cycle data according to the hardware DAL for the development of custom devices.

5.2 Simple/Complex Classification ED - 80/DO - 254 introduces the notion of s imple and complex hardware items. This section clarifies and provides criteria that could be used to classify a device as simple by considering the design content of the custom device, and subsequently, the ability to comprehensively verify the device.

A h ardware custom device is classified as simple only if a technical assessment of the design content supports the ability of the device to be verified by a comprehensive combination of deterministic tests and analyses that ensure correct functional performan ce under all foreseeable operating conditions with no anomalous behaviour. The following criteria should be used for assessing whether a device should be classified as simple: — simplicity of the functions and their number, — number and the simplicity of t he interfaces, — simplicity of the data/signal processing or transfer functions, and — independe nce of functions/blocks/stages.

Additional criteria specific to the digital part of the design include: — whether the design is synchronous or asynchronous, — number of independent clocks, — number of state machines, number of states and state transitions per state machine, and — independe nce between the state machines.

The applicant may propose other or additional criteria for the tech nical asse ssment of simplicity.

When an item cannot be classified as simple, it should be classified as complex. However, note that an item constructed entirely from simple items may itself be complex.

Objective CD - 1 For each custom device, the applicant should docu ment in the PHAC or any related planning document: 1. the development assurance level, 2. the simple or complex classification, and 3. if a device is classified as simple, the justification based on the simple classification criteria.

5.3 Development Assu rance for Complex Custom Devices ED - 80/DO - 254 is recognised as the industry standard for the development assurance of complex custom devices.

The applicant should satisfy ED - 80/DO - 254 and the additional objectives or clarifications described in this AMC fr om Sections 5.5 to 5.11.

Powered by EASA eRules Page 499 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) 5.4 Development Assurance for Simple Custom Devices For the development of simple custom devices, it is understood that the life - cycle data might be significantly reduced compared with the data required for a complex custom device.

ED - 80/DO - 254 acknowledges that the documentation for the design process of a simple hardware device is less extensive than the one needed for a complex device. In addition, while verification and configuration management are also needed, these supp orting processes also require less documentation for a simple device.

However, it is important that a simple custom device performs its intended function, and is under configuration management, thus allowing the device to be reproduced, conformed, and anal ysed to ensure continued operational safety.

Objective CD - 2 The applicant should propose a process in the PHAC, or any other appropriate planning document, to develop simple custom devices which encompasses the following: 1. definition of the device functions, 2. complete verification of the device functions through tests and analyses, 3. configuration management of the device, including problem reporting and the instructions to reproduce the device, 4. assessment of the build conformance of the devic e.

Sections 5.5.2.4 and 5.5.2.5 of this document also apply to the verification process for simple custom devices.

The life - cycle data for simple devices can be combined with other hardware data.

If tools are used for the simple custom device development p rocess, the objectives or clarifications of those objectives described in Section 5.8 of this document are also applicable.

When the applicant intends to reuse a previously developed simple device, ED - 80/DO - 254 Section 11.1 and the clarifications provided in Section 5.9 of this document should be used.

If the applicant intends to use COTS IP, the objectives or clarifications of those objectives described in Section 5.11 of this document are also applicable.

5.5 Clarifications to ED - 80/DO - 254 Validation and Verification Processes 5.5.1 Validation Process Establishing a correct and complete set of requirements is the cornerstone of the development assurance process. ED - 80/DO - 254 Section 6.1 addresses the validation process to ensure the completeness and correc tness of derived requirements. Nevertheless, the validation process is essential for all the requirements. Indeed, the upper - level requirements allocated to the custom device are often refined, decomposed or restated at the custom device level, and in term s that support the hardware design. These custom device requirements, which are traceable from/to the upper - level requirements and, therefore, not considered to be ‘derived’, should also be correct and complete.

Objective CD - 3 The applicant should validate all the custom device requirements by following the ED - 80/DO254 validation process (ED - 80/DO - 254 Section 6). This validation activity covers both derived and non - derived requirements.

For DAL A and B development, validation activities should be performed with independence.

Powered by EASA eRules Page 500 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) Note: ED - 80/DO - 254 Appendix A defines acceptable means for establishing independence.

5.5.2 Verification Process ED - 80/DO - 254 broadly describes the verification process, but additional guidance is needed to ensure the verification of the custom device is complete, particularly in the area of: — design reviews, — reviews of test cases and procedures, and — verification of the implementation.

5.5.2.1 Conceptual Design Review Conceptual design is the process of generating a high - level design description from the hardware requirements (see ED - 80/DO - 254 Section 5.2). The conceptual design review is typically used to ensure that the outcome of the conceptual design activities (see ED - 80/DO254 Section 5.2.2) is consistent with th e requirements, and identifies constraints for the interfacing components (hardware or software) and architectural constraints for the detailed design activities of the custom device.

Since this conceptual design review is already addressed in ED - 80/DO - 254 Section 5.2.2 through the note, no separate objective is needed.

5.5.2.2 Detailed Design Review Detailed design is the process of generating, from the conceptual design and the requirements, a hardware description language (HDL) or analogue representation of the design, constraints for the implementation (e.g. timing constraints, pinout, I/O characteristics), and the hardware – software interface description.

ED - 80/DO - 254 introduces design reviews in Section 6.3.3.2. A design review is considered to be an e ssential step during the detailed design process (ED - 80/DO - 254 Section 5.3) supporting the implementation process, and complementing requirements - based verification.

Objective CD - 4 For hardware DAL A or DAL B, the applicant should review the detailed desig n with respect to the design standards, and review the traceability between the detailed design and the custom device requirements, in order to demonstrate that the detailed design covers the custom device requirements, is consistent with the conceptual de sign, and is compliant with the hardware design standards.

For hardware DAL C, the applicant should demonstrate that the detailed design satisfies the hardware design standards.

5.5.2.3 Implementation Review Within a custom device development process, tool s are used to convert the detailed design data into the physical implementation. While ED - 80/DO - 254 does not explicitly address it, a review of the design tool reports (e.g. synthesis and place and route reports) is necessary to ensure that the execution o f the tool to generate its output was performed correctly.

Objective CD - 5 When tools are used to convert the detailed design data into the physical implementation, the applicant should review the design tool reports (e.g. synthesis and place and route repo rts) to ensure that the tool executed properly when generating the output.

Powered by EASA eRules Page 501 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPAR T A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) 5.5.2.4 Review of Verification Cases and Procedures ED - 80/DO - 254 introduces verification coverage analysis in Section 6.2.2 Item 4 to satisfy the ED - 80/DO - 254 verification process objectives and determine whether the verification process is correct and complete. A part of the coverage analysis is clarified by the following objective.

Objective CD - 6 Each verification case and procedure should be reviewed to confirm that it is approp riate for the requirements to which it traces and that the requirements are correctly and completely covered by the verification cases and procedures.

5.5.2.5 Verification of the Timing Performance of the Implementation ED - 80/DO - 254 Section 6.2 addresses the verification of the implementation. The implementation results from the process to generate the physical custom device from the detailed design data. The post - layout netlist is the closest virtual representation of the physical custom device, resulting from synthesis (for the digital part of the device) and place and route.

While it is recommended to test the implementation in its intended operational environment (i.e. by a physical test), verification using the post - layout netlist may be necessary to complement the verification of the implementation for certain requirements (e.g. features not accessible from the I/O pins of the device, timing, abnormal conditions, or robustness cases). In such cases, the coverage of the requirements by mea ns other than a physical test should be justified.

The requirement to capture the activities in ED - 80/DO - 254 Section 5.1.2 Item 4.g introduces the need for the requirements to address signal timing characteristics under normal - and worst - case conditions.

N evertheless, ED - 80/DO - 254 does not explicitly address the necessity to verify the performance of the device under all possible (best - case and worst - case) timing conditions that could possibly occur during the operation of the device.

The following objectiv e clarifies the need to take into account the variation of the environmental conditions (temperature, voltage, etc.) during the evaluation of the timing performance of the design, as well as the semiconductor device process variations.

Objective CD - 7 The a pplicant should verify the timing performance of the design accounting for the temperature and power supply variations applied to the device and the semiconductor device fabrication process variations as characterised by the manufacturer of the semiconduct or device.

Note: Static timing analysis (STA) with the necessary timing constraints and conditions is one of the possible means of compliance with this objective for the digital parts of custom devices.

5.6 Clarifications to ED - 80/DO - 254 ‘Robustness Aspec ts’ ED - 80/DO - 254 mentions robustness defects but does not explicitly address robustness. The robustness of the design is defined as the expected behaviour of the design under abnormal and boundary/worstcase operating conditions of the inputs and internal d esign states. These conditions are often captured as derived requirements when they are not allocated from the upper - level process.

When subjected to these conditions, it is understood that the design may not continue to perform as it would under normal co nditions.

Objective CD - 8 For DAL A or DAL B hardware, the abnormal and boundary conditions and the associated expected behaviour of the design should be defined as requirements.

Powered by EASA eRules Page 502 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) 5.7 Recognition of HDL Code Coverage Method HDL code coverage analysis is an assessment of whether the HDL code of the design has been exercised through HDL simulations.

The HDL code coverage method provides an assessment of the coverage of the design logic structure, giving an indication of which aspects of the logic structure ar e exercised and which are not.

When performed during requirements - based verification (per ED - 80/DO - 254 Section 6.2), HDL code coverage is recognised as a method to perform ED - 80/DO - 254 elemental analysis per Appendix B Section 3.3.1 for digital devices. H DL code coverage supports the assessment of whether the HDL code elements are fully covered by requirements - based simulations. As such, it does not represent an assessment of the completeness of the requirements - based testing activities or the effectivenes s of the requirement coverage.

Objective CD - 9 For hardware DAL A or DAL B, where HDL code coverage is used to perform elemental analysis (ED - 80/DO - 254 Appendix B Section 3.3.1), the applicant should define in the planning documents the detailed coverage cr iteria of the HDL code elements used in the design. The criteria should ensure coverage over the various cases of the HDL code elements used in the design (e.g. branches, conditions, etc.). Any non - covered case or element should be analysed and justified.

Note: Code coverage might need to be complemented by additional analysis for any hardware items that are identified as not covered by the code coverage analysis, in order to complete the elemental analysis of all elements. This situation may occur in the u se of some COTS IP instantiations.

5.8 Clarifications to ED - 80/DO - 254 ‘Tool Assessment and Qualification’ ED - 80/DO - 254 introduces the notion of tool assessment and qualification. ED - 80/DO - 254 Figure 11 - 1 includes a flow chart indicating the tool assessment considerations and activities, and provides guidance for when tool qualification may be necessary. This AMC uses the flow chart and its related text as a basis for providing further clarification, as follows: ED - 80/DO - 254 — Figure 11 - 1 Item 1 — Identify t he Tool Information capturing the environment required for tool operation and the tool revision should be included with the tool identification.

ED - 80/DO - 254 — Figure 11 - 1 Item 2 — Identify the Process the Tool Supports When identifying the design or verification process that the tool supports, it is important to also identify what purpose or activity within the hardware development process the tool satisfies. While assessing the tool limitations, evidence of formal assessment of the tool problem repor ts is not required if the tool output has been completely and independently assessed.

ED - 80/DO - 254 — Figure 11 - 1 Item 3 — Is the Tool Output Independently Assessed?

The purpose of assessing the tool output is to completely cover, with an independent means, the potential errors that the tool could introduce into the design or fail to detect during verification.

Objective CD - 10 When the applicant intends to independently assess a tool output, the applicant should propose an independent assessment that verifies the tool output is correct. The independent assessment should justify that there is sufficient coverage of the tool output. The completeness of the tool assessment should be based on the design/implementation and/or verification objectives that th e tool is used to satisfy.

Powered by EASA eRules Page 503 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) ED - 80/DO - 254 — Figure 11 - 1 Item 4 — Is the Tool a Level A, B or C Design Tool or a Level A or B Verification Tool?

ED - 80/DO - 254 Figure 11 - 1 Item 4 of the tool assessment/qualification flow excludes the need for activities for too ls ‘used to assess the completion of verification testing, such as in an elemental analysis’.

The last statement is misleading regarding the intent of code coverage tools used for elemental analysis. As stated in Section 5.7 of this document, ‘when a code coverage tool is used for elemental analysis, it does not represent an assessment of the completeness of the requirements - based testing activities or the effectiveness of the requirement coverage’.

It is therefore necessary to provide some further clarific ations.

— This document recognises the Figure 11 - 1 Item 4 exclusion of tool assessment/qualification activities for code coverage tools only when they are used to assess whether the code has been exercised by requirements - based testing/si mulations (element al analysis).

— If test cases or procedures are automatically generated by a tool and this tool uses coverage to determine the completion of the requirements verification, then the tool should be considered to be a verification tool to answer the question raised in Figure 11 - 1 Item 4.

ED - 80/DO - 254 — Figure 11 - 1 Item 5 — Does the Tool have Relevant History?

In ED - 80/DO - 254, the supporting text for Figure 11 - 1 Item 5 can be misinterpreted to suggest that when the tool has been previously used, no further tool assessment is necessary. Item 5 should be understood to mean that the applicant will provide sufficient data and justification to substantiate the relevance and credibility of the tool history.

Objective CD - 11 When the applicant intends to claim credit fo r the relevant history of a tool, sufficient data should be provided as a part of the tool assessment to demonstrate that there is a relevant and credible tool history to justify that the tool will produce correct results for its proposed use.

ED - 80/DO - 254 — Figure 11 - 1 Item 9 — Design Tool Qualification For design tools, contrary to the note in the supporting text for Figure 11 - 1 Item 9, the tool history should not be used as a stand - alone means of tool assessment and qualification. A relevant tool history may be used to compensate for some particular gaps in the tool assessment and qualification process, for example, to explain the method of independent assessment of the tool output. In this case, a relevant tool history is considered to be complementary d ata, providing more assurance for a tool.

In addition to what is already referenced in ED - 80/DO - 254 Figure 11 - 1 Item 9 for tool qualification guidance, ED - 12C/DO - 178C and ED - 215/DO - 330 may also be used.

5.9 Clarifications to ED - 80/DO - 254 regarding Previous ly Developed Hardware (PDH) Previously developed hardware (PDH) is defined as custom - developed hardware that has been installed in an airborne system or equipment either approved through EASA type certification (TC/STC) or authorized through ETSOA. The sec tion providing clarification on the use of PDH also covers PDH that was developed and approved prior to the use of ED - 80/DO - 254 in civil certification.

This section provides guidance on the use of ED - 80/DO - 254 Section 11.1 for PDH.

Objective CD - 12 When an applicant proposes to reuse PDH, the applicant should use ED - 80/DO - 254 Section 11.1 and its subordinate paragraphs. The applicant should perform the assessments and analyses required in Powered by EASA eRules Page 504 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) ED - 80/DO - 254 Section 11.1 in order to ensure that using the PD H is valid and that the compliance shown during the previous approval was not compromised by any of the following: 1. Modification of the PDH for the new application or for obsolescence management; 2. Change to the function, change to its use, or change to a higher failure condition classification of the PDH in the new application; or 3. Change to the design environment of the PDH.

The results should be documented in the PHAC or any other appropriate planning document.

In the context of custom device develo pment, any one of these three points potentially invalidates the original development assurance credit for the PDH. In case of change or modification, the applicant should assess these changes using ED - 80/DO - 254 Section 11.1 and its subordinate paragraphs. When the original design assurance of the PDH is invalidated by one of the above points, the custom device should be upgraded based on the assessment per ED - 80/DO - 254 Section 11.1. When upgrading the hardware, the applicant should consider the objectives of this document that are applicable per the assessment.

5.10 Clarifications to ED - 80/DO - 254 Appendix A This section clarifies the life - cycle data referenced in ED - 80/DO - 254 Appendix A as follows.

— The row corresponding to 10.1.6 ‘Hardware Process Assurance Plan’ in Table A - 1 should also indicate HC2 for Level C to be consistent with row 10.8.

— The row corresponding to 10.2.2 ‘Hardware Design Standard’ in Table A - 1 should also indicate HC2 for Level C. HDL Coding Standards are part of the Hardware Design Standards.

— The row corresponding to 10.3.2.2 ‘Detailed Design Data’ in Table A - 1 should indicate HC1 for Levels A, B and C.

— The row corresponding to 10.4.2 ‘Hardware Review and Analysis Procedures’ in Table A - 1 should also indicate HC2 for Level C to be consistent with row 10.4.3.

— The Top - Level Drawing referenced in ED - 80/DO - 254 Appendix A corresponds to a Hardware Configuration Index (HCI) document. The HCI document completely identifies the hardware configuration, the embedded logic, and the development life - cycle data. To support consistent and accurate replication of the custom device (ED - 80/DO - 254 Section 7.1), the Top - Level Drawing includes the hardware life cycle environment or refers to a Hardware Environment Configuration Index (HECI) d ocument.

5.11 Use of COTS IP in Custom Device Development This section addresses COTS IP that is instantiated within FPGAs/PLDs/ASICs during the development of the custom device.

This section addresses COTS IP and its integration within custom devices and describes objectives to support the demonstration of compliance with the applicable airworthiness regulations for the hardware aspects of airborne systems and equipment certification.

Section 5.11.2, on ‘Applicability to COTS IP’, identifies COTS IP that a re within the scope of Section 5.11.

5.11.1 Background IP refers to design functions (design modules or functional blocks, including IP libraries) used to design and implement a part of or a complete custom device such as a PLD, FPGA, or ASIC. IP is consid ered to be commercial off - the - shelf intellectual property, i.e. ‘COTS IP’, when it is a commercially available Powered by EASA eRules Page 505 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) function, used by a number of different users, in a variety of applications and installations. Custom IP, developed for a few specific aircraft e quipment, is not considered to be COTS IP.

COTS IP are available in various source formats. COTS IP are categorised as Soft IP, Firm IP, or Hard IP based on the stage in the custom device design flow where the IP is instantiated. A function can be a combin ation of source formats and each part needs to be addressed. Definitions for Soft IP, Firm IP, and Hard IP can be found in Appendix A ‘Glossary’.

Figure 1 shows a ‘simplified’ design flow of a PLD, FPGA, or ASIC, and where Soft IP, Firm IP, and Hard IP are located in the design flow.

Figure 1 — Position of COTS IP within a ‘simplified’ design representation flow The availability of a COTS IP does not guarantee that it is suitable to be used in a custom device for aircraft systems. Some COTS IP may have be en developed using ED - 80/DO - 254, and will therefore have the necessary life - cycle data to demonstrate satisfaction of ED - 80/DO - 254. However, most COTS IP are not developed to meet aviation development assurance standards and, therefore, there are risks ass ociated with their use in a custom device for aircraft systems or equipment.

The risks of using COTS IP may include: — Incomplete or missing documentation/data regarding: — the behavioural operation of the COTS IP, — how to integrate it into the design; — Insufficient verification performed by the COTS IP provider; — Deficient quality of the COTS IP.

The potential for design errors may be increased by the lack of development assurance and/or by insufficient service experience.

Possible design erro rs within COTS IP or in the use of COTS IP may lead to a failure mode. Risk factors for these types of errors include: — Unknown level of rigour of the COTS IP design and verification process; — Misalignment between the intended usage of the COTS IP by the IP provider and the usage in the custom device by the IP user; — Incomplete or missing details regarding the detailed operation of the COTS IP; — Incorrect integration of the COTS IP with the rest of the custom device design; — Integrator lacking expertis e with the function of the IP.

Additionally, the COTS IP user completes the development of the integrated COTS IP up to the physical implementation of the device. The COTS IP user may introduce a design error while completing the physical implementation of the COTS IP because of the user’s incomplete knowledge of the internal design of the COTS IP.

Powered by EASA eRules Page 506 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) 5.11.2 Applicability to COTS IP Section 5.11 is applicable to COTS IP used in a custom device that meets the definition of ‘commercial off - the - shelf intellectual property’ in the Glossary of Appendix A. This scope encompasses digital, analogue, and mixed - signal COTS IP.

Note: Analogue COTS IP is within the above - mentioned scope, as it could be instantiated within a custom, mixed - signal device.

Section 5.11 is appl icable to COTS IP contributing to hardware DAL A, B or C functions.

Section 5.11 is applicable to Soft IP, Firm IP, and Hard IP that are inserted within a custom device by the applicant. However, Section 5.11 does not apply to Hard IP that is embedded in t he silicon of an FPGA or a PLD by the FPGA/PLD device manufacturer. This type of IP is considered to be part of the COTS device, and is covered in Section 6 ‘Use of Commercial Off - the - Shelf Devices.

5.11.3 Development Assurance for COTS IP A COTS IP develo pment assurance approach should be based on the category of the COTS IP (Soft, Firm, Hard) and on the identified risks of failure due to a design error in the COTS IP itself or an error in the way it is used in the custom device.

This section provides obje ctives addressing development assurance when using COTS IP. These objectives are intended to cover the particular aspects of development when using COTS IP, and are expressed in connection with the custom device development process that follows ED - 80/DO - 25 4 and the custom device objectives of this document.

The development aspects related to COTS IP start from the custom device process that captures the allocated requirements for the function that will be performed by the COTS IP. From this entry point, the following aspects provide a basis to define the development assurance objectives for the use of COTS IP: — Selection of the COTS IP, — Assessment of the IP provider and the IP data, — Planning activities, including the verification strategy, — Definition of the requirements/derived requirements, — Design integration, implementation, and verification of the COTS IP in the custom device.

5.11.3.1 Selection of the COTS IP to implement the function COTS IP can be available in different forms/source formats and various levels of quality. Some COTS IP may not be acceptable for use in airborne systems. The selection criteria below are intended to address the essential characteristics that are considered a minimum for the use of IP in custom AEH devices.

Objective IP - 1 The applicant should select a COTS IP that is considered to be an acceptable solution, based on at least the following criteria: 1. The IP is technically suitable for implementing the intended function; 2. The description of th e COTS IP architecture or IP design concept provides an understanding of the functionality, modes, and configuration of the IP. The description should also include an understanding of the source format or combination of source formats of the COTS IP; Powered by EASA eRules Page 507 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) 3. Th e availability and quality of data and documentation allow the understanding of all aspects of the COTS IP functions, modes, and behaviour, and enable the integration and verification of the COTS IP (e.g. datasheets, application notes, user guide, knowledg e of errata, etc.); 4. Information exists for the IP user to be able to create the physical implementation of the COTS IP (e.g. synthesis constraints, usage and performance limits, physical implementation, and routing instructions); 5. It can be demonstrat ed that the COTS IP fulfils its intended function.

5.11.3.2 Assessment of the COTS IP Provider and COTS IP Data Objective IP - 2 The applicant should assess the COTS IP provider and the associated data of the COTS IP based on at least the following criteria: 1. The IP provider provides all the information necessary for the integration of the COTS IP within the custom device and to support the implementation of the COTS IP within the device (e.g.

synthesis constraints, usage domain, performance limits, physic al implementation, and routing instructions); 2. The configurations, selectable options, and scalable modules of the COTS IP design are documented so that the implementation of the COTS IP can be properly managed; 3. The COTS IP has been verified by follow ing a trustworthy and reliable process, and the verification covers the applicant’s specific use case for the COTS IP (including the used scale for scalable IP and the IP functions selected for selectable functions); 4. The known errors and limitations are available to the IP user, and there is a process to provide updated information to the IP user; 5. The COTS IP has service experience data that shows reliable operation for the applicant’s specific use case for the COTS IP.

The assessment should be docume nted. The results of the assessment should be submitted together with the planning documents.

5.11.3.3 Planning of the Hardware Development Assurance Approach related to COTS IP 5.11.3.3.1 Complementary Development Assurance Objective IP - 3 When the IP - 2 Ob jective criteria items 1, 2, 4 or 5 cannot be completely met using the IP provider’s data, the applicant should define an appropriate development assurance activity to mitigate the criteria that were not met and address the associated risk of development e rrors. The development assurance activity should be based on the ED - 80/DO - 254 objectives.

Note: The results of the assessment of Objective IP - 2 Item 3 are considered in Section 5.11.3.3.2.

5.11.3.3.2 The Verification Strategy for COTS IP Functions In addition to the verification of the custom device functions supported by the COTS IP, there is a need to ensure that the aspects related to the COTS IP and its usage are addressed. This section focuses on defining a verification strategy to cover those asp ects.

The verification performed by the COTS IP provider typically does not follow the ED - 80/DO - 254 verification process but may provide some credit to be used for the verification strategy. However, the verification process for COTS IP generally differs from one IP vendor to another, and the level of assurance varies depending on the IP provider’s development practices.

Powered by EASA eRules Page 508 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) The verification strategy may combine different means to complement the traditional requirements - based testing approach.

Based on the applicant’s assessment of the IP provider and the IP data through Objective IP - 2, the applicant is expected to establish a verification strategy. The aim of this verification strategy is to cover all three of the following aspects: — The COTS IP: the purpose is to ensure that the COTS IP is verified, addressing the risk identified fr om the IP - 2 Item 3 objective; — Its implementation: the purpose is to ensure that the COTS IP still performs its allocated function, and that no design errors have been int roduced by the design steps performed by the applicant (e.g. synthesis/place and route); — Its integration within the custom device: the purpose is to ensure that the COTS IP has been properly connected, configured, and constr ained within the custom device .

The strategy may accomplish more than one aspect within a common verification step.

This section identifies a general objective for the verification of COTS IP used in a custom device, enabling various verification approaches.

Objective IP - 4 The applican t should describe in the hardware verification plan, PHAC, or any related planning document, a verification strategy that should encompass all three of the following aspects: 1. The verification of the COTS IP itself, addressing the risk identified from th e IP - 2 Item 3 objective; 2. The verification of the COTS IP after the design steps performed by the applicant (e.g.

synthesis/place and route); 3. The verification of the integrated COTS IP functions within the custom device.

Note 1: Reliable and trustwort hy test data, test cases or procedures from the COTS IP provider may be used as part of the verification strategy to satisfy this objective.

Note 2: If the COTS IP implements functions based on an industry standard, proven standardised test vectors verifyi ng compliance with the standard may be used in the verification strategy of the COTS IP.

Note 3: The verification strategy covers at a minimum the used functions of the COTS IP and ensures that the unused functions are correctly disabled or deactivated and do not interfere with the used functions.

5.11.3.3.3 COTS IP and Planning Aspects The applicant has to define the activities that are needed for the hardware development assurance approach related to COTS IP.

Objective IP - 5 The applicant should describe i n the PHAC, or any related planning document, a hardware development assurance approach for using the COTS IP that at least includes: 1. identification of the selected COTS IP (version) and its source format(s) associated with the point(s) in the design flow where the COTS IP is integrated into the custom device; 2. a summary of the COTS IP functions; 3. the development assurance process that the applicant defines to satisfy the objectives of Section 5.11.3; Powered by EASA eRules Page 509 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) 4. the process related to the design int egration and to the usage of the COTS IP in the development process of the custom device; 5. tool assessment and qualification aspects when the applicant uses a tool to perform design and/or verification steps for the COTS IP.

5.11.3.4 Requirements for COT S IP Function and Validation Custom device requirements typically contain requirements that relate to the function supported by the COTS IP. The granularity of these requirements may be very different depending on the COTS IP function and the visibility of the functions supported by the IP at the custom device level.

Depending on the extent of requirements - based testing as a part of the chosen verification strategy of the COTS IP, the level of detail and the granularity of the AEH custom device requirements may need to be refined to specifically address the COTS IP functions and the implementation of the COTS IP.

In addition, requirements should be captured to encompass all the necessary design detail used to connect, configure, and constrain the COTS IP and properly integrate it into the AEH custom device.

Objective IP - 6 The requirements related to the allocated COTS IP functions should be captured to an extent commensurate with the verification strategy.

In addition, derived requirements should be captured to cover the following aspects associated with the integration of the COTS IP into the custom device design: 1. COTS IP used functions (including parameters, configuration, selectable aspects); 2. Deactivation or disabling of unused functions; 3. Correct control and use of the COTS IP, in accordance with the data from the COTS IP provider.

When the applicant chooses a verification strategy (see Section 5.11.3.3.2) that solely relies on requirements - based testing, the ‘extent commensurate with the v erification strategy’ corresponds to a complete requirement capture of the COTS IP following ED - 80/DO - 254.

Regarding the validation aspects, the COTS IP requirements should be validated as a part of the validation process of the AEH custom device.

5.11.3.5 Verification The applicant should ensure that the COTS IP is verified as a part of the overall custom device verification process per ED - 80/DO - 254 and based on the verification strategy for the COTS IP that has been described in the PHAC or a related plan ning document.

