Certification Maintenance Requirements

10/03/11 AC 25-19A 4. Related Documents .

a. Title 14, Code of Federal Regulations (14 CFR), part 25.

Section Title 25.1309 Equipment, systems, and installations 25.1529 Instructions for continued airworthiness b. FAA ACs.

AC No. Title Date 25.1309-1A System Design and Analysis 6/21/88 120-17A Maintenance Control By Reliability 3/27/78 Methods 121-22A Maintenance Review Board Procedures 3/7/97 c. Other Documents.

Air Transport Association (ATA) Maintenance Steering Group (MSG-3), Airline/Manufacturer Maintenance Program Development Document.

Available from the ATA, 1301 Pennsylvania Avenue, N.W. Suite 1100, Washington, DC 20004-1707.

European Aviation Safety Agency (EASA) Acceptable Means of Compliance (AMC) 25.1309, System Design and Analysis. Available on the internet at: http://easa.europa.eu/agency-measures/certification - specifications.php .

Aviation Rulemaking Advisory Committee recommended draft Advisory Circular 25.1309-Arsenal, System Design and Analysis, dated 6/10/ 2002.

Available on the internet at: http://www.faa.gov/regulations_policies/rulemaking/committees/arac/media /tae/TAE_SDA_T2.pdf .

5. Certification Maintenance Requirements (CMR) Definition. A CMR is a required scheduled maintenance task established during the design certification of the airplane systems as an operating limitation of the type certificate (TC) or supplemental type certificate (STC).

The CMRs are a subset of the instructions for continued airworthiness identified during the certification process. A CMR usually results from a formal, numerical analysis conducted to show compliance with the requirements applicable to catastrophic and hazardous failure conditions, as defined in paragraph 6d below. Compliance may also result from a qualitative, engineering judgment-based analysis.

10/03/11 AC 25-19A a. The CMRs are required tasks, and associated intervals, developed to achieve compliance with § 25.1309 and other regulations requiring safety analyses (such as §§ 25.671, 25.783, 25.901, and 25.933). A CMR is intended to detect safety-significant latent failures that would, in combination with one or more other specific failures or events, result in a hazardous or catastrophic failure condition. A CMR can also be used to establish a required task to detect an impending wear-out of an item whose failure is associated with a hazardous or catastrophic failure condition.

b. It is important to note that CMRs are derived from a fundamentally different analysis process than the maintenance tasks and intervals that result from the MSG-3 analysis associated with MRB activities (if the MRB process is used). Although both types of analysis may produce equivalent maintenance tasks and intervals, it is not always appropriate to substitute a CMR with an MSG-3 task.

c. The CMRs verify that a certain failure has or has not occurred, indicate that repairs are necessary if the item has failed, or identify the need to inspect for impending failures (e.g., heavy wear or leakage). Because the exposure time to a latent failure is a key element in the calculations used in a safety analysis, limiting the exposure time will have a significant effect on the resultant overall failure probability of the system. The intervals for CMR tasks should be designated in terms of flight hours, cycles, or calendar time, as appropriate.

d. The type certification process assumes the airplane will be maintained in a condition of airworthiness equal to its certified or properly altered condition. The process described in this AC is not intended to establish normal maintenance tasks (e.g., greasing, fluid-level checks, etc.)

that should be defined through the MSG-3 analysis process. Also, this process is not intended to establish CMRs for the purpose of providing supplemental margins of safety for concerns arising late in the type design approval process. Such concerns should be resolved by appropriate means, which are unlikely to include CMRs not established via normal safety analyses.

e. CMRs should not be confused with required structural inspection programs that are developed by the TC applicant to meet the inspection requirements for damage tolerance, as required by §§ 25.571, 25.1529, and Appendix H25.4 (Airworthiness Limitations section). The CMRs are to be developed and managed separately from any structural inspections programs.

