maa/rn/2019/02 (issue 2) – comparison of defence standard 00 … · 2020. 9. 24. · 25 feb 19...

25 Feb 19

MAA/RN/2019/02 (Issue 2) – Comparison of Defence Standard 00-970 with Alternative Airworthiness Codes

Page 1 of 18

Issue

1. This Regulatory Notice (RN) is intended to increase the guidance available to the Regulated Community (RC) of how best to demonstrate that an Alternative Airworthiness Code (AAC) being used to certify a Military Air System1 (or change to a Type Design2) delivers an acceptable level of safety consistent with the intent of the UK benchmark requirements of Defence Standard (Def Stan) 00-970. This RN is issued recognizing that generally Air Systems entering UK service have been certified by another authority (civil or military) prior to the MOD introducing a similar type design into service. Any certification process, overseen by a Military or Civil Airworthiness Authority, should provide extensive evidence to support the Military Release to Service process. However, all original product certification will have been executed by reference to specific aircraft usage assumptions and no agreements exist by which the original certifying authority will accept responsibility and liability for the performance of a certified product in military service with the UK.

Aim

2. This RN is supplementary to RA 5810, RA 5820, MAA/RN/2016/11 and MAA/RN/2015/08. The aim is to provide additional guidance to the RC on how to conduct comparison assessments between Def Stan 00-970 and AACs in order to demonstrate that the alternative code delivers an acceptable level of safety. This demonstration is required as part of Phase 23 of the Military Air Systems Certification Process (MACP).

Implementation

3. The guidance provided in this RN is applicable to all military registered Air Systems when undergoing certification during major design changes4 or on application for new Military Type Certificates. Where projects are between MACP Phases 2 and 45, on the date of release of this RN, and Type Airworthiness Authorities (TAAs) wish to refer to this RN in their work, then the MAA should be consulted with the aim of agreeing an incremental approach to achieving a full benchmark review against Def Stan 00-970. The MAA will be cognisant of programme demands and workload.

Background

4. The overall intent of certification is to verify the design attributes and performance of an Air System and is at the heart of establishing that the equipment is safe to operate in the way that is intended. This process involves a major transfer of knowledge from the Design Organization (DO) to the MOD to enable the TAA to identify Airworthiness risk to ensure it is As Low As Reasonably

1 RA 5810 – Military Type Certificate (MRP 21 Subpart B). 2 RA 5820 – Changes in Type Design (MRP 21 Subpart D). 3 Establish and Agree the Type Certification Basis (TCB). 4 A change that has appreciable effect on the mass, balance, structural strength, operational characteristics, or other characteristics affecting the Airworthiness of the Air System. 5 Completion of Phase 4 of the MACP is the submission of a Type Certification Exposition to the MAA.

Regulatory Notice

Practicable (ALARP) and that the associated Risk to Life (RtL) is understood and accepted asTolerable6 by the Aviation Duty Holder (ADH).

Page 2 of 18

type Airworthiness team managing Airworthiness, especially as they will be expected to make Airworthiness decisions which would be within the remit of the DO or regulator for civil aircraft. In delivering the certification products, the TAA is generating the knowledge and understanding required to manage the Type Design of a Military Air System through-life. This overall intent should remain the primary focus of the ADH, the TAA and DE&S Airworthiness Chain at every stage of the MACP process.

Amassing this knowledge is key to the TAA and their

5. In accordance with RA 58107, the TAA is required to ensure that the Air System under their responsibility is designed to approved Airworthiness codes. The Regulation requires, as an Acceptable Means of Compliance (AMC), that ‘Def Stan 00-970 should be used as the default Airworthiness code’ and that ‘Formal approval should be sought from the MAA for the use of alternative and appropriate specifications or Airworthiness codes’.

6. Most military aircraft being added to the UK inventory are now procured from abroad, or are based on a civil type design and will not have been designed using Def Stan 00-970 as the TCB. Thus, DE&S Delivery Teams (DTs) will often elect to use an AAC to Def Stan 00-970 as the prime Airworthiness code within the TCB. Current guidance in Annex A to RA 5810 requires that when using an alternative code ‘other specifications and standards…need to be shown to deliver an acceptable level of safety and are consistent with the benchmark requirements of Def Stan 00-970’. Annex A also states that the TAA should articulate, in the TCB, how equivalence will be demonstrated, using the Military Certification Review Items (MCRI) process.

7. The term “..acceptable level of safety” was introduced by the MAA some years ago with the intent of giving the TAA more flexibility than, by default, electing to conduct a line-by-line comparison to demonstrate equivalence and allows the TAA to tailor the certification strategies to meet the specific needs of their Air System; ensuring that the safety case is proportional and appropriate and noting the wide range of technologies and procurement strategies in place across the Defence Air Environment. Whilst the MAA remains of the view that flexibility should be retained within the MAA Regulatory Publications (MRP), there have been requests for additional advice and guidance from the Regulated Community.

MAA Guidance

8. Based on practical experience8, the MAA has yet to receive even a proposal to do anything other than doing a line-by-line comparison with Def Stan 00-970 to demonstrate that an acceptable level of safety can be achieved. At this stage, it’s important that the reader understands the context of this advice. No Air System has yet been certified based on the outcome from Recognition. There were 2 pilot projects; the Poseidon MRA Mk1 and the Apache CSP (E-Model). Improvements to the approach to Recognition are being considered as these projects advance and thus, this RN will adapt and progress as more lessons are learnt. It is recommended that other projects embarking on the use of Recognition should consult Poseidon, Apache CSP and the DE&S Airworthiness Team, in addition to the MAA, to make the most of lessons learnt. This RN provides guidance on how TAA’s can consider the impact of technology, differences in design philosophy and contracting approach when developing the TCB and Equipment Safety Argument. This includes the use of Performance Based Specifications when describing standards. TAAs retain the freedom to use alternative approaches when demonstrating acceptable levels of safety through AACs. These alternative approaches need to be agreed with the MAA when agreeing the TCB.

6 RA 1210 – Ownership and Management of Operating Risk (Risk to Life). 7 RA 5810(4) – Airworthiness Codes. 8 When assuring many new Air Systems and major modifications using foreign and civilian Airworthiness codes between 2015 – 2018.

9. This RN does not change the intent encapsulated within RA 5810 which recognizes European Aviation Safety Agency (EASA)/Federal Aviation Administration (FAA)/Civil Aviation Authority (CAA) Type Certificates (TC) as proof of compliance against their TCB within the bounds of the civilapproved configuration and usage.