For the requirements - based verification part, the applicant should satisfy ED - 80/DO - 254 Section 6.2 for the verification of the requirements related to the COTS IP (see Section 5.11.3.4 above). This can be performed as a part of the overall custom device process, therefore there is no separate objective.

5.11.3.6 DO - 254 Appendix B considerations When developing a hardware DAL A or B custom device, ED - 80/DO - 254 Appendix B is applicable.

Code coverage analysis that is recognised as part of elem ental analysis (refer to Section 5.7 of this document) might not be possible for the COTS IP part of the design. However, ED - 80/DO - 254 Appendix B offers other acceptable methods, including safety - specific analysis. The following objective further clarifies the expectations when using safety - specific analysis.

Powered by EASA eRules Page 510 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) Objective IP - 7 For COTS IP used in DAL A or DAL B hardware, the applicant should satisfy ED - 80/DO - 254 Appendix B.

The applicant may choose safety - specific analysis methods to satisfy Appendix B on the COTS IP function and its integration within the custom device functions. This safety - specific analysis should identify the safety - sensitive portions of the COTS IP and the potential for design errors in the COTS IP that could affect the hardware DAL A and DAL B functions in the custom device or system.

For unmitigated aspects of the safety - sensitive portions of the IP, the safety - specific analysis should determine which additional requirements, design features, and verification activities are required f or the safe operation of the COTS IP in the custom device.

Any additional requirements, design features and/or verification activities that result from the analysis should be fed back to the appropriate process.

6. USE OF COMMERCIAL OFF - THE - SHELF DEVICES A pplicants are increasingly using COTS electronic devices in aircraft/engines/propellers/ airborne systems, which may have safety implications for the aircraft, engines/propellers, or systems.

Section 6 addresses the use of COTS devices through objectives t hat support the demonstration of compliance with the applicable airworthiness regulations for hardware aspects of airborne systems and equipment certification when using complex COTS devices. Section 6.2 ‘Applicability to COTS devices’ enables applicants t o identify the COTS devices that are within the scope of Section 6.

Note: The term ‘COTS device’ used in this document applies to a semiconductor product that is fully encapsulated in a package. This term does not apply to circuit board assemblies (CBAs).

6.1 Background COTS devices continue to increase in complexity and are highly configurable. COTS devices provide ‘off - the - shelf’ already developed functions, some of which are highly complex. Their development and production processes undergo a semiconduct or industry qualification based on their intended market (consumer, automotive, telecom, etc.). Their usage by the aerospace industry provides additional integration and higher performance capabilities than were possible in the past.

The design data for th ese COTS devices is usually not available to the COTS user. Since these devices are generally not developed for airborne system purposes, assurance has not been demonstrated that the rigour of a COTS manufacturer’s development process is commensurate with the aviation safety risks.

ED - 80/DO - 254 introduces a basis for the development assurance for the use of COTS devices in Section 11.2 ‘COTS components usage’. This section states that ‘the use of COTS components will be verified through the overall design p rocess, including the supporting processes’.

Since ED - 80/DO - 254 was released in the year 2000, the number of functions embedded and integrated in a single COTS device has significantly increased. Functions which were previously split into various component s, making the interface between those components accessible for verification, are now embedded within a single chip. While there are clearly some benefits of integrating more functions within a device, the increased level of integration makes it difficult for the user to verify the different hardware functions in the device due to lack of access to the interfaces between functions. Since these devices are more complex and highly configurable than the older separate devices, the risk is greater that the COTS device will not achieve the intended function in particular use cases over the required operating conditions.

Powered by EASA eRules Page 511 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) Furthermore, some additional assurance is needed because design errors may still be discovered after the COTS device is released to the market, or when an applicant extends the use of the device beyond the manufacturer’s specifications.

6.2 Applicability to COTS Devices Section 6 is applicable to digital, hybrid, and mixed - signal COTS devices that contribute to hardware DAL A, B or C funct ions. For COTS devices contributing to hardware DAL C functions, a limited set of the objectives of this section will apply.

Section 6 is also applicable to FPGA and PLD devices that embed Hard IP (see definition) in their produced/manufactured silicon, bu t only for the COTS part of the FPGAs/PLDs.

Section 6.4 only applies to COTS devices that are complex, as determined by the following COTS complexity assessment.

6.3 COTS Complexity Assessment In order to define which COTS devices are complex, the followin g high - level criteria should be used, considering all functions of the device, including any functions intended to be unused: A COTS device is complex when the device: 1. has multiple functional elements that can interact with each other; and 2. offers a s ignificant number of functional modes; and 3. offers configurability of the functions, allowing different data/signal flows and different resource sharing within the device.

Or when the device: 4. contains advanced data processing, advanced switching, or m ultiple processing elements (e.g.

multicore processors, graphics processing, networking, complex bus switching, interconnect fabrics with multiple masters, etc.).

For complex COTS devices, it is impractical to completely verify all possible configurations of the device, and it is difficult to identify all potential failures.

Objective COTS - 1 The applicant should assess the complexity of the COTS devices used in the design according to the high - level criteria of Section 6.3, and document the list of relevant devices (see Note 1), including the classification rationale, in the PHAC or any related hardware planning document.

Note 1: The applicant is not expected to assess the complete bill of material to satisfy the above objective, but only those devic es that are relevant for the classification, including devices that are at the boundary between simple and complex. The resulting classification (simple or complex) for those devices that are at the boundary and those that are definitely complex should be documented.

Note 2: A classification rationale is required for those devices that are at the boundary (meeting a part of the high - level criteria) and are classified as simple.

Some examples of classification are provided in the GM Appendix for illustration .

6.4 Development Assurance for Use of Complex COTS ED - 80/DO - 254 Section 11.2.1 identifies some electronic component management process (ECMP) items when using a COTS device. ED - 80/DO - 254 Section 11.2.2 and Section 6.1 of this document identify some concer ns with using a COTS device. The following objectives acknowledge and Powered by EASA eRules Page 512 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) supplement ED - 80/DO - 254 Section 11.2 in clarifying how to gain certification credit when using complex COTS devices.

6.4.1 Electronic Component Management Process (ECMP) As stated in ED - 80/DO - 254 Section 11.2, ‘the use of an electronic component management process, in conjunction with the design process, provides the basis for COTS components usage.’ Objective COTS - 2 The applicant should ensure that an electronic component management process (ECMP) exists to address the selection, qualification, and configuration management of COTS devices. The ECMP should also address the access to component data such as the user manual, the datasheet, errata, installation manual, and acces s to information on changes made by the component manufacturer.

As part of the ECMP, for devices contributing to hardware DAL A or B functions, the process for selecting a complex COTS device should consider the maturity of the COTS device and, where risks are identified, they should be appropriately mitigated.

Note: Recognised industry standards describing the principles of electronic component management may be used to support the development of the ECMP. See Appendix B.

6.4.1.1 Using a Device outside Ran ges of Values Specified in its Datasheet The device reliability is established by the device manufacturer through the device qualification process (see definition of ‘qualification of a device’ in the glossary). ED - 80/DO254 Section 11.2.1 Item 6 mentions t hat a device is selected based on the technical suitability of the device for the intended application.

In some cases, the applicant may need to use the device outside the specified operating conditions guaranteed by the device manufacturer. ED - 80/DO - 254 S ection 11.2.1 Item 4 and Item 6 should be addressed when the device is used outside its guaranteed specification. The following objective describes what to achieve when using a device outside the ranges of values specified in its datasheet.

Objective COTS - 3 When the complex COTS device is used outside the limits of the device manufacturer’s specification (such as the recommended operating limits), the applicant should establish the reliability and the technical suitability of the device in the intended appl ication.

6.4.1.2 Considerations when the COTS Device has Embedded Microcode COTS devices may need microcode to execute some hardware functions. When those functions are used by the applicant, there is a risk if the microcode has not been verified by the de vice manufacturer during the COTS device qualification, or if the microcode is proposed to be modified by the applicant.

If the microcode is delivered by the device manufacturer, is controlled by the device manufacturer’s configuration management system, a nd is qualified together with the device by the device manufacturer, it is accepted that the microcode is part of the qualified COTS device. If the microcode is not qualified by the device manufacturer or if it is modified by the applicant, the microcode c annot be considered to be part of the qualified COTS device.

Objective COTS - 4 If the microcode is not qualified by the device manufacturer or if it is modified by the applicant, the applicant should ensure that a means of compliance for this microcode inte grated within the COTS device is proposed by the appropriate process, and is commensurate with the usage of the COTS device.

Note: The PHAC (or any other related planning document) should document the existence of the microcode and refer to the process (ha rdware, software, system) where it is addressed.

Powered by EASA eRules Page 513 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) 6.4.2 COTS Device Malfunctions Some COTS devices may contain errors that may or may not have been detected by the device manufacturer.

Objective COTS - 5 The applicant should assess the errata of the COTS device that are relevant to the use of the device in the intended application, and identify and verify the means of mitigation for those errata. If the mitigation means is not implemented in hardware, the mitigation means should be fed back to and verified by the appropriate process.

Note: The above objective refers to any mitigation means (such as hardware, software, system, or other means).

Objective COTS - 6 The applicant should identify the failure modes of the used functions of the device and the possibl e associated common modes, and feed both of these back to the system safety assessment process.

6.4.3 Usage of COTS Devices This section focuses on the usage of complex COTS devices, while Section 7 covers the overall circuit board assembly development pro cess. This Section 6.4.3 refers to the term ’intended function of the hardware’, which is considered to be defined through the CBA development process.

Complex COTS devices can have multiple functions and many configurations of those functions. The configu ration of a device should be managed in order to provide the ability to consistently apply the required configuration settings, to replicate the configuration on another item, and to modify the configuration in a controlled manner, when modification is nec essary.

The configuration of the device addresses at least the following topics: — Used functions (e.g. identification of each function, configuration characteristics, modes of operation), — Unused functions and the means (internal/external) used to deacti vate them, — Means to control any inadvertent activation of the unused functions, or inadvertent deactivation of the used functions, — Means to manage device resets, — Power - on configuration, — Clocking configuration (e.g. identification of the different clock domains), and — Operating conditions (e.g. clock frequency, power supply level, temperature, etc.).

Objective COTS - 7 The applicant should ensure that the usage of the COTS device has been defined and verified according to the intended funct ion of the hardware. This also includes the hardware – software interface and the hardware to (other) hardware interface.

When a COTS device is used in a hardware DAL A or B function, the applicant should show that unused functions of the COTS device do not compromise the integrity and availability of the COTS device’s used functions.

Note 1: For unused functions of the COTS device, it is recommended that an effective deactivation means is used and verified, when available.

Powered by EASA eRules Page 514 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) Note 2: Verification should be perf ormed at an appropriate level (hardware, software, equipment).

ED - 80/DO - 254 Section 10.3.2.2.4 introduces hardware/software (HW/SW) interface data, which can be used as a reference to define the software interface data of the COTS device.

Some additional c onsideration should be given to the critical configuration settings. Those are defined as the settings that are deemed necessary by the applicant for the proper usage of the hardware, which, if inadvertently altered, could change the behaviour of the COTS device, causing it to no longer fulfil the hardware intended function.

Objective COTS - 8 If the complex COTS device contributes to DAL A or B functions, the applicant should develop and verify a means that ensures an appropriate mitigation is specified in the event of any inadvertent alteration of the ‘critical configuration settings’ of the COTS device.

Note: The mitigation means might be defined at the hardware, software, or system level, or a combination of these. The mitigation means may al so be defined by the safety assessment process.

7 Development Assurance of Circuit Board Assemblies (CBAs) This section provides guidance for the development assurance of CBAs (a board or a collection of boards).

7.1 Applicability Section 7 is applicable t o CBAs that contribute to hardware DAL A, B or C functions.

7.2 Development Assurance of Circuit Board Assemblies (CBAs) While it is already a common practice for applicants to have an internal process to address the development of CBAs, it is necessary to clarify the expectations for development assurance, including the flow - down of the equipment/system requirements to the hardware. For consolidation of the development and/or the use of complex devices, it is essential to ensure consistency in the overall development assurance approach for the hardware domain. Moreover, definition of the CBA function is also necessary to enable the allocation of requirements and their flow - down to the complex devices.

Objective CBA - 1 The applicant should have a process to address the development of CBAs that contain complex custom devices or complex COTS devices, in order to ensure that the CBA performs its intended function. The process should include requirements capture, validation, verification, and configura tion management activities, and ensure an appropriate flow - down of requirements. See Appendix B for additional information.

Note: The applicant’s process to address the development of the CBA may be defined together with the equipment process, when relevan t.

8 RELATED REGULATORY, ADVISORY AND INDUSTRY MATERIAL (a) Related EASA Certification Specifications (CSs) (1) CS - 23, Certification Specifications and Acceptable Means of Compliance for Normal, Utility, Aerobatic, and Commuter Category Aeroplanes (2) CS - 2 5, Certification Specifications and Acceptable Means of Compliance for Large Aeroplanes (3) CS - 27, Certification Specifications and Acceptable Means of Compliance for Small Rotorcraft Powered by EASA eRules Page 515 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) (4) CS - 29, Certification Specifications and Acceptable Means of Complian ce for Large Rotorcraft (5) CS - E, Certification Specifications and Acceptable Means of Compliance for Engines , and AMC 20 - 3B , Certification of Engines Equipped with Electronic Eng ine Control Systems (6) CS - P, Certification Specifications for Propellers , and AMC 20 - 1A , Certification of Aircraft Propulsion Systems Equipped with Electronic Control Systems (7) CS - ETSO, Certification Specifications for European Technical Standard Orders (8) CS - APU, Certification Specifications for Auxilia ry Power Units ; and AMC 20 - 2B , Certification of Essential APU Equipped with Electronic Controls (b) FAA Advisory Circulars (ACs) (1) AC 20 - 152, Development Assurance for Airborne E lectronic Hardware (2) AC 00 - 72, Best Practices for Airborne Electronic Hardware Design Assurance Using EUROCAE ED - 80( ) and RTCA DO - 254( ) (3) AC 23.1309 - 1, System Safety Analysis and A ssessment for Part 23 Airplanes (4) AC 25.1309 - 1, System Design and Analysis (5) AC 27 - 1309, Equipment, Systems, and Installations (included in AC 27 - 1, Certification of Normal Category Rotorcraft) (6) AC 29 - 1309, Equipment, Systems, and Installations (included in AC 29 - 2, Certification of Transport Category Rotorcraft) (c ) Industry Documents (1) EUROCAE ED - 79A, Guidelines for Development of Civil Aircraft and Systems , dated December 2010 (2) EUROCAE ED - 80, Design Assurance Guidance for Airborne Electronic Hardware , dated April 2000 (3) RTCA DO - 254, Design Assurance Guidanc e for Airborne Electronic Hardware , dated 19 April 2000 (4) SAE International Aerospace Recommended Practice (ARP) 4754A, Guidelines for Development of Civil Aircraft and Systems , dated 21 December 2010 (5) SAE International Aerospace Recommended Practice (ARP) 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment , dated December 1996 9 AVAILABILITY OF DOCUMENTS (a) EASA Certification Specifications (CSs) and Acceptable Means of Compliance (AMC) ma y be downloaded from the E ASA website: www.easa.europa.eu (b) FAA Advisory Circulars (ACs) may be downloaded from the FAA website: www.faa.gov (c) EUROCAE documents may be purchased from: European Organisati on for Civil Aviation Equipment 102 rue Etienn e Dolet, 92240 Malakoff, France Telephone: +33 1 40 9 2 79 30, Fax: +33 1 46 55 62 65 (Email: eurocae@eurocae.net, website: www.eurocae.net ) Powered by EASA eRules Page 516 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 152A Products, Parts and Appliances (AMC - 20) (d) RTCA documents may b e purchased from: RTCA, Inc.

1150 18th Street NW, Suit e 910, Washington DC 20036, USA (Email: info@rtca.org, website: www.rtca.org ) [Amdt 20/19] Powered by EASA eRules Page 517 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20)

AMC 20 - 158A

AMC 20 - 158A Aircraft electrical and electronic system high -

intensity radiated fields (HIRF) protection

ED Decision 2022/001/R 1. PURPOSE a. This AMC describes an acceptable means, but not the only means, for demonstrating compliance with the applicable certification specifications (CSs) related to h igh - i ntensity r adiated f ield s (HIRF) p rotection (CS 23.1308, 25.1317, 27.1317, and 29.1317).

Com pliance with this AMC is not mandatory, and an applicant may elect to use an alternative means of compliance. However, the alternative means of compliance must meet the relevant requirements, ensure an equivalent level of safety, and be approved by EASA on a product or ETSO article basis.

b. The modal verb ‘must’ is used to indicate which means are necessary to demonstrate compliance with the applicable CSs by using this AMC. The modal verb ‘should’ is used when following the AMC to indicate that an action is recommended but is not necessary to demonstrate compliance with the applicable CS s when using this AMC.

2. SCOPE AND APPLICABILITY This AMC provides possible means to demonstrate compliance with CS 23.1308/23.2520, 25.1317, 27.1317, and 29.1317 for the effects of HIRF s . This AMC may be used by applicants for a new type certificate (TC) or a change to an existing TC when the certification basis requires to address the above - mentioned CS s.

Note : For CS - 23 Amendment 5 and higher, a new HIRF specification, i .e. CS 23.2520, which differs from the previous CS 23.1308, is included. The associated AMC t o CS 23.2520 are published separately in the AMC & GM to CS - 23, based on ASTM F3061 / F3061M - 17 and F3236 - 17. This AMC could nevertheless be used as guidance for d emonstrating compliance with CS 23.2520.

3. DOCUMENT HISTORY This AMC supersedes AMC 20 - 158 , Aircraft Electrical and Electronic System High - Intensity Radiated Fields (HIRF) Protection , dated 15 Ju ly 2015.

4. RELATED MATERIAL a. European Union Aviation Safety Agency (EASA) (in this document also referred to as ‘ the Agency’) Certification Specifications: 1. CS 23.1308, CS 25.1317, CS 27.1317, and CS 29.1317, High - intensity Radiated Fields (HIRF) P rot ection ; 2. CS 23.1309, CS 25.1309, CS 27.1309, and CS 29.1309, Equipment, systems, and installations ; and 3. CS 23.1529, CS 25.1529, CS 27.1529, and CS 29.1529, Instructions for Continued Airworthiness .

EASA Certification Specifications (CSs) and Acceptabl e Means of Compliance (AMC) may be downloaded from the EASA website at www.easa.europa.eu .

Powered by EASA eRules Page 518 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) b. FAA Advisory Circulars (ACs) 1. AC 23.1309 - 1E, System Safety Analysis and Assessment f or Part 23 Airplanes ; 2. AC 25.1309 - 1A, System Design and Analysis ; 3. AC - 27 - 1B, Certification of Normal Category Rotorcraft ; 4. AC - 29 - 2C, Certification of Transport Category Rotorcraft, or later revisions ; 5. AC 20 - 158A, The Certification of Aircraft Electrical and Electronic Systems for Operation in the High - Intensity Radiated Fields (HIRF) Environment .

Applicants can view and download copies from the web - based FAA Regulatory and Guidance Library (RGL) at www.airweb.faa.gov . On the RGL website, the applicant should select ‘Advisory Circular’, then select ‘By Number’. ACs are also available on the FAA website at http://www.faa.gov/regulations_policies/advisory_circulars/ .

c. European Organisation for Civil Aviation Equipment (EUROCAE) Copies of these documents can be requested from EUROCAE, 102 rue Etienne Dolet, 92240 Malakoff, France; Telephone: +33 1 40 92 79 30; Fax: +33 1 46 55 62 65; Website: http://www.eurocae.net .

1. EUROCAE ED - 107A, Guide to c ertification of Aircraft in a High Intensity Radiated Field (HIRF) Environment ; 2. EUROCAE ED - 14G, Environmental Conditions and Test Procedures for Airborne Equipment ; 3. EUROCAE ED - 79A, Guidelines for Development of Civil Aircraft and Systems ; 4. EUROCAE ED - 234, User Guide Supplement to EUROCAE ED - 14G .

EUROCAE documents may be purchased from: European Organisation for Civil Aviation Equipment 9 - 23 rue Paul Lafargue "Le Triangle" building 93200 Saint - D enis, France Telephone: +33 1 49 46 19 65 (Email: eurocae@eurocae.net , website: www.eurocae.net d. Radio Tec hnical Commission for Aeronautics (RTCA) RTCA/DO - 160G , Environmental Conditions and Test Procedures for Airborne Equipment .

This document is technically equivalent to EUROCAE ED - 14G.

RTCA documents may be purchased from: RTCA, Inc. , 1150 18th Street NW, Su ite 910, Washington D . C . 20036, USA (Email: info@rtca.org , website: www.rtca.org Powered by EASA eRules Page 519 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) e. Society of Automotive Engineers (SAE International) 1. SAE Aerospace Recommended Practice (ARP) 5583A, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment . SAE ARP 5583A and ED - 107A are technically equivalent and either document may serve as the ‘User’s Guide’ referred to in this AMC.

2. SAE ARP 4754A, Guidelines For Development Of Civil Aircraft And Systems , dated December 2010. This document is technically equivalent to EUROCAE ED - 79A.

3. SAE ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment , dated December 1996.

SAE International documents may be purchased from: SAE Customer Service 400 Commonwealth Drive Warrendale, PA 15096 - 0001, USA Website: http://www.sae.org 5. BACKGROUND a. Aircraft protection. The need for the protection of aircraft electrical and electronic systems has increased substantially in recent years for the follow ing reasons: 1. g reater dependence on electrical and electronic systems performing functions required for continued safe flight and landing of an aircraft; 2. t he reduced electromagnetic shielding afforded by some composite materials used in aircraft designs; 3. t he increased susceptibility of electrical and electronic systems to HIRF because of increased data bus and processor operating speeds, higher - density integrated circuits and cards, and greater sensitivities of electronic equipment; 4. e xpanded frequency usage, especially above 1 gigahertz (GHz) 5. t he increased severity of the HIRF environment because of an increase in the number and radiated power of radio frequency (RF) transmitters; and 6. t he adverse effects experienced by some air craft when exposed to HIRF.

b. HIRF environment. The electromagnetic HIRF environment exists because of the transmission of electromagnetic RF energy from radar, radio, television, and other ground - based, shipborne, or airborne RF transmitters. The User ’ s Guide (SAE ARP 5583A / EUROCAE ED - 107A) provides a detailed description of the derivation of these HIRF environments.

6. APPROACHES TO COMPLIANCE a. General. The following activities should be elements of a proper HIRF certification programme. Adherence to the sequence shown is not necessary. More detailed information on HIRF certification compliance is provided in the User ’s Guide (ED - 107A).

Powered by EASA eRules Page 520 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) The applicant should: 1. identify the systems to be assessed ; 2. establish the applicable aircraft external HIRF environment ; 3. establish the test environment for installed systems ; 4. apply the appropriate method of HIRF compliance verification ; 5. verify the effectiveness of the HIRF protection ; and 6. take corrective measures (if needed).

More detailed informatio n on these activities is proposed in Section s 7 and 8 of this AMC.

b. Identify the systems to be assessed 1. General. The applicant should identify the aircraft systems requiring a HIRF safety assessment.

The applicant should define the elements of the system performing a function, considering similar and/or dissimilar redundant channels that make up the system. The process used for identifying these systems should be similar to the process for demonstrating compliance with CS 23.1309, 25.1309, 27.1309, and 29.1309, as applicable. These paragraphs address any system failure that may cause or contribute to an effect on the safety of flight of an aircraft. The effects of a HIRF encounter should be assessed to determine the degree to which the safety of the aircraft and its systems may be affected.

The operation of the aircraft systems should be assessed separately and in combination with, or in relation to, other systems. This assessment should cover: (a) all normal aircraft operating modes, phases of flight, and operating conditions; (b) all HIRF - related failure conditions and their subsequent effects on aircraft operations and the flight crew; and (c) any corrective actions required by the flight crew during or after the occurrence of a HIRF - related f ailure.

2. HIRF safety assessment. A safety assessment related to HIRF must be performed to establish and classify the equipment or system failure condition. Table 1 provides the corresponding failure condition classification and system HIRF certification level (HCL) for the appropriate HIRF requirements . The failure condition classifications and terms used in this AMC are similar to those used in AC 23.1309 - 1E, AMC 25.1309, AC - 27 - 1B, and AC - 29 - 2C, as applicable. Only those systems identified as performing or contributing to functions whose failure would result in catastrophic, hazardous, or major failure conditions are subject to HIRF requirements . Based on the safety classification of the failure condition classification by the safety assessment, the syste ms should be assigned appropriate HCLs, as shown in Table 1. The HIRF safety assessment should consider the common - cause effects of HIRF, particularly for highly integrated systems and systems with redundant elements. The HIRF safety assessment determines the consequences of failures for the aircraft functions that are performed by the system. The system HCL classification assigned to the systems and functions can be different from the d evelopment a ssurance l evel (ED - 79A) or the d esign a ssurance l evel (ED - 8 0) assigned for equipment redundancy, software, and airborne electronic hardware (AEH). This is because HIRF is an environment that can cause common - cause effects. The term ‘ DAL ’ should not be used to describe the system HCL because of the potential differ ences in assigned classifications for software, AEH, and equipment redundancy. The HIRF safety assessment must include all electrical and electronic equipment, components and electrical interconnections, assuming that they are potentially affected by HIRF. It is not appropriate to use the HIRF immunity data for Powered by EASA eRules Page 521 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) electrical and electronic equipment, components and electrical interconnections as information input for the HIRF safety assessment. This information should only be used in the next phase, to show co mpliance with the applicable subpart of the HIRF requirements , after the required HCL for the system is defined by the HIRF safety assessment. The HIRF safety assessment must have input and be coordinated between the safety specialist, the system specialis t, and the HIRF/ l ightning specialist. This process may vary from applicant to applicant. Further guidance on performing the safety assessment can be found in AC 23.1309 - 1E, AMC 25.1309, AC - 27 - 1B, AC - 29 - 2C, SAE ARP 4754A / EUROCAE ED - 79A, SAE ARP 4761, and ARP 5583A / EUROCAE ED - 107A.

N ote : Considering that HIRF and lightning environments may have similar effects on electro - electronic systems (disturbing electrical signals, causing upsets or damage to circuits), and that the applicable certification specific ations are similarly structured, in many cases the system HCL and corresponding LCL (see AMC 20 - 136A ) should be the same.

Table 1: HIRF most severe failure conditions of the function and system HIRF certification levels HIRF REQUIREMENTS EXCERPTS FROM CS 23.1308, MOST SEVERE FAILURE SYSTEM HIRF CS 25.1317, CS 27.1317, AND CS 29.1317 CONDITION OF THE CERTIFICATION LEVEL FUNCTION (HCL) (a) Each electrical and electronic system that performs a function whose failure would prevent the continued Catastrophic A safe flight and landing of the aircraft.

(b) Each electrical and electronic system that performs a function whose failure would significantly reduce the Hazardous B capability of the aircraft or the ability of the flight crew to respond to an adverse operating condition.

(c) Each electrical and electronic system that performs a function whose failure would reduce the capability Major C of the aircraft or the ability of the flight crew to respond to an adverse operating condition.

3. Level A systems. The specifications in CS 23.1308(a), 25.1317(a), 27.1317(a), and 29.1317(a) address adverse effects on the aircraft functions and systems that perform functions whose failure would prevent the continued safe flight and landing of the aircr aft. When demonstrating compliance with CS 23.1308(a), 25.1317(a), 27.1317(a), and 29.1317(a), the electrical and electronic system is the one required to perform the function whose failure would prevent continued safe flight and landing. This electrical a nd electronic system must also automatically recover normal operation of the L evel A functions in a timely manner to comply with CS 23.1308(a)(2), 25.1317(a)(2), 27.1317(a)(2), and 29.1317(a)(2). If all Powered by EASA eRules Page 522 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) equipment and components of the system required for t he normal operation of the L evel A functions are not susceptible when complying with paragraphs (a)(1), (a) (2) and (a) (3), then it is acceptable that the equipment and components required only for non - normal situations do not show compliance with the requi rements of paragraph (a). In this case, it is considered acceptable that the equipment and components of the system required only for non - normal situations show compliance at least with the requirements of paragraph (b).

4. Level B or Level C systems. The specifications in CS 23.1308(b)(c), 25.1317(b)(c), 27.1317(b)(c), and 29.1317(b)(c) address adverse effects on systems that perform functions whose failure would reduce the capability of the air craft or the ability of the flight crew to respond to an adverse operating condition when all equipment, components and electrical interconnections of the Level B or Level C system are exposed to HIRF test L evel 1 or 2, or 3 respectively .