6. Other Definitions . The following terms apply to the system design and analysis requirements of § 25.1309(b), and (c), and to the guidance material provided in this AC. For a complete definition of these terms, refer to the applicable regulations and guidance material (e.g., AC 25.1309-1A). The applicable regulations and guidance material are the controlling documents for defining the following terms: a. Crew. The cabin, flight, or maintenance crew, as applicable.

b. Error . An omission or incorrect action by a crewmember or maintenance personnel, or a mistake in requirements, design, or implementation.

10/03/11 AC 25-19A c. Failure. An occurrence which affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function or a malfunction).

d. Failure Condition. A condition caused or contributed to by one or more failures or errors, that has either a direct or consequential effect on the airplane, its occupants, and/or other persons. In identifying failure conditions, the flight phase, relevant adverse operational or environmental conditions, and external events should be considered. Failure conditions may be classified according to their severities as follows: (1) Minor Failure Conditions. Failure conditions that would not significantly reduce airplane safety, and which involve crew actions that are well within their capabilities. Minor Failure Conditions may include, for example: (a) A slight reduction in the safety margin or functional capabilities, or (b) A slight increase in crew workload, such as routine flight plan changes, or some physical discomfort to passengers or cabin crew.

(2) Major Failure Conditions. Failure conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example: (a) A significant reduction in safety margins or functional capabilities, (b) A significant increase in crew workload or in conditions impairing crew efficiency, or (c) Discomfort to occupants, possibly including injures.

(3) Hazardous Failure Conditions. Failure conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be: (a) A large reduction in safety margins or functional capabilities, (b) Physical distress or higher workload such that the flightcrew cannot be relied upon to perform their tasks accurately or completely, or (c) Serious or fatal injury to a relatively small number of the occupants.

(4) Catastrophic Failure Conditions. Failure conditions that would result in multiple fatalities, usually with the loss of the airplane. (Note: Catastrophic failure conditions are also defined as a failure condition that would prevent the continued safe flight and landing of the airplane.)

10/03/11 AC 25-19A e. Governing Aircraft Certification Office (ACO). The ACO responsible for making compliance findings and certificating a particular type design.

f. Probability Terms. When using qualitative or quantitative assessments to determine compliance with § 25.1309(b), the following descriptions of the probability terms used in the requirement and in the advisory materials listed above have become commonly accepted aids to engineering judgment: (1) Probable Failure Conditions. Failure conditions anticipated to occur one or more times during the entire operational life of each airplane. Minor failure conditions may be probable. For quantitative analysis purposes, probable failure conditions are those having a -5 probability greater than on the order of 1 x 10 .

(2) Improbable Failure Conditions. Improbable failure conditions are divided into two categories, as follows: (a) Remote. Unlikely to occur to each airplane during its total life but may occur several times when considering the total operational life of a number of airplanes of that type.

Major failure conditions must be no more frequent than remote. For quantitative analysis -5 purposes, remote failure conditions are those having a probability on the order of 1 x 10 or less, -7 but greater than on the order of 1 x 10 .

(b) Extremely Remote. Not anticipated to occur to each airplane during its total life, but may occur a few times when considering the total operational life of all of the airplanes of that type. Hazardous failure conditions must be no more frequent than extremely remote. For quantitative analysis purposes, extremely remote failure conditions are those having a probability -7 -9 on the order of 1 x 10 or less, but greater than on the order of 1 x 10 .

(3) Extremely Improbable Failure Conditions. Failure conditions so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. For quantitative analysis purposes, extremely improbable failure conditions are those having a -9 probability on the order of 1 x 10 or less. Catastrophic failure conditions must be shown to be extremely improbable.

g. Qualitative. Analytical processes that assess system and airplane safety in an objective, non-numerical manner.

h. Quantitative. Analytical processes that apply mathematical methods to assess system and airplane safety.

i. Significant Latent Failures. A failure is latent until it is made known to the flightcrew or maintenance personnel. Significant latent failures are latent failures that would, in combination with one or more other specific failures or events, result in a hazardous or catastrophic failure condition.

10/03/11 AC 25-19A k. Wear out . A condition where a component is worn beyond a pre-determined limit.