Page 3 of 18

work needed will generally be around validating the Civil Certification for any differences in the Military Intended Usage, explaining pertinent waivers granted in the civil process and reviewing any Military Specific Modifications/Configurations. Since the EASA and FAA airworthiness codes have been demonstrated to deliver an acceptable level of safety, the detailed process described in this RN will only need to be applied to the areas of difference between the scope of the Civil TC and the Military Configuration and Intended Usage. However, experience has shown9 that it is incorrect to assume that an air system with a Civil TC is automatically safe for MOD use without developing some understanding of the Civil TC and design assumptions in the context of how the MOD intends to use the aircraft. For example, there are many civil helicopters operating without bird strike certified windscreens, based on the assumption that the helicopter will have limited exposure to bird strike10. However, this is a design attribute that an Operating Duty Holder (ODH) would wish to be aware of, if intending to operate at low level for significant proportions of typical sortie profiles. Arguably it might be a factor in selection of the most suitable configuration of Type Design for the intended role. Following the bird strike example, civil manufacturers may offer a bird strike proof windscreen as a configuration option and such a decision should sit in the Area of Responsibility (AoR) of the Senior Responsible Owner (SRO) and ODH when that is possible. In the civil world helicopters used for Search and Rescue from the coast or for offshore facility support are likely to opt for the higher grade of glass. Furthermore, some civil aircraft certifications may have been carried out prior to the formation of EASA and with certain waivers and Certification Review Items in place11. In bringing an old design into new service with the MOD, the MOD supplier has a duty to consider the fitness of that product for its intended use at entry to service, noting that many products may have been originally certified in the last century and cognisant that the MOD may wish to operate it, to beyond the middle of this century.

In cases where a platform has a Civil TC the bulk of additional

10. MAA/RN/2016/11 states that: “the MAA does not automatically accept other Primary Certification Codes (PCCs) and their use must therefore be agreed”. In order to use alternative PCCs, applicants should define the requirements that would have been applicable using Def Stan 00-970 as the PCC including the need for Special Conditions. Once we have this baseline it can be compared to the AAC, as applied to the previous certification activity, including the applicable amendments and any Special Conditions, Waivers and Exemptions. Where equivalent, the AAC can be adopted and combined with any Def Stan 00-970 requirements where equivalence cannot be shown. Equally the TAA may make an argument that the AAC is not equivalent but does achieve an acceptable level of safety. The credit that is allowed is significant to the programme by exploiting Recognition (as defined at MAA/RN/2015/08 and MAA/RN/2016/11) in that using the “Artefacts” produced for the Original Certifying Authority (eg NavAir or US Army); TAAs do not need to verify all of these artefacts but do need to assure themselves that the originating certifying authority has followed the processes and procedures recognized by the MAA12. There is also huge credit in not needing to see all of the artefacts but just those deemed appropriate by the TAA13. The precise volume and associated detail of artefacts to review is one for the TAA to agree with the MAA but

9 The Griffin Service Inquiry (SI) data is somewhat of a case study into the importance of understanding the differences from the civil usage profile linked to a design assumption and the usage profile adopted by the MOD as an operator, and what this difference meant in terms of the increasing RtL being taken as operations continued. 10Windscreens with bird strike resilience may look the same as those without, but in reality have a much more involved manufacturing process and cost considerably more.

11Some national CAAs were required to give large weighting on national economic factors for industry when certifying products. MOD has examples of such aircraft in service. 12 This point was set down in MAA/RN/2016/11 and addresses the case where imported air vehicles may only have been partially certified by mutually recognized Accepted Certifying Authorities (ACAs), or certified many years before the process recognized the baseline process of the ACA. 13 TAAs, as a minimum, need to ensure that the originating certifying authority has followed the MAA recognized processes/procedures; to fully understand any areas of identified risk; to ensure sufficient volume is reviewed to facilitate sufficient Type Airworthiness knowledge transfer to the UK Engineering Authority ahead of Air System entry into service.

would be expected to be based upon, for example, confidence in the original certifying authority, usage differences, degree of correlation between the originally derived TCB and the UK TCB, and inherent understanding of design evidence through engagement with the project. Once it is demonstrated that the AAC is equivalent to Def Stan 00-970 or offers an acceptable level of safety then credit can be taken in trusting that the Recognized Certification Authority has done its job and recognize how that meets or does not meet the UK Airworthiness code.

Page 4 of 18

as the TAA has a clear responsibility to either address any shortfall against UK requirements or articulate this to the ODH.

This latter point is important

11. In sum, this removes the need to start a full UK certification and qualification programme from scratch and contract DOs to generate artefacts to provide evidence against Def-Stan 00-970 which

would likely require a major ground test and flight test programme.

Recommended Process to Assess Equivalence

12. In order to demonstrate an acceptable level of safety when producing a TCB based on an AAC, TAAs should consider using the following guidelines:

a. Determine the Parts and Sections of Def Stan 00-970 which are pertinent14 to the type of Air System15 being certified;

b. Within each relevant “Part and Section” of Def Stan 00-970, review each requirement to determine its applicability to the Air System design categorizing each as either “Applicable” or “Not Applicable”. Those which are considered as ‘Not Applicable’’ to the TCB should be recorded as such, with justification, using a short explanation, and submitted to the MAA for review and acceptance.

c. The residual Def Stan 00-970 requirements, classified as “Applicable” should then be assessed against the proposed AAC for equivalence. Requirements should be categorized as either Not Applicable, Direct Equivalence, Partial Equivalence and Acceptably Safe or No Equivalence using the definitions provided below.

13. Following categorization, the TAA will be able to identify those Def Stan 00-970 criteria which are not adequately represented by the proposed AAC and therefore must be incorporated into the Air System TCB using the MCRI process. This will include any requirements categorized as ‘No Equivalence’ and potentially some ‘Partial Equivalence’ requirements in accordance with the guidance below.

Process to secure MAA Agreement

14. Demonstration that an AAC delivers an acceptable level of safety and is consistent with the benchmark requirements of Def Stan 00-970 is a requirement of MACP Phase 2 in order to establish and agree the TCB. Early engagement with the MAA Project Certification Manager will be necessary in order to agree how and when equivalence arguments will be presented to the MAA for agreement and how this will be documented.

14 For example, for a single seat, fixed wing aircraft the requirements of Part 1 (Fixed Wing) apply and Part 7 (Helicopters) can be automatically discounted. 15 Or to the Major Change in Type Design.