If some of the electrical and electronic equipment of a Level A system perform Level B or Level C functions, and effects on these equipment items are noted when the system is submitted to L evel A HIRF e nvironments, these effects should b e reassessed when the system is submitted to HIRF test L evel 1 or 2, or 3 respectively .

5. Failure conditions. The HIRF safety assessment should consider all potential adverse effects due to system failures, malfunctions, or misleading information.

The HIR F safety assessment may show that some systems have different failure conditions in different phases of flight; therefore, the system HCL corresponds to the most severe failure condition. For example, an automatic flight control system may have a catastrop hic failure condition for autoland, while automatic flight control system operations in cruise may have a hazardous failure condition.

c. Establish the applicable aircraft external HIRF environment. The external HIRF E nvironments I, II, and III, as publish ed in CS 23.1308, 25.1317, 27.1317, and 29.1317 , are shown in Tables 2, 3, and 4 respectively. The field strength values for the HIRF environments and test levels are expressed in root - mean - square (rms) units measured during the peak of the modulation cycle.

Table 2 : HIRF E nvironment I FIELD STRENGTH (V/m) FREQUENCY PEAK AVERAGE 10 kHz – 2 MHz 50 50 2 – 30 MHz 100 100 30 – 100 MHz 50 50 100 – 400 MHz 100 100 400 – 700 MHz 700 50 700 MHz – 1 GHz 700 100 1 – 2 GHz 2 000 200 2 – 6 GHz 3 000 200 6 – 8 GHz 1 000 200 8 – 12 GHz 3 000 300 12 – 18 GHz 2 000 200 18 – 40 GHz 600 200 In this table, the higher field strength applies at the frequency band edges.

Powered by EASA eRules Page 523 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Table 3 : HIRF E nvironment II FIELD STRENGTH (V/m) FREQUENCY PEAK AVERAGE 10 – 500 kHz 20 20 500 kHz – 2 MHz 30 30 2 – 30 MHz 100 100 30 – 100 MHz 10 10 100 – 200 MHz 30 10 200 – 400 MHz 10 10 400 MHz – 1 GHz 700 40 1 – 2 GHz 1 300 160 2 – 4 GHz 3 000 120 4 – 6 GHz 3 000 160 6 – 8 GHz 400 170 8 – 12 GHz 1 230 230 12 – 18 GHz 730 190 18 – 40 GHz 600 150 In this table, the higher field strength applies at the frequency band edges.

Table 4 : HIRF E nvironment III FIELD STRENGTH (V/m) FREQUENCY PEAK AVERAGE 10 – 100 kHz 150 150 100 kHz – 400 MHz 200 200 400 – 700 MHz 730 200 700 MHz – 1 GHz 1 400 240 1 – 2 GHz 5 000 250 2 – 4 GHz 6 000 490 4 – 6 GHz 7 200 400 6 – 8 GHz 1 100 170 8 – 12 GHz 5 000 330 12 – 18 GHz 2 000 330 18 – 40 GHz 1 000 420 In this table, the higher field strength applies at the frequency band edges.

d. Establish the test environment for installed systems 1. General. The external HIRF environment will penetrate the aircraft and establish an internal RF environment to which installed electrical and electronic systems will be exposed. The resultant internal RF environment is caused by a combination of factors, such as aircraft seams and a pertures, reradiation from the internal aircraft structure and wiring, and characteristic aircraft electrical resonance.

2. Level A systems. The resulting internal HIRF environments for Level A systems are determined by aircraft attenuation of external HIRF E nvironment I, II, or III, as defined in CS - 23 Appendix K, in CS - 25 Appendix R, in CS - 27 Appendix D, and in CS - 29 Appendix E, as applicable . The attenuation is aircraft - and zone - specific and should be established by aircraft test, analysis, or similarity. The steps for showing L evel A HIRF compliance are presented in Section 8 of this AMC.

Powered by EASA eRules Page 524 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) 3. Level B systems. The internal RF environments for Level B systems are defined in CS - 23 Appendix K, in CS - 25 Appendix R, in CS - 27 Appendix D, and in CS - 29 Appendix E, as applicable, as equipment HIRF test L evels 1 or 2. The steps for showing Level B HIRF compliance are presented in Section 9 of this AMC.

4. Level C systems. The internal RF environment for Level C systems is defined in CS - 23 Appendix K, in CS - 25 Appendix R, in CS - 27 Appendix D, and in CS - 29 Appendix E, as applicable, as equipment HIRF test L evel 3. The steps for showing L evel C HIRF compliance are also presented in Section 9 of this AMC.

e. Apply the appropriate method of HIRF compliance verification 1. General. Table 5 summarises the relationship between the aircraft performance requirements in the HIRF requirements (paragraphs (a), (b) and (c)), and the HIRF environments and test levels.

2. Pass/ f ail criteria. Establish specific HIRF compliance pass/fail criteria for each system corresponding to the applicable HIRF requirements performance c riteria.

The definitions of ‘normal operation’ and ‘automatically recover’ in paragraph 5 of this AMC are provided in the context of CS 23.1308(a)(2), 25.1317(a)(2), 27.1317(a)(2), and 29.1317(a)(2). These pass/fail criteria should be presented to the Agen cy for approval. The means for monitoring system performance relative to these criteria should be established by the applicant and approved by the Agency. All effects defining the pass/fail criteria should be the result of identifiable and traceable analys is that includes both the separate and interdependent operational characteristics of the systems. The analysis should evaluate the failures, either singularly or in combination, which could adversely affect system performance. This should include failures which could negate any system redundancy or influence more than one channel performing the same function.

Table 5 : Summary of the HIRF certification requirements HIRF FAILURE PERFORMANCE ITEM THE HIRF CONDITION FROM CRITERIA ENVIRONMEN OR TEST ENVIRONMENT CSs 23.1308, 25.1317, LEVEL APPLIES TO OR TEST LEVEL 27.1317, AND 29.1317 Each electrical and electronic system that performs a function Each function is not …is exposed to whose failure would prevent the adversely affected during …the aircraft … HIRF continued safe flight and landing or after the time… E nvironment I.

of the aircraft/rotorcraft must be designed and installed so that : …is exposed to HIRF Each electrical and E nvironment I, electronic system unless this automatically recovers conflicts with …the aircraft… normal operation of that other function, in a timely operational or manner after… functional requirements of that system.

Powered by EASA eRules Page 525 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Each electrical and …is exposed to electronic system is not …the aircraft… HIRF adversely affected during E nvironment II.

or after… Each function required …is exposed to during operation under HIRF visual flight rules (VFR) is …the rotorcraft… E nvironment III not adversely affected (CS 27 and CS 29 during only).

or after… Each electrical and electronic system that performs a function whose failure would significantly reduce the capability of the …the equipment …is exposed to The system is not aircraft/rotorcraft or the ability providing these equipment HIRF adversely affected when… of the flight crew to respond to functions… test L evel 1 or 2.

an adverse operating condition must be designed and installed so that : Each electrical and electronic The system is not …the equipment …is exposed to system that performs a function adversely affected when… providing these equipment HIRF whose failure would reduce the functions… test L evel 3.

capability of the aircraft/rotorcraft or the ability of the flight crew to respond to an adverse operating condition must be designed and installed so that : f. Verify compliance with the applicable requirements 1. The applicant should demonstrate that the systems comply with the applicable specifications of CS 23.1308, 25.1317, 27.1317, and 29.1317.

2. The applicant should show that the RF currents on system and equipment wire bundles and the RF fields on the system, created by the HIRF environment, are lower than the equipment or system HIR F qualification test levels.

3. Verification may be accomplished by tests, analyses, or by demonstrating similarity to previously certified aircraft and systems. The certification process for Level A systems is contained in Section 7. The certification pro cess for Level B and Level C systems is contained in Section 8.

4. Margins are not required if HIRF compliance is based on tests of the specific aircraft model and system that undergo certification. Margins are also not required if HIRF compliance is based on analysis or similarity if the process validation is robust and the data well substantiated. Where data has limited substantiation, a margin may be required, depending on the available justifications. When a margin is required, the applicant should incl ude a justification for the selected margin in the HIRF c ompliance p lan, as discussed in Section 6 ( a ) .

5. The applicant should submit their compliance plan in the early stages of the certification programme to the Agency for review (see the details in Sect ion 6 ( a ) ).

Experience shows that, particularly with aircraft using new technology or those Powered by EASA eRules Page 526 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) that have complex systems, early agreement on the compliance plan benefits both the applicant and the Agency. The plan should define acceptable ways to resolve criti cal issues during the certification process. Analyses and test results during the certification process may warrant modifications to the design or verification methods. When significant changes are necessary, the certification plan should be updated accord ingly.

g. Take corrective measures (if needed) If tests and analyses show that the system did not meet the pass/fail criteria, the applicant should review the aircraft, installation or system design , and improve the protection against HIRF.

Powered by EASA eRules Page 527 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Figure 1 : Routes to HIRF compliance — Level A systems (n) = Step number as described in Section 7 of this AMC Powered by EASA eRules Page 528 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Figure 2 : Aircraft low - level coupling tests — Level A systems (n) = Step number as described in Section 7 of this AMC 7. STEPS TO DEMONSTRATE ‘ LEVEL A ’ SYSTEM HIRF COMPLIANCE Figures 1 and 2 illustrate a process that the applicant can use to demonstrate that their Level A system complies with CS 23.1308(a), 25.1317(a), 27.1317(a), and 29.1317(a).

a. Step 1 — HIRF safety assessment 1. The applicant should determine the system failure condition classification for the systems to be certified on their aircraft, using a system safety assessment as discussed in Section 6 ( b ) (2 ). For systems classified with catastrophic failure conditions (Level A systems), the applicant should follow compliance steps 2 to 15 listed below, as appropriate. These compliance steps are also depicted in Figures 1 and 2 of this AMC, and are not necess arily accomplished sequentially. Applicants for systems classified with hazardous or major failure conditions (HIRF c ertification Level B and Level C systems) should follow the compliance steps outlined in Section 8 of this AMC.

Powered by EASA eRules Page 529 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) 2. The system defined for p aragraph (a) of CS 23.1308, 25.1317, 27.1317, and 29.1317 is not required to include: (a) equipment, components and electrical interconnections required only for non - normal situations ; or (b) equipment, components and electrical interconnections required o nly for dispatching under m aster m inimum e quipment l ists (MMELs) (when o perational s uitability d ata (OSD) is applicable).

3. Some systems include mechanical, hydraulic, and/or pneumatic channels as well as electrical and electronic channel(s) to perform fu nctions whose failure would prevent continued safe flight and landing. The HIRF safety assessment for CS 23.1308(a), 25.1317(a), 27.1317(a), and 29.1317(a) only applies to functions performed by electrical and electronic systems. The HIRF safety assessment should consider electrical or electronic failures that would adversely affect the function of the mechanical, hydraulic, and/or pneumatic channel(s). If electrical or electronic equipment and components , as well as electrical interconnections are used to assist, augment, or monitor for control loop feedback, the mechanical, hydraulic, and/or pneumatic channels in performing the normal operation of the functions with failures that would prevent continued safe flight and landing, then the electrical and elec tronic channel(s) must comply with CS 23.1308(a), 25.1317(a), 27.1317(a), and 29.1317(a).

4. CS 23.1308(a), 25.1317(a), 27.1317(a), and 29.1317(a) do not require the applicant to assume pre - existing failure conditions when classifying the functional failu re conditions and the scope of Level A systems. The applicant should consider total or partial loss of the systems and malfunctions of the systems, including hazardously misleading information presented to the flight crew during and after the aircraft is e xposed to HIRF.

5. CS 23.1308(a)(2), 25.1317(a)(2), 27.1317(a)(2), and 29.1317(a)(2) require that Level A systems automatically recover normal operation of the L evel A functions in a timely manner after exposure to HIRF Environment I. Automatic recovery applies to all redundant active channels of the Level A system required for normal operation unless its recovery conflicts with other operational or functional requirements of the system. The exception for automatic recovery conflicts must be base d on aircraft operational or functional requirements independent of HIRF exposure. The exception should not be a mitigation for Level A system effects observed after exposure to HIRF Environment I.

6. Appendix 3 Examples of HIRF s afety a ssessment considerations — Level A s ystems provides examples of system s ’ scope based on the guidance above.

b. Step 2 — Define aircraft and system HIRF protection . The applicant should define the HIR F protection features to be incorporated into the aircraft and system designs, based on the HIRF environments that are applicable to their aircraft and its Level A systems.

Equipment, system, and aircraft HIRF protection design may occur before aircraft - le vel tests are performed, and before the actual internal HIRF environment is determined.

Therefore, the equipment, system and aircraft HIRF protection design should be based on an estimate of the expected internal HIRF environment. The applicant should cons ider all aircraft configurations that may affect HIRF protection, such as open landing gear doors (see Step 7).

Powered by EASA eRules Page 530 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) c. Step 3 — System assessment decision . The applicant should determine whether to perform integrated system HIRF tests on the Level A system, or to base the system verification on previous integrated system HIRF tests performed on a similar system.

Aircraft and system tests and assessments need not be performed for HIRF environments above 18 GHz if data and design analysis show the integrated syst em test results (see Step 5) satisfy the pass /fail criteria from 12 GHz to 18 GHz, and the systems have no circuits that operate in the 18 GHz to 40 GHz frequency range.

d. Step 4 — Equipment test 1. Radiated and conducted RF susceptibility laboratory tes ts of RTCA / DO - 160G / EUROCAE ED - 14G (or latest version) Section 20 may be used to build confidence in the equipment ’ s HIRF immunity before conducting integrated system laboratory tests in Step 5. The equipment should be specified and tested in accordance with the test levels (wire bundle currents injection and RF field illumination) of RTCA / DO - 160 / EUROCAE ED - 14 Section 20 or to a level estimated for the aircraft and equipment installation using the applicable external HIRF environment.

2. Equipment HI RF tests may be used to augment the integrated system HIRF tests where appropriate. For equipment whose HIRF immunity is evaluated as part of the integrated system - level HIRF tests discussed in Step 5, the individual equipment’s HIRF testing described in t his step is optional.

e. Step 5 — Integrated system test 1. Radiated and conducted RF susceptibility laboratory tests on an integrated system should be performed for Level A systems. The HIRF field strengths and wire bundle currents selected for this test should be based on the attenuated external HIRF environment determined in the aircraft assessment (see Steps 10, 11, or 12). In many cases, the integrated system test is performed before the aircraft assessment is complete. In these cases, the integra ted system test field strengths and currents should be selected based on the expected aircraft attenuation or transfer function.

2. The installation details for the laboratory integrated system tests should be similar to the installation in the aircraft. F or example, the bonding and grounding of the system, wire size, routing, arrangement (whether parallel or twisted wires), connector types, wire shields, and shield terminations, and the relative position of the elements to each other and the ground plane i n the laboratory should closely match the system installation on the aircraft to be certified. For this reason, the laboratory integrated system rig should have an Agency conformity inspection prior to conducting any Agency certification credit testing.

3. The integrated system should be tested with the system operating, to include connected displays, sensors, actuators, and other pieces of equipment. Applicants should place the system in various operating modes to ensure the integrated system is tested whe n operating at its maximum sensitivity. If the connected equipment is not related to the functions with catastrophic failures, these items may be simulated by test sets, if the test sets accurately represent the terminating circuit impedance of the sensor. However, the connected equipment should meet the appropriate HIRF requirements required for its failure condition classification.

4. The test levels should be selected based on the expected aircraft internal HIRF environment determined through aircraft te sts (see Step 10), generic transfer functions ‘for L evel A display systems only’ and attenuation (see Step 11), or aircraft similarity assessment (see Step 12), using the applicable external HIRF Powered by EASA eRules Page 531 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) environment. Integrated system test procedures are described in detail in the User ’ s Guide (SAE ARP 5583A / EUROCAE ED - 107A).

5. Wire bundle current injection should be used for frequencies from 10 kHz to 400 MHz. RF currents are injected into the integrated system wiring via a current transformer. Each wire bundle in the system should be injected and the induced wire bundle current measured. If a system wire bundle branches, then each wire bundle branch should also be tested. Simultaneous multi - bundle current injection may be necessary on systems with redundant or multi - channel architectures.

6. High - level radiated susceptibility tests should be used at frequencies greater than 100 MHz. The radiating antenna should be far enough away to ensure the total volume of the equipment and at least half a wavelength of the w iring is simultaneously and uniformly illuminated during the test.

7. The applicant should define appropriate pass/fail criteria for the system, based on the system safety assessment and the appropriate HIRF requirements . Any system susceptibility, includi ng system malfunctions such as displaying hazardously misleading information, upsets, or damage , should be recorded and evaluated based on these previously defined pass/fail criteria.

8. Using only the modulation to which the system under evaluation is mos t sensitive may minimise the test time. The User ’ s Guide (SAE ARP 5583A / EUROCAE ED - 107A) provides guidance on modulation selection and suggested default modulations and dwell times.

9. The equipment tests in Step 4, using the techniques in RTCA / DO - 160G / EUROCAE ED - 14G (or latest version) Section 20, normally are not sufficient to show HIRF compliance for Step 5 and Step 6. However, these standard RTCA / DO - 160G / EUROCAE ED - 14G Section 20 tests may be sufficient if paragraph 7 ( e ) (2) and (3) of this ste p are met.

10. If the Level A System consists of multiple similar channels, the applicant may propose using one or more channels in the laboratory test set - up for the integrated system, instead of all similar channels. The applicant should demonstrate that the laboratory test set - up adequately performs the functions that must demonstrate compliance with CS 23.1308(a), 25.1317(a), 27.1317(a), and 29.1317(a). The applicant should ensure that the laboratory test set - up represents and monitors any cross - channel interactions, such as cross - channel data links, redundancy management, and system health monitoring.

Note : Similar channels are composed of equipment that ha s the same hardware but not necessarily the same part number; in case of use of pin programming an d/or software to identify or configure equipment of similar channels, it must be assessed whether these differences have an impact on the functions performed.

f. Step 6 — System similarity assessment 1. The integrated system HIRF tests performed for a system previously certified on a given aircraft model may be used to demonstrate system verification for a similar system. Each system considered under the similarity approach needs to be assessed independen tly even if it may use equipment and installation techniques from previous certification projects.

2. The system used as the basis for similarity must have successfully completed integrated system HIRF tests. A similarity assessment requires a comparison o f Powered by EASA eRules Page 532 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) both the equipment and installation differences that could adversely affect HIRF immunity. The assessment should evaluate the differences between the previously HIRF certified system and the equipment circuit interfaces, wiring, grounding, bonding, conne ctors, and wire - shielding practices of the equipment that is part of the new system.

3. If the assessment finds only minimal differences between the previously certified system and the new system to be certified, similarity may be used as the basis for sys tem - level verification without the need for additional integrated system tests, provid ed there are no unresolved in - service HIRF problems related to the previously certified system. If there is uncertainty about the effects of the differences, additional t ests and analys e s should be conducted , as necessary and appropriate , to resolve the uncertainty. The amount of additional testing should be commensurate with the degree of difference identified between the new system and the system previously certified. If significant differences are found, similarity should not be used as the basis for system - level verification.

g. Step 7 — Aircraft assessment decision 1. Level A systems require an aircraft assessment. The aircraft assessment should determine the actual in ternal HIRF environment where the Level A systems are installed in the aircraft. The applicant should choose whether to use aircraft tests, previous coupling/attenuation data from similar aircraft types (similarity). For L evel A display systems only, appli cants should use the generic transfer functions and attenuation in Appendix 1 to this AMC. Alternately, the aircraft assessment may be a test that exposes the entire aircraft with operating Level A systems to external HIRF E nvironment I, II, or III (Tables 2, 3, and 4 respectively), as appropriate, to demonstrate acceptable Level A system performance.

2. Level A display systems include the display equipment, control panels, and the sensors that provide information to the displays. These sensors could also provide information to Level A n on - d isplay s ystems, so in that case, the applicant should determine the real transfer function and attenuation curves of these sensors when demonstra ting compliance for this Level A n on - d isplay s ystem. For example, for a ir d ata s ystems and i nertial r eference s ystems, which send information to the EFIS and f light c ontrols, the transfer function and attenuation should be determined by a ircraft low - level coupling testing or an a ircraft similarity assessment as defined in Steps 10 and 12.

3. Other methods for aircraft HIRF assessment, such as analysis, may be acceptable.

However, comprehensive modelling and analysis for RF field coupling to the aircraft structure is an emerging technology. Therefore, analysis alone is currently not adequate to show HIRF compliance for Level A systems and should be augmented by testing.

4. If analysis is used to determine aircraft attenuation and transfer f unction characteristics, test data should be provided to support this analysis. Any analysis results should take into account the quality and accuracy of the analysis. Significant testing, including aircraft - level testing, may be required to support the an alysis.

5. Aircraft and system tests and assessments need not be performed for the HIRF environments above 18 GHz if data and design analysis show the integrated system test results (see Step 5) satisfy the pass /fail criteria from 12 to 18 GHz, and the sys tems have no circuits operating in the 18 to 40 GHz frequency range.

Powered by EASA eRules Page 533 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) h. Step 8 — Aircraft test decision 1. Various aircraft test procedures are available and accepted for collecting data for aircraft HIRF verification. The two main approaches to aircraft t esting are the aircraft high - level test (see Step 9) and the aircraft low - level coupling test (see Step 10). The aircraft high - level field - illumination test involves radiating the aircraft at test levels equal to the applicable external HIRF environment in the HIRF requirements . Aircraft low - level coupling tests involve measuring the airframe attenuation and transfer functions, so that the internal HIRF electric fields and currents can be compared with the integrated system test levels.

2. Some test procedu res may be more appropriate than others because of the size of the aircraft and the practicality of illuminating the entire aircraft with the appropriate external HIRF environment. The aircraft low - level coupling tests (see Step 10) may be more suitable fo r testing large aircraft than the high - level field - illumination test in Step 9, which requires illumination of the entire aircraft with the external HIRF environment.

i. Step 9 — Aircraft high - level tests 1. The aircraft high - level field - illumination test requires generating RF fields external to an aircraft at a level equal to the applicable external HIRF environment.

2. At frequencies below 400 MHz, the distance between the aircraft and the transmitting antenna should be sufficient to ensure the aircraft is illuminated uniformly by the external HIRF environment. The transmitting antenna should be placed in at least four positions around the aircraft. For aircraft, the antenna is typically placed to illuminate the nose, tail, and each wing tip. For rotorcra ft, the antenna is typically placed to illuminate the nose, tail, and each side. The aircraft should be illuminated by the antenna at each position while sweeping the frequency range. Perform separate frequency sweeps with the transmitting antenna oriented for horizontal and vertical polarisation. The RF field should be calibrated by measuring the RF field strength in the centre of the test volume before the aircraft is placed there.

3. At frequencies above 400 MHz, the RF illumination should be localised t o the system under test, provided all parts of the system and at least one wavelength of any associated wiring (or the total length if less than one wavelength) are illuminated uniformly by the RF field. The applicant may need reflection planes to illumina te relevant apertures on the bottom and top of the aircraft.

4. To ensure the systems are tested when operating at their maximum sensitivity, Level A systems should be fully operational , and the aircraft should be placed in various simulated operating modes.

5. The test time can be minimised by using only the modulation to which the system under evaluation is most sensitive. If the applicant does this, the rationale used to select the mos t sensitive modulation should be documented in the HIRF test plan as discussed in Section 6 ( b ) (1). The User ’ s Guide (SAE ARP 5583A / EUROCAE ED - 107A) provides guidance on modulation selection and suggested default modulations and dwell times.

6. As an alte rnative to testing at frequencies below the first airframe resonant frequency, it is possible to inject high - level currents directly into the airframe using aircraft high - level direct - drive test methods. Aircraft skin current analysis should Powered by EASA eRules Page 534 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) be performed a s described in the User ’ s Guide, or low - level swept - current measurements should be made to determine the skin current distribution that will exist for different RF field polarisations and aircraft illumination angles so that these can be simulated accurate ly during this test. Aircraft high - level direct - drive testing, although applicable only from 10 kHz to the first airframe resonant frequency, is advantageous because it is possible to test all systems simultaneously.

j. Step 10 — Aircraft low - level couplin g tests 1. General (a) The aircraft low - level coupling tests include three different tests that cover the frequency range of 10 kHz to 18 GHz (see Figure 2). Detailed descriptions are available in the User ’ s Guide. Other techniques may be valid, but must b e discussed with and accepted by the Agency before being used.

(b) The low - level direct - drive test (see Step 10b, Figure 2) and the low - level swept - current test (see Step 10c) are used for frequencies at or below 400 MHz. The low - level swept - field test (se e Step 10d) is used for frequencies at and above 100 MHz. There is an overlap of test frequencies from 100 to 400 MHz in the low - level swept - current test and the low - level swept - field test.

The division at 100 MHz is not absolute and depends on the aircraf t to be tested and the resonance of the wiring and instrumentation limitations. The division at 400 MHz is not absolute either, and depends on when HIRF penetration of the equipment case becomes a significant factor.

2. Steps 10a and 10b — Aircraft s kin c urrent a nalysis and l ow - l evel d irect - d rive t est .

Low - level direct - drive tests in conjunction with skin current analysis should be used to determine the transfer function between the skin current and individual equipment w ire bundle currents. The low - level direct - drive test is typically used for frequencies from 10 kHz to the first airframe resonant frequency. For the low - level direct - drive test to be applied successfully, a three - dimensional model of the aircraft should be derived using aircraft skin current analysis. The three - dimensional model can then be used to derive the aircraft ’ s skin current pattern for the applicable external HIRF environment. Guidance on skin current analysis is in the User’s Guide. If the relatio nship between the external HIRF environment and the skin current is known for all illumination angles and polarisation, either because of aircraft skin current analysis or the use of the low - level swept - current test, the skin current can be set up by direc t injection into the airframe. The resultant currents on the system wire bundles are measured with a current probe and normalised to 1 V/m electric field strength so they can be scaled to the appropriate external HIRF environment. The low - level direct - driv e test is more effective than low - level swept - current tests for frequencies from 10 kHz to the first airframe resonant frequency, and may be necessary for small aircraft or aircraft with high levels of airframe shielding.

3. Step 10c — Low - level swept - curr ent test . The low - level swept - current test involves illuminating the aircraft with a low - level external HIRF field to measure the transfer function between the external field and the aircraft and equipment wire bundle currents. This test is typically used in the frequency range of 500 kHz to 400 MHz. The transfer function is resonant in nature and is dependent on both the aircraft structure and the system installation. Because the transfer function Powered by EASA eRules Page 535 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GE NERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) relates wire bundle currents to the external field, the ind uced bulk current injection test levels can be related to an external HIRF environment.

The transmitting antenna should be placed in at least four positions around the aircraft, with the distance between the aircraft and the transmitting antenna sufficient to ensure the aircraft is illuminated uniformly. For aircraft, the antenna is typically placed to illuminate the nose, tail, and each wing tip. For rotorcraft, the antenna is typically placed to illuminate the nose, tail, and each side. The aircraft shoul d be illuminated by the antenna at each position while sweeping the frequencies in the range of 500 kHz to 400 MHz. The applicant should perform separate frequency sweeps with the transmitting antenna oriented for horizontal and vertical polarisation, and measure the currents induced on the aircraft wire bundles.

The applicant should calculate the ratio between the induced wire bundle current and the illuminating antenna field strength , and normalise this ratio to 1 V/m. This provides the transfer function in terms of induced current per external field strength unit . Then the current induced by the applicable external HIRF environment can be calculated by multiplying the transfer function by the external HIRF field strength. The calculated HIRF currents for all transmitting antenna positions for each aircraft wire bundle to be assessed should be overlaid to produce worst - case induced current for each wire bundle. These worst - case induced currents can be compared with the current used during the integrated sys tem test in Step 5.

4. Step 10d — Low - level swept - field test . Low - level swept - field testing is typically used from 100 MHz to 18 GHz. The test procedures for the low - level swept - field test are similar to those used for the low - level swept - current test; how ever, in the low - level swept - field test, the internal RF fields in the vicinity of the equipment are measured instead of the wire bundle currents. Various techniques can be used to ensure the maximum internal field in the vicinity of the equipment is measu red.

