Advisory Circular (AC) No. 521-008

Responsibilities of a Design Approval Document Holder

Issuing Office: Civil Aviation, Standards
Document No.: AC 521-008
File Classification No.: Z 5000-34
Issue No.: 01
RDIMS No.: 15058753-V34
Effective Date: 2026-02-13

Table of contents

1.0 Introduction

  1. (1) This Advisory Circular (AC) is provided for information and guidance purposes. It describes an example of an acceptable means, but not the only means, of demonstrating compliance with regulations and standards. This AC on its own does not change, create, amend or permit deviations from regulatory requirements, nor does it establish minimum standards.

1.1 Purpose

  1. (1) This document provides guidance on the responsibilities a Design Approval Document Holder (DADH) fulfills once they have been issued a Canadian design approval document, or their foreign design approval document has been accepted by Transport Canada Civil Aviation (TCCA).

1.2 Applicability

  1. (1) This document applies to:
    1. (a) TCCA personnel;
    2. (b) Domestic holders of Canadian design approval documents; and
    3. (c) Foreign holders of Canadian design approval documents, or of design approval documents issued by foreign airworthiness authorities which have been accepted by TCCA under subsection 521.455(3) of the Canadian Aviation Regulations (CARs).

1.3 Description of changes

  1. (1) Not applicable.

2.0 References and requirements

2.1 Reference documents

  1. (1) This document refers to the following reference materials:
    1. (a) Aeronautics Act (R.S.C., 1985, c. A-2);
    2. (b) Canadian Transportation Accident Investigation and Safety Board Act (S.C. 1989, c. 3);
    3. (c) Part I, Subpart 1 of the CARs — Interpretation;
    4. (d) Part I, Subpart 3 of the CARs — Administration and Compliance;
    5. (e) Part V, Subpart 21 of the CARs — Approval of the Type Design or a Change to the Type Design of an Aeronautical Product;
    6. (f) Part V, Subpart 61 of the CARs — Manufacture of Aeronautical Products;
    7. (g) Part VII, Subpart 1 of the CARs — Foreign Air Operations;
    8. (h) Part VII, Subpart 5 of the CARs — Airline Operations;
    9. (i) Chapter 525 of the Airworthiness Manual (AWM) — Transport Category Aeroplanes;
    10. (j) Chapter 533 of the AWM — Aircraft Engines;
    11. (k) Chapter 535 of the AWM — Propellers;
    12. (l) Policy Letter (PL) 525-001 — Implementation of the FAA SFAR 88 – Mandatory Action Decision Criteria Memorandum;
    13. (m) Advisory Circular (AC) 521-002 — Type Certification Requirements of Aircraft, Engines and Propellers;
    14. (n) AC 521-004 — Changes to the Type Design of an Aeronautical Product;
    15. (o) AC 521-005 — Supplemental Type Certificates;
    16. (p) AC 521-006 — Repair Design Approvals;
    17. (q) AC 521-007 — Part Design Approvals;
    18. (r) AC 521-009 — Division IX – Service Difficulty Reporting;
    19. (s) AC SUR-002 — Root Cause Analysis and Corrective Action for TCCA Findings;
    20. (t) AC SUR-004 — Civil Aviation Surveillance Program;
    21. (u) Staff Instruction (SI) 500-018 — Transfer of Design Approval Documents to a New Holder;
    22. (v) Transport Canada Publication (TP) 4711 — Air Operator Certification Manual;
    23. (w) TP 6327 — Safety Criteria for Approval of Extended Range Twin-Engine Operations (ETOPS);
    24. (x) International Agreements and Arrangements;
    25. (y) Technical Implementation Procedures – European Union;
    26. (z) Implementation Procedures for Airworthiness – United States;
    27. (aa) International Civil Aviation Organization (ICAO) Annex 6 — Operation of Aircraft;
    28. (bb) ICAO Annex 8 — Airworthiness of Aircraft;
    29. (cc) ICAO Annex 13 — Aircraft Accident and Incident Investigation;
    30. (dd) ICAO Annex 19 — Safety Management;
    31. (ee) ICAO Document 9760 — Airworthiness Manual;
    32. (ff) ICAO Document 9859 — Safety Management Manual;
    33. (gg) European Union Aviation Safety Agency (EASA) Acceptable Means of Compliance (AMC) 21A.3B(b) — Unsafe Condition;
    34. (hh) EASA AMC 25.1309 — System Design and Analysis;
    35. (ii) EASA Certification Memorandum (CM) 21.A-A-001 — Parts Detached From Aeroplanes;
    36. (jj) EASA CM 21.A-J-001 — Service Bulletins (SBs) related to Airworthiness Directives (ADs);
    37. (kk) EASA Guidance Material (GM) 21A.3B(b) — Determination of an unsafe condition;
    38. (ll) EASA GM 21A.3B(d)(4) — Defect correction – Sufficiency of proposed corrective action;
    39. (mm) Federal Aviation Administration (FAA) AC 20-176A — Service Bulletins Related to Airworthiness Directives and Indicating FAA Approval on Service Documents;
    40. (nn) FAA AC 23.1309-1E — System Safety Analysis and Assessment for Part 23 Airplanes;
    41. (oo) FAA AC 25-19A — Certification Maintenance Requirements;
    42. (pp) FAA AC 25.1309-1A — System Design and Analysis;
    43. (qq) FAA AC 39-8 — Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes;
    44. (rr) FAA-IR-M-8040.1C — Airworthiness Directives Manual;
    45. (ss) FAA ANE-2007-33.70-1 — Policy for Continued Airworthiness Assessment Methodology for Turbine Engine Rotating Life-Limited Parts Life Shortfall;
    46. (tt) FAA Policy Statement (PS) PS-AIR-21.8-1602 — Approval of Non-Required Safety Enhancing Equipment (NORSEE);
    47. (uu) FAA PS-ANE-2011-33-1 — Engine Reliability in Extended Operations (ETOPS) – Continued Operational Safety (COS) Assessments;
    48. (vv) FAA PS-ANM-25-05 — Transport Airplane Risk Assessment Methodology (TARAM) Handbook;
    49. (ww) FAA PS-ANM-25-11 — Guidance for Hazard Classifications of Failure Conditions that Lead to Runway Excursions;
    50. (xx) FAA PS-ANM110-1999-115-99-22 — Transport Airplane Directorate Policy Regarding Methods Used to Determine the Likelihood of Catastrophic Failure Events;
    51. (yy) AIA/AIAB/AIAC/ASD/GAMA International Industry Standard, SM-0001 — Implementing a Safety Management System in Design, Manufacturing and Maintenance Organizations; and
    52. (zz) Cybersecurity and Infrastructure Security Agency Alerts and Emergency Directives.

2.2 Cancelled documents

  1. (1) Airworthiness Notice (AN) A015, Edition 1, Dated 2004-04-19 – Transmission of Defect Information to the Organization Responsible for Type Design.
  2. (2) By default, it is understood the publication of a new issue of a document automatically renders any earlier issues of the same document null and void.