Category Definitions

15. A system of categorization16, such as detailed below, can be used when developing the TCB for an Air System or modification and considering the equivalence and appropriateness of an AAC against Def Stan 00-970 criteria:

Page 5 of 18

a. Not Applicable (NA). The Def Stan 00-970 design requirement has no applicability to the design due to:

(i) The nature of the design eg multi-engine requirements in a single engine aircraft;

(ii) The operating intent of the Air System eg Low-level or medium level flying;

(iii) The technology being used eg Control by software and electric actuator or direct mechanical linkage and hydraulic action;

(iv) The overarching design methodology eg reporting system failures to the pilot by exception rather than as a rule within the Pilot Vehicle Interface.

b. Direct Equivalence (E). When comparing the Def Stan 00-970 design requirement with that of an AAC, it is possible to draw direct comparisons between the intent of their design outcomes or their underpinning description, AMC, test criteria or reference to other Design Standards that by their nature are equivalent. The intent of a single design requirement within Def Stan 00-970 can be met by read-across to a single or combination of design criteria in an AAC. Where such equivalence can be demonstrated, the design criteria described within the AAC should be used in the TCB.

c. Partial Equivalence and Acceptably Safe (PEAS). When comparing the Def Stan 00-970 design requirement with that of an AAC, it is not possible to demonstrate direct equivalence between the associated design criteria. Using further analysis and referring to design requirements specified within documents such as the Air System contract, performance based specification or ITEAP17, equivalence can be demonstrated, or it can be shown that the associated risk is mitigated to provide an acceptable level of Airworthiness/safety. In such cases the alternative wording used in the referenced document should be included in the TCB as a tailored set of design requirements and proposed by the TAA for agreement by the MAA for use in the TCB.

d. No Equivalence (NE). The AAC does not contain an equivalent Airworthiness or safety requirement to Def Stan 00-970 which remains relevant to the intended UK usage and operation and Airworthiness/safety of the platform. In such circumstances the Def Stan 00-970 requirement should be used in the TCB.

16. Annexes A and B to this RN provide generic examples of each of the categories described above. The examples are based on comparing Def Stan 00-970 requirements to the Airworthiness certification criteria contained in Mil-Hdbk-51618 based upon a Fast Jet and Large Aircraft respectively. The examples provided are not exhaustive but seek to cover a range of different requirements contained within Def Stan 00-970 based on a trial of this approach with existing DE&S certification projects.

16 Experience has shown that DE&S DTs and external consultants have used a series of different definitions to describe equivalence over the last 5 years and in the interests of achieving clear overarching judgments, a uniform set of definitions should be used.17 Integrated Test, Evaluation and Acceptance Plan. 18 Whilst the examples are based upon US Mil Standard 516 (Revision A and Revison B) the principles used are equally applicable to other Nations/Regulators Air System Design Standards/Guides.

Queries

17. Any queries or requests for further guidance on the content of this RN should be submitted in the first instance to DSA-MAA-Cert-DepHd via [email protected].

Page 6 of 18

MAA Director Technical

Annexes:

A. Generic Examples of Def Stan 00-970 to AAC Equivalence Statements – Fast Jet. B. Generic Examples of Def Stan 00-970 to AAC Equivalence Statements – Large Aircraft.

mailto:[email protected]

Annex A To MAA/RN/2019/02 Dated 25 Feb 19

Page 7 of 18

GENERIC EXAMPLES OF DEF STAN 00-970 TO ALTERNATIVE AIRWORTHINESS CODE EQUIVALENCE STATEMENTS – FAST JETS (MIL HDBK 516B)

1. Table 1 below provides some generic examples of equivalence statements which could be made to demonstrate that an AAC delivers an acceptable level of safety consistent with the benchmark requirements of Def Stan 00-970. The example has been produced for a single seat, single engine fixed wing aircraft against a selection of the fuel system requirements in Def Stan 00-970 Part 1 Section 5 (Powerplant).

Example of Equivalency Statements – Fuel System (Part 1 Section 5: Powerplant Issue 13)Other

References as Required

Def Stan 00-970 ID

Summary of Def Stan 00-970 Requirement Summary of Mil-Hdbk-516B Equivalent Criteria Categorisation, Safety Argument & Justification

5.2.3 Each fuel system shall be designed and constructed to ensure an adequate supply of fuel to each engine and auxiliary power unit (if fitted) at flow pressures and temperatures within the ranges agreed with the engine manufacturer(s) in all ground operations and flight conditions relevant to the Aeroplane Specification including periods of flight under negative increments of normal acceleration as defined in Section 5.1. The fuel system shall be suitable for F34 and any of the fuels/additives stated in the Aeroplane Specification.

7.1.1 Verify that safety critical propulsion system risks are identified, probabilities are validated and risk controls are in place. (Failure of any propulsion system or component does not result in exceeding LOA rate for system)

7.2.1.1 Verify that engine performance is adequate for safe operation of the air vehicle. This includes consideration of all installation effects imposed by the air vehicle, and all intended operational environments.

8.3.1 Verify that the fuel system is safely compatible with other system interfaces.

8.3.1.1 Verify that all components, either individually or as part of a subsystem, have passed all safety-related qualification tests (e.g., proof, burst, vibration, containment, over-speed, acceleration, explosive atmosphere, pressure cycling, and temperature cycling as required for airworthy performance).

8.3.2 Verify that the fuel system functions under all probable conditions with the approved fuels.

8.3.4 Verify the safe installation of the fuel system and components. Standard: Fuel components and tubing withstands expected loading conditions for all phases of flight for static and durability related loads as well as internal pressure loads.

Equivalence – Collectively the Mil-Hdbk-516B criteria detailed in column 3 of this table are considered to deliver an equivalent level of safety to design criteria 5.2.3 of the Def Stan 00-970. The engine design criteria and aircraft performance specification have been used to identify the associated pressures and temperatures as explained below.

7.1.1 & 7.2.1.1 – The engine specification will identify the fuel supply requirements and operating pressures and temperatures for the fuel system. This will be derived from the aircraft performance specification and all associated safety critical hazards identified. These design parameters are captured within Interface Control Documents and verified by bench, ground and flight test.

8.3.1 & 8.3.1.1 - The fuel system design requirements, including interfaces, must be functionally and physically compatible with other air vehicle systems which include the engine.

8.3.2 - The aircraft performance specification details F34 as an approved fuel.

8.3.5 Verify that the plumbing and components in the fuel system (as completely assembled and installed within the air vehicle) can withstand exposure to the specified proof pressure limit for the subsystem without resulting in fuel leakage, critical system performance degradation or critical life limited durability.

Page 8 of 18

8.3.6 Verify that the fuel feed system provides a continuous supply of fuel to the engine at sufficient pressure throughout the flight and ground operation envelopes, including starting and all flight manoeuvres.

8.3.7 Verify that fuel transfer flow rates meet the operational ground and flight envelope requirements.

8.3.9 Verify that the fuel system is designed to prevent pressures from exceeding the system's proof pressure limits (both minimum and maximum) during refuelling (aerial and ground), defueling, transfer, fuel feed, fuel dump operations and engine feed.