Depending on the size of the aircraft and the size of the aircraft cabin, flight deck, and equipment bays, multipoint measurement or mode stirring can be used to maximise the internal field in the vicinity of the equipment. See the User ’ s Guide (SAE A RP 5583A / EUROCAE ED - 107A) for detailed low - level swept - field test procedures.

k. Step 11 — Generic transfer functions and attenuation — Level A display systems only 1. Level A displays involve functions for which system information is displayed directly to the pilot. For L evel A display systems, the aircraft attenuation data may be determined using generic attenuation and transfer function data. This approach should not be used for other Level A systems, such as control systems, because failures and malfu nctions of those systems can more directly and abruptly contribute to a catastrophic failure event than display system failures and malfunctions; therefore, other Level A systems should have a more rigorous HIRF compliance verification programme.

2. The in tegrated system test levels specified in Step 5 may be derived from the generic transfer functions and attenuation for different types of aircraft.

Acceptable transfer functions for calculating the test levels are given in Appendix 1 to this AMC. Appendix 1 to this AMC also contains guidelines for selecting the proper generic attenuation. The generic transfer functions show the envelope of Powered by EASA eRules Page 536 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) the currents that might be expected to be induced in the types of aircraft in an exte rnal HIRF environment of 1 V/m. The current levels should be multiplied linearly by HIRF E nvironment I, II, or III, as appropriate, to determine the integrated system test levels.

3. The internal HIRF electric field levels are the external HIRF environment divided by the appropriate attenuation, in linear units. For example, 20 dB or a 10:1 attenuation means the test level is the applicable external HIRF environment electric field strength reduced by a factor of 10.

4. The internal HIRF environments for L ev el A display systems can also be measured using on - aircraft low - level coupling measurements of the actual system installation (see Step 10). This procedure should provide more accurate information to the user, and the test levels may be lower than the gene ric transfer functions or attenuation, which are worst - case estimates.

l. Step 12 — Aircraft similarity assessment 1. The aircraft attenuation and transfer function tests performed for a previously certified aircraft may be used to support aircraft - level v erification for a similar aircraft model. The aircraft used as the basis for similarity must have been previously certified for HIRF compliance, using HIRF attenuation and transfer functions determined by tests on that aircraft.

2. The similarity assessmen t for the new aircraft model should consider the aircraft differences that could impact on the internal HIRF environment affecting the Level A systems and the associated wiring. The comparison should consider equipment and wiring locations, airframe materi als and construction, and apertures that could affect attenuation for the external HIRF environment.

3. If the assessment finds only minimal differences between the previously certified aircraft and the new aircraft to be certified, similarity may be used to determine the aircraft attenuation and transfer functions without the need for additional aircraft tests, providing there are no unresolved in - service HIRF problems related to the existing aircraft. If there is uncertainty about the effects of the diffe rences, additional tests and analyses should be conducted as necessary and appropriate to resolve the uncertainty. The amount of additional testing should be commensurate with the degree of difference identified between the new aircraft to be certified and the aircraft previously certified. If significant differences are found, similarity should not be used as the basis for aircraft - level verification.

m. Step 13 — Assess the immunity 1. The applicant should compare the test levels used for the integrated s ystem test of Step 5 with the internal RF current or RF fields determined by the aircraft low - level coupling tests (see Step 10), the generic transfer functions and attenuation (see Step 11), or the aircraft similarity assessment (see Step 12). The actual aircraft internal RF currents and RF fields should be lower than the integrated system test levels.The comparison method should be included in the HIRF compliance plan.

The method should enable a direct comparison between the system test level and the airc raft internal HIRF environment at the equipment or system location, using current for frequencies from 10 kHz to 400 MHz, and using electric field strength for frequencies from 100 MHz through 18 GHz.

Powered by EASA eRules Page 537 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) 2. If the conducted RF susceptibility test levels used for the integrated system test (see Step 5) were too low when compared with the aircraft - induced currents determined in Steps 10b, 10c, 11 or 12, then corrective measures are needed (see Step 14). If the radiated RF susceptibility test levels used for inte grated system tests (see Step 5) were too low when compared with the aircraft internal fields determined in Steps 10d, 11 or 12, then corrective measures are needed (see Step 14).

3. When comparing the current measured during low - level swept - current tests in Step 10c with the current used during the integrated system tests in Step 5, there may be differences. These differences may be due to variations between the actual aircraft installation and the integrated system laboratory installation, such as wire bu ndle lengths, shielding and bonding, and wire bundle composition. The worst - case current signature for a particular wire bundle should be compared with the current induced at the particular test level or equipment malfunction over discrete frequency ranges such as 50 to 500 kHz, 500 kHz to 30 MHz, and 30 to 100 MHz.

This comparison should be broken into discrete frequency ranges because the resonant frequencies may differ between the integrated system tests and the aircraft tests.

4. If the applicant uses a ircraft high - level tests (see Step 9) for aircraft HIRF verification, the y should determine whether there were any Level A system susceptibilities. Any Level A system susceptibilities should be evaluated based on the pass/fail criteria as established in th e test plan (see Section 8 ( b ) (1)). If the HIRF susceptibilities are not acceptable, then corrective measures may be needed (see Step 14).

5. HIRF susceptibilities that were not anticipated or defined in the test plan pass/fail criteria may be observed during aircraft high - level tests or integrated system laboratory tests. The pass/fail criteria may be modified if the effects neither cause nor c ontribute to conditions that adversely affect the aircraft functions or systems in the HIRF requirements . The applicant should provide an assessment and the supporting rationale for any modifications to the pass/fail criteria to the Agency for acceptance.

If the HIRF susceptibilities are not acceptable, then corrective measures may be needed (see Step 14).

6. If the Level A systems show no adverse effects when tested to levels derived from the applicable HIRF E nvironment I or III, this also demonstrates co mpliance of the system with HIRF E nvironment II.

7. If the integrated system test results (see Step 5) satisfy the pass /fail criteria from 12 to 18 GHz, and design analysis shows the system has no circuits operating in the 18 to 40 GHz frequency range, thi s demonstrates by analysis that the system is not adversely affected when exposed to HIRF environments above 18 GHz. If these conditions are satisfied, further aircraft and system tests and assessments above 18 GHz are not necessary.

8. The applicant shoul d review the actual system installation in the aircraft and the system configuration used for the integrated system test (see Step 5). If significant configuration differences are identified, corrective measures may be needed (see Step 14).

Powered by EASA eRules Page 538 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) 9. Certain RF r eceivers with antennas connected should not be expected to perform without effects during exposure to the HIRF environments, particularly in the RF receiver operating band. Because the definition of adverse effects and the RF response at particular portion s of the spectrum depends on the RF receiver system function, the applicant should refer to the individual RF receiver minimum performance standards for additional guidance. However, because many RF receiver minimum performance standards were prepared befo re the implementation of the HIRF requirements, the RF receiver pass/fail criteria should be coordinated with the Agency.

10. The applicant should provide the similarity assessment and the supporting rationale to the Agency for acceptance.

n. Step 14 — Cor rective measures . Corrective measures should be taken if the system fails to satisfy the HIRF immunity assessment of Step 13. If changes or modifications to the aircraft, equipment, system or system installation are required, then additional tests may be n ecessary to verify the effectiveness of the changes. The RTCA / DO - 160G / EUROCAE ED - 14G , or latest version, Section 20 equipment tests, integrated system tests, and aircraft tests, in whole or in part, may need to be repeated to show HIRF compliance.

o. S tep 15 — HIRF protection compliance . The test results and compliance report should be submitted to the Agency for approval as part of the overall aircraft type certification or supplemental type certification process.

Powered by EASA eRules Page 539 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Figure 3 : Routes to HIRF compliance — Level B and Level C systems (n) = Step number as described in Section 10 of this AMC Powered by EASA eRules Page 540 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) 8. STEPS TO DEMONSTRATE ‘ LEVEL B ’ AND ‘LEVEL C ’ SYSTEM HIRF COMPLIANCE Figure 3 illustrates a process that the applicant can use to demonstrate whether their Level B and Level C systems comply with CS 23.1308(b), 25.1317(b), 27.1317(b), and 29.1317(b) , and with CS 23.1308(c), 25.1317(c), 27.1317(c), and 29.1317(c) respectivel y .

a. Step 1 — HIRF safety assessment. The applicant should determine the system certification level for the systems to be certified on their aircraft, using a system safety assessment as discussed in Section 6 ( b ) (2). For systems classified with hazardous or major failure conditions (Level B and Level C systems), the applicant should follow compliance S teps 2 through 8 listed below, as appropriate. These compliance steps are also depicted in Figure 3 of this AMC and are not necessarily accomplished sequenti ally. For systems classified with catastrophic failure conditions (Level A systems), the applicant should follow the compliance steps outlined in Section 7.

b. Step 2 — Define the aircraft and system HIRF protection. The applicant should define the HIRF pr otection features incorporated into the aircraft and system designs, based on the HIRF test levels applicable to their aircraft and its Level B and Level C systems.

Equipment, system, and aircraft HIRF protection design may occur before aircraft - level test s are performed, and before the actual internal HIRF environment is determined.

Therefore, the equipment, system and aircraft HIRF protection design should be based on an estimate of the expected internal HIRF environment.

c. Step 3 — Select the compliance method. The applicant should determine whether to perform equipment HIRF tests on the Level B and Level C systems, or to base the compliance on previous equipment tests performed for a similar system.

d. Step 4 — Equipment test 1. Level B and Le vel C systems do not require the same degree of HIRF compliance testing as Level A systems and , therefore , do not require aircraft - level testing. RTCA / DO - 160G / EUROCAE ED - 14G , or latest version, Section 20 laboratory test procedures should be used, usin g equipment test levels defined in the applicable specifications . The test levels used depend on whether the system is categorised as Level B or Level C. Equipment HIRF test L evel 1 or 2, as applicable, should be used for Level B systems. RTCA / DO - 160 / E UROCAE ED - 14 Section 20 Category RR (using the alternative modulation for radiated susceptibility) satisfies the requirements of equipment HIRF test L evel 1. For equipment HIRF test L evel 2, the applicant may use the approach in Section 9 ( k ) to help determ ine the acceptable aircraft transfer function and attenuation curves for their Level B system.

Equipment HIRF test L evel 3 should only be used for Level C systems. RTCA / DO - 160 / EUROCAE ED - 14 Section 20 Category TT satisfies the requirements of equipment HIRF test L evel 3. When applying modulated signals, the test levels are given in terms of the peak of the test signal as measured by a root mean square (rms), indicating the spectrum analyser’s peak detector. See the User ’ s Guide (SAE ARP 5583A / EUROCAE ED - 107A) for more details on modulation.

2. The applicant should define appropriate pass/fail criteria for the system, based on the system safety assessment and the appropriate HIRF requirements (see Section 6 ( b )( 2 ) ). Any susceptibility noted during the equipment tests, including equipment malfuncti ons, upsets, or damage, should be recorded and evaluated based on the defined pass/fail criteria.

Powered by EASA eRules Page 541 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) e. Step 5 — Similarity assessment 1. The equipment HIRF tests performed for a system previously certified on a given aircraft model may be used to show compliance for a similar system. Each system considered for similarity needs to be assessed independently even if it used equipment and insta llation techniques from a previous certification.

2. The system used as the basis for certification by similarity must have successfully completed equipment HIRF tests and been previously certified for HIRF compliance on another aircraft model. Similarity assessment requires a comparison of both the equipment and installation differences that could adversely affect HIRF immunity.

An assessment of a new system should consider the differences in the equipment circuit interfaces, wiring, grounding, bonding, co nnectors, and wire - shielding practices.

3. If the assessment finds only minimal differences between the previously certified system and the new system to be certified, similarity may be used for HIRF compliance without the need for additional equipment HIR F tests, provid ed there are no unresolved in - service HIRF problems related to the previously certified system. If there is uncertainty about the effects of the differences, additional tests and analyses should be conducted as necessary and appropriate to r esolve the uncertainty. The amount of additional testing should be commensurate with the degree of difference identified between the new system and the system previously certified. If significant differences are found, similarity should not be used as the basis for HIRF compliance.

f. Step 6 — Assess the immunity 1. The applicant should review the results of the equipment test to determine whether the pass/fail criteria are satisfied. HIRF susceptibilities that were not anticipated or defined in the test pl an pass/fail criteria may be observed during equipment HIRF tests. The pass/fail criteria may be modified if the effects neither cause nor contribute to conditions that adversely affect the aircraft functions or systems, as applicable, in the HIRF requirem ents . The applicant should provide an assessment of, and the supporting rationale for, any modifications to the pass/fail criteria to the Agency for approval. If the HIRF susceptibilities are not acceptable, then corrective measures may be needed (see Step 7).

2. The applicant should review the actual system installation in the aircraft and the configuration used for the equipment tests (see Step 4). If significant differences in grounding, shielding, connectors, or wiring are identified, corrective measure s may be needed (see Step 7).

3. Certain RF receivers with antennas connected should not be expected to perform without effects during exposure to the HIRF environments, particularly in the RF receiver operating band. Because the definition of adverse effe cts and the RF response at particular portions of the spectrum depends on the RF receiver system function, applicants should refer to the individual RF receiver minimum performance standards for additional guidance. However, because many RF receiver minimu m performance standards were prepared before the implementation of the HIRF requirements, the RF receiver pass/fail criteria should be coordinated with the Agency. Future modifications of the minimum performance standards should reflect the HIRF performanc e requirements.

Powered by EASA eRules Page 542 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) g. Step 7 — Corrective measures. The applicant should take corrective measures if the system fails to satisfy the HIRF immunity assessment of Step 6. If changes or modifications to the equipment, system, or system installation are required, then additional tests may be necessary to verify the effectiveness of the changes. The RTCA / DO - 160G / EUROCAE ED - 14G , or latest version, Section 20 equipment tests, in whole or in part, may need to be repeated to show HIRF compliance.

h. Step 8 — HIRF p rotection compliance. The applicant should submit the test results and compliance report to the Agency for acceptance as part of the overall aircraft type certification or supplemental type certification process.

9. HIRF COMPLIANCE DEMONSTRATION a. HIRF compliance plan. An overall HIRF compliance plan should be established to clearly identify and define HIRF certification requirements, HIRF protection development, and the design, test, and analysis activities intended to be part of the compliance eff ort. This plan should provide definitions of the aircraft systems, installations, and protective features against which HIRF compliance will be assessed. The HIRF compliance plan should be discussed with, and submitted to, the Agency for acceptance before initiating HIRF compliance activities. If the aircraft, system, or installation design changes after approval, a revised HIRF compliance plan should be submitted to the Agency for acceptance. The HIRF compliance plan should include the following: 1. a HIRF compliance plan summary ; 2. identification of the aircraft systems, with classifications based on the safety assessment as it relates to HIRF (see Section 6 ( b ) (2)) ; 3. the planned or expected HIRF environment for the aircraft and installed systems ; and 4. t he verification methods, such as test, analysis, or similarity.

b. Methods of compliance verification 1. Various methods are available to aid in demonstrating HIRF compliance. Methods acceptable to the Agency are described in Sections 6 and 7 of this AMC . Figures 1 and 2 above outline the steps to HIRF compliance for systems that requir e L evel A HIRF certification. Figure 3 above outlines the steps to HIRF compliance for systems that requir e Level B or Level C HIRF certification. The steps in these figure s are not necessarily accomplished sequentially. Wherever a decision point is indicated on these figures, the applicant should complete the steps in that path as described in Sections 6 and 7 of this AMC.

2. Other HIRF compliance techniques may be used to demonstrate system performance in the HIRF environment; however, those techniques should be accepted by the Agency before using them.

c. HIRF verification test, analysis, or similarity plan. Test, analysis and similarity are all acceptable methods. The app licant must choose the method or the combination of methods most appropriate for their project. See Sections 6 and 7 of this AMC, and SAE ARP 5583A / EUROCAE ED - 107A for additional guidance for selecting the appropriate method. Specific HIRF test, analysis , or similarity plans could be prepared to describe specific verification activities. A single verification plan combining various methods for all the selected systems or dedicated verification plans may be necessary. For example, Powered by EASA eRules Page 543 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) there may be several syst ems or equipment laboratory test plans, an aircraft test plan, or a similarity plan for selected systems on an aircraft.

1. Test plan (a) A HIRF compliance test plan may include the equipment, system, and aircraft test objectives for the acquisition of dat a to support HIRF compliance verification. The plan should provide an overview of the factors to be addressed for each system test requirement.

The test plan should include: 1. the purpose of the test ; 2. a description of the aircraft and/or the system to be tested ; 3. system configuration drawings ; 4. the proposed test set - up and methods ; 5. the intended test levels, modulations, and frequency bands ; 6. pass/fail criteria ; and 7. the test schedule and test location.

(b) The test plan should cover Level A, B, and C systems and equipment, as appropriate. Level A systems may require both integrated systems laboratory tests and aircraft tests. Level B and Level C systems and equipment require only equipment laboratory testing.

(c) The test plan should describe the appropriate aspects of the systems to be tested and their installation. Additionally, the test plan should reflect the results of any analysis performed in the overall process of the HIRF complianc e evaluation.

2. Analysis plan. A HIRF compliance analysis plan should include the objectives, both at system and equipment level, for generating data to support HIRF compliance verification. Comprehensive modelling and analysis for RF field coupling to ai rcraft systems and structures is an emerging technology; therefore, the analysis plan should be coordinated with the Agency to determine an acceptable scope for the analysis.

The analysis plan should include: (a) the purpose and scope of the analysis ; (b) a description of the aircraft and/or the system addressed by the analysis ; (c) system configuration descriptions ; (d) the proposed analysis methods ; (e) t he approach for validating the analysis results ; and (f) p ass/fail criteria, including margins to acc ount for analysis uncertainty.

Powered by EASA eRules Page 544 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) 3. Similarity plan. A similarity plan should describe the approach undertaken to use the certification data from previously certified systems, equipment, and aircraft in the proposed HIRF compliance programme.

The similari ty plan should include: (a) t he purpose and scope of the similarity assessment ; (b) t he specific systems addressed by the similarity assessment ; (c) t he data used from the previously certified systems, equipment, and aircraft ; (d) d etails of the significant differences between the aircraft and system to be certified and the similar aircraft and system from which the data will be used ; and (e) w hen data has limited substantiation, a description and justification for margins to account for similarity uncertainty ; s ee Section 6 ( f )( 3 ) for additional information on margins.

d. Compliance reports. One or more compliance reports may be necessary to document the results of test, analysis, or similarity assessments. For new or significantly mo dified aircraft, HIRF compliance reports include many system and equipment test reports, aircraft test reports, and HIRF vulnerability analysis reports. For these types of HIRF certification programmes, a compliance summary report may be useful to summaris e the results of tests and analyses . For HIRF certification programmes of relatively simple systems, a single compliance report is adequate.

1. Test reports. Comprehensive test reports should be produced at the conclusion of HIRF compliance testing. The te st reports should include descriptions of the salient aspects of equipment or system performance during the test, details of any area of non - compliance with HIRF requirements, actions taken to correct the non - compliance, and any similarity declarations. Th e applicant should also provide the supporting rationale for any deviations from system performance observed during testing.

2. Analysis reports. Analysis reports should describe the details of the analytical model, the methods used to perform the analysis, and the results of the analysis.

The reports should identify any modelling uncertainty and justify the margins established in the analysis plan .

3. Similarity reports. Similarity reports should document the significant aircraft, system, equipment, and installation features that are common between the aircraft or system that is the subject of the similarity analysis and the aircraft or system that was previously certified for HIRF. The reports should identify all the significant differences encountered, along with the assessment of the impact of these differences on HIRF compliance. These reports should also justify the margins established in the s imilarity plan.

10. MAINTENANCE, PROTECTION ASSURANCE, AND MODIFICATIONS a. The minimum maintenance required to support HIRF certification should be identified in the instructions for continued airworthiness (ICAs) as specified in CS 23.1529, 25.1529, 25.1 729, 27.1529, and 29.1529, as appropriate. Dedicated devices or specific features may be required to provide HIRF protection for an equipment or system installation.

Appropriate maintenance procedures should be defined for these devices and features to ens ure in - service protection integrity. A HIRF protection assurance programme should Powered by EASA eRules Page 545 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) be proposed in the certification plan to identify all actions necessary to justify or to verify that the maintenance procedures are adequate. This assurance programme may pro pose a surveillance programme based on a sampling of the fleet for monitoring the effectiveness of the protection features and/or maintenance procedures. The User ’ s Guide (SAE ARP 5583A / EUROCAE ED-107A) provides further information on these topics.

b. Th e maintenance procedures should consider the effects of corrosion, fretting, flexing cycles, or other causes that could degrade these HIRF protection devices. Whenever applicable, specific replacement times of these devices and features should be identifie d.

c. Aircraft or system modifications should be assessed for the impact that any changes will have on the HIRF protection. This assessment should be based on analysis and/or measurement.

[Amdt 20/2 3 ]

Appendix 1 to AMC 20 - 158A — Definitions and acronyms

ED Decision 2022/001/R 1. Definitions Adverse effect: a response of a system that results in an unexpected and unacceptable operation of an aircraft system, or unexpected and unacceptable operation of the function performed by the system.

Attenu ation: t he term used to denote a decrease in the electromagnetic field strength in the transmission from one point to another. Attenuation may be expressed as a scalar ratio of the input magnitude to the output magnitude, or in decibels (dB).

Automatically recover: a return to normal operations without pilot action.

Bulk current injection: a method of electromagnetic interference (EMI) testing that involves injecting current into wire bundles through a current injection probe.

Channel: a s ubset of a system consist ing of equipment, components, and interconnections , which performs an aircraft function provided by the system. A system could be composed of redundant similar or dissimilar channels in order to maintain the function at the aircraft level in case of failure on one or several channels.

Continued safe flight and landing: t he capability for continued controlled flight and landing at a suitable location, possibly using emergency procedures, but without requiring exceptional pilot ing skill or strength. Fo r CS - 25 aeroplanes, the pilot must be able to land safely at a suitable airport. For CS - 23 aeroplanes, it is not necessary to land at an airport. For rotorcraft, the rotorcraft must continue to cope with adverse operating conditions, and the pilot must be able to land safely at a suitable site. Some aircraft damage may be associated with a failure condition during flight or upon landing.

Continuous wave: a n RF signal consisting of only the fundamental frequency with no modulation in amplitude, frequency, or phase.

Coupling: t he process whereby electromagnetic energy is induced in a system by radiation produced by an RF source.

Current injection probe: a n inductive device designed to inject RF signals directly into wire bundles when clamped around them.

Direc t drive test: a n electromagnetic interference ( EMI ) test that involves electrically connecting a signal source directly to the unit to be tested.

Powered by EASA eRules Page 546 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Electrical and electronic system: a n electrical or electronic system includes all the electrical and electronic equipment, components, elements and the electrical interconnections that are required to perform a particular function.

Equipment: a component of an electrical or electronic system with interconnecting electrical conductors.

Equipment electrical interface: a location on a piece of equipment where an electrical connection is made to the other equipment in a system of which it is a part. The electrical interface may consist of individual wires or wire bundles that connect the equipment.

External HI RF environment: e lectromagnetic RF fields at the exterior of an aircraft.

Field strength: t he magnitude of the electromagnetic energy propagating in free space expressed in volts per metre (V/m).

Function: t he specific action of a system, equipment, and flight crew performance aboard the aircraft that, by itself, provides a completely recognisable operational capability. For example, ‘display aircraft heading to the pilots’ is a function. One or more systems may perform a specific function, or one system may perform multiple functions.

HIRF environment: t he electromagnetic environment created by the transmission of high - power RF energy into free space.

HIRF vulnerability: t he susceptibility characteristics of a system that cause it to suffer adverse effects when performing its intended function as a result of having been subjected to a HIRF environment.

Immunity: t he capacity of a system or piece of equipment to continue to perform its intended function, in an acceptable manner, in the presen ce of RF fields.

Interface circuit: a n electrical or electronic device connecting the electrical inputs and outputs of a piece of equipment to other pieces of equipment or devices in an aircraft.

Internal HIRF environment: t he RF environment inside an airf rame, equipment enclosure, or cavity. The internal RF environment is described in terms of the internal RF field strength or wire bundle current.

Margin: t he difference between the equipment susceptibility or qualification levels and the aircraft internal HIRF environment. Margin requirements may be specified to account for uncertainties in design, analysis, or test.

Modulation: t he process whereby certain characteristics of a wave, often called the carrier wave, are varied in accordance with an applied fun ction.

Non - normal situation: a ny situation that requires non - normal, abnormal, emergency, unusual procedures, or configurations for operating an aircraft.

Normal operation: a status where the system perform s its intended function. When addressing compliance with CS 23.1308(a)(2), 25.1317(a)(2), 27.1317(a)(2), and 29.1317(a)(2), the function whose failure would prevent the continued safe flight and landing should be in the same undisturbed state as before expo sure to the HIRF threat, while other functions, performed by the same system, subject to CS 23.1308(b) and (c), 25.1317(b) and (c), 27.1317(b) and (c), and 29.1317(b) and (c), are not required to be recovered. The system that performs the function may be n evertheless in a different state as long as the function is not adversely affected.

Radio frequency (RF) : a frequency useful for radio transmission. The present practical limits of RF transmissions are roughly 10 kilohertz (kHz) to 100 gigahertz (GHz). Wit hin this frequency Powered by EASA eRules Page 547 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) range, electromagnetic energy may be detected and amplified as an electric current at the wave frequency.

Reflection plane: a conducting plate that reflects RF signals.

Similarity: t he process of using existing HIRF compliance documentat ion and data from a system or an aircraft to demonstrate HIRF compliance for a nearly identical system or aircraft of equivalent design, construction, and installation.

Susceptibility: a property of a piece of equipment that describes its inability to fun c tion acceptably when subjected to unwanted electromagnetic energy.

Susceptibility level: t he level where the effects of interference from electromagnetic energy become apparent.

Transfer function: t he ratio of the electrical output of a system to the elect rical input of a system, expressed in the frequency domain. For HIRF, a typical transfer function is the ratio of the current on a wire bundle to the external HIRF field strength, as a function of frequency.

Timely manner: t imely recovery has been introduc ed to account for the necessary period for complex systems to reconfigure safely after a disruption. The meaning of ‘in a timely manner’ therefore depends upon the function performed by the system to be evaluated, the specific system design, the interactio ns between that system and other systems, and interactions between the system and the flight crew. The definition of ‘in a timely manner’ must be determined for each specific system and for the specific functions performed by the system.

The applicable def inition could be included in the HIRF compliance plan for review and concurred with the Agency.

Upset: a n impairment , either permanent or momentary, of the system operation. For example, a change of digital or analogue state that may or may not require a m anual reset.

User’s G uide: t his refers to SAE D ocument ARP 5583A or EUROCAE Document ED - 107A.

2. Acronyms AC: advisory circular AMC: acceptable means of compliance ARP: aerospace recommended practice CS: certification specification DAL: development assurance level (ED - 79A / ARP 4754A) / design assurance level (ED - 80 / DO - 254) EASA: European Union Aviation Safety Agency EWIS: electrical wiring interconnection systems EUROCAE: European Organisation for Civil Aviation Equipment FDAL: functional development assurance level (ED - 79A / ARP 4754A) HCL: HIRF certification level HIRF: high - intensity radiated field ICA s : instructions for continued airworthiness IDAL: item development assurance level (ED - 79A / ARP 4754A) RTCA: Radio Technical Commission for Aeronautics SAE: Society of Automotive Engineers [Amdt 20/2 3 ] Powered by EASA eRules Page 548 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SU BPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20)

Appendix 2 to AMC 20 - 158A — Generic transfer functions and

attenuation

ED Decision 2022/001/R 1. Generic transfer functions a. Suitable transfer functions for calculating the bulk current injection test levels for L evel A display systems (see Section 8 ( k ) ) are given in Figures A1 - 1 through A1 - 5. These are derived generic transfer functions acquired from test results obtained from a significant number of aircraft. The test results were processed to establish a 95 per cent population probability.

b. The transfer functions are normalised to a 1 V/m HIRF environment and may be multiplied linearly by the external HIRF environment to est ablish the bulk current injection test level requirements in the frequency range from 10 kHz up to 400 MHz. For example, if the HIRF environment is 100 V/m at 3 MHz, then using Figure A1 - 1, multiply 0.7 mA/V/m by 100 V/m to establish a test level of 70 mil liamperes (mA).

c. Consult the User ’ s Guide (SAE ARP 5583A / EUROCAE ED - 107A) for details on the use of generic transfer functions.

F igure A1 - 1 : Generic transfer function — Aeroplane s Note : Generic transfer function normalised to 1 V/m for an aircraft with a fuselage length of ≤ 25 m .