7. System Safety Assessments (SSA). Section 25.1309(b) provides general requirements for an inverse relationship between the probability and severity of each failure condition.

a. Section 25.1309(b) specifies required safety levels in qualitative terms, and a safety assessment must be made to show compliance. Various assessment techniques have been developed to help applicants and the FAA in determining that a logical and acceptable inverse relationship exists between the probability and the severity of each failure condition. These techniques include the use of service experience data of similar, previously approved systems, and thorough qualitative and quantitative analyses.

b. In addition, difficulties have been experienced in assessing the acceptability of some designs, especially those of systems, or parts of systems, that are complex, that have a high degree of integration, that use new technology, or that perform safety-critical functions.

These difficulties led to the selective use of rational analyses to estimate quantitative probabilities, and the development of related criteria based on historical data of accidents and incidents caused or contributed to by failures. These criteria, expressed as numerical probability ranges associated with the terms used in § 25.1309(b), became commonly accepted for evaluating the quantitative analyses that are often used in such cases to support experienced engineering and operational judgment and to supplement qualitative analyses and tests.

NOTE : See AC 25.1309-1A, System Design and Analysis, or ARAC recommended draft AC 25.1309-Arsenal, for a complete description of the inverse relationship between the probability and severity of failure conditions, and the various methods of showing compliance with § 25.1309.

8. Design Considerations Related to Candidate CMRs (CCMRs). A decision to create a CCMR should follow the guidelines given in the current AC 25.1309-1 and appendix 1 of this AC. Practical and reliable failure monitoring and indication systems to detect significant latent failures should be implemented in lieu of CMRs. A practical failure monitoring and indication system is one that is considered to be within the state of the art. Reliable failure monitoring and indication should utilize current state of the art technology to minimize the probability of falsely detecting and indicating non-existent failures. Experienced judgment should be applied when determining whether or not a failure monitoring and warning system would be practical and reliable. Comparison with similar, previously approved systems is sometimes helpful.

Appendix 1 of this AC outlines design considerations that should be followed in any decision to create a CCMR.

9. Overview of the Scheduled Maintenance Task Development Process. Figure 1, below, shows the relationship between the certification and MRB processes in establishing scheduled maintenance tasks. Those tasks related to the certification process, as well as those derived through MSG-3 analysis, are identified and documented as illustrated. The details of the process 10/03/11 AC 25-19A to be followed in defining, documenting, and handling CMRs are given in paragraphs 11 through 14, below.

10/03/11 AC 25-19A Sheet TC Data Manufacturers ACO specialist Engineering personnel Operators MRB Chairperson Reference Certification Maintenance CCMR vs. MRB task comparison CMR selection Coordination Committee (CMCC) Section C Section B Zonal Inspection CMRs Section A MRB Report Systems and Powerplant Integrated Structural Maintenance CMR Zones SSIs (CCMR) MSIs MRB PROCESS TC ACO Approval Applicant Candidate Certification Maintenance Requirement CERTIFICATION PROCESS ACO Acceptance

I ~ • - -

FAA MRB For info only Chairperson review & accept

I I

Re-evaluation/Redesign Figure 1. Scheduled Maintenance Task Development TC

I I

Applicant TC Applicant 25.1309, etc.)

§ Discussion & Feedback Manufacturers Operators MRB Advisor ACO specialist Safety analysis ( Properly justified engineering judgment

• • • '> I '>'>'>'>

Aircraft Certification Office Industry Steering Committee Maintenance Review Board Maintenance Steering Group Maintenance Significant Items Type Certificate Design ISC ISC Working Group Activity MSG-3 analysis ISC Working Group Activity MSG-3 analysis ISC Working Group Activity MSG-3 analysis Proposed MRB task and intervals ACO: ISC: MRB: MSG: MSI: TC: • 10/03/11 AC 25-19A 10. Identification of Candidate CMRs (CCMRs).

a. Tasks that are candidates for selection as CMRs usually come from safety analyses (e.g., SSA, which establishes whether there is a need for tasks to be carried out periodically to comply with § 25.1309, and other requirements requiring this type of analysis (such as §§ 25.671, 25.783, 25.901, and 25.933). The SSA should identify as CCMRs the maintenance tasks intended to detect latent failures that would, in combination with one or more specified failures or events, lead to a hazardous or catastrophic failure condition. Tasks may also be selected from those intended to inspect for impending failures due to wear out.