5.2.4 The possibility of interaction of the fuel(s) (and additives if used) with the materials used in the system shall be investigated.


19.1.5 Verify that the material property degradation due to the environment (e.g., moisture absorption; chemical, solvent, fuel, and lubricant exposure; hydrolytic instability; thermal exposure; electromagnetic radiation; wear; and erosion) is accounted for

Equivalence – The referenced Mil-Hdbk-516B requirements meet the intent of the Def Stan requirement as seen from the expanded standard description detailed below which includes the phrase in italics from 8.3.2:

Standard - Primary fuels use allows full fuel system functionality without any restrictions to aircraft envelope performance. Alternate fuels use is utilized on a continuous basis without fuel system damage, but has possible aircraft performance restrictions.

5.2.6 Each fuel system must be arranged so that any air which is introduced into the system will not have an adverse effect on the performance of the aeroplane and in any event, will not result in flame out.

7.1.1 Verify that safety critical propulsion system risks are identified, probabilities are validated and risk controls are in place. (Failure of any propulsion system or component does not result in exceeding LOA rate for system)


8.3.3 Verify that all fuel system critical failure modes and hazards have acceptable risk levels.

8.3.6 Verify that the fuel feed system provides a continuous supply of fuel to the engine at sufficient pressure throughout the flight and ground operation envelopes, including starting and all flight manoeuvres

Partial Equivalence and Acceptably Safe– The intent of this Def Stan 00-970 criterion is to ensure that the engine is supplied with fuel without interruption under all conditions throughout the full flight envelope. Mil-Hdbk-516B addresses the intent of this requirement at a more holistic level through the 4 x system level criteria, as detailed in previous column. They are assessed to achieve an equivalent level of safety.

Additionally, the TAA can confirm that the Preliminary and Functional Hazard Analysis, carried out prior to design implementation (at PDR), for the engine and fuel system have captured and mitigated the risks associated with air induction and its adverse effects on the engine. This can be seen from the following hazard IDs within the Air System hazard log:

[Insert relevant hazard IDs]

5.2.7 In multi-engine aeroplanes, all usable fuel including fuel for power augmentation, shall be available for any engine or combination of engines.

Page 9 of 18

Not Applicable – Design criteria not applicable to a single engine aircraft.

5.2.9 The malfunctioning of any auxiliary system which draws fuel from the main system shall not adversely affect the main system.

8.3.1 Verify that the fuel system is safely compatible with other system interfaces.

Standard: The fuel system design requirements, including interfaces, are functionally and physically compatible with other air vehicle systems, e.g., engine, tankage, vent system, scavenge, Warnings, Cautions and Advisories, displays, gauging, refuelling, aerial refuelling and other unique interfaces.

Compliance: Interface requirements are documented and verified through design analysis, component qualification tests, system functional checkout tests, and ground/flight tests.


14.2.3 Verify that no single-point failure unacceptably affects the safety of the system. (Optional)

Partial Equivalence and Acceptably Safe– The intent of this Def Stan 00-970 criterion is to ensure that auxiliary systems do not adversely affect the airworthiness of the fuel system. Mil-Hdbk-516B specifically refers to safe compatibility of other systems, such as scavenge systems. It is assessed to achieve an equivalent level of safety.

Additionally, the TAA can confirm that the design hazard analysis process for the fuel system has captured and mitigated the risks associated with malfunction of the [auxiliary system] and its effect on the main system. This can be seen from the following hazard IDs within the Air System hazard log:


5.2.10 Each fuel system must be capable of sustained operation throughout its flow and pressure range with fuel initially saturated with water at 27°C and having 0.2 cc of free water per litre added and cooled to the most critical condition for icing likely to be encountered in operation.



Standard: Primary fuels use allows full fuel system functionality without any restrictions to aircraft envelope performance.

8.3.11 Verify that the design and procedures are adequate for controlling and purging impurities from the fuel system and that the fuel system's level of contamination is acceptable always.

Standard: The fuel system components are qualified to a contaminated fuel condition that reflects the presumed contamination over the expected usage. The fuel system has provisions to drain water from sump areas in the tanks or provide in-flight scavenge capability. Procedures for controlling and purging impurities are included in the Maintenance T.O.s.

Compliance: Component qualification testing indicates capability of components to operate at contamination levels specified in the engine ICD. Ground tests verify compliance

Equivalence – The intent of this Def Stan 00-970 criterion is to ensure that the engine is supplied with fuel without interruption under all conditions throughout the full flight envelope, specifically dealing with the risk of water contamination. While Mil-Hdbk-516B does not address the design detail in Def Stan 00-970, it does achieve the same intent by addressing system functionality and the risk of contamination as seen in previous column. It is assessed to achieve an equivalent level of safety.

with engine ICD fuel quality requirements. Bench and ground testing verifies performance of water scavenging system. Fluid samples taken prior to first flight are within system

Page 10 of 18

5.2.11 Where operational requirement exposes the aeroplane to the possibility of fuel waxing or solidification, due to low temperature, provision shall be made in the system to safeguard against such waxing/solidification. Where it is impractical to provide such safeguards means shall be provided to indicate to the flight crew the temperatures of the fuel in each tank. The temperature margin available, as determined by Clauses 5.1.124 to 5.1.140, shall be declared in the Aircrew Manual.



8.3.6 Verify that the fuel feed system provides a continuous supply of fuel to the engine at sufficient pressure throughout the flight and ground operation envelopes, including starting and all flight manoeuvres

8.3.1.2 Verify that adequate crew station information is available to notify the flight crew of the system operating conditions.

8.3.10 Verify that the flight and maintenance manuals include normal and emergency operating procedures, limitations, restrictions, servicing, and maintenance information.

8.3.17 Verify that adequate controls and displays for the fuel system functions are provided for the appropriate crewmember(s) to indicate the necessary fuel system functions and warn of hazardous conditions.

Equivalence – The intent of this Def Stan 00-970 criterion is to ensure that the engine is supplied with fuel without interruption under all conditions throughout the full flight envelope, specifically dealing with the risk of fuel waxing. While Mil-Hdbk-516B does not address the design detail in Def Stan 00-970, it does achieve the same intent by addressing system functionality through the design criteria in the previous column.

5.2.18 A zonal analysis shall be carried out to show that the occurrence of any failure condition of the fuel system, caused by failure of equipment in other systems, which would prevent continued safe flight and landing of the aeroplane is extremely unlikely.


8.3.12 Verify that the system is designed to withstand the hazards associated with lightning, static electricity, fuel leaks, and the introduction of electrical power into fuel tanks.