Powered by EASA eRules Page 549 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) F igure A1 - 2 : Generic transfer function — Aeroplane s Note : Generic transfer function normalised to 1 V/m for an aircraft with a fuselage length of > 25 m and ≤ 50 m .

F igure A1 - 3 : Generic transfer function — Aeroplane s Note : Generic transfer function normalised to 1 V/m for an aircraft with a fuselage length of > 50 m .

Powered by EASA eRules Page 550 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) F igure A1 - 4 : Generic transfer function — Rotorcraft Note : Generic transfer function normalised to 1 V/m for a rotorcraft .

F igure A1 - 5 : Generic transfer function — All aircraft Note : Generic transfer function normalised to 1 V/m for all aircraft .

Powered by EASA eRules Page 551 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) 2. Generic a ttenuation a. Figure A1 - 6 shows the generic attenuation for frequencies from 100 MHz to 18 GHz that can be used for determining the internal HIRF environment where the equipment and associated wiring for L evel A display systems (see Section 9 ( k ) ) are installed. This int ernal HIRF environment provides the test level for the integrated system radiated susceptibility laboratory test. The external HIRF environment should be divided by the appropriate attenuation, in linear units, to determine the internal HIRF environment. F or example, 12 dB or a 4:1 attenuation means that the test level is the applicable external HIRF environment electric field strength reduced by a factor of 4.

b. Guidance on the use of the generic attenuation is given below: 1. No a ttenuation . No attenuati on credit can be used when the L evel A display equipment and the associated wiring are located in aircraft areas with no HIRF shielding, such as areas with unprotected , non - conductive composite structures, areas where there is no guarantee of structural bo nding, or other open areas where no shielding is provided. The applicant may choose to use no attenuation for equipment that may be installed in a broad range of aircraft areas.

2. 6 dB a ttenuation . This attenuation is appropriate when the L evel A display equipment and the associated wiring are located in aircraft areas with minimal HIRF shielding, such as a cockpit in a non - conductive composite fuselage with minimal additional shielding, or areas on the wing leading or trailing edges, or in wheel wells.

3. 12 dB a ttenuation . This attenuation is appropriate when the L evel A display equipment and the associated wiring are located entirely within aircraft areas with some HIRF shielding, in aircraft with a metal fuselage or a composite fuselage with shielding e ffectiveness equivalent to metal. Examples of such areas are avionics bays not enclosed by bulkheads, cockpits, and areas near windows, access panels, and doors without EMI gaskets. Current - carrying conductors in this area, such as hydraulic tubing, contro l cables, wire bundles, and metal wire trays, are not all electrically bonded to the bulkheads they pass through.

4. 20 dB a ttenuation . This attenuation is appropriate when the L evel A display equipment and the associated wiring are located entirely within aircraft areas with moderate HIRF shielding, in aircraft with a metal fuselage or a composite fuselage with shielding effectiveness equivalent to metal. In addition, wire bundles passing through bulkheads in these areas have shields electrically bonded to the bulkheads. Wire bundles are installed close to metal structure and take advantage of other inherent shielding characteristics provided by metal structure. Current - carrying conductors, such as hydraulic tubing, cables, and metal wire trays are electric ally bonded to all the bulkheads they pass through.

5. 32 dB a ttenuation . This attenuation is appropriate when the level A display equipment and all the associated wiring to and from equipment are located entirely within areas with very effective HIRF shie lding to form an electromagnetic enclosure.

6. Generic a ttenuation for r otorcraft . Display units installed in rotorcraft typically have minimal attenuation unless specific shielding is provided in the bulkhead, glare shield, panel, and doors.

Powered by EASA eRules Page 552 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERA L of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) c. Different attenuation values may be appropriate for different frequency ranges. For example, 0 dB attenuation may be used for the frequency range of 100 to 400 MHz, 6 dB attenuation for the frequency range of 400 MHz to 1 GHz, and 12 dB attenuation for the frequency range of 1 to 18 GHz. If an applicant intends to use different attenuation values for various frequency ranges, then they should also provide the supporting rationale.

d. Consult the User ’ s Guide (SAE ARP 5583A / EUROCAE ED - 107A) for details on the use of generic attenuation.

3. Measured t ransfer f unctions or a ttenuation The applicant may produce their own generic transfer functions and attenuation for their L evel A display systems (see Section 9 ( k ) ) based on actual measurements on their aircraft models.

These transfer functions and the attenuation can then be used in their HIRF compliance submission in place of the generic transfer functions and attenuation specified in this A ppendix.

The Agency enc ourages this approach because it provides a more accurate reflection of the true internal HIRF environment for aircraft models. However, if an applicant intends to produce their own generic transfer functions and attenuation, then this approach should also be addressed in the HIRF compliance plan (see Section 6 ( a ) ) that is submitted to the Agency for acceptance.

F igure A1 - 6 : Generic attenuation values — All aircraft 100 MHz to 18 GHz [Amdt 20/2 3 ] Powered by EASA eRules Page 553 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20)

Appendix 3 to AMC 20 - 158A — Examples of HIRF safety assessment

considerations — Level A systems on large aeroplanes

ED Decision 2022/001/R 1. Establishing appropriate pass/fail criteria for complying with CS 25.1317(a) can only be achieved through a comprehensive review of the system design using an accep table HIRF functional hazard assessment process in the form of a system HIRF certification level (HCL). The following paragraphs summarise the approaches whereby pass/fail criteria for compliance with CS 25.1317(a) are specified on the merit of specific sy stem architecture attributes.

2. For the purposes of discussion and evaluation of the examples, the architectural strategies used in the system implementation need to be defined. Therefore, the additional definitions below should be considered: a. Similar r edundant c hannels : t he multiple channels consist of equipment, components, electrical interconnections and configurations that are similar, typically with pieces of equipment that have identical part numbers. The channels should be independent. They may be configured in active, active - backup and passive - backup modes.

b. Dissimilar r edundant c hannels : e ach channel is unique and independent of the others.

They may be configured in active, active - backup and passive - backup modes.

c. Combination of s imilar and d issimilar r edundant c hannels : t he combination of similar and dissimilar channels , as defined above , with independence between channels. They may be configured in active, active - backup and passive - backup modes.

Notes : a. ‘ Active mode ’ means that the channel performs the aircraft function in normal operation.

b. ‘ Active - backup mode ’ means that the channel is operational but not used to perform the aircraft function until switched to active mode either automatically or by flight crew action.

c. ‘ Passive - backup mode ’ means that the channel is not operational; switching to active mode is either automatic or b y flight crew action upon failure recognition.

d. ‘ Combination of e lectrical/ e lectronic and m echanical, h ydraulic and/or p neumatic c hannels ’ : c ertain architectures combine electrical and electronic channels with mechanical, hydraulic and/or pneumatic chann els. These combinations of electrical/electronic and mechanical, hydraulic or pneumatic channels may be configured in active, active - backup and passive - backup modes.

e. These examples are theoretical and intended to facilitate the discussion from which uni versal guidelines may be derived to help develop useful guidance material. It is not the intention to account for all possible configurations but only to represent the common system architectures or some that present unique challenges.

Powered by EASA eRules Page 554 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) 3. This Appendix p resents examples of l arge a eroplane systems with multiple independent and redundant channels that perform a function whose failure would prevent continued safe flight and landing.

These examples could also be used for other types of aircraft.

Example 1 25.1317(a) Function Channel Channel Channel Display of attitude, altitude, and Active Active Active - backup airspeed information to the pilots during IFR operations (Dissimilar standby (e.g. primary display system and (Pilot displays and (Co - pilot displays display and associated sensors, with dissimilar associated sensors) and associated associated sensors) standby display system and sensors) sensors) Requirements for compliance (a)(1), (a) (2), (a) (3) (a)(1), (a) (2), (a) (3) (b) demonstration (CS 25.1317) Discussion: This example depicts the specification of CS 25.1333 for independent displays of information essential to the safety of flight at each pilot station. The standby display is required in order to achieve the safet y objectives of CS 25.1309. Either the pilot or the co - pilot can be the pilot flying (PF) or pilot monitoring (PM) during normal operations, so both the pilot and the co - pilot display systems should be considered as active systems.

Compliance with CS 25.1 317(a)(1), (a)(2), and (a)(3) should demonstrate that neither pilot display of aircraft attitude, altitude, and airspeed is adversely affected and recovers normal operation of these L evel A functions when the aircraft is exposed to HIRF E nvironment I and I I. It is acceptable that the dissimilar standby display demonstrates compliance with the CS 25.1316(b) requirements. The adverse effects must include both a loss of, and hazardously misleading, attitude, altitude, and airspeed information.

Example 2 25.1317(a) System Function Channel Channel Channel Full authority control of pitch, yaw, Active or Active or Active or and roll using electrical and electronic a ctive - backup a ctive - backup a ctive - backup flight control systems (Flight control (Flight control (Flight control system #1) system #2) system #3) Requirements for compliance (a)(1), (a) (2), (a) (3) (a)(1), (a) (2), (a) (3) (a)(1), (a) (2), (a) (3) demonstration (CS 25.1317) Discussion: This example depicts an electronic flight control system that compris es three independent channels to meet the safety objectives of CS 25.1309. At any time, any one of the three channels can operate as the active channel.

Only one channel operates in an ac tive mode while the others are in active - backup mode. Any channel can perform the control function at any time; therefore, all the channels must comply with CS 25.1317(a)(1), (a)(2), and (a)(3).

Powered by EASA eRules Page 555 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Example 3 25.1317(a) System Function Channel Channel Channel Provide engine overspeed protection Active Active or Active ( E lectronic engine active - backup control system) (Electronic engine (Independent control system) mechanical overspeed (Normal s peed (Overspeed protection) c ontrol) protection) Requirements for compliance (b) (b) Not subject to demonstration (CS 25.1317) CS 25.1317 Discussion: This example depicts the function of engine overspeed protection performed by a combination of active electrical and electronic control and mechanical system control. The mechanical channel must provide overspeed protection during normal operations, and be independent of the active electronic control channels. The mechanical channel must not rely on electrical or electronic components to assist, augment, or monitor the overspeed protection. If the mechanical channel is independent of the electronic engine c ontrol speed control and overspeed protection, and has no electrical or electronic components that have failure modes that could prevent overspeed protection, then the engine overspeed protection function is not adversely affected when the aircraft is expo sed to HIRF E nvironment I and II. The system is , therefore , not subject to CS 25.1317(a). The electronic engine control channels should comply with CS 25.1317(b).

This example only considers the overspeed protection feature implemented by the system. Other functions whose failure may be classified as catastrophic, such as the loss of thrust control function where the function may be implemented by electronic control channels, should comply with CS 25.1317(a).

Example 4 25.1317(a) System Function Channel Channel Channel Provide electrical power for electrical Active Active Passive - backup and electronic systems including those with catastrophic failure conditions (Left engine (Right engine (Emergency p ower generator system) generator system) supply system driven by ram - air turbine) Requirements for compliance (a)(1), (a) (2), (a) (3) (a)(1), (a) (2), (a) (3) (b) demonstration (CS 25.1317) Discussion: This example depicts a typical transport category aircraft electrical system on a twin - engined aircraft where two or more independent sources of electrical power are required by CS 25.1307(b) and a ram - air turbine is necessary to meet the safety objectives of CS 25.1309 and CS 25.1351(d).

For this example, the electrical sys tem consists of two active channels provided by a single main - engine - driven generator on each engine with the associated distribution and controls, and a third passive - backup channel provided by a ram - air turbine electrical power system. The ram - air turbin e electrical power system is stowed during normal operation and deployed either automatically and/or manually when power from the two main - engine - driven generators is lost.

The active engine generator system channels must not be adversely affected when the aircraft is exposed to HIRF E nvironment I and II, and comply with CS 25.1317(a)(1), (a) (2), and (a) (3). The passive - backup ram - air turbine electrical power system does not mitigate adverse effects for compliance with CS 25.1317(a). It is acceptable that t he ram - air turbine electrical power system demonstrates compliance with the CS 25.1317(b) requirements.

Powered by EASA eRules Page 556 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Example 5 25.1317(a) System Function Channel Channel Channel Channel Provide electrical power for Active Active Active Passive - backup electrical and electronic systems including those (Left engine (Right engine (APU - driven (Emergency with catastrophic failure generator generator generator system power supply conditions system) system) required for drive n by ETOPS flight ram - air turbine) beyond 180 ' ) Requirements for (a)(1), (a) (2), (a)(1), (a) (2), (a)(1), (a) (2), (b) compliance demonstration (a) (3) (a) (3) (a) (3) (CS 25.1317) Discussion: This example depicts a twin - engined transport category aircraft electrical system where two or more independent sources of electrical power are required by CS 25.1307(b) and an alternate source (driven by a ram - air turbine) is necessary to meet the safety objectives of CS 25.1309 and CS 25.1351(d). This configuration includes a third electrical power source driven by an auxiliary power unit (APU). This third source is required ( a ctive channel) for ETOPS beyond 180 minutes.

As in Example 4, the emergency po wer source is a passive - backup channel provided by a ram - air turbine that remains stowed during normal flight and deployed either automatically and/or manually when power from all other channels is lost.

All active electrical power generation channels shou ld comply with CS 25.1317(a)(1), (a)(2), and (a)(3). The passive - backup electrical power generation channel does not mitigate the adverse effects due to HIRF exposure to meet the intent of the HIRF requirements . It is acceptable that the passive - backup cha nnel demonstrate compliance with CS 25.1316(b) requirements.

Note : For non - ETOPS or for ETOPS up to 180 ' aircraft, the APU HIRF certification level should be defined based on the specific aircraft safety assessment.

Powered by EASA eRules Page 557 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Example 6 25.1317(a) System 25.1317 System 25.1317 System System Function Channel Channel Channel Channel Reduce aircraft speed Active Active Active Active on ground in a controlled manner Main brake system (Electronic engine (Elect ronic spoiler (Independent using thrust reverser ( E lectro - thrust reverse deployment mechanical control system, spoiler mechanical) control with control with wheel braking) deployment system, associated associated and wheel braking sensors) sensors) system Requirements for (a)(1), (a) (2), (a) (3) 25.1317(a), (b) or 25.1317(a), (b) or Not subject to compliance (c) depending on (c) depending on CS 25.1317 demonstration specific aircraft specific aircraft (CS 25.1317) safety assessmen t safety assessment Discussion: This example depicts an aircraft - level function that is performed by a combination of independent systems each contributing in part to the function during a specific phase of flight. In this case, each system implements a very distinct aircraft - level function that serves in a complementary manner to decelerate the aircraft during the landing roll. The mechanical wheel braking system is as sumed to be independent of the other channels, with no associated electrical or electronic equipment to assist, augment, or monitor the mechanical wheel braking system.

In this example, it is assumed that the main brake system includes failure conditions t hat are catastrophic.

For the electronic engine thrust reverser control and the electronic spoiler control systems, the applicable parts of CS 25.1317 would depend on the specific failure conditions. The effectiveness, authority, and malfunctions associate d with each system should be considered. Additionally, the interaction between the systems has also to be considered. Issues such as asymmetrical thrust reverser activation or spoiler deployment could adversely affect the main brake and mechanical wheel br aking functions and could affect the safety classification for the thrust reverser and spoiler controls.

An aircraft safety assessment must be carried out for each of these systems that perform a specific aircraft - level function to identify and classify th eir failure conditions. The failure hazard classifications and the decomposition of each system into the constituent channels would then dictate which paragraphs of CS 25.1317 are needed.

Powered by EASA eRules Page 558 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 158A Products, Parts and Appliances (AMC - 20) Example 7 25.1317(a) System Function Channel Channel Channel Provide altitude information to be Active Active Active - backup display ed in IFR flight using air - data computer connected to the primary (Air - data computer (Air - data computer (Pneumatic flight display ( PFD ) , and pneumatic 1 with static port) 2 with s tatic p ort) standby altimeter standby instrument with alternate with alternate static port static port) Requirements for compliance (a)(1), (a) (2), (a) (3) (a)(1), (a) (2), (a) (3) Not subject to demonstration (CS 25.1317) CS 25.1317 Discussion: This example depicts the function to provide altitude information. The main sources are two air - data computers (ADCs) coupled to static ports and a backup source from a standby pneumatic altimeter coupled to an alternate static port independent from the main static ports.

In such a case, the standby altimeter does not mitigate compliance with CS 25.1317(a) for the active ADC channels. The standby altimeter does not mitigate the common hazardously misleading altitude information from the active A DC channels for compliance with CS 25.1317(a).

Example 8 25.1317(a) System Function Channel Channel Channel Control and protection of the aircraft Active Active Passive - backup pneumatic (bleed) system (Pneumatic system ( P neumatic system (High pressure (Top - level failure condition controller #1) controller #2) switch + valve) classification: catastrophic) FDAL B / IDAL B FDAL B / IDAL B FDAL C / IDAL C Requirements for compliance (a)(1), (a) (2), (a) (3) (a)(1), (a) (2), (a) (3) (b) demonstration (CS 25.1317) Discussion: This is a generic example with the objective to show that not rarely the HIRF certification level (HCL) of a given system will be different from the f unctional d evelopment a ssurance l evel (FDAL) and i tem d evelopment a ssurance l evel (IDAL), defined according to SAE ARP 4754A / EUROCAE ED - 79A Guidelines for Development of Civil Aircraft and Systems.

Therefore, it is important to use the proper nomenclature and avoid SAE ARP 4754A / EUROCAE ED - 79A ‘ DAL ’ or similar terms when referring to the HCL.

In this example, the pneumatic control system is composed of two main active controllers and a simpler p assive - b ackup channel that can perform the function, preventing the catastrophic event in case of the failure of both contro llers.

The FDAL for each channel or member (SAE ARP 4754A / EUROCAE ED - 79A nomenclature) was defined for a catastrophic top - level failure condition based on the ‘Option 2’ column 4 of Table 3 DEVELOPMENT ASSURANCE LEVEL ASSIGNMENT TO MEMBERS OF A FUNCTIONAL FAILURE SET of SAE ARP 4754A / EUROCAE ED - 79A , which allows the combination of FDALs B+B+C for independent channels. In contrast, the respective HCLs would be A+A+B.

Considering that HIRF can simultaneously affect all the channels, the considera tions used for IDAL assignment cannot be used, and compliance with CS 25.1317(a) is required for both the active channels that perform a function with the catastrophic top - level failure condition.

In this example, the IDAL for the passive - backup channel ma y be C. However, for HIRF, the applicable part of CS 25.1317 is (b), similarly to Example 5.

[Amdt 20/2 3 ] Powered by EASA eRules Page 559 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20)

AMC 20 - 170

AMC 20 - 170 In tegrated modular avionics (IMA)

ED Decision 2018/008/R 1. Introduction 1.1. Purpose This Acceptable Means of Compliance (AMC) provides a means that can be used to demonstrate that the safety aspects of integrated modular avionics (IMA) systems comply with the airworthiness requirements when such systems are integrated in a product, a part , or an appliance submitted to EASA for approval.

Compliance with this AMC is not mandatory and hence an applicant may elect to use alternative means of compliance. However, those alternative means of compliance must meet the relevant certification specif ications, ensure an equivalent level of safety, and be accepted by EASA on a product basis.

1.2. Scope and applicability The guidance contained in this AMC applies to any type certificate (TC) or supplemental type certificate (STC) applicants seeking ap proval from EASA for IMA systems installed in aircraft or rotorcraft.

IMA is a shared set of flexible, reusable and interoperable hardware and software resources that, when integrated, form a system that provides computing resources and services to hosted applications performing aircraft functions [ED - 124].

An IMA architecture may integrate several aircraft functions on the same platform. Those functions are provided by several hosted applications that have historically been contained in functionally and physically separated ‘boxes’ or line replaceable units (LRUs).

This AMC addresses certification considerations for IMA systems, and should apply when: — hosted applications* on the same platform are designed, verified and integrated independently (at application level**) from each other; and — the platforms/modules provide shared resources (typically designed, verified and integrated independently from the hosted applications), OR — a process for obtaining incremental certification*** credit is anticipated or applied.

* A single application hosted on an independently developed platform is considered to be a traditional federated architecture and thus is not subject to this AMC.

However, if additional application(s) that is (are) independently developed is (are) hosted on the same platform at a later stage (e.g. through a major change), this AMC should be applied.

** Software integration/verification activities are not performed on the whole set of integrated software as in a federated architecture.

*** Credit for incre mental certification in an IMA context as detailed in Section 4.

Powered by EASA eRules Page 560 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) An applicant may choose to apply this AMC for a system which would not fulfil the conditions above. In that case, early discussions should take place between the applicant and EASA in order to confirm whether this AMC should be followed or not.

1.3. Document overview This document: (a) provides an overview of and background information on IMA systems and on concerns related to their certification (Section 2); (b) presents the EASA poli cy for IMA certification by recognising the use of EUROCAE document ED - 124, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations, as an acceptable means of compliance for the development and certification of IMA systems. It also clarifies and amends the intent, scope, and use of that document (in Section 3); (c) introduces the incremental certification approach, and introduces the link to ETSO authorisations (ETSOAs) (in Section 4); (d) complements ED - 124 with addition al considerations on dedicated topics, such as environmental qualification, open problem reports (OPRs), and configuration files (in Section 5).

1.4. Documents to be used with this AMC This AMC should be used together with the following documents. The a pplicable version of the documents for a given project will be established in the certification basis or in the applicable CRIs.

Reference Title ED - 124/DO - 297 Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations ED - 79/ARP4754* Certification Considerations for Highly - Integrated or Complex Aircraft Systems ED - 79A/ARP4754A Guidelines for Development of Civil Aircraft and Systems ED - 12()/DO - 178()** Software Considerations in Airborne Systems and Equipment Certification ED - 80/DO - 254 Design Assurance Guidance for Airborne Electronic Hardware ARP4761() Guidelines and Methods for Conducting the Safety Assessment Process on Airborne Systems and Equipment ED - 14()/DO - 160() Environmental Conditions And Test Procedures For Airborne Equipment ED - 215/DO - 330 Software Tool Qualification Considerations * ED - 79A should be used, unless ED - 79 is the applicable document in a given project.

** Recommendations for software are developed in AMC 20 - 115().

1.5. Referenced material 1.5.1. Certification specifications (CS) and acceptable means of compliance (AMC) Reference Title CS XX.1301 Function and installation CS XX.1302 Installed systems and equipment for use by the flight crew CS XX.1309 Equipment, systems and installations Powered by EASA eRules Page 561 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) Reference Title AC 23.1309 - 1() System safety analysis and assessment for Part 23 airplanes AMC 25.1309 System design and analysis AC 27.1309 Equipment, systems and installations AC 29.1309 Equipment, systems and installations CS XX.1322 Flight crew alerting CS - E 50 Engine control system AMC E 50 Engine control system AMC 20 - 3 Certification of engines equipped with electronic engine control systems AMC 20 - 115() Software considerations for certification of airborne systems and equipment ETSO - 2C153 Integrated Modular Avionics (IMA) platform and modules ETSO - C214 Functional - ETSO equipment using authorised ETSO - 2C153 IMA platform or module The applicable version of the documents for a given project will be established in the certification basis or in the applicable CRIs.

1.5.2. Referenced documents Reference Title ED - 94C Supporting information for ED - 12C and ED - 109A 1.6. Definitions and abbreviations 1.6.1. Definitions Term Meaning Aircraft A capability of the aircraft that is provided by the hardware and function software of the systems on the aircraft. [ED - 124] Application Software and/or application - specific hardware with a defined set of interfaces that, when integrated with a p latform(s), performs a function. [ED - 124] Cabinet Result of the integration of hardware modules mounted within one rack. [ETSO - 2C153] Compliance Evidence that a set of objectives related to certification requirements credit has been reached for a compone nt or a set of components.

Credit can be full or partial, meaning that, in case of partial credit, some objectives allocated to the component were not yet satisfied and should be completed at another stage.

Component A self - contained hardware part, softwa re part, database, or combination of them that is configuration - controlled. A component does not provide an aircraft function by itself. [ED - 124 Chapter 2.1.1] Core software The operating system and support software that manage resources to provide an env ironment in which applications can execute. Core software is a necessary component of a platform and is typically comprised of one or more modules (such as, for example, libraries, drivers, kernel, data - loading, boot, etc.). [ED - 124] Federated Airc raft equipment architecture consisting of primarily line system replaceable units that perform a specific function, connected by dedicated interfaces or aircraft system data buses. [ED - 124] Powered by EASA eRules Page 562 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) Term Meaning IMA system Consists of an IMA platform(s) and a defined set of hosted applications. [ETSO - 2C153] Incremental The incremental certification process is the process by which EASA certification agrees to grant compliance credit to IMA modules/platforms or hosted applications considered independently, based on activities performed at intermediate steps.

Intermixability The capability to intermix software and/or hardware of different versions and/or modification standards. [ED - 124] Interoperability The capability of several modules to operate together to accomplish a spec ific goal or function. [ED - 124] Module A component or collection of components that may be accepted by themselves or in the context of an IMA system. A module may also comprise other modules. A module may be software, hardware, or a combination of hardwar e and software, which provides resources to the IMA system hosted applications. [ED - 124] Module/ The action of setting some adjustable characteristics of the platform module/platform in order to adapt it to the user context.

configuration By extension, th e result of this action.

NOTE: A configuration table is one way but not the only way to configure a module/ platform.

Partitioning Partitioning is ‘An architectural technique to provide the necessary and robust separation and independence of functions or applications to ensure partitioning that only intended coupling occurs.’ [ED - 124] Robust partitioning is a means for assuring the intended isolation in all circumstances (including hardware failures, hardware and software design errors, or anomalous behavi our) of aircraft functions and hosted applications using shared resources. The objective of robust partitioning is to provide a level of functional isolation and independence equivalent to that of a federated system implementation.

Platform A module or group of modules, including core software, that manages resources in a manner sufficient to support at least one application.

[ED - 124] Resource Any object (processor, memory, software, data, etc.) or component used by a processor, IMA platform, core softw are or application. A resource may be shared by multiple applications or dedicated to a specific application. A resource may be physical (a hardware device) or logical (a piece of information). [ED - 124] Support Embedded software necessary as a co mplement to the operating software system to provide general services such as contributing to the intended function of resources sharing, handling hardware, drivers, software loading, health monitoring, boot strap, etc. [ETSO - 2C153] Usage domain The usage domain o f an IMA module is defined as an exhaustive list of conditions (such as configuration settings, usage rules, etc.) to be respected by the user(s) to ensure that the IMA module continues to meet its characteristics. Compliance with the usage domain ensures that: the module is compliant with its functional, performance, safety and environmental requirements specified for all implemented intended functions; the module characteristics documented in the user guide/manual remain at the levels guaranteed by the ma nufacturer; Powered by EASA eRules Page 563 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) Term Meaning the module remains compliant with the applicable airworthiness requirements (including continuing airworthiness aspects).

[Adapted from ETSO - 2C153, without reference to the ETSO Minimum Performance Standard] 1.6.2. Abbreviations Abbreviation Meaning AEH airborne electronic hardware AMC acceptable means of compliance API application programming interface ATA air transport association of America CRI certification review item CS certification specification EASA European Aviation Safety Agency ETSO European technical standard order ETSOA European technical standard order authorisation F - ETSO functional ETSO HW hardware IDAL item development assurance level I/O input/output IMA integrated modular avionics LRU line replaceable unit MMEL master minimum equipment list OPR open problem report RSC reusable software component SOI stage of involvement STC supplemental type certificate SW software TC type certificate TQL tool qualification level TSO technical standard order TSOA technical standard order authorisation 2. Background The use of IMA has rapidly expanded in the last two decades and is expected to progress even more in the future in all types of products, parts and appliances. Additional guidance is hence needed to address specific aspects at the application, component, p latform, system, and aircraft levels.

2.1. IMA overview A representation of a simple IMA architecture is illustrated in Figure 1: — Applications implementing several aircraft functions are hosted on the same platform. Several applications (e.g. Applications 1.1 & 1.2) may contribute to the same aircraft function.

Powered by EASA eRules Page 564 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) — The platform consists of: — a hardware layer offering resources shared by the applications; and — a software layer, also known as ‘middleware’, including the operating system, health mon itoring, various kinds of services and hardware drivers (core software [ED - 124] and support software [ETSO - 2C153]).

— Through the middleware, the platform mainly: — provides services to the software applications; — manages the interfaces between software appl ications; — manages the internal/external resources shared between software applications; and — ensures isolation between applications.

— External inputs/outputs (I/Os) may encompass a wide scope of interfaces such as discrete data, various data buses or anal ogue signals.