2.3 Definitions and abbreviations

  1. (1) This document uses the following definitions:
    1. (a) Deficiency: In the context of this AC, refers to an error or omission which results in an aeronautical product or its type design not providing the performance, qualities, reliability, information, or level of safety intended to be achieved through conformance of the aeronautical product to its type design approved or accepted by the Minister or compliance of the type design with its certification basis established, or otherwise accepted, by the Minister;
    2. (b) Make Available: In the context of this AC, means to make available on the market a supply of an item for distribution, consumption or use in the course of a commercial activity, whether in return for payment or free of charge, and in accordance with any existing commercial relationships;
    3. (c) Monitored Fleet Campaign: In the context of this AC, refers to corrective action undertaken by a DADH to address an unsafe condition in-service, one which is approved by TCCA and monitored by the DADH and TCCA, and if not completed in its entirety within the agreed compliance time, results in the re-evaluation of the corrective action plan, including issuance of an Airworthiness Directive to mandate the corrective action;
    4. (d) Reportable Service Difficulty: Means a service difficulty that affects or that, if not corrected, is likely to affect the safety of an aircraft, its occupants or any other person (Ref. section 101.01 of the CARs);
    5. (e) Service Difficulty: Means a failure or malfunction of, or defect in, an aeronautical product (Ref. section 101.01 of the CARs); and
    6. (f) Type Design: Means:
      1. (i) The drawings and specifications, and a listing of those drawings and specifications that are necessary to define the design features of an aeronautical product in compliance with the standards applicable to the aeronautical product;
      2. (ii) The information on dimensions, materials and manufacturing processes that is necessary to define the structural strength of an aeronautical product;
      3. (iii) The approved sections of the aircraft flight manual, where required by the applicable standards of airworthiness;
      4. (iv) The airworthiness limitations section of the instructions for continued airworthiness specified in the applicable chapters of the Airworthiness Manual; and
      5. (v) Any other data necessary to allow, by comparison, the determination of the airworthiness and, where applicable, the environmental characteristics of later aeronautical products of the same type or model. (Ref. section 101.01 of the CARs).
  2. (2) This document uses the following abbreviations:
    1. (a) AC: Advisory Circular;
    2. (b) AD: Airworthiness Directive;
    3. (c) AMOC: Alternative Means of Compliance;
    4. (d) AFM: Aircraft Flight Manual;
    5. (e) AMC: Acceptable Means of Compliance;
    6. (f) ARP: Aerospace Recommended Practice;
    7. (g) AWL: Airworthiness Limitation;
    8. (h) AWM: Airworthiness Manual;
    9. (i) CAA: Civil Aviation Authority;
    10. (j) CAN-TSO: Canadian Technical Standard Order;
    11. (k) CAR: Canadian Aviation Regulation;
    12. (l) CARI: Continuing Airworthiness Review Item;
    13. (m) CASA: Civil Aviation Safety Alert;
    14. (n) CMP: Configuration, Maintenance and Procedures;
    15. (o) CMR: Certification Maintenance Requirements;
    16. (p) CS: Certification Specification;
    17. (q) CTAISB: Canadian Transportation Accident Investigation and Safety Board;
    18. (r) CVR: Cockpit Voice Recorder;
    19. (s) DADH: Design Approval Document Holder;
    20. (t) EASA: European Union Aviation Safety Agency;
    21. (u) EDTO: Extended Diversion Time Operations;
    22. (v) EFVS: Enhanced Flight Vision System;
    23. (w) ETOPS: Extended-range Twin-engine Operations;
    24. (x) ETSO: European Technical Standard Order;
    25. (y) FAA: Federal Aviation Administration;
    26. (z) FCOM: Flight Crew Operating Manual;
    27. (aa) FDR: Flight Data Recorder;
    28. (bb) FRM: Flammability Reduction Means;
    29. (cc) GM: Guidance Material;
    30. (dd) HIRF: High Intensity Radiated Fields;
    31. (ee) ICA: Instructions for Continued Airworthiness;
    32. (ff) ICAO: International Civil Aviation Organization;
    33. (gg) IFSD: In-Flight Shutdown;
    34. (hh) MCAI: Mandatory Continuing Airworthiness Information;
    35. (ii) MEL: Minimum Equipment List;
    36. (jj) MMEL: Master Minimum Equipment List;
    37. (kk) MRBR: Maintenance Review Board Report;
    38. (ll) PDA: Part Design Approval;
    39. (mm) PI: Process Inspection;
    40. (nn) PVI: Program Validation Inspection;
    41. (oo) RDA: Repair Design Approval;
    42. (pp) RFM: Rotorcraft Flight Manual;
    43. (qq) RNP: Required Navigation Performance;
    44. (rr) RVSM: Reduced Vertical Separation Minima;
    45. (ss) SAIB: Special Airworthiness Information Bulletin;
    46. (tt) SAE: Society of Automotive Engineers;
    47. (uu) SB: Service Bulletin;
    48. (vv) SCA: Special Conditions - Airworthiness;
    49. (ww) SDR: Service Difficulty Report;
    50. (xx) SI: Staff Instruction;
    51. (yy) SIB: Safety Information Bulletin;
    52. (zz) SMS: Safety Management System;
    53. (aaa) SoD: State of Design;
    54. (bbb) SoR: State of Registry;
    55. (ccc) SSP: State Safety Program;
    56. (ddd) STC: Supplemental Type Certificate;
    57. (eee) TARAM: Transport Airplane Risk Assessment Methodology;
    58. (fff) TC: Type Certificate;
    59. (ggg) TCCA: Transport Canada Civil Aviation;
    60. (hhh) TP: Transport Canada Publication;
    61. (iii) TSB: Transportation Safety Board; and
    62. (jjj) WSDRS: Web Service Difficulty Reporting System.

3.0 Background

  1. (1) With the implementation of Subpart 521 of the Canadian Aviation Regulations (CARs), new documents have been created to support the regulations. All guidance materials such as Staff Instructions (SIs), ACs, and Policy Letters (PLs) which supported the previous CARs and Chapters 511, 513, 591 and 593 of the Airworthiness Manual(AWM) have been reviewed and the relevant material included in the 521 series ACs and SIs.
  2. (2) This AC is organized to mirror the sections and subsections of Division VIII of Subpart 521 of the CARs, so it can be easily read in conjunction with the CARs. Please note all sections and subsections of Division VIII of Subpart 521 of the CARs may not be represented in this document. Only the sections and subsections which have recommended acceptable means of compliance are included.
  3. (3) Division VIII of Subpart 521 of the CARs is structured to enable Canada to meet its commitments under International Civil Aviation Organization (ICAO) Annex 8, Part II, Chapter 4 as State of Design (SoD). These requirements at a high level include collecting and analyzing service difficulties, issuing Mandatory Continuing Airworthiness Information (MCAI) through an Airworthiness Directive (AD) to correct unsafe conditions, and other related activities.
  4. (4) Guidance for the regulations within Division VIII of Subpart 521 of the CARs is supplemented by recommendations and best practices for complex organizations (ex. AIA/AIAB/AIAC/ASD/GAMA International Industry Standard SM-0001). A principle of Safety Management Systems (SMS) is the extent and capability of the system itself should be commensurate with the organization’s regulatory obligations and safety goals. DADHs, and especially Type Certificate (TC) and Supplemental Type Certificate (STC) holders, are regarded as having significant obligations.
  5. (5) Many of the requirements in Division VIII of Subpart 521 of the CARs require actions by the Minister of Transportation (hereafter, the Minister). In these instances, TCCA is fulfilling the role of the Minister.
  6. (6) The term deficiency in this AC and in section 521.355 of the CARs is associated with airworthiness. Elsewhere in the CARs deficiencies are generally associated with quality assurance programs or SMS as well as other plans, programs, or processes.
  7. (7) An unsafe condition may exist in an aeronautical product due to deficiencies, service difficulties, or other causes.
  8. (8) A reportable service difficulty is submitted to the Minister as a Service Difficulty Report (SDR) under subsection 521.401(1) of the CARs.
  9. (9) In 2012, ICAO replaced the previously used term Extended-range Twin-engine Operations (ETOPS) with the new term Extended Diversion Time Operations (EDTO) through Amendment 36 to Annex 6, Part I. The main reason for this change in terminology is to better reflect the scope and applicability of the new standards. EDTO is an evolution of ETOPS based on industry best practices and lessons learned from over 25 years of ETOPS operations. This change in terminology is not intended to mandate a change in the concerned documentation. The term “ETOPS” may still be used instead of “EDTO” if the concepts are correctly embodied in the concerned documentation; therefore, EDTO may be referred to as ETOPS in some references contained in this document.

