Design Organization Approval (DOA) and Certification Process

(1)

PART V

State of Design Manufacture

(2)

Course outline

Initial Airworthiness (Part 21)

Type Certificate and Changes to Type Certificate Certification Process

Design Organization Approval (DOA)

Instruction for Continued Airworthiness

(3)

Course outline

Instruction for Continued Airworthiness

(4)

EASA Basic Regulation

Regulation (EU) 2018/1139

(5)

Why DOA exist?

AOC AUTHORITY

CERTIFICATION

AOC

AOC AOC AOC

AOC

At first, certification was handled directly by authority As aviation industry grows bigger,

authority could not keep up with certification requests, then became overloaded

OVERLOAD

(6)

Why DOA exist?

AOC AUTHORITY

AOC

AOC AOC

AOC

DOA DOA

DOA

USER REQUIREMENT

AUDIT/SURVEILLANCE

At first, certification was handled directly by authority As aviation industry grows bigger,

authority could not keep up with certification requests, then became overloaded

DOA system was established as

PRIVILEGES

(7)

Organization responsible for the design of aircraft; changes to aircraft; repairs of aircraft; and parts and appliances need to fulfill the applicable requirements.

A design organization is required to comply with Part 21 – Airworthiness and Environmental Certification requirements, specifically Subpart J.

GMF AeroAsia, as a design organization, currently holds DOA from Indonesian DGCA and EASA.

What is

Design Organization

(8)

UNAIRWORTHY REPAIRED DAMAGED, WORN,

CORRODED, ETC.

DEFINED STANDARD

COMPLIANT TO TCDS AIRWORTHY

AIRWORTHY

CHANGE

NEWLY DEFINED STANDARD

COMPLIANT TO LATEST REQUIREMENTS

REPAIR vs CHANGE

DEFINITION OF

A change is defined as alteration of any of the data included in the type design

CHANGE DEFINITION

GM 21.A.91

A repair is defined as elimination of damage and/or restoration to an airworthy condition following initial release into service by manufacturer of any

REPAIR DEFINITION

(9)

Only DOA Holder is able to apply for TC or Restricted TC

^21.A.14(a)

Application period validity

^21.A.15(e)

5 years for large aeroplane or large rotorcraft (CS-25 and CS-29) 3 years for other (CS-23, CS-27, CS-E, CS-31, etc.)

The purpose of validity period is to ensure the applicable certification basis do not

become obsolete

GM 21.A.15(e)(f)

(10)

Regulation 2018/1139 BASIC REGULATION

Commission Regulation 748/2012 INITIAL AIRWORTHINESS

PART 21

Commission Regulation 1321/2014 CONTINUING AIRWORTHINESS

PART M / 145 / 66 / 147

Certification Specifications

+ associated AMC / GM AMC / GM

(certification) AMC / GM (maintenance)

European Parliament

European Commission

EASA

NON -BINDING BINDING

EASA Regulation Structure

(11)

EASA Regulation Structure

SECTION A TECHNICAL REQUIREMENTS

SUBPART A SUBPART B SUBPART C SUBPART D SUBPART E SUBPART F SUBPART G SUBPART H SUBPART I SUBPART J SUBPART K SUBPART L SUBPART M SUBPART N SUBPART O

General Provisions

Type-Certificates and Restricted Type-Certificates (not applicable)

Changes to Type-Certificates and Restricted Type-Certificates Supplemental Type-Certificate

Production without Production Organization Approval Production Organization Approval

Certificates of Airworthiness and Restricted Certificates of Airworthiness Noise Certificates

Design Organization Approval Parts and Appliances

(not applicable) Repairs

(not applicable)

European Technical Standard Order Authorisations

SUBPART J - Design Organization Approval

21.A.231 Scope 21.A.233 Eligibility 21.A.234 Application

21.A.235 Issue of design organization approval 21.A.239 Design management system

21.A.243 Handbook 21.A.245 Resources

21.A.247 Changes in the design management system 21.A.249 Transferability

21.A.251 Terms of approval

21.A.253 Changes to the terms of approval 21.A.258 Findings and observations

21.A.259 Duration and continued validity

(12)

During product development, design organization may require collaboration with other organizations Design organization may collaborate with other design organization

Design Organization

Part 21 J

Production Organization

Part 21 G

Maintenance Organization

Part 145

Design organization may also use qualified subcontractor

Produced parts

Working arrangement should be in place:

DO-PO Arrangement; or DO-MO Arrangement; or DO-DO Arrangement

Relationships

between organizations

(13)

EASA Form 1

As Part 21

“NEW”

“PROTOTYPE”

As Part 145

“OVERHAULED”

“REPAIRED”

“INSPECTED” / “TESTED”

“MODIFIED”

Part is released as an approved part

or prototype

(14)

Course outline

Type Certificate and Changes to Type Certificate

Certification Process

(15)

A document issued by regulatory authority signifying the airworthiness of the approved design of an aircraft to be manufactured

“ ”

TYPE CERTIFICATE

DEFINITION OF

Approval to design/data can only be issued by:

Authority/agency or DOA holder

Once issued, the design cannot be changed until at least part

of certification process is repeated to cover the changes

(16)

TYPE DESIGN

21.A.31

1 Drawings & specifications

necessary to define the configuration and the design features of the product shown to comply with the applicable certification basis

2 Materials & processes

of manufacture and assembly of the product necessary to ensure the conformity of the product

3 Airworthiness limitation section

of the Instruction for Continued Airworthiness as defined by the applicable certification specifications

4 Other dataallowing by comparison the determination of the airworthiness and, if relevant, the environmental characteristics of later products of the same type

(17)

A minor change has no appreciable effect on the mass, balance, structural strength, reliability, operational characteristics, operational suitability data, or other

characteristics affecting the airworthiness of the product or its environmental characteristics

“

^21.A.91

”

Classification

of Changes

(18)

Classification of Changes

GM 21.A.91

(19)

Example of

Major Changes

GM 21.A.91 Changes such as cargo cut out, fuselage plugs, change of dihedral, addition of floats

Changes to materials, processes or methods, of manufacture of PSE

Changes that adversely affect fatigue or damage tolerance or life limit characteristics Changes that adversely affect aeroelastic characteristics

Structure

Changes which introduce a new cabin layout to require a re-assessment of emergency evacuation Changes to the pressurization control system which adversely affect previously approved limitations

Cabin Safety

Systems

(20)

OPERATIONAL SUITABILITY DATA (OSD) means data, which are part of an aircraft TC, restricted TC, or STC, consisting of all the following:

The definition of scope of the aircraft validation source data to support the objective qualification of simulators or the provisional data to support their interim qualification

The minimum syllabus of maintenance certifying staff type rating training, including determination of type rating

The master minimum equipment list

Determination of type or variant for cabin crew and type specific data for cabin crew

The minimum syllabus of pilot type rating training, including determination of type rating

OSD WHAT IS IT?

(21)

Example of

Major Changes

GM 21.A.91

Flight deck modernization / Avionics Upgrade

(22)

Classification of Repairs

Same as Classification of Changes

21.A.435

(23)

Supplemental Type-Certificate STC

Issued by the Agency or DOA holder within the scope of its privileges

^21.A.115

An STC can be developed through arrangement with TC holder or completely by the Applicant

TC Holder does not have technical objection to the information submitted

TC Holder has agreed to collaborate with the STC Holder to ensure discharge of all

obligations for continued airworthiness of the changed product

(24)

Course outline

(25)

Approved data

Embodiment of

CHANGE / REPAIR DESIGN

by Part-145 or Part-121

AMC 21.A.239(d)

Certification Process

(26)

EASA LEVEL OF INVOLVEMENT

21.B.100

To determine EASA involvement in the verification of compliance demonstration activities and data related to the application

For MINOR REPAIR DESIGN and MINOR CHANGE

Risk class

Non-critical Non-novel and non-complex Class A Class A

Novel and/or complex Class B Class C

Critical All cases Class C Class C

Level of Exp: high or medium Level of Exp: low or unknown

A

Limited to the review that summarizes the main results of the compliance

demonstration; No participation in compliance activities

C

Limited to the review of those compliance elements that are related to the identified criticality of the design, or novel and unusual features; May participate in the related compliance activities (witnessing test, audit, etc.)