— The software applications and the platform may be independently provided by different stakeholders (i.e. different system suppliers, or entities pertain ing to the same company/group).

Figure 1 — Illustration of an IMA architecture Note: Examples of different classes of electronic hardware parts constituting a platform/module can be found in ETSO - 2C153.

Figure 2 shows a functional projection of an IMA architecture at aircraft level: — Each aircraft function may have its own set of LRUs connected to the platform (which provides/gets the data to/from the application).

Powered by EASA eRules Page 565 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) — The set of I/O may cover a large range of items, such as: — input items: data from sensors, control panels, data received from other applications/systems; — out put items: data to actuators, displays, and data transmitted to other applications/systems.

Figure 2 — Functional projection of an IMA architecture at aircraft level An example of an IMA architecture is illustrated in Figure 3.

Figure 3 — Illustration of an IMA architecture Powered by EASA eRules Page 566 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) 2.2. IMA system breakdown into aircraft systems (ATA chapters) The organisation of an IMA system into aircraft systems (e.g. ATA chapters) provides structure to a certification project and to the methods used to demonst rate compliance.

This breakdown may depend on (this list is not exhaustive): — the aircraft and systems’ architecture; — the industrial organisation and work sharing; — the applicant’s development methods; and/or — the aircraft maintenance principles and procedures (closely linked to ATA - XX chaptering).

Note: Applicants may elect to address the IMA items and activities (not the hosted functions) within an ATA chapter dedicated to IMA systems such as ATA - 42.

2.3. IM A certification concerns From a certification viewpoint, the use of an IMA architecture raises the following concerns: — failures or faults of the IMA platforms (including hosted applications) or LRUs connected to the communication network and the associat ed interfaces may cause the malfunction, loss or partial loss of more than one function; — the potential for some failures to propagate and create multiple failure conditions; — the lack of design independence among common hardware resources; — susceptibility to common mode failures, faults or design errors, within several identical modules or within the communication network; — a lack of assurance that the system will behave as intended once all the hosted applications are integrated onto the platform/modules, when software and electronic hardware items have been independently developed and verified; — inappropriate resource management leading to potential access conflicts and a lack of determinism or unexpected system behaviour; and — improper isolation mechanis ms or configuration not ensuring correct partitioning between functions.

2.4. Functional isolation and independence From a safety perspective, the primary purpose of the IMA design and certification activities is to demonstrate that the level of functio nal isolation and independence between the aircraft functions hosted in the IMA system is equivalent to that which would be achieved in a federated architecture.

Functional isolation mostly relies on three pillars: — proper allocation of shared resources, to prevent adverse interference between hosted applications; — robust partitioning, concretely assuring the isolation and detection/mitigation of partitioning violations; — fault containment, to prevent the propagation of faults between hosted applications.

Powered by EASA eRules Page 567 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) 3. Policy for IMA system certification This section provides guidance to be used for the certification of an IMA system. Considering the IMA architecture, industrial organisation, and the experience in IMA system d evelopment of the applicant, several approaches are considered: — use of the ED - 124 standard; — use of an alternative means to demonstrate compliance; — use of previously recognised IMA certification processes.

3.1. Use of ED - 124 3.1.1. Recognition of ED - 1 24 EUROCAE document ED - 124 on Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations, published in July 2007 (equivalent to the RTCA document DO - 297), provides guidance for the development and certification of IMA systems.

The use of ED - 124 is acceptable to EASA to support the certification of IMA systems when it is used in conjunction with the additional considerations described in this AMC.

3.1.2. Scope of this AMC with respect to ED - 124 ED - 124 encompasses various aspe cts and some concepts which are not compatible with the EASA system or which are considered to be outside the scope of this AMC: — It is not the intent of this AMC to cover the development processes for aircraft functions, even if they are implemented by ap plications hosted in an IMA system.

— In relationship with ED - 124, it is not the intent of this AMC to cover: — operational aspects of master minimum equipment lists (MMELs) (ED - 124 Chapter 3.9); — considerations for continued airworthiness (ED - 124 Chapter 6) ; — the safety assessment process (ED - 124 Chapter 5.1).

— The cybersecurity aspects (ED - 124 Chapter 5.1.5.8) are not adequate, and should be superseded by the applicable cybersecurity standards as defined in the project certification basis.

— Regarding the in cremental certification process presented in ED - 124: — the ‘letter of acceptance’ concept is not feasible in the EASA context.

The certification given by EASA is limited to only a specific aircraft type certification (TC), or to a subsequent aircraft level certification of a system change or in the frame of a supplemental type certificate (STC), or granted through an ETSOA; — the alternate concept of ‘reusable software component (RSC)’ acceptance as described in ED - 124 Chapter 4, Table 4, with reference to FAA AC 20 - 148, is not feasible in the EASA context as it makes use of acceptance letters for software parts.

Powered by EASA eRules Page 568 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) 3.1.3. Clarification and use of ED - 124 ED - 124 defines a complete ‘end - to - end’ framework and a set of objectives to support the certification of IMA systems, i.e. from the development of software/airborne electronic hardware (SW/AEH) items to aircraft integration.

As it covers the complete deve lopment and certification of IMA systems, ED - 124 may contain some objectives, activities and life cycle data similar to those that apply to a federated architecture, and which may not be IMA - specific. Additionally, some considerations in ED - 124 may overlap or may be considered to be addressed by other applicable guidance documents (e.g. ED - 79).

The way in which ED - 124 was written, e.g. by allocating objectives, activities and life cycle data to the various ‘tasks’, should therefore not be interpreted: — as imposing a unique scheme in terms of the project organisation, sequencing of activities and expected life cycle data required to meet the objectives; or — as requesting the duplication of activities or life cycle data.

The following sections further expla in the flexibility which is inherent in the ED - 124 approach and which is fully recognised by EASA.

3.1.3.1. The ED - 124 task framework ED - 124 structures the IMA development activities by tasks and objectives to be achieved at the AEH/SW/module item level. This framework also suggests a definition of roles and responsibilities of the different stakeholders involved in the IMA system development (e.g. application supplier, IMA system integrator).

Figure 4 illustrates a mapping between an IMA system breakdow n and the certification tasks of ED - 124: Figure 4 — Mapping between an IMA system and the ED - 124 certification tasks Powered by EASA eRules Page 569 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) Among the considerations detailed in the ED - 124 tasks, the key IMA specificities are: — Task 1: the need to develop resources/services to be shared by applications and the adequate associated mechanisms (partitioning, health monitoring, etc.), and the need to document these resources, services and mechanisms for the IMA platform users; — Task 2: the need to characterise the applications in ter ms of their resource usage and execution constraints, and the need to verify that the applications satisfy the usage domain of the platform; — Task 3: the need to verify that the whole set of applications complies with the platform usage domain, and the prop er implementation of the resource allocation and platform configuration requests from the applications; — Task 4: has little specificity in comparison with non - IMA systems.

3.1.3.2. Relationship with other guidelines In order to maximise the credit taken from other standards and existing processes, two certification approaches based on the ED - 124 tasks and objectives are considered eligible to support an IMA system certifica tion: (a) an IMA system perspective: by considering the application of ED - 124 as a complete and consistent set of objectives; (b) an aircraft perspective: where the IMA system certification and its specificities are addressed within the global framework of the aircraft certification and its related processes. This means that ED - 124 considerations/objectives may be covered by other ai rcraft system processes and activities.

As ED - 79 provides guidance and acceptable means of compliance for the development of systems, ED - 79 processes may be used to cover ED - 124 objectives and activities. However, the use of ED - 79 will not ensure exhausti ve coverage of the ED - 124 objectives. Consequently, the IMA - specific objectives and activities of ED - 124 will remain to be addressed separately from the ED - 79 objectives.

These two approaches are suitable because they would ensure the completeness of the activities supporting an IMA system certification.

Powered by EASA eRules Page 570 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) Figure 5 — Links between ED - 124 tasks and other guidelines 3.1.3.3. Tailoring of ED - 124 tasks A task framework is proposed by ED - 124, but it is not the purpose of AMC 20 - 170 to enforce this division of tasks. The allocation of the ED - 124 objectives to the ED - 124 tasks can be tailored by the applicant.

For instance, an IMA specificity is the need to coordinate verification activities such that the performance of the integrated IMA system can be guarante ed without requiring the reverification of each hosted application on the entire integrated system: — ED - 124 Chapter 3.1.3 d.2 may be interpreted as requesting that IMA integration should be performed with the full set of applications.

However, the applican t may integrate and verify applications independently on the IMA platform, taking into account the platform properties (e.g. robust partitioning and resource management).

— Some Task 3 objectives may be already anticipated and accomplished during Task 2, or they may be deferred to Task 4.

If the applicant intends to develop an IMA system and the supported aircraft functions by tailoring the ED - 124 tasks or by following another framework, the applicant should detail the division of tasks, the objectives of e ach work package, and the associated activities.

Powered by EASA eRules Page 571 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) The applicant should describe how the work package objectives are mapped to the ED - 124 objectives in order to ensure that the objectives of ED - 124 are met within the alternative framework presented by the a pplicant. The ED - 124 life cycle data can be also adapted to the division of tasks and work packages defined by the applicant.

Moreover, ED - 124 Task 4 may have few IMA specificities compared to a federated architecture. The achievement of Task 4 to support compliance demonstration in the frame of this AMC could be deemed to be outside the scope of this AMC, provided that: — the aircraft integration activity is covered through other guidance and its related applicant processes (to be clarified in the certific ation plan); — Task 3 is complete: meaning that no objectives, activities, or life cycle data are deferred to or covered by Task 4.

Another area where tailoring can be performed is requirement validation.

ED - 124 Chapter 5.3.a. considers that each level of requirements within the hierarchy should be validated prior to validating the next lower level. A strict interpretation of this statement would not allow the development of a platform based on the assumptions for the intended use without consideration of t he final aircraft functions (as suggested in Chapter 4.2.1.b).

Also, it would imply a top - down approach from the aircraft functions to the level of hardware and the core/support software, which may not be relevant. A bottom - up approach is also feasible, wh ich involves ensuring that the platform usage rules and constraints identified in the platform user guide/manual (Chapter 4.2.12.e.) are fulfilled, and that they satisfy the IMA system requirements.

3.1.4. Use of alternative means to demonstrate complianc e If an applicant elects to comply with an alternative means to demonstrate compliance with the CS, consistency with the ED - 124 acceptance objectives in Annex A tables [A1 - A6] (IMA module/platform development process objectives) should be demonstrated.

Early coordination with EASA should be ensured.

3.2. Use of previously recognised means of compliance Applicants who did not use this AMC in their past IMA certifications and who successfully used other means of compliance that were: — discussed in specific CRI(s); — previously recognised as equivalent to the ED - 124 objectives; and — previously accepted by EASA for covering IMA certification concerns, may use the same means of compliance for their certification project, provided that the IMA system is similar to the previously certified one (i.e. with a similar architecture, the same design concepts, the same development process, and the same certification approach).

Early coordination with EASA to confirm the use of the applicant’s previ ously recognised means of compliance should be ensured.

Powered by EASA eRules Page 572 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) 3.3. Role of the IMA system certification plan ED - 124 objectives can be met by using various industrial mappings, based on the sharing of roles, activities and life cycle data. The strategy selecte d for demonstration of compliance with this AMC should be defined by the applicant in their certification plans.

An IMA system certification plan should introduce the planning, the organisation, the work share, work packages, and the development, validati on, integration, and verification activities of the IMA system.

Considerations regarding the content of an IMA system certification plan can be found in ED - 124 Chapter 4.4.3. The certification plan should particularly emphasise the following topics: — The scope covered by the IMA system certification plan and its relationship with other certification plans, including the certification plans of the aircraft functions hosted (totally or partially) on the IMA system.

— The strategy proposed by the applicant to demonstrate compliance with this AMC, including: — the certification approach selected (see paragraph 3); — the relationship and credit potentially taken from other standards or processes to satisfy the objectives of ED - 124; — the nature and extent of credit claimed from previously approved components (i.e. having obtained an ETSOA) or from activities performed on components reused from previous certification projects (see paragraph 4); — the identification of modules, platforms and applications for which full or partial incremental compliance credit is sought.

— The industrial organisation supporting the IMA system development and certification, including the roles, responsibilities and work share between the stakeholders, with, in particular: — the sharing of ac tivities related to aircraft functions hosted on the IMA platform and the IMA system integration activities; — when applicable, the tailoring and scope of the ED - 124 tasks, or ED - 124 life cycle data; — the work package allocated to each IMA stakeholder, incl uding the design, validation, verification and integration activities, including environmental qualification under their responsibility and the credit claimed for the incremental certification.

— The activities planned for the integration of the IMA system and its installation on an aircraft with an emphasis on: — the establishment of full or partial incremental credit gained from the integration, validation and verification activities conducted at each stage of the development, with their associated transiti on criteria. If a future step cannot be planned by a stakeholder, who for instance would — only perform the development of a function, the interface to future steps and the assumptions made (e.g. on resources used) need to be identified; Powered by EASA eRules Page 573 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) — the credit expect ed from the characteristics of the IMA platform to independently verify aircraft functions allocated or partially allocated to the IMA system; — the activities to be completed for the installation of an ETSO - 2C153 or C214 article; — the rationale for not per forming some ground or flight tests when the IMA system is installed on the aircraft.

— A description of the development and verification environments, with emphasis on the tools used to generate data or automate the activities and the rationale for the qua lification or non - qualification of the tools.

Note: A dedicated IMA system certification plan may not be required provided that its role is equivalently performed by a comprehensive set of documents in the applicant’s data package.

4. Incremental certification process As indicated in Section 3.1.2, the concepts of ‘letters of acceptance’ and of ‘reusable software components (RSCs)’ are not compatible with the EASA system.

Furthermore, within the EASA system, there is currently no mean s to benefit from the certification credit granted within a TC or an STC in the frame of another product certification.

Formal compliance credit can only be claimed from an ETSOA.

However, the lack of an ETSOA, or the absence of a letter of acceptance, do es not prevent an applicant from incrementally building confidence and demonstrating compliance of IMA components during the development flow (as per the ED - 124 task framework), nor does it prevent the reuse of previous certification artefacts and activiti es for a new demonstration of compliance.

The incremental certification process is the process to certify a product for which EASA agrees to grant some credit to a component/module, application or system, before that module, application or system is confi gured, integrated and certified as part of the final product. The incremental certification process applies to the following approaches: (a) Incremental component qualification: credit is taken from activities performed during various steps of the develo pment in order to reduce the effort during a subsequent phase (e.g. verification activities). This qualification is mainly built up using the incremental verification approach.

(b) Reuse: credit is taken from activities performed on components (modules, platforms, applications) reused from other projects. This approach encompasses the components reused from a previously approved TC or from legacy IMA systems.

(c) Compliance credit: formal credit is claimed from an ETSOA.

In all cases, the applicant should evaluate and substantiate the suitability and level of the credit sought. Early coordination with EASA should be ensured.

Note: An ETSOA is not a mandatory step in the certificat ion of an IMA system.

Powered by EASA eRules Page 574 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) Demonstration of Evidence supporting the Approach compliance — Applicant activities claim responsibilities (a) Incremental Under the full Full compliance Evidence of review and component responsibility of the demonstration is acceptance by the qualification applicant*. expected from the applicant, covering all See paragraph applicant. objectives for which credit 4.1 is sought, including final review reports (at software, hardware, platform, IMA system level(s), as applic able).

(b) Reuse from Under the full Compliance Previous set of evidence.

previous TC responsibility of the demonstration may be Evidence of review and See paragraph applicant*. tailored depending on acceptance by the 4.2 the agreement with applicant, covering all EASA**. objectives for which credit Note: Demonstration of is sought, including final compliance for the IMA review reports (at components may be softwar e, hardware, reduced ( e.g. no platform, IMA system software development level(s), as applicable).

and verification reviews (SOI#2&3) as part of Task 2).

(c) Compliance Shared between the: Compliance ETSOA credit ETSO holder for the demonstration is See paragraph scope covered by the reduced according to 4.3 ETSOA (e.g. the certification credit module/platform); claimed from the ETSOA.

applicant* for the completion of integration and/or installation activities.

Incremental certification evidence table * Applicant stands for the applicant developing and/or installing the IMA system.

** Discussions held on a case - by - case basis based on the information provided through the certification plan.

Whatever the approach selected for the recognition of credit and the level of credit grante d, the applicant remains responsible for ensuring and for demonstrating that each component is integrated and installed consistently with its function, interfaces, usage domain, and limitations.

4.1. Incremental component qualification One main character istic of IMA systems and the ED - 124 task framework is that they allow a high level of independence in the design and verification activities: — between the functional level (application) and the resource level (module/platform); — between different applicati ons (except for possible functional coupling between applications).

Powered by EASA eRules Page 575 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) In addition, Chapter 2.2.e of ED - 124 introduces the concept of ‘composability’, where the integration of a new application does not invalidate any of the verified requirements of an alrea dy integrated application. When an IMA system is ‘composable’, credit can be taken from its properties (e.g. robust partitioning) regarding two aspects: — during the development of the application itself: credit may be taken from module/platform development activities; — during the integration and verification activities: credit may be taken from the integration of the application and from the absence of impact on other already verified and installed applications.

These principles drive a modular approach, w hich can be used to support an incremental component qualification process, provided the following considerations are fulfilled: — The applicant should define criteria and supporting evidence to demonstrate the achievement of all objectives for which credit is sought.

— The applicant should assess, and record through a formal review, the achievement and acceptance of a set of objectives for a given component. For instance, a final software and hardware review (SOI#4) on the components of a module and the acce ptance of the corresponding software and hardware accomplishment summaries could support the completion of ED - 124 Task 1.

Depending on the framework and organisation, strict AMC 20 - 115() or ED - 80 compliance may not, on its own, be sufficient to show the a chievement of a given task.

Complementary accomplishment summaries should be provided and encompassed in the applicant’s review.

4.2. Reuse of components The applicant remains fully responsible for the contents of the associated data, which have to be as sessed through the applicant’s activities as being reusable in the context of the current certification project.

4.2.1. Reuse from a legacy IMA system Components that were previously approved may be reused provided that the applicant shows that the reuse of the component is appropriate. If changes are necessary, a change impact analysis should be performed to identify the scope of the changes and the necessary activities to re - engage in to cover the changes.

4.2.2. Reuse from a previous ED - 124 project T he management of reused components is addressed through ED - 124 Task 6 (ED - 124 Chapter 4.7). If changes are intended, they should be managed through ED - 124 Task 5 (ED - 124 Chapter 4.6).

Note: To facilitate the reuse of a component, ED - 124 recommends develop ers to anticipate such reuse during the initial development through dedicated objectives that are part of Tasks 1 & 2 (e.g. the module acceptance plan providing the data listed in Chapter 4.2.3.h).

4.3. Compliance credit In the frame of this AMC, formal certification credit is offered from an ETSOA granted to: — platform(s)/module(s): ETSO - 2C153; — application(s) integrated with an ETSO - 2C153 module/platform: ETSO - C214.

Powered by EASA eRules Page 576 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) 4.3.1. Use of an ETSO - 2C153 authorisation An ETSO - 2C153 can be granted to a platform(s)/module(s) in order to facilitate its (their) use in an IMA system. As per ETSO - 2C153 paragraph 3.2.2.1, the IMA module or platform should meet the ED - 124 Task 1 objectives. Compliance credit could be hence clai med by an applicant for the demonstration of compliance with ED - 124 Task 1, provided the platform(s)/module(s) had obtained an ETSO - 2C153 authorisation beforehand.

Nevertheless, the ETSOA does not by itself ensure that the platform(s)/module(s) is (are) technically adequate to be integrated into the IMA system. The applicant remains responsible for all the activities to ensure the proper integration of the ETSO - 2C153 platform(s)/module(s) into the IMA system, and the applicant should: — substantiate the scope of the ETSOA compliance credit, and define the complementary certification activities based on the data provided (e.g.

user/installation manuals); — demonstrate th e correct use of the platform(s)/module(s), including compliance: — with the platform/module integration requirements/user requirements, and the IMA system and safety requirements; — of the use, the partitioning, the health monitoring, the configuration of t he resources and the installation of the items with the platforms/modules user guide/manual, installation manual, or equivalent data (as documented per ETSO - 2C153 Appendix 3). This also includes the deactivation or disabling of unused ETSO - 2C153 functions/ modules, when available, or the means to ensure that the intended function is performed without any interference from unused ETSO - 2C153 functions/ modules.

This section only addresses the use of EASA ETSO - 2C153, and its use cannot be extended to any other authority TSO standards on IMA platforms and modules that are not equivalent in their technical requirements.

4.3.2. Use of a functional ETSO - C214 authorisation Through a functional ETSO - C214 (F - ETSO), an authorisation can be granted to application(s) i ntegrated with an ETSO - 2C153 module/platform. As per ETSO - C214, compliance with the ED - 124 Task 2 & 3 objectives has to be demonstrated.

Compliance credit could hence be claimed by an applicant for the demonstration of compliance with ED - 124 Tasks 2 & 3, p rovided that the F - ETSO - C214 authorisation had been obtained beforehand.

Nevertheless, the functional ETSOA does not by itself ensure that the ETSO article is technically adequate to be installed in the product. The applicant remains responsible for all t he activities to ensure the proper integration of the application(s)/module(s)/platform(s) into the IMA system, and the applicant should: — substantiate the scope of the ETSOA compliance credit, and define the complementary certification activities; — comple te the demonstration that the function covered by the F - ETSO article complies with the IMA system and safety requirements.

Powered by EASA eRules Page 577 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) If the F - ETSO article is in the ‘open’ class and the applicant intends to perform incremental development on the ETSOA article (e.g. to add an application), the considerations of this AMC apply to the new and affected items. The applicant should ensure the integrity and continuity of the system configuration, and in particular should show that the resource allocation, partitioning, and health monitoring are not impaired by the intended changes to the ETSOA article. The level of credit that can be obtained from the F - ETSO article, and the certification activities to be completed in the frame of this AMC, will hence vary depending on the scope of the changes made to the initial F - ETSO article.

If the F - ETSO article is in the ‘closed’ class, it no longer offers any capability for IMA development. Credit can be taken for ED - 124 Tasks 2 and 3. This closed F - ETSO article is equivalent to a con ventional ETSO article.

4.3.3. Summary of ETSO compliance credit The following table summarises the credit that can be claimed from ETSO - 2C153 and ETSO - C214, and the remaining certification activities to support the demonstration of compliance with AMC 2 0 - 170: ETSOA Credit Remaining activities ETSO - 2C153 Acceptance of the Substantiation of the scope platform/module of ETSOA compliance credit.

(ED - 124 Task 1) All subsequent activities (ED - 124 Tasks 2 and 3, plus those deferred to Task 4).

ETSO - C214 ‘open’ class Acceptance of the Substantiation of the scope platform/module of ETSOA compliance credit.

(ED - 124 Task 1) Demonstration that the F - Acceptance of the non - ETSO article complies with impacted hosted the IMA system and safety application(s) requirements.

(ED - 124 Task 2) All activities impacted by the incremental development, such as on the modified or new hosted application (ED - 124 Tasks 2), and IMA configuration and integration (ED - 124 Task 3 plus those deferred to Task 4.)

Powered by EASA eRules Page 578 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) ETSO - C 214 ‘closed’ class Acceptance of the Substantiation of the scope platform/module of ETSOA compliance credit.

(ED - 124 Task 1) Acceptance of the hosted application(s) (ED - 124 Task 2) IMA configuration and integration (ED - 124 Task 3) ETSO compliance credit table for AMC 20 - 170 5. Additional recommendations for IMA system certification 5.1. Fault management and human factors ED - 124 Chapter 3.6.5 deals with the annunciation of failures to the crew. CS XX.1322 and the associated AMC addres s flight crew alerting systems and warning, caution, or advisory lights. In any case where an inconsistency is identified between the text in ED - 124 and the text in CS XX.1322 and the associated AMC, the text in CS XX.1322 and the associated AMC should pre vail.

Similarly, for any inconsistency between the text in ED - 124 Chapter 3.10 dealing with human factors and the text in CS XX.1302 and the associated AMC, the text in CS XX.1302 and the associated AMC should prevail.

5.2. Configuration data/parameter data items Guidance on IMA configuration data is provided in ED - 124 Chapter 3.7.1.1 at the IMA system level and in Chapter 3.7.1.2 at the application level. These data items are nowadays described as ‘parameter data items’ as defined in ED - 12C and should be treated in the same way as other elements of the software. Depending on how a parameter data item is to be used in the IMA system or application, it needs to be defined, managed and documented at the appropriate level (platf orm, module, application) and to comply with the AMC 20 - 115() guidance, including the process to ensure intermixability and compatibility during the post - TC period as indicated in ED - 124. In particular, any parameter data item should be assigned the same software level as the component using it.

5.3. Use of tools and the need for qualification IMA system development may be supported by the use, at the system level, of tools in order to eliminate, reduce, or automate the activities associated with the E D - 124 objectives. If a tool could introduce an error or could fail to detect an error, and there are no other alternative means to detect the issue, qualification of the tool is needed.

Starting from AMC 20 - 115D.

Powered by EASA eRules Page 579 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) For instance, a tool may be used to generate and/or verify IMA config uration data and may produce an erroneous configuration that is not necessarily easily detectable at a subsequent integration/verification step.

The objectives of tool qualification are to: — ensure an equivalent level of confidence to the non - automated pro cess/activities; — demonstrate that the tool complies, and its qualification is commensurate, with the intended use.

Adequate guidance for tool qualification is provided in ED - 215, Software Tool Qualification Considerations, and should be followed when a t ool is intended to be qualified to support the IMA system development.

The following criteria should be used to determine the appropriate tool qualification level (TQL), according to its intended use: (a) Impact of the tool: (1) Criterion 1: a tool whose output is part of the IMA system and thus could introduce an error.

(2) Criterion 2: a tool that automates verification process(es) and thus could fail to detect an error, and whose output is used to justify the elimination or re duction of: — verification process(es) other than that (those) automated by the tool; or — development process(es) that could have an impact on the IMA system.

(3) Criterion 3: a tool that, within the scope of its intended use, could fail to detect an erro r.

(b) IDAL of the IMA component supported by the tool: Criteria IDAL 1 2 3 A TQL - 1 TQL - 4 TQL - 5 B TQL - 2 TQL - 4 TQL - 5 C TQL - 3 TQL - 5 TQL - 5 D TQL - 4 TQL - 5 TQL - 5 5.4. Change management This section deals not only with changes to components that were previously accepted through a TC, STC or ETSOA, but also with changes during the development as soon as components are delivered for use in a subsequent stage of the process and a formal base line is established for these components.

The main objectives of the change management process are to conduct and document a change impact analysis and to reintegrate the changed component into the IMA system, performing all the necessary verification, va lidation, and integration activities (including regression analysis and testing).

Powered by EASA eRules Page 580 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) (a) Since there are various levels of development and integration in an IMA system, and potentially various stakeholders (the module/platform developer, application develop er, IMA system integrator, aircraft designer), agreements should be concluded between stakeholders to establish the way to communicate changes and to perform impact analyses at each level.

(b) A change impact analysis should consider the possible impacts to be reported at each relevant level: — changes at the resource allocation level; — changes at the module/platform level; — changes at the application level.

(c) Impacts on incremental compliance credit (if applicable) also need to be considered.

(d) The changes should be documented in the appropriate life cycle data, including the trace data, configuration indexes and accomplishment summaries.

5.5. Management of problem reports IMA systems contain multiple applications hosted on the same IMA module/platform, therefore any OPR related to a module/platform or application, collected at any level, could affect one or several aircraft functions directly or indirectly.

Considering the diversity of stakeholders in an IMA system, the management of problem reports can be more complex than with federated systems. In addition to the applicable guidance on OPR management, for IMA systems, the applicant should organise the management of OPRs, focusing on: — the evaluation of the potential effect of each OPR on any shared resources and IMA services, and the evaluation of those OPRs for impact on any aircraft function that uses the affected shared resources and IMA services; — the verification tha t necessary workarounds, including limitations, at the application and/or system levels, are documented within the IMA documentation (e.g. user guide/manual). In such cases, the efficiency of a workaround should be substantiated and the successful (i.e. co mplete and correct) deployment of the workaround should be ensured.

NOTE: In order to facilitate the assessment and the communication between stakeholders, the use of a harmonised classification scale for OPRs is recommended.