The CCMR should identify the failure mode to be detected, the failure condition of concern, the check interval, and the maintenance task.

b. All Significant latent failures should be addressed in the SAA. In some situations, a failure condition might meet the quantitative probability objective, yet contain a component that, per the analysis, does not require inspections to meet that objective (i.e., could be left latently failed for the life of the airplane). In that situation, we believe that some inspections in the life of the airplane are necessary to avoid undue exposure to catastrophic or hazardous “single failure” situations, therefore a qualitative assessment to determine the required maintenance before end of airplane life is still necessary.

c. As the safety analysis may be qualitative or quantitative, some task intervals may be derived in a qualitative manner (e.g., engineering judgment and service experience). Per the advisory material on § 25.1309, numerical analysis supplements, but does not replace, qualitative engineering and operational judgments. Therefore, other tasks that are not derived from numerical analysis of significant latent failures, but are based on properly justified engineering judgment, can also be candidates for CMRs. The justification should include the logic leading to identification as a candidate CMR, and the data and experience base supporting the logic. As § 25.1309(b) regulates catastrophic, hazardous, and major failure conditions, CMRs may also be identified for latent failures that would, in combination with one or more specified failures or events, lead to a major failure condition that is not identified and assigned a task via the MSG-3 process (however experience has shown these cases are rare).

11. Certification Maintenance Coordination Committee (CMCC).

a. The CMCC should discuss and disposition all CCMRs. In order to grant airplane operators an opportunity to participate in the selection of CMRs, and to assess the candidate CMRs and the proposed MRB tasks and intervals in an integrated process, the TC applicant should convene a CMCC (see Figure 1 of this AC). This committee should be made up of manufacturer representatives (typically maintenance, design, and safety engineering personnel), operator representatives designated by the Industry Steering Committee (ISC) Chairperson, ACO specialists, and the MRB Chairperson. The governing ACO participation in the CMCC process is necessary to provide regulatory guidance to the selection of CMRs.

10/03/11 AC 25-19A b. As early as possible in the design phase of the airplane program, and at intervals as necessary, the CMCC should meet to review candidate CMRs and their purpose, the failure conditions and their criticality, the intended tasks, and other relevant factors. In addition, where multiple tasks result from a quantitative analysis, it may be possible to extend a given interval at the expense of one or more other intervals, in order to optimize the required maintenance activity. However, once a decision is made to create a CMR, then the CMR task interval should be based solely on the results of the safety analysis.

c. The CMCC functions as an advisory committee for the TC applicant and proposes the necessary CMRs. The governing ACO is the authority that ultimately approves CMRs as a limitation of the type certificate per 14 CFR 21.41. The results of the CMCC (proposed CMRs to be included in the type design limitations, and proposed MRB tasks and/or intervals that meet the intent of the CCMRs) are forwarded by the TC applicant to the ISC for consideration. CMCC proposed MRB tasks and/or intervals accepted by the ISC are reflected in the MRB report proposal. Proposed MRB tasks and/or intervals rejected by the ISC will result in CMR tasks. Following the ISC's consideration, the TC applicant submits the CMR document to the governing ACO for final review and approval.

12. Selection of CMRs. Each CCMR should be reviewed by the CMCC and a determination made as to whether it should be a CMR. The applicant should provide sufficient information to the CMCC to enable an understanding of the failure conditions and the failure or event combinations that result in the CCMR. CCMRs are evaluated in the context of the failure conditions in which they are involved, e.g., whether the latent failure is part of a dual failure, or a more complex failure condition.