4.0 Application and technical capability

4.1 Application under section 521.351 of the CARs

  1. (1) The responsibilities described under Division VIII of Subpart 521 of the CARs apply as indicated in section 521.351 of the CARs. Additionally, the information can be useful for an applicant for a design approval document so they are aware of their responsibilities once they become a holder.
  2. (2) Responsibilities of foreign DADHs:
    1. (a) The holder responsibilities under Division VIII of Subpart 521 of the CARs are equally applicable to domestic DADHs as well as foreign DADHs. Foreign DADHs include both foreign holders of Canadian design approval documents, and foreign holders of design approval documents issued by a foreign civil aviation authority which are accepted by TCCA when an application is submitted in accordance with airworthiness agreements or similar arrangements (see section 521.455 of the CARs); and
    2. (b) For foreign DADHs, TCCA may rely on the SoD to verify if the foreign DADH is fulfilling their responsibilities under Division VIII of Subpart 521 of the CARs. See Appendix A for more discussion of the practical implementation of responsibilities for foreign DADHs under Division VIII of Subpart 521 of the CARs.
  3. (3) Prior to an applicant being granted a design approval document, the applicant provides a signed undertaking to fulfill the holder responsibilities identified in Subpart 521 of the CARs. The signed undertaking is required when applying for the following design approval documents:
    1. (a) Type Certificates (TC), under paragraph 521.57(1)(b) of the CARs;
    2. (b) Canadian Technical Standard Order (CAN-TSO) design approvals, under paragraph 521.109(b) of the CARs;
    3. (c) Changes to a type design, under paragraph 521.160(1)(e) of the CARs, and Supplemental Type Certificates (STCs), under section 521.205 of the CARs;
    4. (d) Repair Design Approvals (RDAs), under section 521.255 of the CARs;
    5. (e) Part Design Approvals (PDAs), under section 521.305 of the CARs; and
    6. (f) Transfers of any of the above design approval documents between holders, under subparagraph 521.357(1)(b)(iii) of the CARs.
  4. (4) The signed undertaking is not required for foreign holders of design approval documents issued by a foreign civil aviation authority which are automatically accepted by TCCA without an application in accordance with airworthiness agreements or similar arrangements.
  5. (5) The requirements for the text of the signed undertaking are explained in AC 521-002 for Type Certificates, and AC 521-004 for changes to a type design. The guidance in both documents is consistent and may be used for CAN-TSO design approvals or transfer of a design approval document as well. See also AC 521-005, AC 521-006 and AC 521-007 for more information regarding the signed undertaking.
  6. (6) If the original holder of a design approval document transfers the document to a new holder under the requirements of section 521.357 of the CARs, the new holder takes on the same responsibilities as the original holder. If the new holder cannot fulfill some of the responsibilities on their own, they arrange with a third party who has the technical capability to carry out the work required to fulfill the remaining responsibilities.
  7. (7) Should the DADH be unable or unwilling to continue to hold such documents and maintain the associated responsibilities, they should make their intentions known to TCCA in writing without delay. The design approval document is required to be surrendered to TCCA or transferred to an eligible holder.
  8. (8) The domestic DADH of design approval documents for which Canada is the SoD has an ordinary place of business in Canada and maintains a substantive presence of personnel in Canada to fulfill the holder responsibilities identified in Subpart 521 of the CARs. The number of personnel is commensurate with the complexity and quantity of design approval documents held by the DADH as well as with the quantity of aeronautical products in production or in service.

4.2 Technical capability under section 521.352 of the CARs

  1. (1) Section 521.352 of the CARs requires the DADH to have or have access to the required technical capabilities to conduct design analyses and tests in order to develop the data required to maintain the aeronautical product in an airworthy condition and to carry out the responsibilities in Division VIII of Subpart 521 of the CARs. A DADH could meet this requirement by:
    1. (a) Having the technical capabilities within the holder’s own organization; or
    2. (b) Showing an arrangement exists for the holder to have access to any technical capabilities required but not present within the holder’s own organization, and this arrangement is maintained accordingly.
  2. (2) Technical capability includes the following elements:
    1. (a) Personnel:
      1. (i) Sufficient personnel to meet the workload associated with fulfilling the holder’s responsibilities; and
      2. (ii) Personnel who are trained and knowledgeable and who have adequate oversight and management support to carry out their responsibilities.
    2. (b) Processes:
      1. (i) Documented and effective processes which are followed in practice; and
      2. (ii) Initial and recurrent training programs.
    3. (c) Tools:
      1. (i) Tools to support the processes identified above.
  3. (3) Recommended best practices:
    1. (a) Processes subjected to regular self-audits; and
    2. (b) A strong safety culture within the organization which promotes the identification and resolution of potential safety issues without reprisal against the individuals who identify the issues.
  4. (4) Documentation of an organization’s technical capability is discussed below in section 5.2, where it is associated with section 521.354 of the CARs for establishing a service difficulty reporting system.

5.0 Service difficulty reporting and service difficulty reporting system

  1. (1) This section provides guidance to meet the requirements for service difficulty reporting and the service difficulty reporting system.
  2. (2) Foreign DADHs should refer to Appendix A for alternate compliance means which may be available to them.

5.1 Service difficulty reporting under section 521.353 of the CARs

  1. (1) Section 521.353 of the CARs requires the DADH to report to the Minister any reportable service difficulty related to their aeronautical product(s). This obligation applies to service difficulties discovered by the DADH by any means. Service difficulties may be discovered through:
    1. (a) The DADH’s manufacturing quality system;
    2. (b) Reports from operators;
    3. (c) Flight testing;
    4. (d) Design review activities;
    5. (e) Production issues;
    6. (f) Reliability data reporting by automated or other means; or
    7. (g) Any other means.
  2. (2) The obligation to report service difficulties applies equally to holders of all types of design approval documents, as indicated in section 1.2 of this document.
  3. (3) What constitutes a reportable service difficulty varies with the type of aeronautical product. For example, what is reported for an aeroplane differs when compared to a rotorcraft, engine, or appliance. Accordingly, complex design organizations are encouraged to develop and maintain their own service difficulty reporting procedures and criteria, in consultation with the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch. The criteria may need to be reviewed to assess the need for revision due to changes in technologies used for design, criteria found to be inadequate, or requests from TCCA to do so. See the next section for discussion on this in the context of complex design organizations. Further guidance for developing a system for service difficulty reporting, how to report a service difficulty, and reporting timelines can be found in AC 521-009.
  4. (4) The DADH has the responsibility to submit an SDR to TCCA when they are advised of a service difficulty by another organization who did not already submit an SDR to TCCA for the service difficulty. The DADH may become aware through any channel of communication. For example, the DADH may become aware of reportable service difficulties through foreign operators who may be subject to foreign regulations requiring them to report service difficulties directly to the DADH.