8.4.2 Verify that each component of the air vehicle is properly zoned according to the fire and explosion hazards and that protection is provided to counter the hazards such that no fire or explosion hazards exist under normal operating conditions.

14.1.1.4.11 (was 14.1.1.4.k) Fail safe design

Standard: Design ensures system remains inherently safe, or that a single failure will cause system to revert to a state which will not cause a mishap.

14.1.1.1 Verify that the system safety program incorporates system safety into all aspects of systems engineering.

Equivalence - The intent of Def Stan 00-970 is satisfied via the design criteria in the previous column which require system level design reviews and zonal hazard analysis, including FMECA. Collectively the hazardous analysis process requires system performance and failure modes to be considered from the perceptive of the fuel system and holistically to meet design safety targets as detailed in [TAA to reference performance specification with design safety targets]

5.2.19 A fire worthiness analysis shall be carried out to ensure it complies with the requirements of Part 1, Section 4, Clause 4.26.3

Page 11 of 18

8.3.12.1 Verify that the fuel system is designed and arranged to prevent the ignition of fuel vapor within the system.

8.3.12.2 Verify that secondary fuel and vapor tight barriers is provided between fuel tanks, fire hazard areas, and inhabited areas.

8.3.12.4 Verify that fuel jettison, fuel venting, fuel leaks, or fuel spills cannot be ingested by the engine, flow into hazardous ignition areas, onto the environmental management system, or become re-ingested into the air vehicle.

8.4 Fire and hazard protection.

Includes prevention, detection, and extinguish and explosion suppression provision.

FAA Doc: 14CFR references: 23.851-23.865, 25.851-25.869, 23.1181-23.1203, 25.1181-25.1207, 23.1411, 25.1411

Equivalence – A fireworthiness analysis is undertaken across the aircraft iaw section 8.4 of Mil-Hdbk-516B. This section deals with Fire and Hazard protection across the whole aircraft and covers design and test. All failure modes must be identified and mitigated by, manual selection, zonal isolation, ventilation, protection of components, detection and suppression as appropriate.

Additional fuel system specific requirements are included within section 8.3.12. Together, these requirements demonstrate an equivalent level of airworthiness/safety with the Def Stan 00-970 requirement.

5.2.26 The unusable fuel quantity for each tank and its fuel system components shall be established. The unusable quantity in each tank is that quantity at which first evidence of engine malfunction occurs when fed from that tank. The flight condition used to establish the unusable fuel quantity shall be discussed and agreed with the Project Team Leader. The possibility of sustained flight in a banked attitude (e.g., after engine failure) shall be considered. Fuel system component failures need not be considered.

8.3.17 Verify that adequate controls and displays for the fuel system functions are provided for the appropriate crewmember(s) to indicate the necessary fuel system functions and warn of hazardous conditions.

No Equivalence – Mil-Hdbk-516B does not contain an equivalent airworthiness or safety requirement to the Def Stan 00-970 criteria which remains relevant to the intended operation and airworthiness/safety of the platform. Therefore, Pt 1 Sect 5 criteria 5.2.26 will be included within the Air System TCB.

(NB The TAA could potentially use the aircraft specification and/or hazard analysis to demonstrate Partial Equivalence)

5.2.28 The fuel system must perform satisfactorily in hot weather operation in accordance with the Aeroplane Specification.


Standard: Primary fuels use allows full fuel system functionality without any restrictions to aircraft envelope performance.

Equivalence – This Mil-Hdbk-516B criterion provides the necessary equivalence if it is accepted that the ‘probable conditions’ are defined in the aircraft specification.

5.2.30 The fuel system installation in addition to being designed to meet all the design cases listed in this clause shall also be designed to withstand the inertia loads appropriate to the emergency landing condition of Part 1, Section 4, Clause 4.22

5.1.11 Verify that in the generation of loads the airframe is able to withstand crashes and to protect personnel to the extent reflected by the ultimate loading conditions and parameters.

Standard: C. Airframe designed such that all internal fuel tanks, including all critical amounts of fuel up to two-thirds of the individual tank capacities, are able to withstand the ultimate load factor requirements.

Equivalence – This Def Stan 00-970 criterion is very specific in referring to the fuel system. Mil-Hdbk-516B achieves an equivalent level of safety by having requirements at the platform level, but referring specifically to the fuel system within the associated standards.

8.4.19 Verify that the air vehicle provides safety features for post-crash fire and explosion hazards.

Page 12 of 18

Standard: Flammable fluids are contained during a post-crash condition to avoid further explosions or feeding a ground fire. Ignition sources are reduced, e.g., hot surfaces during a wheels up landing, in close proximity to a flammable fluid.

5.2.34 The requirement for the protection of fuel systems from enemy weapon effects will be stated in the Aeroplane Specification which will also define its combat role.

Not Applicable – this is a performance requirement rather than an airworthiness certification requirement. As such its inclusion in the TCB would not contribute to the airworthiness or safety of the platform.

5.2.35 The design aim shall be that, following any single strike by one of the Defined or Specified Threats (Part 13, Section 3, Clause 3.9), sufficient fuel will be retained so that the aeroplane will be recoverable from any point on the specified mission profile(s). The Designer shall inform the Project Team Leader at an early stage of the extent to which this design aim may not be achieved.

Not Applicable – this is a performance requirement rather than an airworthiness certification requirement. As such its inclusion in the TCB would not contribute to the airworthiness or safety of the platform.

5.2.39 Flexible fuel tanks must be approved in accordance with the requirements of Def Stan 15-2

8.3.1.1. Verify that all components, either individually or as part of a subsystem, have passed all safety-related qualification tests (e.g., proof, burst, vibration, containment, over-speed, acceleration, explosive atmosphere, pressure cycling, and temperature cycling as required for airworthy performance).

5.1.11 Verify that in the generation of loads the airframe is able to withstand crashes and to protect personnel to the extent reflected by the ultimate loading conditions and parameters.

8.4.19 Verify that the air vehicle provides safety features for post-crash fire and explosion hazards.

Partial Equivalence and Acceptably Safe– Def Stan 15-2 specifies the basic requirements for the construction, design and testing of flexible tanks for use in aircraft fuel and methanol/water systems. It also specifies the requirements for those flexible tanks which are required to have self-sealing and/or crash-resistant properties. In essence, the standard contains detailed design considerations and techniques for the development of flexible tanks, to ensure that they are fit for purpose in use, are able to withstand the environment encountered throughout the aircraft operating envelope, and do not increase the risk of fire or explosion.

Mil-Hdbk-516B does not specify how the tanks should be designed, rather that the components that are selected as part of the design process should fully qualified, that they should be crash resistant, and that they must not contribute to a post-crash fire. It is assessed that the intent of Mil-Hdbk-516B is Partially Equivalent to that of Def Stan 00-970.