(27)

Documentation that covers the plan for certification process of product, including:

Project overview

Certification basis Project timeframe

General overview describing the project. Should be enough so the certification team, including authority understood the project scope Providing information of major milestone during certification process

Defining the certification basis used for the change/repair Recommended practice is using the latest requirements

Listing the requirement of which compliance will be shown, and the

CERTIFICATION PROGRAMME

or Certification Plan

(28)

A set of regulation, standards, and requirements established by aviation authorities that an aircraft must comply with in order to be certified as airworthy and safe for operation

The certification basis forms the foundation for evaluating an aircraft’s design, construction, and performance to ensure it meets specific safety and operational standards

Certification Specifications

Special Condition

Equivalent Level of Safety

or Equivalent Safety Findings (FAA)

When the design is novel, and not covered in CS

When other means to meet airworthiness is preferred, instead of following the relevant CS

Standard guidance to develop aircraft or aircraft parts CS-23 for Small Aeroplanes, CS-25 for Large Aeroplanes, CS-27 for Small Rotorcraft, CS-E for Engines, etc.

Exemption

When a requirement will not be complied or partially complied

CERTIFICATION BASIS

(29)

Type-Certificate Data Sheet

A16WE (FAA TCDS for B737)

(30)

(31)

(32)

(33)

Req Amdt Description MoC Document 25.1301 20 Each item of installed equipment must be of a

kind and design appropriate to its intended function

1, 5 Technical description Test plan & test report

25.1309

(b) 20 The aeroplane systems and associated components, considered separately and in relation to other systems, must be designed so that –

(1) Any catastrophic failure condition (i) Is extremely improbable

(ii) Does not result from a single failure, and

3 Safety assessment

COMPLIANCE CHECKLIST

Example

(34)

Means of Compliance

AMC 21.A.15(b)

Statement

0 5 Ground test

1 Design review 6 Flight Test

2 Analysis 77 Inspection

3 Safety assessment 88 Simulation

4 Lab test 9 Equipment qualification

(35)

Example of

ANALYSIS

Electrical Load

Analysis Static Load

Analysis RF Interoperability Analysis

(36)

Example of

TESTS

(37)

TYPE DESIGN

Conform to Before test for compliance demonstration, applicant shall verify the:

Test specimens

Material & process Parts

Manufacturing process, construction, assembly

Test & measuring equipment Correct equipment Properly calibrated

Statement of Conformity

CONFORMITY

INSPECTIONS

^21.A.33

(38)

INTERACTION BETWEEN DESIGN AND SAFETY Safety Assessment Process

CS 25.1309

(39)

INTERACTION BETWEEN DESIGN AND SAFETY Safety Assessment Process

CS 25.1309

Functional Hazard

Assessment System Safety

Assessment

PSSA

Conceptual

design Design development Implementation

Common Cause Analysis

Fault Tree Analysis Dependency

Diagram

Markov Analysis

(40)

INTERACTION BETWEEN DESIGN AND SAFETY Safety Assessment Process

Function Failure Condition Phase Failure Effect Classification Prob.

Requirement Decelerate aircraft

on the ground Loss of deceleration

capability Landing/RTO/

Taxi (see below)

a. Unnanunciated loss of

deceleration capabilty Landing/RTO Crew is unable to decelerate the aircraft, resulting

in a high speed overrun Catastrophic < 1 x 10^-9

b. Annunciated loss of

deceleration capabilty Landing Crew selects a more suitable airport, notifies emergency ground support, and prepares occupants for landing overrun

Hazardous < 1 x 10^-7

c. Unnanunciated loss of

deceleration capabilty Taxi Crew is unable to stop the aircraft on the taxiway or gate resulting in low speed contact with terminal, aircraft, or vehicles

Major < 1 x 10^-5

d. Annunciated loss of

deceleration capabilty Taxi Crew steers the aircraft clear of any obstacles and

calls for a tug or portable stairs No safety effect None Inadvertent deceleration

after V1 Takeoff Crew Is unable to takeoff due to application of

brakes at the same time as high thrust settings, Catastrophic < 1 x 10^-9

Example – Wheel Brake System FHA

(41)

Example – Wheel Brake System

FAULT TREE ANALYSIS

(42)

Example of accidents due to

DESIGN ERROR

United Airlines flight 232, DC-10 British Midland Airways flight 092, B737-400

(43)

Course outline

(44)

Head of Design Organization

Design Office Airworthiness Office

Independent Monitoring Office

TEJ

TEJ-2 TEJ-3

TEJ-1

Typical

Organization Structure

(45)

SAFETY MANAGEMENT ELEMENT

DESIGN ASSURANCE ELEMENT

Design assurance system

Design Organization Handbook

and associated procedures

Airworthiness Office

Acceptance and control of partners and subcontractors Safety policy and objectives