5.6. Environmental qualific ation The scope of this section is to provide environmental qualification guidance complementary to ED - 124 Chapter 5.2.6 for the environmental qualification of an IMA system. It can be an IMA platform composed of only one LRU, or various modules in a give n configuration. The platform is qualified in conditions of the same severity as those expected when installed on the aircraft, interfaced with its peripherals through the aircraft (or equivalent) harnesses, and loaded with its set of applications. The acc eptance criteria to qualify the platform are driven by the operational requirements of a given aircraft.

Powered by EASA eRules Page 581 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 170 Products, Parts and Appliances (AMC - 20) Level of qualification testing activities: The modularity of an IMA platform makes it possible to conduct qualification testing activities at variou s stages: — IMA module testing: the testing is performed on an IMA module, involving the shared resources (hardware and/or software), and when relevant, with a representative set of software applications loaded onto the module. In the case of a cabinet, the module can be a chassis and/or a backplane.

— IMA platform testing: the testing is performed on the platform or cabinet (chassis and backplane) equipped with its modules, and when relevant, loaded with a representative set of software applications.

— System testing: the testing is performed on a set of modules and/or the backplane installed in the cabinet, with system peripherals interfaced with the cabinet, and with representative software applications loaded onto the modules.

— Aircraft testing: the testing is performed with the systems installed on the aircraft.

The modularity of the IMA platform, combined with the variety of its possible configurations, leads to the establishment of principles to reuse qualification credit for IMA modules in the context o f qualifying a desired IMA platform for a given aircraft: (a) The environmental usage domain of an IMA module is the set of environmental conditions for which it is qualified. This is documented in the module user guide/manual.

(b) For an IMA module in tegrated within a cabinet, its environmental qualification conditions should consider: — its environmental conditions (i.e. the envelope of thermal, electromagnetic, vibration, lightning, etc., conditions) encountered inside the cabinet when in use on the a ircraft; — all its possible arrangements in the cabinet (i.e. different IMA platform configurations).

Incremental environmental qualification is an approach used in qualifying a cabinet populated with modules in a known configuration for a given aircraft, relying on existing qualification credit for IMA modules in their environmental usage domain, and identifying any complementary qualification substantiation that would be necessary to cover the envelope of the environmental conditions of the aircraft.

Thus it provides the latitude to populate a cabinet with already qualified modules, to qualify it without having to perform a full reassessment of the qualification of each module, and the capability to reuse its existing qualification dossier.

All the substa ntiation data recorded in the qualification plan should be based on dedicated tests or on equivalence with the reuse of existing qualification results, or existing authorisations such as ETSO - 2C153. The representativeness of the substantiation should consi der the testing configuration, the testing conditions (including electrical, thermal, mechanical interfaces, etc.), the qualification testing level, the application software used for the testing, the test scenario and the level of stress applied.

When an IMA system change is implemented, a change impact analysis should be conducted against the qualified configuration to assess the complementary qualification substantiation to be provided for each of its modules.

[Amdt 20/15] Powered by EASA eRules Page 582 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 189 Products, Parts and Appliances (AMC - 20)

AMC 20 - 189

AMC 20 - 189 The Management of Open Problem Reports (OPRs)

ED Decision 2020/010/R 1. PURPOSE This AMC describes an acceptable means, but not the only means, for showing compliance with the applicable airworthiness regulations for the management of open problem reports (O PRs) in ETSO authorisations and type certification, for the system, software and airborne electronic hardware (AEH) domains. Compliance with this AMC is not mandatory, and an applicant may elect to use an alternative means of compliance. However, the alter native means of compliance must meet the relevant requirements, ensure an equivalent level of safety, and be approved by EASA on a product or ETSO article basis.

2. APPLICABILITY This AMC may be used by applicants, design approval holders, and developers o f airborne systems and equipment to be installed on type - certified aircraft, engines, and propellers. This AMC applies to all airborne electronic systems and equipment, including to the software and AEH components contained in those systems, which could ca use or contribute to Catastrophic, Hazardous, or Major failure conditions.

3. BACKGROUND 3.1. Each of the system, software and AEH domains relies on problem report (PR) management to ensure the proper management of open problem reports (OPRs) and to help e nsure safe products at the time of approval. However, the existing guidance on PR and OPR management is inconsistent and incomplete across domains. Therefore, this AMC provides consistent guidance across these domains for PR management, OPR management, sta keholder responsibilities, reporting, and other aspects of OPR management. This AMC complements but does not alleviate the project - applicable system, software and AEH guidance .

3.2. The technical content of this AMC has been jointly developed with the Fede ral Aviation Administration (FAA), in order to harmonise as far as practicable .

4. DEFINITIONS 4.1. Terms defined in this AMC Approval: the term ‘approval’ in this document addresses the approval by EASA of a product or of changes to a product, or authoris ation of an ETSO article or of changes to an ETSO article.

Article: refer to Article 1(2)(f) of Regulation (EU) No 748/2012 (‘EASA Part 21’).

Development assurance: all of those planned and systematic actions used to substantiate, with an adequate level of confidence, that errors in requirements, design, and implementation have been identified and corrected such that the system satisfies the applicable certification basis (source: ARP4754A/ED - 79A).

Equipment: an item or collection of items with a defined set of requirements.

Error: a mistake in the requirements, design, or implementation with the potential of producing a failure.

Failure: the inability of a system or system component to perform a function with in specified limits (source: DO - 178C/ED - 12C and DO - 254/ED - 80).

Powered by EASA eRules Page 583 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 189 Products, Parts and Appliances (AMC - 20) Item: a hardware or software element that has bounded and well - defined interfaces (source: ARP4754A/ED - 79A).

Open problem report (OPR): a problem report that has not reached the state ‘Closed’ at the time of approval.

Problem report (PR): a means to identify and record the resolution of anomalous behaviour, process non - compliance with development assurance plans and standards, and deficiencies in life - cycle data (adapted from DO - 178C/ED - 12C).

Pr oduct: refer to Article 3(3) of Regulation (EU) 2018/1139 (the ‘EASA Basic Regulation’).

System: a combination of interrelated equipment, article(s), and/or items arranged to perform a specific function (or functions) within a product.

4.2. States of PRs/O PRs Recorded: a problem that has been documented using the problem - reporting process.

Classified: a problem report that has been categorised in accordance with an established classification scheme.

Resolved: a problem report that has been corrected or full y mitigated, for which the resolution of the problem has been verified but not formally reviewed and confirmed.

Closed: a resolved problem report that underwent a formal review and confirmation of the effective resolution of the problem.

4.3. Classifications of PRs/OPRs ‘Significant’: assessed at the product, system, or equipment level, a PR that has an actual or potential effect on the product, system, or equipment function that may lead to a Catastrophic, Hazardous or Major failure condition, or may affect compliance with the operating rules.

‘Functional’: a PR that has an actual or a potential effect on a function at the product, system, or equipment level.

‘Process’: a PR that records a process non - compliance or deficiency that cannot result in a potential safety, nor a potential functional, effect.

‘Life - cycle data’: a PR that is linked to a deficiency in a life - cycle d ata item but not linked to a process non - compliance or process deficiency.

5. PROBLEM REPORT MANAGEMENT The PR management process is a key enabler for the management of OPRs. The PR management process enables the consistent and timely management of problem s encountered across the system, software and AEH domains. Consequently, this process reduces the risk of a loss of visibility of critical issues remaining at the time of approval.

5.1 A PR management process across the system, software and AEH domains sho uld be established and used during the development (both for initial certification and subsequent changes) of a product or an ETSO article. The PR management process should address the review and resolution of PRs that impact the transition to other develo pment assurance processes.

5.2 A problem recorded after approval should also be managed through the PR management process, and any related systemic process issues should be identified and corrected.

5.3 PRs that cannot be resolved by the current stakeholder should be reported in a manner that is understandable to the affected stakeholders.

Powered by EASA eRules Page 584 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 189 Products, Parts and Appliances (AMC - 20) 5.4 For PRs that may have an impact on other products or articles that are developed within an organisation, a means should be established for sharing PR information so that any necessary corrective actions can be taken .

6. OPR MANAGEMENT An OPR management process, based on the PR management process, should be established across the system, software and AEH domains, incl uding the following process steps: 6.1 The classification of OPRs 6.1.1 The applicant should establish an OPR classification scheme including, at a minimum, the following classifications: ‘Significant’, ‘Functional’, ‘Process’ and ‘Life - cycle data’. Other classifications or subclassifications may be created as needed. The classification scheme should be described in the appropriate planning document(s).

6.1.2 Each OPR should be assigned a single classification per the classification scheme. When multiple cl assifications apply, the OPR should be assigned the classification with the highest priority. The priority from highest to lowest (including the defined subclassifications) is: 1. ‘Significant’; 2. ‘Functional’; 3. ‘Process’; 4. ‘Life - cycle data’; 5. any o ther OPR classification.

Note: The classification of an individual OPR may differ from one stakeholder to another, depending on the known mitigations at the time of classification.

6.1.3 The classification of an OPR should account for and document all the mitigations known at the time of classification that are under the control of the classifying stakeholder. A mitigation that is controlled by another stakeholder may be considered in the classification only if validated with that stakeholder, and provided this mitigation remains acceptable in the frame of the type certificate (TC) / supplemental type certificate (STC) approval or European technical standard order (ETSO) article authorisation, as applicable.

6.1.4 A stakeholder, other than the aircraft TC or STC applicant, should classify as ‘Significant’ any OPR for which the classification may vary between ‘Functional’ and ‘Significant’, depending on the installation.

6.2 The assessment of OPRs Each OPR should be assessed to determine: 1. any resulting functional limitations or operational restrictions at the equipment level (for ETSOs) or at the product level (for other types of approvals); 2. relationships that may exist with other OPRs; and 3. for a ‘Significant’ or ‘Functional’ OPR, the und erlying technical cause of the problem.

6.3 Disposition: OPRs classified as ‘Significant’ per the classification in Section 6.1, for which no sufficient mitigation or justification exists to substantiate the acceptability of the safety effect, should be resolved prior to approval. The disposition of OPRs may in volve coordination with the certification authority.

Powered by EASA eRules Page 585 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 189 Products, Parts and Appliances (AMC - 20) 6.4 Reporting: an OPR summary report should be prepared and provided to the affected stakeholder(s), and to the certification authority upon request. The OPR summary report may be an aggregation of summa ries (e.g. Software/Hardware Accomplishment Summaries or system - level OPR reports) prepared by all the involved stakeholders. The summary report should provide access to the following information for each OPR: 6.4.1 The identification of the OPR (for examp le, the OPR ID); 6.4.2 The identification of the affected configuration item(s) (for example, the item part number, component name, artefact name) or of the affected process(es); 6.4.3 Title or a summary of the problem, formulated in a manner understandabl e by the affected stakeholder(s); 6.4.4 Description of the problem, formulated in a manner understandable by the affected stakeholder(s); 6.4.5 The conditions under which the problem occurs; 6.4.6 The OPR classification and assessment results (per Se ctions 6.1 and 6.2), including: 1. for each OPR, regardless of its classification: a. the classification of the OPR, and b. the relationships that are known to exist with other OPRs; 2. for OP Rs classified as ‘Significant’: a. a description of any mitigations or justifications used to substantiate the acceptability of the OPR safety effect (per Section 6.3), and b. the functional limitations and operational restrictions, if any; 3. for OPRs classified as ‘Functional’: a. a description of any mitigations or justif ications used to reduce the safety effect to Minor or No Safety Effect, and b. the functional limitations and operational restrictions, if any; 4. for OPRs classified as ‘Process’, a description of the extent or nature of the process non - compliance or defi ciency that might contribute to not satisfying the applicable development assurance objectives; and 5. for each OPR not classified as ‘Significant’ or ‘Functional’, the justification that the error cannot have a safety or functional effect.

6.5 ETSO specif ics: The ETSO authorisation holder may exclude from the reporting process (per Section 6.4) any OPRs classified as ‘Process’ or ‘Life - cycle data’ that are not necessary for the installation approval. However, all OPRs should be available upon request by th e certification authority for assessment in the frame of the ETSO approval.

7. STAKEHOLDER RESPONSIBILITIES The levels of stakeholders include: item, equipment or ETSO article, system and product. The actual stakeholders for a specific project depend on the project organisation.

7.1 The levels of stakeholders include: item, equipment or ETSO article, system and product. The actual stakeholders for a specific project depend on the project organisation.

Powered by EASA eRules Page 586 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 189 Products, Parts and Appliances (AMC - 20) 7.2 OPR management (per Section 6) should be performed , at a minimum, at the ETSO article level, at the level of each individual system within a product, and at the product level.

8. RELATED REGULATORY, ADVISORY AND INDUSTRY MATERIAL (a) Related EASA Certification Specifications (CSs) (1) CS - 23, Certification Specifications and Acceptable Means of Compliance for Normal Category Aeroplanes (2) CS - 25, Certification Specifications and Acceptable Means of Compliance for Large Aeroplanes (3) CS - 27, Certification Specifications and Acceptable Means of Compliance for Small Rotorcraft (4) CS - 29, Certification Specifications and Acceptable Means of Compliance for Large Rotorcraft (5) CS - E, Certification Specifications and Acceptable Means of Compliance for Engines , and AMC 20 - 3A , Certification of Engines Equipped with Electronic Engine Control Systems (6) CS - P, Certification Specifications for Propellers , and AMC 20 - 1 , Certification of Aircraft Propulsion Systems Equipped with Electronic Control Systems (7) CS - ETSO, Certification Specifications for European Technical Standard Orders (8) CS - APU, Certification Specifications for Auxiliary Power Units , and AMC 20 - 2A , Certification of Essential APU Equipped with Electronic Controls (b) EASA Acceptable Means of Compliance (AMC) (1) AMC 20 - 115( ) , Airborne Software Development Assurance Using EUROCAE ED - 12 and RTCA DO - 178 (2) AMC 20 - 152( ) , Development Assurance for Airborne Electronic Hardware (c) FAA ACs Refer to latest version.

(1) AC 20 - 115( ), Airborne Software Development Assurance Using EUROCAE ED - 12( ) and RTCA DO - 178( ) (2) AC 20 - 152( ), Development Assurance for Airborne Electronic Hardware (3) AC 27 - 1309( ), Equipment, Systems, and Installations (included in AC 27 - 1, Certification of Normal Category Rotorcraft ) (4) AC 29 - 1309( ), Equipment, Systems, and Installations (included in AC 29 - 2, Certification of Transport Category Rotorcraft) (d) Industry Documents (1) EUROCAE ED - 12, Softwa re Considerations in Airborne Systems and Equipment Certification , date d May 1982 (no longer in print) (2) EUROCAE ED - 12A, Software Considerations in Airborne Systems and Equipment Certification , dated October 1985 (no longer in print) (3) EUROCAE ED - 12B, Software Considerations in Airborne Systems and Equipment Certification , dated December 1992 Powered by EASA eRules Page 587 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 189 Products, Parts and Appliances (AMC - 20) (4) EUROCAE ED - 12C, Software Considerations in Airborne Systems and Equipment Certification , dated January 2012 (5) EUROCAE ED - 79A, Guidelines for Development of Civil Aircraft and Systems , dated December 2010 (6) EUROCAE ED - 80, Design Assurance Guidance for Airborne Electronic Hardware , dated April 2000 (7) EUROCAE ED - 94C, Supporting Information for ED - 12C and ED - 109A , dated January 2012 (8) EUROCAE ED - 215, Software Tool Qualification Considerations , dated January 2012 (9) EUROCAE ED - 216, Formal Methods Supplement to ED - 12C and ED - 109A , dated January (10) EUROCAE ED - 217, Object - Oriented Technology and Related Techniques Supplement to ED - 12C and ED - 109A , dated January 2012 (11) EUROCAE ED - 218, Model - Based Development and Verification Supplement to ED - 12C and ED - 109A , dated January 2012 (12) RTCA DO - 178, Software Considerations in Airborne Systems and Equipment Certification , dated January 1982 (no longer in print) (13) RTCA DO - 178A, Software Considerations in Airborne Systems and Equipment Certification , dated March 1985 (no longer in print) (14) RTCA DO - 178B, Software Considerations in Airborne Systems and Equipment Certification , dated 1 Decem ber 1992 (15) RTCA DO - 178C, Software Considerations in Airborne Systems and Equipment Certification , dated 13 December 2011 (16) RTCA DO - 248C, Supporting Information for DO - 178C and DO - 278A , dated 13 December (17) RTCA DO - 254, Design Assurance Guidanc e for Airborne Electronic Hardware , dated April 19, 2000 (18) RTCA DO - 297, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations , dated 8 November 2005 (19) RTCA DO - 330, Software Tool Qualification Considerations , dated 13 December 2011 (20) RTCA DO - 331, Model - Based Development and Verification Supplement to DO - 178C and DO - 278A , dated 13 December 2011 (21) RTCA DO - 332, Object - Oriented Technology and Related Techniques Supplement to DO178C and DO - 278A , dated 13 December 2011 (22) RTCA DO - 333, Formal Methods Supplement to DO - 178C and DO - 278A , dated 13 December 2011 (23) SAE International Aerospace Recommended Practice (ARP) 4754A, Guidelines for Development of Civil Aircraft and Systems Powered by EASA eRules Page 588 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 189 Products, Parts and Appliances (AMC - 20) 9. AVAILABILITY OF DOCUMENTS (1) EASA Certification Specifications (CSs) and Acceptable Means of Compliance (AMC) may be downloaded from the EASA website: www.easa.europa.eu (2) FAA Advisory Circulars (ACs) may be down loaded from the FAA website: www.faa.gov (3) EUROCAE d ocuments may be purchased from: European Organisation for Civil Aviation Equipment 9 - 23 rue Paul Lafargue "Le Triangle" building 93200 Saint - Denis, France Telephone: +33 1 49 46 19 65 (Email: eurocae@eurocae.net, w ebsite: www.eurocae.net ) (4) RTCA d ocuments may be purchased from: RTCA, Inc.1150 18th Street NW, Suite 910, Washington DC 20036, USA (Email: info@rtca.org, websi te: www.rtca.org ) 10. GUIDANCE MATERIAL GM 20 - 189 The Management of Open Problem Reports [Amdt 20/19]

GM1 to AMC 20 - 189 — PR management

ED Decision 2020/010/R Typically, PR processes include the following aspects: 1. PR Recording: a means to document problems resulting from the exe cution of life - cycle processes.

2. PR Classification: a means to classify PRs prior to the time of approval of the product or of the ETSO article, as early in the life cycle as practical. While early classification may be preliminary, it will help to focus attention on PRs with a potential safety or functional effect, as well as process PRs that may impact the development or development assurance pro cesses.

3. PR Assessment: a means to assess the effect of having a PR remain open at the time of approval.

The assessment of PRs classified as ‘Significant’, ‘Functional’ or ‘Process’ would typically be performed by a review board. The assessment of PRs cl assified as ‘Life - cycle data’ may be performed within the peer - review pro cess instead of a review board.

4. PR Resolution: a means to correct or mitigate PRs prior to the time of approval, as early in the life cycle as practical. The PR resolution process may depend on the classification of the PR; for example, shorter closure loops could be set for PRs c lassified as ‘Life - cycle data’.

5. PR Closure: a means to close PRs, which includes the review and confirmation of the resolution of the problem, and indic ated through a documented authorisation process (e.g. Change Control Board sign - off).

[Amdt 20/19] Powered by EASA eRules Page 589 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 189 Products, Parts and Appliances (AMC - 20)

GM2 to AMC 20 - 189 — OPR classification

ED Decision 2020/010/R The following paragraph links the classifications presented in DO - 248C/ED - 94C, DP #9 to those defined in AMC 20 - 189 , subparagraph 6.1. This paragraph highlights the clarifications made to the former scheme (e.g. removing the overlaps between the classifications).

1. The most important clarification compared with the former classification scheme is to give each OPR a single classification using a given order of priority as reflected in AMC 20 - 189 subparagraph 6.1.2. This promotes visibility of the most relevant issues and helps to prevent inconsistencies in classification. For example, a missing or incorrect requirement issue can be classified as ‘Life - cycle data’ only if it is confirmed that it c annot be classified as ‘Significant’, ‘Functional’, or ‘Process’, in that order of priority.

2. Type ‘Significant’: this typically maps to ‘Type 0’. However, some applicants may have used ‘Type 1A’ to characterise some PRs, for instance, those linked to Ma jor failure conditions. The AMC 20 - 189 scheme clarifies that those PRs potentially causing or contributing to Catastrophic, Hazardous or Major failure conditions bel ong to the cla ss ‘Significant’.

3. Type ‘Functional’: this typically maps to ‘Type 1A’ or ‘Type 1B’, that is, a problem that results in a failure with a minor or no adverse impact on safety. A PR whose consequences are a failure that can potentially lead to a Minor fail ure condition could be mapped to ‘Type 1A’, and a PR leading to a failure having No Safety Effect could be mapped to ‘Type 1B’. Two separate subclassifications could therefore be created in the applicant’s classification scheme to ease the mapping: problem s having a functional effect leading to a Minor failure condition could be classified separately (e.g. ‘Functional 1’) from the ones having No Safety Effect (e.g.

‘Functional 2’). Moreover, an important clarification is that AMC 20 - 189 does not explicitly consider the ‘operational’ nature of a PR in the classification scheme to avoid creating overlaps, as a PR with operational consequences could either be classified as ‘Significant’ or ‘Functional’.

Creating an ‘Operational’ subclassification within the classification ‘Significant’ or ‘Functional’ is nevertheless an option available to stakeholders to create a specific emphasis on operational issues within the proposed classification scheme.

4. Type ‘Process’: this may map to ‘Type 3A’; however, not in cases where the process non - compliance or deficiency could result in either not detecting a failure or creating a failure. An important clarification in AMC 20 - 189 is the removal of the ambiguous notion of ‘significant deviation from the plans or standards’ used in the definition of ‘Type 3A’. The ‘Process’ classification in AMC 20 - 189 should be used for PRs that record a process non - compliance or deficiency, provided they cannot result in a potential safety or potential functional effect. An example of an OPR that should not be classifie d as a ‘Process’ PR is one related to a requirement that was not completely verified due to a process deficiency, because the potential safety or functional impact remains undetermined. Considering the highest priority classification would, in such a case, lead to a ‘Significant’ or ‘Functional’ classification, thus putting even more emphasis on the need to resolve the shortcoming in the verification activities.

5. Type ‘Life - cycle data’: this typically maps to ‘Type 2’ or ‘Type 3B’. Since ‘Life - cycle data’ OPRs may range widely, subclassifications may be proposed by stakeholders to distinguish the different types of OPRs. Examples of OPRs classified as ‘Life - cycle data’ may range from issues in a component having no potential safety or functional impact to PRs on pure documentary issues. Moreover, the removal of the notion of ‘non - significant deviation from the plans or standards’ from the definition of ‘Type 3B’ helps to remove the ambiguity and overlap between the ‘Process’ and ‘Li fe - cycle data’ classifica tions.

Powered by EASA eRules Page 590 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 189 Products, Parts and Appliances (AMC - 20) 6. Other OPR classification: additional classifications of OPRs may be created to cover ‘Type 4’ or any other classification not specified in AMC 20 - 189 , paragraph 6.1.1.

[A mdt 20/19]

GM3 to AMC 20 - 189 — Additional GM related to the ‘Significant’

classification

ED Decision 2020/010/R In the frame of an engine or propeller TC/STC or of an ETSO article authorisation, the definition of ‘Significant’ is based on the anticipation of a potential effect on the product, system, or equipment function that could lead to a Catastrophic, Hazardous or Major failure condition. The goal is to identify and enhance the visibility of OPRs that may pose potential safety risks at the aircraft installation level (s ee AMC 20 - 189 paragraph 6.1.4).

For example, in the case of an engine TC, a partial or complete loss of thrust or power is regarded as a Minor Engin e Effect, whereas it may have a more severe effect at the aircraft level. Unless the engine manufacturer can confirm that the effect at the installation level is no more than Minor, the OPR would be classified as ‘Significant’. The associated assumptions o r mitigations are usually recorded through instructions for installing and operating the engine, e.g. in an engine installation manual.

In the case of an ETSO authorisation, classification of the failure condition is either based on assumptions defined by the applicant, or mandated through the ETSO standard, and is the basis of the safety analysis at the ETSO article level. An OPR is classified as ‘Significant’ when the OPR may lead to a functional failure associated with a Catastrophic, Hazardous or Major failure condition.

[Amdt 20/19] Powered by EASA eRules Page 591 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20)

AMC 20 - 193

AMC 20 - 193 Use of multi - core processors

ED Decision 2022/001/R 1. Purpose 1.1 This AMC describes an acceptable means, but not the only means, for showing compliance with the applicable airworthiness specificat ions for aspects related to multi - core processors (MCPs) contained in airborne systems and equipment used in p roduct certification or ETSO authorisation.

Compliance with this AMC is not mandatory, and an applicant may elect to use an alternative means of compliance. However, the alternative means of compliance must meet the relevant requirements, ensure an equival ent level of safety, and be approved by the Agency on a product or ETSO article basis.

1.2 This AMC provides objectives for the demonstration of compliance with the applicable airworthiness specifications for airborne systems and equipment that contain MC Ps, according to the applicability in Section 2 of this AMC .

2. Applicability 2.1. This AMC may be used by applicants, design approval holders, and developers of airborne systems and equipment , which contain MCPs, to be installed on type - certified aircraft, engines, and propellers. This also includes developers of ETSO articles.

This AMC applies to systems and equipment that contain MCPs with two or more activated cores for which the item development assurance level (IDAL) of at least one of the sof tware applications hosted by the MCP or of the hardware item that contain s the MCP is A, B, or C. The deactivation of cores is handled through the applicable a irborne e lectronic h ardware (AEH) guidance.

Th is AMC does not apply when the IDALs are all L evel D or E.

If an applicant modifies the use of the MCP (such as by activating one or more additional cores or adding software of IDAL A, B, or C), then the applicant should reassess the applicability of this AMC.

Section 0 of this AMC describes the objectives that apply according to the assigned IDAL (A, B, or C) of the hosted software or of the hardware item that contain s the MCP.

2.2. Aspects not covered by this AMC The following aspects are not covered by this AMC. This does not constitute an exemption, i.e. the objectives of this AMC are still applicable if an applicant uses these features.

Any applicant who uses these features should describe ho w they are used so that the behaviour of the MCP is not altered, and determinism is still guaranteed.

In their planning activities, the applicant should present the methods employed to cover these aspects, and satisfy the objectives of this AMC or show com pliance with the applicable airworthiness specifications if they propose an alternative to this AMC or part of it.

2.2.1. Dynamic allocation of software applications An assumption in this AMC is that software applications are statically allocated to cores during the start - up of the MCP software, but not during the subsequent operation of the software.

This AMC does not cover MCP platforms on which software applications or tasks can be dynamically reallocated to a different core (or different cores) by the o perating system, a software hypervisor, or by other means.

Powered by EASA eRules Page 592 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) However, justification for using dynamic allocation features within the scope of this AMC may rely on robust and proven limitations that lead to deterministic behaviour, such as: — r estricted usage permitting the applicant to claim equivalence to the conditions expressed in this AMC (for example , multi - static allocation, i.e. selection of a prequalified configuration, instead of pure dynamic allocation).

2.2.2. Simultaneous multithreading support Th is AMC does not cover simultaneous multithreading, as this issue is not specific to MCPs.

2.3. Exceptions An MCP may contain multiple cores of different types, which may interact in different ways and some of the interactions do not produce interference. T herefore, the objectives of this AMC do not apply to the interactions between two or more activated cores of an MCP in the following cases: — The activated cores are set up in lockstep mode (in lockstep processors with two or more activated cores, the cores host the same software and execute that same software in parallel so that their outputs, based on identical input data, can be compared for use in a safety - critical application); or — The activated cores are only linked by the conventional databuses typicall y used in avionic s systems, and not by any of the following: shared memory, shared cache, or a ‘coherency fabric ’ / ‘ module interconnect’. This category includes the case where the cores only act as co - processors or graphics processors, each under the cont rol of another core that executes software.

The objectives of this AMC apply to the interactions between all the other activated cores of an MCP.

3. Background MCPs can execute several software applications at the same time by hosting them on different co res ; therefore , several software applications and/or hardware functions may attempt to access the same shared resources of the MCP (such as memory, cache, ‘coherency fabric ’ / ‘ module interconnect’, or external interfaces) at the same time, causing contention for those resources.

Most MCPs have internal features to handle and arbitrate the concurrent demands for MCP resources, which may cause delays in access to the resources. These delays are a form of time interference between the software applications or tasks, which can cause the software applications to take much longer to execute than when executing on their own.