Although 516B is only Partially Equivalent to the Def Stan 00-970 due to its high level approach, the Performance Based Specification (PBS) for the Fuel System has extensive detail which will ensure that the tanks are fit for purpose

[TAA to reference performance based specification with details of requirements similar to those of Def Stan 15-2]

Page 13 of 18

Finally, the TAA has considered the F-35B programme safety analysis and has confirmed that the design hazard analysis has highlighted 4 x hazards that have identified the risk of fuel tank leakage:


For these hazards, one of the identified controls to be implemented during design, is:

[Insert details of control]

5.2.40 For pressurised fuel tanks, a means with fail-safe features must be provided to prevent the build-up of an excessive pressure difference between the inside and outside of the tank.


Standard: Primary fuels use allows full fuel system functionality without any restrictions to aircraft envelope performance

8.3.14 Verify that tank pressure does not exceed tank structural limits due to a single failure under normal operation.

Standard: The fuel vent system maintains internal tank pressure within limits during single failure operations, e.g., rapid descent with empty tanks, failed open fuel control valve during refuelling, tank to tank transfer, etc.

Equivalent – The Mil-Hdbk-516B criterion 8.3.2 covers normal conditions and 8.3.14 covers failure conditions and these are judged to provide an equivalent level of safety/airworthiness with the Def Stan 00-970 criterion.

5.2.43 Non- integral tanks shall be arranged so that they can be removed and replaced easily with the least possible disturbance to other parts of the aeroplane. Where practical the installation shall not be such as to require jacking of the wings or nacelle to allow replacement of any tank.

Not Applicable - This Def Stan 00-970 criterion is related to maintainability and therefore its inclusion in the TCB would not contribute to the airworthiness or safety of the platform.

5.2.57 Where jettisonable tanks are used to increase the capabilities of an aeroplane in its primary roles, the tank and the aeroplane fitted with the tank shall comply with the requirements of the aeroplane as a whole and with Clause 5.2.55.

Not Applicable – The platform does not have the option of jettisonable tanks, consequently this requirement is Not Relevant to the design. Therefore, in accordance with MAA guidance, the inclusion of this criterion in the TCB would not contribute to the airworthiness of safety of the platform.

Annex B To MAA/RN/2019/02 Dated 25 Feb 19

Page 14 of 18

GENERIC EXAMPLES OF DEF STAN 00-970 TO ALTERNATIVE AIRWORTHINESS CODE EQUIVALENCE STATEMENTS – LARGE AIRCRAFT (MIL HDBK 516A)

1. Table 1 below provides some generic examples of equivalence statements which could be made to demonstrate that an AAC delivers an acceptable level of safety consistent with the benchmark requirements of Def Stan 00-970. The example has been extracted from certification evidence presented and agreed with the MAA for a large, multi engine fixed wing aircraft against a selection of requirements in Def Stan 00-970 Part 5.

Examples of Direct Equivalence (Mil Hdbk 516A)UK25.851a Fire Extinguishers

Def Stan 00-970 Requirement

(US) ACA Tailored Mil Hdbk 516 Criteria

Categorisation and Detailed Equivalence Argument (2018)

UK 25.851a Fire Extinguishers

In addition to the requirements of CS25.851the aeroplane shall be fitted with hand held extinguishers as follows:

(a) For aeroplanes fitted with electronicequipment or any other equipment which may cause fire or smoke and which is accessible to the crew there shall be handheld fire extinguishers located throughoutthe cabin in positions which are easilyaccessible to the crew.

(b) Where the role or specific mission of theaircraft increases the likelihood of fire in thecabin to a greater extent than a CS25 certified aircraft the Project Team Leader shall determine, together with the AircraftDesigner, the appropriate number andlocation of extinguishers to mitigate such risks.

9.7 Crash survivability

9.7.8 Verify that the air vehicle is equippedwith breathing and eye protection equipment, fire fighting equipment, and fire extinguishersappropriate for the expected use.

18.2 Fire detection, suppression, and resistance18.2 Fire detection, suppression,

Direct Equivalence (E).

The referenced TCB criteria and associated design standards fully meet the design intent of the Def Stanrequirement as detailed below.

UK 25.851a deals with portable hand-held fire extinguishers and requires that they are installed throughoutthe cabin in positions which are easily accessible to the crew.

Equivalence is claimed through the application and verification of the TCB criteria highlighted in the column opposite:

and resistance

18.2.2 Verify that the air vehicle is equippedwith breathing and eye protection equipmentand fire extinguishers appropriate for theexpected use.

TCB criteria 9.7.8 and 18.2.2 deal with Crash Survivability and Passenger Safety respectively and specifymirror requirements for the provision of emergency equipment to deal with in-flight, ground, and ditchingemergencies, tailored for the intended mission of the aircraft. Collectively these criteria will ensure thatsufficient approved hand-held fire extinguishers are provided in the cockpit and cabin. Verification throughanalysis and inspection will ensure the availability and accessibility of each hand-held fire extinguisher andensure they are mounted to facilitate quick removal from their mounting brackets.

The TCB also identifies MIL-HDBK-759C as one of the design standards against TCB criterion 18.2.2.Within this, the following sections address the design intent of UK 25.851a:

• MIL-HDBK-759C 5.13.7.3.2.2 Fire Extinguishers

• MIL-HDBK-759C 5.13.7.8 Safety Checklist

It is the TAA assessment that the requirements of UK 25.851a are fully included within the scope of the TCB criteria identified. Application and verification of these criteria will provide portable emergency hand-held fire extinguishers in the flight deck and cabin which meet the design intent of this requirement.

The TAA concludes that the TCB criteria identified in the previous column supported by the associated design standards, provide an acceptable level of design safety and fully meet the design intent of this DefStan requirement.

No change to the [AIR PLATFORM] TCB is required.

CS25.787 Stowage Compartments

Page 15 of 18

Def Stan 00-970 Requirement(US) ACA Tailored Mil

Hdbk 516 CriteriaCategorisation and Detailed Equivalence Argument (2018)

CS 25.787 Stowage Compartments 9.7 Crash survivability Direct Equivalence (E).(a) Each compartment for the stowage of cargo, baggage, carry-on articles and

9.7.7 Verify that, under design crash loads, items of high mass (objects which can cause

The referenced TCB criteria and associated design standards fully meet the design intent of the Def Stan requirement as detailed below.

equipment (such as life rafts) and any other stowage compartment must be designed for

injury to occupants) will hold their spatial position relative to the occupants.