5.2 Establishing a service difficulty reporting system under section 521.354 of the CARs

  1. (1) The DADH establishes and maintains a service difficulty reporting system for receiving, recording, analyzing and investigating reports and information concerning a reportable service difficulty related to their aeronautical product(s), to meet the requirements of section 521.354 of the CARs.
  2. (2) There is no regulatory requirement for the service difficulty reporting system to be approved or accepted by TCCA. Also, unlike holders of other certificates, there is no explicit regulatory requirement for a DADH to maintain an approved procedures manual. However, it is difficult to demonstrate technical capability without having processes which effectively amount to such a manual. The service difficulty reporting system required by section 521.354 of the CARs is a significant component of Division VIII of Subpart 521 of the CARs; therefore, expanding the service difficulty reporting system to include the remaining requirements of Division VIII of Subpart 521 of the CARs is recommended.
  3. (3) The service difficulty reporting system is intended to ensure the DADH undertakes the actions necessary for the conformance of the aeronautical product to its type design as well as for the upkeep of the type design and any associated approved data required under section 521.365 of the CARs throughout an aeronautical product’s in-service life. These actions include, but are not limited to:
    1. (a) Monitoring the airworthiness performance of the in-service aeronautical products to detect service difficulties and reportable service difficulties;
    2. (b) Detecting if the aeronautical product’s type design, manufacturing processes or required manuals to support the operation of the product in service are not providing the features, qualities, performance, or level of safety intended by the standards used to define its certification basis;
    3. (c) Detecting if an aeronautical product is not conforming to its type design;
    4. (d) If deficiencies are detected, taking appropriate and effective corrective action to ensure conformance of the aeronautical product to its type design, update the aeronautical product’s type design, or generate the required data needed to return the aeronautical product to an acceptable level of safety and support its continued airworthiness in-service;
    5. (e) Maintaining records; and
    6. (f) Timely communication with, and the provision of all required reports and data to, TCCA.
  4. (4) The design and implementation of the service difficulty reporting system and its processes:
    1. (a) Is commensurate with the complexity, operational context, and proliferation of the aeronautical product;
    2. (b) Encompasses the policies, procedures, processes, methods, practices, and timelines necessary for the DADH to discharge their responsibilities in an effective and safe manner; and
    3. (c) Is consistent with typical aviation industry engineering practices.
  5. (5) Clear documentation containing details of the policies, procedures, processes, methods, practices, and timelines for each major milestone for the systems instituted by the DADH, including the identification of roles, responsibilities, organizational structure, accountabilities of personnel, and the tools and training they require to carry out their duties should be made available for use internally by the DADH and to any external entities which have been engaged to provide technical capability. The documentation should be reviewed periodically and revised as needed to maintain currency.
  6. (6) As large or complex DADH organizations create or change processes relevant to the fulfillment of DADH responsibilities of Division VIII of Subpart 521 of the CARs, they are encouraged and requested to seek acceptance of these processes from the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch.

5.3 Service difficulty reporting system components under section 521.354 of the CARs

  1. (1) A service difficulty reporting system encompasses all activities undertaken by the DADH for the receipt, analysis, investigation, corrective action, and communication related to service difficulties reported for their product.
  2. (2) An established and maintained service difficulty reporting system typically includes the processes necessary to carry out the following activities:
    1. (a) Receiving and recording reports and information on service difficulties related to the aeronautical product from various sources, such as:
      1. (i) The TCCA Web Service Difficulty Reporting System (WSDRS);
      2. (ii) The TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch (e.g. TCCA’s Feedback and Civil Aviation Safety Alerts (CASAs));
      3. (iii) Foreign civil aviation authorities of States in which their aeronautical products are known to be operating or registered (e.g. the European Union Aviation Safety Agency (EASA)’s Safety Information Bulletins (SIBs), and the Federal Aviation Administration (FAA)’s Special Airworthiness Information Bulletins (SAIBs));
      4. (iv) Owners and operators of the aeronautical product(s);
      5. (v) Accident investigation authorities, such as the Transportation Safety Board (TSB) of Canada and other foreign investigative authorities;
      6. (vi) The production control and quality assurance systems of the organization(s) manufacturing the product;
      7. (vii) Subcontractor and supplier reporting systems;
      8. (viii) Internal staff or departments, such as customer service units and accident investigation sections; and
      9. (ix) Credible media-based information.
    2. (b) Assessing received reports and information on service difficulties, without undue delay, for the purposes of:
      1. (i) Identifying and gathering any missing or required information under subsection 521.401(1) of the CARs;
      2. (ii) Determining if the service difficulty is a reportable service difficulty and, if so, submitting an SDR to TCCA within the timelines established under section 521.402 of the CARs;
      3. (iii) Determining whether the cause of the service difficulty falls within the scope of the DADH’s responsibilities; and

      4. (iv) Determining safety risk(s) to facilitate appropriate scheduling and handling through the DADH’s service difficulty reporting system with an emphasis on identifying any immediate safety threats which require priority handling.

        Note: The DADH is expected to make reasonable efforts to gather missing or required information. It is acknowledged it is not always possible to gather all this information when dealing with products operated outside of Canada or by uncooperative product owners. In such cases, the DADH is expected to be able to demonstrate the measures taken to gather this information through documentation.

        Note: When the cause of a reportable service difficulty is determined to not fall within the scope of the DADH’s responsibilities, an SDR is still required under section 521.353 of the CARs thus the DADH submits an SDR prior to terminating their activities.

    3. (c) Investigating SDRs to determine whether the aeronautical product conforms to its type design and its type design continues to provide the performance, features, or level of safety intended by its established certification basis. Investigations often include, but are not limited to:
      1. (i) Determining if the SDR forms part of a trend or is an isolated event;
      2. (ii) Inspection or testing of affected aeronautical products when necessary;
      3. (iii) Determining causes and contributing factors at the aeronautical product or type design level;
      4. (iv) Utilizing newly acquired data to reassess the type design’s compliance with the certification basis;
      5. (v) Risk analysis; and
      6. (vi) Concluding if corrective action is required.
    4. (d) Developing and implementing corrective action to rectify deficiencies to return the aeronautical product to conformance with its type design, return the type design to compliance with its certification basis, or otherwise reduce identified safety risk(s) to an acceptable level.
    5. (e) Communicating with TCCA throughout the investigation process. Communication procedures should include the following:
      1. (i) Established reporting methods, such as a DADH’s WSDRS account and other means to communicate directly with the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch;
      2. (ii) Established methods to expediently communicate with the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch upon detection of an emergency or safety critical matter;
      3. (iii) Investigation and corrective action progress report triggers, including associated timeframes, such as reporting to the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch upon:
        1. (A) Detecting a significant safety threat or concern which may require urgent or priority action;
        2. (B) Commencement of an investigation;
        3. (C) Updates related to significant milestones during the investigation;
        4. (D) Conclusion of an investigation;
        5. (E) Formulation of a corrective action plan to address a deficiency;
        6. (F) Commencement of corrective action(s);
        7. (G) Significant deviations during corrective action implementation; and
        8. (H) Completion of corrective action(s).
      4. (iv) Established methods to respond to formal requests received from TCCA within timeframes commensurate with the urgency of the request.