The execution of software applications may be different on MCPs than it is on single - core processors (due to parallelism and other MCP mechanisms, or software components such as operating systems or hypervisors). This may result in new or different data or control coupling paths, and functional interference betwe en the software applications or tasks.

Interference between the software applications or tasks executing on an MCP could cause safety - critical software applications to behave in a non - deterministic or unsafe manner, or could prevent them from having suffic ient time to complete the execution of their safety - critical functionality.

4. Definitions Applicable airborne electronic hardware (AEH) guidance : AMC 20 - 152( ) and any project - specific guidance.

Applicable software guidance : AMC 20 - 115 ( ) and any project - specific guidance.

Asymmetric multi - processing (AMP) : an MCP software architecture in which each individual functional task is permanently allocated to a specific core and each core has its own operating system (however, Powered by EASA eRules Page 593 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) the operating systems may be multiple copies of the same operating system or be different from core to core).

Bound multi - processing (BMP) : an MCP software architecture that restricts s ymmetric multi - processing ( SMP ) (see definition below) architecture by constraining tasks to be bound to specific cores while using a common operating system across all cores.

Determinism/deterministic : the ability to produce a predictable outcome generall y based on the preceding operations and data. The outcome occurs in a specific period of time with repeatability ( d efinition taken f rom ED - 124/DO - 297).

Integrated m odular a vionics (IMA) platform : in this AMC , this term refers to an integrated modular avionics MCP platform that provides both robust resource partitioning and robust time partitioning (as defined in this AMC ).

Intended final configuration : the configuration of the software and hardware in which t he set of the MCP resources has been defined by implementing the configuration settings and all software components have been installed on the target MCP.

Interference channel : a platform property that may cause interference between software applications o r tasks.

Item : a hardware or software element that ha s bounded and well - defined interfaces ( d efinition taken from ED - 79A / ARP 4754A).

Item development assurance level (IDAL) : the level of rigour of development assurance tasks performed on item(s), e.g. ID AL is the appropriate software level in ED - 12C / DO - 178C and design assurance level in ED - 80 / DO - 254 objectives that need to be satisfied for an item ( d efinition taken f rom ED - 79A / ARP 4754A).

MCP platform : it consists of the MCP itself and, in many case s, the platform software, such as an operating system and/or software hypervisor, which provides the interface between the software applications and the MCP.

MCP platform with robust partitioning : an MCP platform that complies with the objectives of this A MC and provides robust resource partitioning and robust time partitioning as defined in this AMC , not only between software applications hosted on the same core, but also between software applications hosted on different cores of an MCP or between software applications that have tasks hosted on several cores.

Multi - core processor (MCP) : an AEH device that contains two or more processing cores. A core in an MCP is defined as a device that executes software. This includes virtual cores (e.g. in a simultaneou s multithreading microarchitecture, although as stated in Section 2.2.2, the use of simultaneous multithreading is not covered by this guidance). An MCP is typically implemented in a device that may also include resources such as memory or peripheral contr ollers, internal memory, peripherals, and internal interconnects.

Robust partitioning : both robust resource partitioning and robust time partitioning.

Robust resource partitioning (adapted from ED - 94C / DO - 248C and ED - 124 / DO - 297): robust resource partitioning is achieved when: — s oftware partitions cannot contaminate the storage areas for the code, I/O, or data of other partitions; — s oftware partitions cannot consume more than their allocation of shared resources; and Powered by EASA eRules Page 594 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) — f ailure s of hardware unique to a software partition cannot cause adverse effects on other software partitions.

N ote : S oftware that provides partitioning should have at least the same IDAL as the highest IDAL of the software that it partitions.

Robust time partiti oning (on an MCP): this is achieved when, as a result of mitigating the time interference between partitions hosted on different cores, no software partition consumes more than its allocation of execution time on the core(s) on which it executes, irrespect ive of whether partitions are executing on none of the other active cores or on one, more than one, or all of the other active cores.

Safety net: a safety net is defined as the employment of mitigations and/or protections at the appropriate level of aircra ft and system design as a means to satisfy the safety objectives. The safety net methodology may be applied when it is assumed that part of a system will misbehave. The safety net is by nature independent o f the source of misbehaviour. The safety net can i nclude passive monitoring functions, active fault avoidance functions, and control functions for effective recovery of system operations from anomalous events.

Simultaneous multithreading: this is when virtual cores are used to execute more than one execu tion thread on a single physical core.

Software application: generally , it designates the software part of a function installed on a n MCP.

Software component: any part of the software which may access MCP shared resources ; i t may designate either a softwar e application or an operating system or a hypervisor.

Hardware component: any part of the hardware which may independently access MCP shared resources.

Symmetric multi - processing (SMP): an MCP software architecture in which a single operating system contro ls the execution of the software on multiple cores and may dynamically allocate tasks to cores at run - time.

Task: the smallest unit of software execution that can be managed independently by a scheduler. For the purpose s of this AMC , this term encompasses ‘threads’ or ‘processes’ (in the sense of ARINC 653).

For simplification in this AMC, when addressing interference, a task also represents any part of an application or any part of a software component that executes on one core.

5. Multi - core processor (MCP) guidance This section takes stages of a typical life cycle of a project involving an MCP in turn, explains the important issues involved in each stage, and provides objectives for applicants to meet for each of those stages.

The applicant should meet the objectives of this AMC, with the exception of any obj ective or part of an objective that the applicant justifies as not being applicable to the MCP in their system or equipment (e.g. if the MCP mechanism addressed does not exist on the selected MCP). The applicant should state in the appropriate deliverable document which particular aspects do not apply and explain why they do not apply.

Some of the objectives have notes provided after them. These notes should be considered to be part of the objectives, as they provide additional information that is relevant to the objectives. Objectives and their included notes are formatted in italics to differentiate them from the rest of the text.

Powered by EASA eRules Page 595 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) 5.1. Planning The additional planning objectives below clarify the information to be included in the applicable plans to ac hieve planning data [standardisation]/[standardization] for projects with MCPs.

Objective MCP_Planning_1 The applicant’s plans or other deliverable documents: 1. Identify the specific MCP, including the unique identifier from the manufacturer .

2. Identify the number of active cores .

3. Identify the MCP software architecture to be used and all the software components that will be hosted on the MCP .

4. Identify any dynamic features provided in software hosted on the MCP that will be activated, and provide a h igh - level description of how they will be used.

5. Identify whether or not the MCP will be used in an integrated modular avionics (IMA)platform to host software applications from more than one system .

6. Identify whether or not the MCP platform will provi de robust resource partitioning and/or robust time partitioning as defined in this AMC .

7. Identify the methods and tools to be used to develop and verify all the individual software components hosted on the MCP so as to meet the objectives of this AMC and the applicable software guidance, including any methods or tools needed due to the use of an MCP or the selected MCP architecture.

N otes : a) The MCP software architecture includes asymmetric multi - processing (AMP), symmetric multi - processing (SMP) , or any other architecture used by the applicant.

b) The software components identified should include any operating systems, hypervisors, software applications, and all functions that are provided in software. In the case of an MCP used in an IMA platform , the software components that are identified do not have to include the hosted software applications.

c) The dynamic features provided in software should include such aspects as the dynamic allocation of software applications or tasks to cores and any oth er software dynamic features that can affect the execution of the software while it is executing.

d) Where the applicable s oftware and AEH guidance calls for independence in meeting the objectives, the plans should identify how verification independence w ill be applied.

Multiple software applications and/or hardware functions may use resources of the MCP and may cause contention for resources and interference between software applications or tasks. Even if there is no explicit data or control flow betwee n software applications or tasks running concurrently on different cores, MCP resources (e.g. cache or interconnects) may be shared. Therefore, coupling may exist on the platform level which can cause interference between the software applications or tasks and cause increases in the worst - case execution times (WCETs) of the software applications. In addition, there could be interaction between software and hardware functions that would need to be considered (e.g. cases where there are multiple masters).

Powered by EASA eRules Page 596 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — G ENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) O bjective MCP_Planning_2: The applicant’s plans or other deliverable documents: 1. Provide a high - level description of how MCP shared resources will be used and how the applicant intends to allocate and verify the use of shared resources ( s ee Note a) so as to avoid or mitigate the effects of contention for MCP resources and to prevent th e resource capabilities of the MCP from being exceeded by the demands from the software applications and/or the hardware components of the MCP .

2. Identify the MCP hardware resources to be used to support the objectives in this AMC .

3. Identify any hardwar e dynamic features of the MCP that will be active, and provide a high - level description of how they will be used .

4. Identify the aspects of the use of the MCP that may require a safety net or other mechanisms to detect and handle failures in the MCP.

N ote s : a) The description of the use of shared resources should include any use of shared cache (taking into account the time interference it may cause due to cache misses or other effects) or shared memory (taking into account the time interference and the data and control flow effects it may cause , such as lockouts, race conditions, data starvation, deadlocks, live - locks, or excessive data latency). The description of shared resources should also include any use of shared interconnect a nd take into account the time interference due to arbitration for access to the shared interconnect.

b) Hardware dynamic features of the MCP include any features that can alter the behaviour of the MCP or the hosted software during execution — for example, energy - saving features (clock enable / gating, frequency adaptations, deactivating one or more cores, or dynamic control of peripheral access).

5.2. The setting of MCP resources In the context of MCPs, some of the configuration settings are especially rel evant to the MCP hardware and software architectures, such as: — which cores are activated ; — the execution frequencies of the cores ; — the priorities and allocation of shared interconnect ; — which of the peripheral devices of the MCP are activated ; — whether sha red memory or shared cache is used , and how each is allocated ; and — whether dynamic features that are built into some MCPs are allowed to alter the frequency of execution of the cores or to deactivate one or more cores in order to save energy ( t his might no t be desirable for cores that host safety - critical software applications) .

Objective MCP_Resource_Usage_1: The applicant has determined and documented the MCP configuration settings that will enable the hardware and the software hosted on the MCP to satisf y the functional, performance, and timing requirements of the system.

Objective MCP_Resource_Usage_2: RESERVED .

Covered by AMC 20 - 152A , O bjective COTS - 8.

Powered by EASA eRules Page 597 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) 5.3. Interference channels and resource usage As stated above, the software applications or tasks that execute on different cores of a n MCP share MCP resources ; so , even if there is no explicit data or control flow between these software applications or tasks, coupling exists on the platform level, which can cause interference between them.

There may be software or hardware channels through which the MCP cores or the software hosted on those cores coul d interfere with each other, in addition to those channels specifically mentioned in this AMC. For instance, many MCPs include an ‘interconnect ’ / ‘ coherency fabric’, through which the demands for MCP resources ( e.g. from the software applications hosted o n the MCP ) are channelled and the demands are arbitrated. This arbitration can cause interference effects such as jitter on data arrival times, data consistency issues, or it can change the order in which transactions requested by the software applications are executed.

Non - deterministic behaviour of the hosted software applications may occur due to such interference.

Moreover, the complexity of the MCP, executing tasks in parallel and the interference could lead to the demands for resources exceeding the available resources. For instance, if the demands for interconnect transactions are very high in MCPs with a very high level of external databus traffic, the interconnect can become overloaded, which can affect transactions on some MCPs.

MCP_Resource_Usage_3: The applicant has identified the interference channels that could permit interference to affect the software applications hosted on the MCP cores, and has verified the applicant’s chosen means of mitigation of the interference.

N otes : a) This objective includes the identification of any interference caused by the use of shared memory, shared cache, an interconnect, or the use of any other shared resources, including shared peripherals, and the verification of the means of mitigation chosen by the applicant.

b) If the applicant identifies interference channels that cannot affect the software applications in the intended final configuration, then those interference channels do not need to be mitigated and no verification of mitigation is needed.

c) The applicant should handle any interference channel discovered at any time during the project in the same manner as in this objective and these explanatory notes.

d) If the highest IDAL of the MCP hardware and of all the software application s hosted on the MCP is C , and the hosted software applications are not required by the safety analysis to be robustly partitioned, then the applicant has the option to not conduct an interference analysis and , therefore , to not meet this objective. However , applicants should note that opting to not meet this objective affects the manner in which they are permitted to conduct their software verification ( s ee O bjective MCP_Software_1 and Note c ) of that objective.)

MCP_Resource_Usage_4: The applicant has iden tified the available resources of the MCP and of its interconnect in the intended final configuration, has allocated the resources of the MCP to the software applications hosted on the MCP, and has verified that the demands for the resources of the MCP and of the interconnect do not exceed the available resources when all the hosted software is executing on the target processor.

Note: The use of worst - case scenarios is implicit in this objective.

Powered by EASA eRules Page 598 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) 5.4. Software verification The software verification proces ses in the applicable software guidance need to be adapted for use on an MCP to demonstrate that the hosted software applications function correctly and have sufficient time to execute in the presence of the interference that occurs when all the hosted sof tware is executing on an MCP.

With an MCP, there may be data and control flows between software components or tasks hosted on different cores of the MCP. Therefore , the data and control coupling analysis performed on the software hosted on each separate core (as required by the applicable software guidance) may not reveal the improper software behaviour associated with features such as hardware runtime optimi s ations and memory models on MCPs.

The WCET of a software component or task may increase significantly when other software components or tasks are executing in parallel on the other cores of an MCP. This could cause some software applications to have insufficient time to complete the execution of their safety - critical functionality.

Interference and interactions between software applications or tasks occur via the proprietary internal mechanisms of an MCP. Any simulation of those mechanisms is , therefore , less li kely to be representative in terms of functionality or execution time than testing conducted on the target MCP in the intended final configuration, and thus is less likely to detect errors.

To adapt the software verification guidance for different types of MCP platforms, the two following categories of MCP platforms are considered: — MCP platforms with robust partitioning, and — a ll other MCP platforms.

MCP_Software_1: The applicant has verified that all the software components hosted by the MCP meet the obj ectives of the applicable software guidance. In particular, the applicant has verified that all the hosted software components function correctly and have sufficient time to complete their execution when all the hosted software and hardware of the MCP is e xecuting in the intended final configuration.

The way in which the applicant should satisfy this objective depends on the type of the MCP platform: — MCP platforms with robust partitioning: Applicants who have verified that their MCP platform provides both robust resource partitioning and robust time partitioning (as defined in this AMC ) may verify software applications separately on the MCP and determine their WCETs separately.

— All other MCP platforms: Applicants may verify separately on the MCP any software component or set of requirements for which the interference identified in the interference analysis is mitigated or is precluded by design. Software components or sets of software requirements for which interference is not avoided or mitigated sho uld be tested on the target MCP with all software components executing in the intended final configuration, including robustness testing of the interfaces of the MCP.

The WCET of a software component may be determined separately on the MCP if the applicant shows that time interference is mitigated for that software component ; otherwise, the WCET should be determined by analysis and confirmed by test on the target MCP with all the software components executing in the intended final configuration.

Powered by EASA eRules Page 599 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) N otes : a) All the interfaces between the hosted software and the hardware of the MCP should be included in this testing.

b) The robustness testing mentioned above is intended to cover the specific aspects of an MCP that are not specifically covered by the standard verification activities described in the applicable software guidance.

c) If the highest IDAL of the MCP hardware and of all the software applications hosted on the MCP is C , and the hosted software applications are not required by the safety anal ysis to be robustly partitioned, then the applicant has the option to not conduct an interference analysis and therefore to not meet O bjective MCP_Resource_Usage_3. In such a case where no interference analysis has been performed, the hosted software compo nents should be verified according to this objective as components for which interference is not avoided or mitigated and for which separate verification is , therefore , not permitted.

d) To ‘ verify separately’ and ‘ determine the WCET separately’ mean to co nduct these activities without all the software executing at the same time on other cores of the MCP.

e) Interference may occur between tasks of a single component when the tasks execute on different cores.

MCP_Software_2: The applicant has verified that t he data and control coupling between all the individual software components hosted on the same core or on different cores of the MCP has been exercised during software requirement - based testing, including exercising any interfaces between the software comp onents via shared memory and any mechanisms to control the access to shared memory, and that the data and control coupling is correct.

N otes : a) When this objective cannot be completely met during the software verification, applicants may propose to use s ystem - level testing to exercise the data and control coupling between software components hosted on different cores.

b) Interference may occur between tasks of a single component when the tasks execute on different cores.

5.5. Error detection and handling, and safety nets As well as the types of errors and failures normally detected and handled in a system that incorporates a single - core processor, additional types of errors and failures may need to be detected and handled in an MCP environment due to probl ems caused by the features of MCPs and due to the additional complexity of executing several software applications or tasks in parallel in real time.

Features of an MCP may , therefore , contain unintended functionality that may cause errors and produce une xpected behaviour. Applicants may , therefore , wish to consider the use of a ‘ safety net’ independent from the MCP to detect and handle failures within the MCP and to contain any such failures within the equipment in which the MCP is installed.

MCP_Error_Handling_1: The applicant has identified the effects of failures that may occur within the MCP and has designed, implemented, and verified means commensurate with the safety objectives, by which to detect and handle those failures in a fail - safe manner that contains the effects of any failures within the equipment in which the MCP is installed. These means may include a ‘safety net’ independent from the MCP.

Powered by EASA eRules Page 600 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) 5.6. Data to complement the accomplishment summaries The applicant is expected to describ e how the objectives of this AMC were satisfied.

MCP_Accomplishment_Summary_1: In addition to providing the information requested by the applicable software and AEH guidance, the applicant has provided documentation that summari s es how they have met each o f the objectives of this AMC .

5.7. Applicability of the MCP objectives according to their IDALs The column ‘IDAL A or B’ shows the objectives applicable when the highest IDAL of any of the software applications hosted by the MCP or of the MCP hardware device is A or B.

The column ‘IDAL C’ shows the objectives applicable when the highest IDAL of any of the software applications hosted by the MCP or of the MCP Hardware device is C.

MCP OBJECTIVES IDAL A or B IDAL C MCP_Planning_1 Yes Yes MCP_Planning_2 Yes Yes MCP_Resource_Usage_1 Yes Yes MCP_Resource_Usage_2 Covered by n/a AMC 20 - 152A O bjective COTS - 8 MCP_Resource_Usage_3 Yes Refer to N ote d MCP_Resource_Usage_4 Yes No MCP_Software_1 Yes Yes MCP_Software_2 Yes Yes MCP_Error_Handling_1 Yes No MCP_Accomplishment_Summary_1 Yes Yes 6. Related Regulatory, Advisory, and Industry Material (a) Related EASA Certification Specifications (CSs) (1) CS - 23 Certification Specifications and Acceptable Means of Compliance for Normal, Utility, Aerobatic, and Commuter Category Aeroplanes (2) CS - 25 Certification Specifications and Acceptable Means of Compliance for Large Aeroplanes (3) CS - 27 Certification Specifications and Acceptable Means of Compliance for Small Rotorcraft (4) CS - 29 Certificatio n Specifications and Acceptable Means of Compliance for Large Rotorcraft (5) CS - E Certification Specifications and Acceptable Means of Compliance for Engines and AMC 20 - 3B Certific ation of Engines Equipped with Electronic Engine Control Systems (6) CS - P Certification Specifications for Propellers and AMC 20 - 1A Certification of Aircraft Propulsion Systems Equ ipped with Electronic Control Systems (7) CS - ETSO Certification Specifications for European Technical Standard Orders Powered by EASA eRules Page 601 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) (8) CS - APU Certification Specifications for Auxiliary Power Units and AMC 20 - 2B Certification of Essential APU Equipped with Electronic Controls (b) EASA Acceptable Means of Compliance (AMC) (1) AMC 20 - 115 ( ) Airborne Software Development Assurance Using EUROCAE ED - 12 and RTCA DO - 178 (2) AMC 20 - 152( ) Development Assurance for Airborne Electronic Hardware (AEH) (c) FAA Advisory Circulars (ACs) (1) AC 20 - 115 Airborne Software Development Assurance Using EUROCAE ED - 12( ) and RTCA DO - 178( ) (2) AC 20 - 152 Development Assurance for Airborne Electronic Hardware (AEH) (3) AC 00 - 72 Best Practices for Airborne Electronic Hardware Design Assurance Using EUROCAE ED - 80( ) and RTCA DO - 254( ) (4) AC 20 - 170 Integrated Modular Avionics Deve lopment, Verification, Integration and Approval using RTCA DO - 297 and Technical Standard Order C - 153 (5) AC 27 - 1309 Equipment, Systems, and Installations (included in AC 27 - 1, Certification of Normal Category Rotorcraft) (6) AC 29 - 1309 Equipment, Systems, and Installations (included in AC 29 - 2, Certification of Transport Category Rotorcraft) (d) Industry Documents (1) EUROCAE ED - 12 Software Considerations in Airborne Systems and Equipment Certification , dated May 1982 (no longer in print) (2) EUROCAE ED - 12A Software Considerations in Airborne Systems and Equipment Certification , dated October 1985 (no longer in print) (3) EUROCAE ED - 12B Software Considerations in Airborne Systems and Equipment Certification , dated December 1992 (4) EUROCAE ED - 12C Software Co nsiderations in Airborne Systems and Equipment Certification , dated January 2012 (5) EUROCAE ED - 79A Guidelines for Development of Civil Aircraft and Systems , dated December 2010 (6) EUROCAE ED - 80 Design Assurance Guidance for Airborne Electronic Hardware , dated April 2000 (7) EUROCAE ED - 94C Supporting Information for ED - 12C and ED - 109A , dated January 2012 (8) EUROCAE ED - 124 Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations , dated June 2007 (9) EUROCAE ED - 215 Software T ool Qualification Considerations , dated January 2012 (10) EUROCAE ED - 216 Formal Methods Supplement to ED - 12C and ED - 109A , dated January (11) EUROCAE ED - 217 Object - Oriented Technology and Related Techniques Supplement to ED - 12C and ED - 109A , dated January 2012 Powered by EASA eRules Page 602 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART A — GENERAL of Compliance for Airworthiness of AMC 20 - 193 Products, Parts and Appliances (AMC - 20) (12) EUROCAE ED - 218 Model - Based Development and Verification Supplement to ED - 12C and ED - 109A , dated January 2012 (13) SAE International Aerospace Recommended Practice (ARP) 4754A Guidelines for Development of Civil Aircraft and Systems , date d 21 December 2010 (14) RTCA DO - 178 Software Considerations in Airborne Systems and Equipment Certification , dated January 1982 (no longer in print) (15) RTCA DO - 178A Software Considerations in Airborne Systems and Equipment Certification , dated March 198 5 (no longer in print) (16) RTCA DO - 178B Software Considerations in Airborne Systems and Equipment Certification , dated 1 December 1992 (17) RTCA DO - 178C Software Considerations in Airborne Systems and Equipment Certification , dated 13 December 2011 (18) R TCA DO - 248C Supporting Information for DO - 178C and DO - 278A , dated 13 December (19) RTCA DO - 254 Design Assurance Guidance for Airborne Electronic Hardware , dated 19 April 2000 (20) RTCA DO - 297 Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations , dated 8 November 2005 (21) RTCA DO - 330 Software Tool Qualification Considerations , dated 13 December 2011 (22) RTCA DO - 331 Model - Based Development and Verification Supplement to DO - 178C and DO - 278A , dated 13 December 2011 (23) RTCA DO - 332 Object - Oriented Technology and Related Techniques Supplement to DO - 178C and DO - 278A , dated 13 December 2011 (24) RTCA DO - 333 Formal Methods Supplement to DO - 178C and DO - 278A , dated 13 December 2011 [Amdt 20/2 3 ] Powered by EASA eRules Page 603 of 605 | Jun 2023

Easy Access Rules for Acceptable Means SUBPART B — LIST OF AMC - 20 ITEMS of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20)

SUBPART B — LIST OF AMC - 20 ITEMS

ED Decision 2021/007/R INDEX 1 EASA AMC - 20 Title Last amended by reference AMC 20 - 1A The Certification of Aircraft Propulsion Systems Equipped AMC - 20 Amdt 19 with Electronic Controls AMC 20 - 2B The Certification of Essential APU s Equipped with Electronic AMC - 20 Amdt 19 Controls AMC 20 - 3B The Certification of Engines Equipped with Electronic Engine AMC - 20 Amdt 19 Control Systems AMC 20 - 4A Airworthiness Approval and Operational Criteria For the Use Cancelled of Navigation Systems in European Airspace Designated For (By AMC - 20 Amdt 17) Basic RNAV Operations AMC 20 - 5 Airworthiness Approval and Operational Criteria for the use Cancelled of the Navstar Global Positioning System (GPS) (By AMC - 20 Amdt 17) AMC 20 - 6 rev 2 Extended Range Operation with Two - Engine Aeroplanes AMC - 20 A mdt 7 ETOPS Certification and Operation AMC 20 - 8A Occurrence Reporting AMC - 20 Amdt 19 AMC 20 - 9 Acceptable Means of Compliance for the A pproval of AMC - 20 Amdt 1 Departure Clearance via Data Communications over ACARS.

AMC 20 - 10 Acceptable Means of Compliance for the Approval of Digital AMC - 20 Amdt 1 ATIS via Data Link over ACARS.

AMC 20 - 11 Acceptable Means of Compliance for the Approval of use of Cancelled Initial Services for Air Ground Data Link in Co ntinental (by AMC - 20 Amdt 11) Airspace AMC 20 - 12 Recognition of FAA Order 8400.12a for RNP 10 Operations Cancelled (By AMC - 20 Amdt 17) AMC 20 - 13 Certification of Mode S Transponder Systems for Enhanced Cancelled Surveillance (by AMC - 20 Amdt 11) AMC 20 - 15 AMC 20 - 15 Airworthiness Certification Considerations for the AMC - 20 Amdt 8 Airborne Collision Avoidance System (ACAS II) with optional Hybrid Surveillance AMC 20 - 19 In - Flight Entertainment AMC - 20 Amdt 19 AMC 20 - 20B Continuing Structural Integrity Programme AMC - 20 Amdt 22 AMC 20 - 21 Programme to enhance aeroplane Electrical Wiring AMC - 20 Amdt 4 Interconnection System maintenance AMC 20 - 22 Aeroplane Electrical Wiring Interconnection System Training AMC - 20 Amdt 4 Programme Powered by EASA eRules Page 604 of 605 | Jun 2023 Easy Access Rules for Acceptable Means SUBPART B — LIST OF AMC - 20 ITEMS of Compliance for Airworthiness of Products, Parts and Appliances (AMC - 20) AMC 20 - 23 Development of Electrical Standard Wiring Practices AMC - 20 Amdt 4 documentation AMC 20 - 24 Certification Considerations for the Enhanced ATS in AMC - 20 Amdt 3 NonRadar Areas using ADS - B Surveill ance (ADS - B - NRA) Application via 1090 MHZ Extended Squitter AMC 20 - 25A Airworthiness consideration for Electronic Flight Bags (EFBs) AMC - 20 Amdt 16 AMC 20 - 26 Airworthiness Approval and Operational Criteria for RNP Cancelled Authorisation Required (RNP AR) Operations (By AMC - 20 Amdt 17) AMC 20 - 27A Airworthiness Approval and Operational Criteria for RNP Cancelled APPROACH (RNP APCH) Operations Including APV (By AMC - 20 Amdt 17) BAROVNAV Opera tions AMC 20 - 28 Airworthiness Approval and Operational Criteria related to Cancelled Area Navigation for Global Navigation Satellite System (By AMC - 20 Amdt 17) approach operation to Localiser Performance with Vertical guidance minima using Satellite Based Augmentation System AMC 20 - 29 Composite Aircraft Structure AMC - 20 Amdt 6 AMC 20 - 42 Airworthiness information security risk assessment AMC - 20 Amdt 18 AMC 20 - 115D Software considerations for certification of airborne systems AMC - 20 Amdt 14 and equipment AMC 20 - 128A Design Considerations for Minimizing Hazards Caused by AMC - 20 Initial issue Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure AMC 20 - 136A Aircraft elect rical and electronic system lightning protection AMC - 20 Amdt 2 3 AMC 20 - 152A Airborne Electronic Hardware AMC - 20 Amdt 19 AMC 20 - 158A Aircraft electrical and electronic system high - intensity AMC - 20 Amdt 2 3 radiated fields (HIRF) protection AMC 20 - 170 IMA AMC - 20 Amdt 15 AMC 20 - 189 The Management of Open Problem Reports AMC - 20 Amdt 19 AMC 20 - 193 Use of multi - core processors AMC - 20 Amdt 23 [Amdt 20/2 0 ] [Amdt 20/22] [Amdt 20/2 3 ] Powered by EASA eRules Page 605 of 605 | Jun 2023