a. The CMR designation should be applied in the case of catastrophic dual failures where one failure is latent. The CMR designation should also be applied to tasks that address wear out of a component involved in a catastrophic failure condition that results from two failures. The interval for the CMR task should be chosen such that the system safety analysis assumptions are protected in service, while allowing flexibility for the airplane operators to manage their maintenance programs. In the case where the system safety analysis does not specify an interval, the CMCC may establish an interval that is less than the life of the airplane considering factors that influence the outcome of the failure condition, such as the nature of the fault, field experience, or the task characteristics.

b. The CMR designation may not be necessary if there is an equivalent MSG-3 task, or an approved AFM procedure, to accommodate the CCMR. The following criteria are used in making this determination: (1) The SSA allows the failure to be latent for the life of the airplane, or (2) Latent failures leaving the airplane one failure away from hazardous failure conditions, or (3) A wear out failure mode that directly or in combination with another failure, leads to a hazardous failure condition.

10/03/11 AC 25-19A (4) In all the above cases, the CCMR is satisfied by: (a) A MSG-3 task provided it meets all of the following criteria: 1 It is a Failure Effect Category 8 task (FEC8) for latent failure, or FEC5 task for evident failure due to wear out. See the ATA document referenced in paragraph 4c above for definitions of FEC5 and FEC8. Note that because the MSG-3 logic may not consider a failure condition containing three or more failures, it is possible that there is no MSG-3 task identified for a CCMR.

2 The FEC8 or FEC5 task interval is shorter than the interval that would be required for the CMR. For example, some applicants have applied, and the Authorities have accepted, a factor of one half of the CMR interval as a margin to guard against potential escalation of FEC8 task intervals beyond the intervals specified by the CMR.

3 The applicant has procedures in place (e.g. tagging of MSG-3 tasks to identify those derived from the safety analysis) so that the FEC8 or FEC5 task would not be susceptible to escalation beyond the interval that would otherwise be required by a CMR. For example, due to difficulty in accessing the item, a task may not be conducted at the required interval. Engineering judgment indicates a CMR is appropriate for compliance rather than a MSG-3 task.

(b) Tasks covered by the approved airplane flight manual (AFM) procedures.

c. In complex failure conditions (e.g., a combination of three or more failures) the SSA may identify more than one CCMR. Equivalent and compatible MSG-3 tasks (if they exist) may be used to satisfy some of those CCMRs. The rationale for the disposition of each CCMR should be presented to the governing ACO for approval.

13. Documentation and Handling of CMRs.

a. The CMR data location should be referenced in the type certificate data sheet (TCDS).

The latest version of the CMR document should be controlled by a log of pages approved by the governing ACO. In this way, changes to CMRs following certification will not require an amendment to the TCDS. As stated in FAA Order 8110.54A, Instructions for Continued Airworthiness Responsibilities, Requirements, and Contents, dated 10/23/2010, CMRs are functionally equal to airworthiness limitations. An acceptable means is to include CMRs in the Airworthiness Limitations section of the airplane maintenance manual.

b. Since CMRs are based on statistical averages and reliability rates, an “exceptional short term extension” for CMR intervals may be made on one airplane for a specific period of time without risking safety. Any exceptional short term extensions to CMR intervals must be defined and fully explained in the CMR document. The local regulatory authority (e.g., a Principal Maintenance Inspector) must concur with any exceptional short term extensions allowed by the CMR document before they take place using procedures established with the local regulatory 10/03/11 AC 25-19A authority in the operators’ manuals. The exceptional short term extension process is applicable to CMR intervals. It should not be confused with the operator’s “short term escalation” program for normal maintenance tasks described in the operators’ manuals and in the Flight Standards Information Management System, Order 8900.1.

(1) The term "exceptional short term extension" is defined as an increase in a CMR interval that may be needed to cover an uncontrollable or unexpected situation. Any allowable increase must be defined either as a percent of the normal interval, or a stated number of flight hours, flight cycles, or calendar days. If no exceptional short term extension is to be allowed for a given CMR, this restriction should be stated in the CMR document.

(2) Repeated use of exceptional short term extensions, either on the same airplane or on similar airplanes in an operator's fleet, should not be used as a substitute for good management practices. Exceptional short term extensions must not be used for fleet CMR interval escalation.