6.0 SDR investigation and corrective action under sections 521.355 and 521.356 of the CARs

6.1 Introduction

  1. (1) An aeronautical product may experience service difficulties throughout its operational or service life. Service difficulty and reportable service difficulty are defined in section 2.3 of this document and in section 101.01 of the CARs.
  2. (2) For a reportable service difficulty, in practice, this typically means the submitter believes it is likely the service difficulty in the aeronautical product poses a hazard to an aircraft, its crew, passengers, or any other person and the safety risk(s) has not been sufficiently mitigated by existing features of the aeronautical product’s type design, the recommended maintenance and/or operating manuals, or by industry standard maintenance and airmanship practices.
  3. (3) A reportable service difficulty may be a symptom of, or evidence for, a deficiency.
  4. (4) Foreign DADHs should refer to Appendix A for alternate means of compliance which may be available to them.

6.2 Service Difficulty Report investigation overview

  1. (1) This section addresses subsection 521.355(1) of the CARs which requires the DADH to investigate SDRs, determine if they resulted from a deficiency in their aeronautical product, and if so, take corrective action to rectify the deficiency. The subsection also requires the DADH to submit reports to the Minister related to the progress of investigations and corrective action.
  2. (2) The expected outcomes of an SDR investigation are:
    1. (a) Identification of type design or aeronautical product deficiencies;
    2. (b) Understanding and quantification of the safety risk(s) posed by the service difficulty or deficiency; and
    3. (c) Timely and effective rectification of deficiencies and/or the reduction of safety risk(s) to acceptable levels.
  3. (3) The DADH is expected to make reasonable efforts to investigate all SDRs associated with their aeronautical product. It is acknowledged full investigations may be difficult for products operated outside of Canada or by uncooperative product owners. In such cases, the DADH is expected to be able to demonstrate the measures taken to conduct the investigation through documentation and communicate the inability to fully investigate to TCCA as part of required progress reports.
  4. (4) Service difficulties anticipated to occur during normal operation of the aeronautical product are typically not considered to affect safety for the purposes of determining the reportability of a service difficulty and therefore do not require extensive investigation by the DADH in most cases. The service difficulties anticipated to occur during normal operation of the aeronautical product are adequately addressed through existing:
    1. (a) Instructions for Continued Airworthiness (ICA);
    2. (b) Non-emergency related Aircraft Flight Manual (AFM) or Rotorcraft Flight Manual (RFM) procedures;
    3. (c) Maintenance Review Board Report (MRBR) tasks or maintenance procedures;
    4. (d) Master Minimum Equipment List (MMEL); or
    5. (e) Specific design features (such as Certification Maintenance Requirements (CMRs) and Airworthiness Limitations (AWLs).
  5. (5) Service difficulties whose cause is determined to not fall within the scope of the DADH’s responsibilities may not require corrective action by the DADH but are considered a reportable service difficulty and require an SDR to be submitted to TCCA. However, if the SDR is found to pose an unacceptable level of risk to the in-service fleet, and the Minister determines the condition to be unsafe, the DADH is required to assist the Minister through the development of corrective action(s) under section 521.356 of the CARs.
  6. (6) SDRs posing a hazard typically require a full investigation by the DADH:
    1. (a) SDRs not expected to occur;
    2. (b) SDRs occurring more frequently than expected; or
    3. (c) SDRs are more severe or widespread than anticipated.
  7. (7) When a domestic applicant receives a design approval, or for foreign DADHs, when an aeronautical product is registered in Canada, the DADH is expected to contact the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch who creates an account in WSDRS or establishes other means of reporting (particularly in the case of STC holders) and determines which email address(es) are used for forwarding SDRs. The WSDRS is an internet-based SDR application which allows users to submit SDRs, query the database, track, store and update SDRs.
  8. (8) To request a WSDRS account, or other inquires related to WSDRS, contact TCCA at the following e-mail address: TC.WSDRS-SWRDS.TC@tc.gc.ca.
  9. (9) The SDR information transmitted is secure and accessible only after registration with a TCCA provided username and password. This is normally assigned to the person responsible for continuing airworthiness (or their delegate) within the design organization. These SDRs are available for viewing, printing, comment or download from the organization responsible for aeronautical type design’s private WSDRS account accessed at https://wwwapps.tc.gc.ca/saf-sec-sur/2/cawis-swimn/.
  10. (10) SDR investigation normally consists of the following phases:
    1. (a) Receipt and review: Gather missing information, confirm the service difficulty was reportable and therefore requires investigation and whether it is within the DADHs scope of responsibility;
    2. (b) Preliminary analysis (Triage): Assess aviation safety risk(s) and prioritize further investigation commensurate with risk. Expediently notify TCCA of any immediate threats to aviation safety or potential high-risk conditions;
    3. (c) Analysis: Root cause analysis, trend analysis, testing, modeling, etc. Determination if a product or design deficiency exists and if so, refine and quantify the level of risk to which the in-service products and production operations are exposed; and
    4. (d) Corrective Action:Develop and take actions necessary to rectify deficiencies and manage safety risk(s).

6.3 Service Difficulty Report investigation timelines

  1. (1) Investigations should proceed quickly and according to the level of risk associated with the underlying issue. In the early stages of the investigation, conservative assumptions with respect to the risk level may be necessary until the investigation phase progresses. The following guidelines are applicable in general, though each DADH is encouraged collaborate with TCCA to establish timelines tailored to their own process:
    1. (a) From notification of an SDR entered in the DADH’s WSDRS account to completion of the triage and submission of the preliminary progress report to TCCA, which typically includes the initial risk assessment: three (3) months; and
    2. (b) Analysis of the SDR or series of SDRs, including any testing or additional investigation required to determine if a deficiency is present through to reporting the analysis results and any intention to undertake corrective action to TCCA:
      1. (i) One (1) month for high-risk issues, four (4) months for medium-risk issues, and twelve (12) months for low-risk issues. Definitions of these risk levels are provided in subsection 6.3(3) below; and
      2. (ii) When determining timelines for investigation, issues affecting emergency-related equipment (as outlined in Appendix C) are to be treated as no less than medium risk, and security-related issues are to be treated as no less than high risk.
  2. (2) Where an occurrence is judged, at any point in the investigation process, to have resulted in an immediate or particularly significant hazard (such as immediate probability of a hazardous or catastrophic unsafe condition, or safety critical deficiency), the subsequent procedural step timelines should be reduced from the guidelines above to the shortest possible time including an immediate notification to the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch.
  3. (3) Definition of risk levels as used in subsection 6.3(1) above:
    1. (a) High: Generally considered by TCCA to be safety critical and/or unsafe per Appendix C and for which guidance for reaction time suggests urgent corrective action is required;
    2. (b) Medium: Typically considered by TCCA to be safety critical and/or unsafe per Appendix C. This includes a number of issues which, from a strict severity/probability analysis, would be classified as Low risk. For example, the intent is all of the occurrences generally considered safety critical or unsafe be treated as no less than Medium risk for the purpose of determining if investigation is required and the timeliness of the investigation; and
    3. (c) Low: Issues not typically judged to be unsafe by TCCA according to Appendix C.
  4. (4) For aircraft DADH, it is necessary to conduct aircraft-level assessment of risks on equipment included in the aircraft type design for which the equipment DADH also performs their own assessment (e.g. CAN-TSOs, engines, propellers, STCs, RDAs and PDAs).

6.4 Receipt and review of Service Difficulty Reports

  1. (1) The receipt and review phase refers to reviewing the SDR to gather any missing data to ensure appropriate prioritization and analysis can occur within safe and reasonable timeframes.
  2. (2) The DADH is notified by email via WSDRS or by other means when an SDR requires their attention.
  3. (3) The DADH is responsible for reviewing the SDRs upon notification and the review should be commenced and completed without undue delay.
  4. (4) TCCA may further communicate with the DADH to ask questions about an SDR or request more information. This communication may take place within the WSDRS Supplemental Text field or by another means acceptable to TCCA.
  5. (5) Upon receipt and review, if the DADH concludes the service difficulty reported may not, in fact, meet the definition of a reportable service difficulty, the DADH contacts TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch to request cancellation of the SDR.