CS 25.787 deals with stowage compartments. It is a composite requirement that deals with the structural

its placarded maximum weight of contentsstrength of stowage compartments and their general design arrangements to prevent contents breaking

and for the critical load distribution at the18.1 Survivability of passengers loose and becoming a hazard to the aircraft or to its occupants.

appropriate maximum load factors 18.1.3 Verify that, if stowage compartments Within the scope of this equivalence assessment, the only stowage compartments considered are thosecorresponding to the specified flight and are present, they are designed to contain the located within the cockpit and cabin areas of the air vehicle. Note that the [AIR PLATFORM] does notground load conditions and, where the maximum weight of its contents and the incorporate cargo compartments, so sub para (c) of CS 25.787 is not applicable.breaking loose of the contents of such critical load conditions in an emergency Equivalence is claimed through the application and verification of the TCB criteria highlighted in the columncompartments could– landing. The contents should not become a opposite:

(1) Cause direct injury to occupants; hazard to passengers due to shifting under emergency landing conditions. TCB criterion 9.7.7 will ensure that items of high mass, including baggage, carry-on articles and other

(2) Penetrate fuel tanks or lines or cause equipment, will remain in place in a crash scenario, and in doing so will not endanger the occupants.fire or explosion hazard by damage to 18.1.16 Verify that all installed equipment in

adjacent systems; or passenger compartments is provided with a TCB criterion 18.1.3 will define the maximum weight limits for stowage compartments and the crash

restraining means to protect passengers loading requirements at these maximum weights. The criterion will ensure the stowage compartments(3) Nullify any of the escape facilities

during an emergency landing. are strong enough to restrain fixed or removable equipment in the event of a heavy or emergencyprovided for use after an emergency landing, to the emergency landing conditions of CS 25.561(b)(3).

landing.

TCB criterion 18.1.16 will ensure the aircraft’s installed equipment, including stowage compartments are equipped with restraining systems where necessary to prevent contents from breaking loose during a heavy or emergency landing.

If the aeroplane has a passenger-seatingThe TCB identifies JSSG 2001 and 2010 as design standards against the TCB criteria identified in the

configuration, excluding pilot seats, of 10 seats or more, each stowage compartment in

previous column. Sections of these relevant to CS 25.787 are listed below:

the passenger cabin, except for under seat • JSSG 2001 3.3.10.2.1 Crash Worthinessand overhead compartments for passenger convenience, must be completely enclosed.

• JSSG-2010-7 3.7.3.2.3 Cargo and Ancillary Equipment Retention

(b) There must be a means to prevent the It is the TAA assessment that the requirements of UK 25.787 are fully included within the scope of the TCB

contents in the compartments from becoming criteria identified. Application of these criteria will set maximum weight and crash loading requirements for

a hazard by shifting, under the loads specified stowage compartments. The TAA concludes that the TCB criteria identified in the previous column

in sub-paragraph (a) of this paragraph. (See supported by the associated design standards, provide an acceptable level of design safety and fully meet

AMC 25.787(b).) the design intent of this Def Stan requirement.

(c) If cargo compartment lamps are installed, each lamp must be installed so as to prevent contact between lamp bulb and cargo.


Examples of Partial Equivalence (Mil Hdbk 516A and Performance Based Requirements)

Page 16 of 18

UK25.473a Ground Load Conditions

Def Stan 00-970 Requirement(US) ACA Tailored Mil Hdbk 516

CriteriaCategorisation and Detailed Equivalence Argument (2018)

UK25.473a Ground Load Conditions And 5.1.1 Loads. Verify that the external loads Partial Equivalence and Acceptably SafeAssumptions reflect the latest design criteria, The referenced TCB criteria partially meet the design intent of the Def Stan requirement as detailed below.Consideration shall be given to the impulse load caused by traversing an arresting gear

aerodynamics, flight control system, structural stiffness, actual weight data, and

Performance based requirements have been identified that address the shortfall to the Def Stan requirement and will be added to the [AIR PLATFORM] TCB.

hook cable at all speeds up to maximum in-flight center of gravity (C.G.) controls; and

takeoff speed. loads from appropriate ground and The design intent of UK25.473a is to ensure the aircraft structural design loads include the effects of

shipboard operations, including maintenance traversing an arresting gear hook cable during taxi, takeoff and landing.

activities, are included. 5.1.1 – Ensures that the external loads reflect those from appropriate ground operations, which for a

8.5.3.2 Landing Gear Structure. Verify the military aircraft could reasonably include arresting gear hook cable rollover.

functionality of the shock strut to perform all 8.5.3.2 & 8.5.5 – Demand that the landing gear structure is designed to withstand the loading for all groundits required energy absorption for all ground operations, landing, and takeoffs with normal

operations.

servicing and with acceptable levels of The following performance based requirements provide supporting design criteria to mitigate the fact that

misservicing. the referenced TCB criteria do not specifically refer to the effects of traversing an arresting gear hook cable:

8.5.5 Landing Gear Structure. Verify that theworst-case loads expected during 1. [TAA to reference performance based requirements that specifically ensure the effect of

operational missions on the nose/tail wheels traversing an arrestor gear cable is considered]

and main gear wheels are not exceeded. The TAA concludes that the TCB criteria identified in the previous column, supported by the selected performance based requirements listed above, provide an acceptable level of design safety and fully meet the design intent of this Def Stan requirement.

Performance based requirements, as described above, will be added to the [AIR PLATFORM] TCB.

UK25.631a Bird Strike Damage



UK25.631a Bird Strike Damage 5.2.1 Strength. Verify that the air vehicle

Dependant on the role of the aircraft the structure has zero or positive margins of

higher of the energy requirement of safety for all configurations within allowable

CS25.631 or Part 1, Section 4.9 shall be operating conditions (including probable

considered against the overall requirements failure and defined emergency conditions).

of Part 1, Section 4. The determination of margins of safety isbased on the smaller of the design orprocurement specification allowable.

6.2.1.3 VCF architecture design. Verify thatthe integrated VCF architecture safely implements the proper levels of redundancy, fault tolerance, physical/functional

Partial Equivalence and Acceptably Safe

The referenced TCB criteria and associated design standards partially meet the design intent of the DefStan requirement as detailed below. Performance based requirements have been identified that addressthe shortfall to the Def Stan requirement and will be added to the [AIR PLATFORM] TCB.

separation of flight/safety-criticalfunctions/components and other aspects.

UK25.631a directly references eleven further requirements - Part 1 Section 4.9, clauses 4.9.2 to 4.9.12(clause 4.9.1 provides context only – it is not a requirement). The design intent of UK25.631a and thecascaded requirements is to ensure that the aircraft is designed to withstand a defined energy bird strike impact on the frontal aspect of the aircraft, including consideration of the effect on flying qualities, transparencies, structures, engine intakes, flying surfaces (inc. aerodynamic devices) and systems (inc.flight instruments, fuel systems, landing gear and crew/passenger escape systems).