(3) The CMR document should state that the governing ACO must approve, prior to its use, any desired exceptional short term extension not explicitly listed in the CMR document.

14. Post-Certification Changes to CMRs . Any post-certification changes to CMRs should be reviewed by the same entities that participated in the CMCC and must be approved by the ACO that approved the type design.

a. Since the purpose of a CMR is to limit the exposure time to a given Significant Latent Failure, or a given wear out, as part of an engineering analysis of overall system safety, instances of a CMR task repeatedly finding that no failure has occurred may not be sufficient justification for deleting the task or increasing the time between repetitive performances of the CMR task. In general, a CMR task change or interval escalation could only be made if world fleet service experience indicates that certain assumptions regarding component failure rates made early during the engineering analysis were too conservative, and a re-calculation of system reliability with revised failure rates of certain components reveals that the task or interval may be changed.

b. The introduction of a new CMR or any change to an existing CMR should be reviewed by the same entities that were involved in the CMCC at time of initial certification. To allow the operators to manage their own maintenance programs, it is important that they be afforded the same opportunity for participation that they received during the original certification of the airplane.

c. If later data provides a sufficient basis for the relaxation of a CMR (less restrictive actions to be required), the change may be documented by a revision to the CMR document and approved by the governing ACO.

d. If the FAA determines that the requirements of an existing CMR must be increased (more restrictive actions to be performed), the new requirements will be mandated by an 10/03/11 AC 25-19A airworthiness directive (AD) and the CMR document will be revised to include the change.

e. New CMRs that are unrelated to in-service events may be created and they should be documented and approved by the governing ACO. New CMRs can arise in situations such as: (1) Certification of design changes, or (2) Updates to the applicant’s certification compliance documentation. These may result from regulation changes, AD actions on similar systems or airplanes, awareness of additional hazardous or catastrophic failure conditions, revised failure rates, consideration of extended service goals, etc .

Original signed by Ali Bahrami Ali Bahrami Manager, Transport Airplane Directorate Aircraft Certification Service

10/03/11 AC 25-19A Appendix 1 APPENDIX 1 Supplemental Guidance for CMR Use 1. The FAA intends that the manufacturer chooses a system design that minimizes the number of significant latent failures, with the goal being no such failures if it is practical to do so. A practical and reliable monitoring and/or warning system should be considered as the first means to expose the significant latent failure. If the cost of adding practical and reliable monitoring and/or warning to a system is large, and the added maintenance cost of a CMR is small, addition of a CMR may be the solution of choice for both the type certificate applicant and the operator, provided all applicable regulations are met. Substituting a CMR with a MSG-3 task does not necessarily improve maintenance costs.

2. A decision to create a CMR may include a trade-off of the cost, weight, or complexity of providing an alerting mechanism or device that will expose the latent failure, versus the requirement for the operator to conduct a maintenance or inspection task at fixed intervals.

3. The following points should be considered in any decision to create a CMR: a. What is the magnitude of the changes to the system and/or airplane needed to add a reliable monitoring or warning device that would expose the hidden failure? What is the cost in added system complexity?

b. Is it possible to introduce a self-test on power-up?

c. Is the monitoring and warning system reliable? False warnings must be considered, as well as a lack of warnings.

d. Does the monitoring or warning system itself need a CMR due to its latent failure potential?

e. Is the CMR task reasonable, considering all aspects of the failure condition that the task is intended to address?

f. How long (or short) is the CMR task interval?

g. Is the proposed CMR task labor intensive or time consuming? Can it be done without having to "gain access" and/or without workstands? Without test equipment? Can the CMR task be done without removing equipment from the airplane? Without having to re-adjust equipment? Without leak checks and/or engine runs?

h. Can a simple visual inspection be used instead of a complex one? Can a simple operational check suffice in lieu of a formal functional check against measured requirements?

A1-1

10/03/11 AC 25-19A Appendix 1 i. Is there "added value" to the proposed task (i.e., will the proposed task do more harm than good if the airplane must be continually inspected)?

j. Have all alternatives been evaluated?

A1-2