6.5 Preliminary analysis (triage) for initial assessment of Service Difficulty Report safety impact

  1. (1) The triage is a rapid analysis by the DADH to:
    1. (a) Identify if there are any immediate threats to the operational safety of the product, or any potentially safety critical conditions which would necessitate an accelerated investigation and corrective action; and
    2. (b) Establish a preliminary level of risk to determine how quickly, or if, further analysis is required.
  2. (2) DADHs are encouraged to use the criteria utilized by TCCA for the identification of potential unsafe conditions when assessing for threats to operational safety or safety critical conditions. Appendix C provides an overview of these criteria. However, given the intent of the triage is to assess the SDR quickly, conservative assumptions may need to be used to make a more definitive determination. As a result, the analysis should consider the issue underlying an SDR as potentially unsafe until proven otherwise.
  3. (3) Upon initial assessment, if the DADH concludes the service difficulty reported may not, in fact, meet the definition of a reportable service difficulty, the DADH contacts TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch to request cancellation of the SDR.
  4. (4) The outcome of the triage is typically documented in a preliminary risk assessment and communicated to TCCA. Unless otherwise agreed, the communication should, as a minimum, consist of an entry in the WSDRS supplemental text field for the subject SDR.
  5. (5) Upon review of the preliminary risk assessment, TCCA may disagree with some assumptions or conclusions drawn by the DADH to establish the risk and require an investigation to proceed more rapidly due to TCCA’s assessment of a higher level of risk. In this case TCCA informs the DADH of their position, provides the justification, and the DADH proceeds accordingly.

6.6 Service difficulty report analysis to determine the presence of a deficiency in the aeronautical product

  1. (1) The holder analyzes each SDR to determine if it results from a deficiency in the aeronautical product. The aeronautical product includes not only the physical product but also the type design and any required documentation such as procedures, limitations, and operational approvals. Examples of possible deficiencies include, but are not limited to:
    1. (a) Errors or omissions during production which result in an aeronautical product not conforming to its approved design (e.g. a manufacturing non-conformance/quality defect);
    2. (b) Errors or omissions in the drawings, specifications, information, or other data defined as part of the type design and utilized by a manufacturer to produce new aeronautical products;
    3. (c) Errors or omissions in the compliance demonstration which result in an approved type design being out of compliance with its certification basis due to:
      1. (i) Structure or components subjected to more severe design loads or a more severe usage spectrum than they were designed to withstand;
      2. (ii) Component failure rates do not meet reliability requirements;
      3. (iii) The discovery of new functional hazard or failure modes not considered or incorrect system design assumptions in the system safety assessment;
      4. (iv) Design assumptions shown by subsequent analysis or in-service experience to be incorrect and non-conservative; or
      5. (v) Any of the above which are new discoveries related to the initial design or any subsequent design changes.
    4. (d) Any feature or characteristic making the aeronautical product unsafe, even if the aeronautical product conforms to its approved design and its approved design complies with its certification basis. Additional guidance for unsafe condition determination can be found in Appendix C; or
    5. (e) Ambiguous, erroneous, inadequate or misleading maintenance or operating instructions, procedures, limitations or training, whether a part of the approved document set or not. These may also be considerations for compliance as indicated above:
      1. (i) Factual evidence of maintenance personnel or aircrew failure to follow procedures in service may be indicative of a deficiency related to the aeronautical product. Specifically, when the documented procedures are in error, misleading, or cannot be followed or implemented consistently.
  2. (2) The DADH has the responsibility to develop and implement means to collect information to determine if a deficiency exists in the aeronautical product. Techniques the DADH can employ include, but are not limited to:
    1. (a) A review of service history;
    2. (b) Laboratory analysis of components;
    3. (c) Comparison of the actual usage spectrum against the spectrum used in design;
    4. (d) Comparison of actual reliability rates against the rates used in design;
    5. (e) Non-destructive or destructive inspection of components;
    6. (f) Design review;
    7. (g) Flight Data Recorder (FDR) or Cockpit Voice Recorder (CVR) analysis;
    8. (h) System or component simulation or test;
    9. (i) Installing additional data recording capability (e.g., quick access recorders) to support investigation, should it be necessary;
    10. (j) Analysis of maintenance records; and
    11. (k) Communication with operators or maintenance personnel.
  3. (3) While Division VIII of Subpart 521 of the CARs requires investigation of SDRs, separate legislation requires investigation of accidents and incidents. The following paragraphs describe the interaction between these two types of investigations, and in some cases both are required following the same SDR:
    1. (a) TCCA and the TSB are two governmental entities who have independent investigative requirements. Their relevant regulations are as follows:
      1. (i) TSB: Article 14(3) of the Canadian Transportation Accident Investigation and Safety Board (CTAISB) Act gives exclusive jurisdiction to investigate transportation occurrences for the purpose of making findings as to its causes and contributing factors, when the TSB is performing such an investigation. Article 14(4)(a) of the CTAISB Act states this does not prevent a department from investigating an occurrence for any other purpose; and
      2. (ii) TCCA: Article 4.9 of the Aeronautics Act gives the Government the authority to make regulations. Subsection 521.355(1) of the CARs requires the holder to investigate SDRs to determine if they result from a deficiency in the aeronautical product, and to report investigation progress to TCCA.
    2. (b) The presence of a TSB, or any other, investigation does not absolve the holder from investigating SDRs to determine whether they result from a deficiency in the aeronautical product or from fulfilling any of their other responsibilities under Division VIII of Subpart 521 of the CARs. A prompt SDR investigation is often required following an accident or serious incident to take immediate action to ensure other products of the same type are safe.
  4. (4) A root cause analysis of a service difficulty should be performed for the investigation to be complete. There are several techniques available to perform a root cause analysis; AC SUR-002 and Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 5150 Rev A provide some examples. However, it is recognized in some cases there isn’t sufficient information to determine the root cause. The details of the efforts made to identify the root cause should be provided when there isn’t enough information to determine the root cause.
  5. (5) The outcome of the analysis is to be recorded and reported to TCCA. Lengthy investigations or investigations of safety critical SDRs and deficiencies require interim updates at intervals acceptable to TCCA as the investigation progresses. A non-exhaustive list of examples of the required updates to TCCA are as follows:
    1. (a) Where an occurrence is judged, at any point in the investigation process, to have resulted in an immediate or particularly significant hazard (such as immediate probability of a hazardous or catastrophic unsafe condition), the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch expects to be advised immediately, and by the fastest possible means (e.g., telephone, e-mail) of whatever details are available at the time. This initial notification should then be followed up by a report in accordance with the regulations affecting service difficulty reporting;
    2. (b) A final risk assessment with a conclusion regarding presence of a deficiency in the aeronautical product including the root cause if it can be determined, as well as a plan for the corrective action phase of the SDR investigation; and
    3. (c) If applicable, an explanation of why or how an SDR was found to not have resulted from a deficiency in the aeronautical product.