5.2.1 ensures that the aircraft structure is strong enough to withstand applied loading, including probablefailure conditions. Although it is not explicitly mentioned in 5.2.1, bird strike is a well understood event thatcould reasonably be classed as a probable failure condition and it is explicitly referenced in the associated standard for this criterion, JSSG 2006. The following sections within JSSG 2006 require consideration of the effects of a defined energy bird strike on the aircraft and crew. Note that the JSSG 2006 requirement

of 18



6.2.1.5 VCF architecture design. Verify for the airframe to withstand impact without the loss of the air vehicle will also ensure that any critical

failure mode effects to be safe for the entire internal systems (e.g. fuel) are adequately protected by the aircraft structure.

VCF operation. JSSG 2006 3.2.24.1 Bird FOD – Requires that the airframe is designed to withstand the impact of a single

6.2.1.6 VCF architecture design. Verify bird, with bird mass and air vehicle speeds defined by the user, in a manner consistent with the normal

special failure states of single fail, dual fail, and special single fail/combination failure(s), as well as order of failure(s), are safe.

flight without loss of the air vehicle or the incapacitation of the pilot or crew.

JSSG 2006 3.3.17 Rapid decompression – Requires that the aircraft flight structure has sufficient residual strength to withstand rapid decompressions as a result of events including bird strike, and that failures shall

6.2.2.17 Basic VCF. Verify the clearances not degrade, damage, or cause to fail any other components of the flight control, fuel, hydraulic, or

available safely tolerate foreign object electrical systems, such that safe, continued, and controlled flight is in question.

damage (FOD). 6.2.1.3, 6.2.1.5, 6.2.1.6, 6.2.2.17 ensure that the Vehicle Control Function (VCF) architecture (which

6.2.2.52 Basic VCF. Verify air data is safe includes aircraft flying surfaces/controls) is designed to withstand failures through redundancy and

for the following: e. Bird strike vulnerability. separation, and in the case of 6.2.2.17 specifically addresses the ability to safely tolerate FOD, which can reasonably be considered to include bird strike.

7.3.1 Engine Structures. Verify that damage tolerance, blade containment, foreign object In addition to the above consideration of the effects of failures on flying surfaces/controls, TCB section 6.1

damage (FOD), durability, corrosion, and (Stability and Control) makes extensive reference to MIL-F-8785C (Flying Qualities of Piloted Airplanes) as

sand, ice, liquid water, and bird ingestion the associated primary standard, which includes consideration of aircraft failure states when assessing

requirements have been met. aircraft flying qualities. Flying qualities can also be considered to represent an outcome of the design, and so the effects of bird strike on aircraft flying qualities will be addressed as a consequence of assessing the

8.5.12.12 Landing gear and deceleration effect on the other areas presented in this argument (structures, transparencies, flying controls, enginessystems - Ground handling. Verify that the system and system components have damage tolerance capability to sustain

etc.).

6.2.2.52 ensures that the effects of bird strike on flight instruments and any associated sensors that supply

partial failure or leakage before failure air data is considered.

without jeopardizing safety. 7.3.1 ensures that the effects of a range of external factors, including bird strike, on the engines is

9.6.2 Transparency Integration. Verify that considered. The associated standard for this criterion is FAR 33.76 (Bird Ingestion), within which subpart b

the transparency system meets bird-strike specifically addresses large single bird impacts:

impact survivability requirements. FAR 33.76 Bird ingestion – Requires that a large bird ingestion test is conducted using one bird of minimum 4lb mass aimed at the most critical exposed location on the first stage rotor blades and ingested at a bird speed of 200-knots.

8.5.12.12 ensures that the landing gear is capable of withstanding damage or partial failure without jeopardising safety.

9.6.2 ensures that the effects of bird strike on aircraft transparencies are considered, with a focus on survivability. The associated standard for this criterion is JSSG 2006 3.2.24.1 (Bird FOD) - the same as forTCB criteria 5.2.1 listed above.

Whilst the TCB criteria and design standards listed above meet the design intent of UK 25.631a in broad terms, the majority do not define the bird mass and impact speed parameters to be considered. The following performance based requirements have been identified and are considered to address this shortfall:

1. [TAA to reference performance based requirements that define specific bid strike mass and impact speed parameters].

The bird mass impact speed defined in the above performance based requirements is greater than the impact speeds required by 00-970 Part 1 Section 4 and CS 25.63.

of 18



The TAA concludes that the TCB criteria identified in the previous column, supported by the associated design standards and selected performance based requirements, provide an acceptable level of design safety and fully meet the design intent of this Def Stan requirement.

Performance based requirements, as described above, will be added to the [AIR PLATFORM] TCB.

Examples of Not Applicable UK25.771b Pilot Compartment and Crew Station Armour Protection



UK 25.771b Pilot Compartment and CrewStation Armour Protection

Where protective armour for the crew is required as part of the aeroplanespecification it shall meet therequirements of Part 1, Section 4, Clauses 4.15.13 to 4.15.16.

None Not Applicable (NA).

The referenced Def Stan requirement is not considered to be applicable to the TCB, as detailed below.

UK25.771b requires that if protective armour for the aircrew is included in the aircraft specification then itsdesign must meet the requirements of Def Stan 00-970 Part 1, Section 4, Clauses 4.15.13 to 4.15.16.

Part 1, Section 4, Clauses 4.15.13 to 4.15.16 (Crew Stations - General Requirements: Armour Protection) specifies design requirements relating to protective armour, when it is either an integral part of the aircraft structure or an integral part of the crew seat.

The [AIR PLATFORM] specification does not contain any requirement for aircrew protective armour, either as an integral part of the aeroplane structure (00-970 Part 1 Section 4 4.15.13/4.15.15) or as an integral part of a seat or clothing (clauses 4.15.14/4.15.16). Review of the [AIR PLATFORM] operating manuals confirms that the [AIR PLATFORM] design does not incorporate any such aircrew protective armour.

Since protective armour for the crew is not required as part of the [AIR PLATFORM] specification, theTAA concludes that UK 25.771b is Not Applicable to the [AIR PLATFORM TCB].


UK25.1301c TEMPEST



UK25.1301c TEMPEST

Requirements for TEMPEST clearance shall be considered in conjunction with the Project Team Leader.

None Not Applicable (NA)

The referenced Def Stan requirement is a performance requirement rather than an airworthiness certification requirement.

The TAA concludes that UK 25.1301c is categorised as Not Applicable to the [AIR PLATFORM] TCB as its inclusion would not contribute to the airworthiness or safety of the aircraft.