Airworthiness function

Safety risk management process

Safety assurance process

Safety promotion

Occurrence reporting system Safety personnel

If the organization holds multiple organization certificates that are issued under Regulation (EU) 2018/1139,

Independent verification

function

Compliance Verification Engineer (CVE)

Design Management System

21.A.239

(46)

Roles and Responsibilities

DESIGN ENGINEER

AIRWORTHINESS ENGINEER COMPLIANCE VERIFICATION ENGINEER

DESIGN OFFICE

Develop design data to meet the customer and airworthiness requirements, including the Demonstration of Compliance activities

AIRWORTHINESS OFFICE

Ensure the organization comply with Part 21.J, ensure the product comply with the applicable airworthiness requirements, liaison with the authority

INDEPENDENT MONITORING

OFFICE

Verify and monitor the compliance of the organization with Part 21J

(47)

MINOR ALTERATION REPAIR

CLASS A PRIVILEGE MAJOR ALTERATION REPAIR CLASS B PRIVILEGE STC TSOA APU

CLASS C PRIVILEGE TC

CLASS A CLASS B CLASS C CLASS D

MINOR CHANGE REPAIR

MINOR

DOA Classification

(48)

Obligations

of DOA Holder

21.A.265

a) Maintain the handbook, in conformity with the DAS

b) Ensure the handbook are used as a basic working document

c) Determine that the design complies with the applicable certification basis, and have no unsafe feature d) Provide the Agency with statements and associated documentation confirming item c) above

e) Provide to the Agency data and information related to action required under 21.A.3B Airworthiness Directive f) Determine the flight conditions under which a permit to fly can be issued

g) Establish compliance with point b) and e) before issuing permit to fly

h) Designate data and information issued under the authority of the approved design organization within the scope of its terms of approval as established by the Agency with the following statement: “The technical content of this document is approved under the authority of the DOA ref. EASA.21J.[XXXX]”

i) Comply with Subpart A

(49)

Obligations

of DOA Holder

21.A.265

Example 1:

A320 Service Bulletin

Example 2:

ATR72 Service Bulletin

(50)

Reporting System

of Malfunctions, Failures, and Defects Design Organization must establish and maintain a system for collecting, investigating, analysing, and reporting any failures, malfunctions, defects, or other occurrences which cause or might cause adverse effect on continuing airworthiness of the product

72 hours

Notify authority not later than

After occurrences identified

(51)

Course outline

(52)

Instructions for Continued Airworthiness

ICA is a mean to keep the product airworthy throughout its operational life

Maintenance manual/section

Introduction Description of airplanes/systems

Control and operation Servicing

Scheduling Troubleshooting Removal/replacement

procedure

Special inspection

Special tools Access

Airworthiness limitations section

Mandatory modification time, replacement time, structural

inspection interval Under sec. 25.571

Mandatory replacement time, inspection interval, and all critical design configuration

limitation Under sec. 25.981 Limit of validity of the engineering data that support

the structural maintenance program (LOV)

EWIS section

Maintenance and inspection requirements

Maintenance practices

Identification methods Electrical load data and

its updating method

21.A.7 CS-25 Appendix H

(53)

Thank You

(54)

AOC Air Operator Certificate EASA European Union Aviation Safety Agency

AMC Acceptable Means of Compliance EU European Union

ASA Aircraft Safety Assessment FAA Federal Aviation Administration

CCA Common Cause Analysis FHA Functional Hazard Assessment

CDI Compliance Demonstration Item FMEA Failure Mode and Effects Analysis CVE Compliance Verification Engineer FTA Fault Tree Analysis

CS Certification Specification GM Guidance Material

DAS Design Assurance System ICA Instruction for Continued Airworthiness DGCA Directorate General of Civil Aviation MC/MOC Means of Compliance

DO(A) Design Organization (Approval) MO(A) Maintenance Organization (Approval)

DMS Design Management System OSD Operational Suitability Data

Abbreviations

(55)

PASA Preliminary Aircraft Safety Assessment PSE Primary Structural Element

PSSA Preliminary System Safety Assessment PO(A) Production Organization (Approval)

RF Radio Frequency

RTO Rejected Take-Off

SSA System Safety Assessment STC Supplemental Type Certificate TC Type Certificate

TCDS Type Certificate Data Sheet