6.7 Corrective action plan and corrective action development, approval, distribution and implementation

  1. (1) The expected outcomes of corrective action are:
    1. (a) To ensure the aeronautical product’s type design continues to meet the intent of, and complies with, the basis of certification as approved by the Minister so the expected minimum level of safety is maintained throughout the service life of the product; and
    2. (b) To develop, update, and make available the data necessary for maintaining the aeronautical product in, or returning the aeronautical product to, an airworthy condition throughout its expected in-service life.
  2. (2) Corrective action(s):
    1. (a) Are required to be developed by the DADH for any deficiency identified during the SDR investigation process;
    2. (b) Are required to be developed by the DADH to rectify unsafe conditions as determined by the Minister under section 521.356 of the CARs. These often include in-service corrective action(s) mandated through issuance of an Airworthiness Directive (AD);
    3. (c) Are required to be developed by the DADH when the Minister determines they are needed to rectify a deficiency under subsection 521.355(2) of the CARs;
    4. (d) May be required to be developed by the DADH as part of the Extended Range Twin-Engine Operations (ETOPS) or Flammability Reduction Means (FRM) requirements as described in section 8.0;
    5. (e) Are encouraged to be developed and undertaken by the DADH for any service difficulty discovered, when it enables operators to improve their level of safety or improve reliability; and
    6. (f) Are undertaken by the DADH when the Minister determines they are necessary to rectify the deficiency or unsafe condition under paragraph 521.355(2)(b) and section 521.356 of the CARs.
  3. (3) Corrective action(s) should, whenever possible, directly rectify the deficiency, however, in some cases corrective action(s) focusing on mitigation of safety risk(s) may be acceptable.
  4. (4) Progress of corrective action development, approval, distribution, and implementation is reported to TCCA as part of the DADH’s established SDR system.
  5. (5) Corrective action(s) for safety critical deficiencies or potential unsafe conditions require more detailed reporting to TCCA. Specifically, sufficient technical data in support of the corrective action is provided, and, in the case of an unsafe condition, approved by TCCA. DADH’s are encouraged to be familiar with TCCA’s guidance in Appendix C related to the identification of safety critical deficiencies and unsafe conditions and to report to TCCA any SDRs or deficiencies meeting those definitions as soon as possible.
  6. (6) TCCA may also choose to publish information to raise awareness about an SDR and its corrective action, including:
    1. (a) The publication of a CASA;
    2. (b) The publication of a Feedback article; or
    3. (c) The publication of an Aviation Safety Letter.

6.8 Corrective action development

  1. (1) The development of a corrective action typically consists of the following phases:
    1. (a) Corrective action plan development; and
    2. (b) Corrective action implementation.
  2. (2) The corrective action plan should be documented and include:
    1. (a) A description of the deficiency, including the root cause when known, and the effects on the affected aeronautical product(s);
    2. (b) Identification of the affected aeronautical products;
    3. (c) If the corrective action is intended to address a recurring service difficulty or deficiency, a review of previous attempts to correct the issue and their results;
    4. (d) A description of the actions to be undertaken by the DADH such as:
      1. (i) The type of data to be developed (e.g. modifications, repairs, Service Bulletins (SBs), AFM amendments);
      2. (ii) Any data gathering activities or communication initiatives;
      3. (iii) Any activities, often referred to as campaigns, working directly with in-service product owners, operators, service centers (e.g. maintenance organizations), or manufacturing organizations; and
      4. (iv) For in-production products, any changes to be made to the assembly or manufacturing instructions. Including serial number cut-ins based on risk, if applicable.
    5. (e) An explanation of how the planned corrective action(s) rectifies, or mitigates the risk posed by, the deficiency;
    6. (f) A schedule for implementation of the corrective action plan, to include:
      1. (i) A risk-based overall rectification period within which all corrective action(s) should be developed and completed to ensure acceptable risk management of the deficiency or unsafe condition. Typically expressed in hours, cycles or calendar time;
      2. (ii) The rectification period should typically commence upon receipt of notification to the DADH of a reportable service difficulty and end upon implementation of the corrective action(s) in-service and/or in-production;
      3. (iii) Whenever possible, such as in the case of an unsafe condition, the overall rectification period should take into consideration the calculated reaction time;
      4. (iv) A schedule for the various stages, activities, or deliverables of the corrective action plan, including the planned dates for release of any publications, demonstrating how the corrective action(s) are developed and implemented within the overall rectification period; and
      5. (v) The schedule should consider availability of any parts required as well as the time needed by in-service operators or product manufacturers to implement the corrective action(s).
    7. (g) A description of any amendments to manufacturing or assembly processes developed to correct the deficiency in the affected in-production products including implementation timelines or recommendations when appropriate:

      1. (i) Inspection and quarantine, modification or rework of non-conforming parts.

        Note: With reference to guidance in FAA AC 39-8 and AC 25-19A, design changes to remove the unsafe condition are generally preferred to recurring inspections as terminating actions.

    8. (h) A description of any maintenance or operational methods developed to correct the deficiency in the affected in-service products including implementation timelines or recommendations when appropriate, such as:
      1. (i) Additional inspections (initial and/or subsequent), or a change to the interval and/or technique for an existing inspection;
      2. (ii) Replacement or modification of components;
      3. (iii) Changes to AFM or RFM, operating procedures such as the Flight Crew Operating Manual (FCOM), MMELs, Configuration, Maintenance and Procedures (CMP), AWLs, or MRBR tasks or maintenance procedures:
        1. (A) Experience has shown using AFM limitations or procedures as mitigation for continuing airworthiness issues is often ineffective, particularly if the limitation prohibits use of any function which remains available on the flight deck. Any proposed mitigation by AFM should be considered in the context of the existing AFM limitations and/or procedures, as it is unreasonable to expect flight crews to remember numerous or unintuitive limitations and procedures when unexpected system behaviour is encountered, particularly in high workload phases of flight. It has been shown through service history, SDRs and other data, crews have implicit expectations the system functions intuitively and consistently, and only a limited number of concise, straightforward exceptions/ mitigations/ prohibitions are remembered and adhered to. AFM limitations or amended procedures for risk mitigation may be acceptable in the short term as a last resort, but they should be reasonable, practical, feasible, and easily remembered, and the underlying issue should be rectified promptly - or the function made unavailable - as a more reliable, effective and robust solution; and
        2. (B) Similarly, amendments to FCOM crew procedures and/or training cannot be relied upon for risk mitigation. These procedures and changes are implemented at the discretion of the operator, and potentially only after some delay. Even if implemented, some procedures are less effective as mitigations depending on the underlying issue (i.e., if they deviate too far from typical airmanship or crew expectations, are unintuitive, and/or numerous). Similar to mitigation by AFM, FCOM amendment should only be proposed as a short term, last resort solution.
      4. (iv) Operational limitations (e.g., maximum weight, speed or altitude, prohibiting certain functions under all or specific conditions, de-pairing engines of specific populations);
      5. (v) Restriction or prohibition of operation under certain operational approvals (e.g., Required Navigation Performance (RNP), ETOPS, Reduced Vertical Separation Minima (RVSM), steep approach, autoland, enhanced flight vision system (EFVS)); and
      6. (vi) Training for personnel.

6.9 Corrective action implementation

  1. (1) Corrective action implementation should progress in line with the plan and be monitored within the DADH from commencement to completion.
  2. (2) Progress reports to TCCA should be made, as a minimum, upon commencement and completion of corrective action(s), though long and/or complex implementations should provide appropriate interim progress reports.
  3. (3) The effectiveness and adequacy of the corrective action(s) should be evaluated during the implementation period and any significant deviations from the plan, including any necessary re-assessments of risk, or unforeseen implementation issues which may result in the corrective action exceeding the established rectification period, should be reported to TCCA as part of a progress report.
  4. (4) A record of the corrective action(s) undertaken, as well as any results, should be maintained by the DADH.

6.10 Corrective action for safety critical deficiencies and unsafe conditions

  1. (1) This section addresses subsection 521.355(2) and section 521.356 of the CARs.
  2. (2) The Minister, through review of DADH progress reports, routine surveillance activities, monitoring of SDRs, investigation of aviation accidents or serious incidents, or review of other information sources, may determine corrective action is required to correct a deficiency or unsafe condition in an aeronautical product:
    1. (a) This determination may be made independently of the DADH’s SDR investigation. More commonly this determination occurs in parallel and often in response to the DADH’s SDR investigation; and
    2. (b) When this determination is different than the conclusions of the DADH’s SDR investigation, the Minister provides their justification in support of the required corrective action.
  3. (3) In most cases, deficiencies or unsafe conditions are deemed by the Minister to require corrective action when they are assessed at the risk levels identified below:
    1. (a) Risk level determined to be Medium or High, in reference to Appendix C;
    2. (b) Risk level determined to be High or Excessive, as defined in FAA AC 39-8 for powerplant and APU; or
    3. (c) Risk level determined to be Low but:
      1. (i) With a severity of Catastrophic, as defined in EASA Acceptable Means of Compliance (AMC) 25.1309;
      2. (ii) With a severity of Hazardous and probability of Extremely Remote, as defined in EASA AMC 25.1309;
      3. (iii) Affecting emergency-related equipment as described in Appendix C; or
      4. (iv) Otherwise considered to constitute an unacceptable risk by the DADH.
  4. (4) When the Minister determines a deficiency or an unsafe condition requires corrective action under subsection 521.355(2) or section 521.356 of the CARs, the DADH must meet additional requirements beyond those of the baseline corrective action expectations under paragraphs 521.355(1)(a) and 521.355(1)(b) of the CARs:
    1. (a) When the Minister has determined a deficiency requires corrective action the following additional requirements apply:
      1. (i) Submit to TCCA, the technical data in support of the corrective action(s). This may take the form of, but is not limited to:
        1. (A) Revised and/or published ICAs and other information, such as SBs or equivalent data;
        2. (B) Revised production data or procedures;
        3. (C) Approved design changes, including repairs and modifications; and
        4. (D) Records of SDR analyses and corrective action plans related to the deficiency as necessary to demonstrate corrective action(s) were undertaken.
      2. (ii) As a result of TCCAs review of the technical data, the DADH may be required to undertake corrective action the Minister has determined is necessary under paragraph 521.355(2)(b) of the CARs. TCCA may determine additional corrective action(s) are necessary, or existing corrective action(s) require amendment. For example, the DADH may be required to:
        1. (A) Develop a design change;
        2. (B) Publish a document to raise awareness among operators;
        3. (C) Amend ICA such as maintenance procedures;
        4. (D) Amend operating procedures such as the FCOM; or
        5. (E) Carry out other actions.
      3. (iii) The requirement to submit technical data should not be construed as requiring approval or acceptance by the Minister. The responsibility lays with the DADH to develop and implement corrective action in response to a deficiency.
    2. (b) When the Minister determines an unsafe condition requires corrective action the following additional requirements apply:
      1. (i) The DADH must submit to TCCA for review and approval, without delay, sufficient technical data to demonstrate the corrective action(s) they have developed rectify the deficiency and do so within an acceptable period of time. These data include, but are not limited to:

        1. (A) Reports, test results or other documentation sufficient to illustrate the nature of the deficiency and its effect at the aircraft level, as appropriate. This may include supplier information such as disclosure letters, or any other information to support the evaluation of the effectiveness of the corrective action;

          Note: Technical data identified as intellectual property of the DADH, or of a supplier, is expected to be submitted upon request.

        2. (B) Detailed risk analyses, appropriate to the nature of the unsafe condition, illustrating the risk of all feasible hazard scenarios, including the explanation of any underlying assumptions or analysis techniques used in the calculation or determination of probability, severity, and (if applicable) average reaction time;
        3. (C) Details of the in-service, or in-production product’s exposure to the deficiency and hazard. This typically takes the form of serial number ranges, registration marks, or other means to identify the affected products;
        4. (D) Details of the methods, techniques, practices or any other data developed to address the deficiency and/or hazard in-service, including technical details of design changes, modifications, repairs and inspections;

        5. (E) Details of the risk-based rectification period for corrective action implementation on the affected in-service products, specifically how this period was determined and sufficient data to demonstrate the period is adequate to manage fleet risk exposure. For implementation schedules exceeding reaction time guidance specified in Appendix D, additional justification to substantiate the proposal should be submitted; and

          Note: Due to limitations of various models with respect to cumulative risks of multiple issues over the life of an aeronautical product fleet, the risk-based time limits are not targets for corrective action incorporation. Rather, they are guidelines for not-to-exceed incorporation times which should be used as a reference against incorporation times developed based on correcting the issues at the first practical opportunity. The factors affecting determination of the first practical opportunity are discussed in Appendix D. The safety risk(s) may require corrective action(s) to be accomplished before it is practical to do so, up to and including immediate cessation of operations when warranted.

        6. (F) Submit for review and approval, any publications or documents developed to support the continued airworthiness or safe operation of in-service products affected by the unsafe condition.
      2. (ii) In general, the purpose of approval by the Minister is to enable publication of an effective AD under section 521.427 of the CARs if required. Therefore, the criteria used for approval include:
        1. (A) The plan adequately addresses the unsafe condition, specifically:
          1. (I) The root cause and risk analysis are comprehensive, accurate, and sufficiently conservative; and
          2. (II) The methods, techniques, or practices proposed to address the in-service (or in-production) products are sufficient to either eliminate the unsafe condition or reduce the risk to an acceptable level and address the root cause, when known.
        2. (B) Documents developed to support the implementation of the corrective action(s) in-service are found to:
          1. (I) Clearly communicate the nature of the unsafe condition and its consequences;
          2. (II) Clearly identify the affected products;
          3. (III) Contain methods, techniques, or practices sufficient to rectify the unsafe condition;
          4. (IV) Be complete, concise, and easily utilized in the performance of maintenance or operation of the product in-service; and
          5. (V) Include timelines or schedules which aim to implement the in-service corrective action(s) at the earliest practical opportunity and are reasonable when considered against calculated reaction times or other analysis, when appropriate.
      3. (iii) Upon approval of corrective action(s) and any supporting documents, the DADH is required to make available information to correct the unsafe condition:
        1. (A) For aeronautical products with ICA, generally this may be accomplished by following the same procedures used to comply with paragraphs 521.368(c) and 521.368(d) of the CARs;
        2. (B) The DADH should notify each owner and each operator of the corrective action(s) required for their affected products. The DADH should make available the information necessary to correct the unsafe condition to each owner, each operator, and when applicable, each person performing elementary work and maintenance under subsection 571.02(1) of the CARs;
        3. (C) As a best practice, the DADH should track the implementation of the corrective action(s) in-service; and
        4. (D) Security sensitive information corrective action(s):
          1. (I) Some corrective action(s) consist of security sensitive information; therefore, it is necessary to control their communication to prevent security vulnerabilities from being advertised and exploited prior to implementation of the corrective action. These require close collaboration between the DADH and TCCA and are managed on a case-by-case basis between the organizations;
          2. (II) The personnel at the DADH who are aware of these security vulnerabilities should be kept to a minimum, and a plan to communicate the corrective action to affected owners/operators is developed by working closely with TCCA; and
          3. (III) A security sensitive information corrective action does not directly contain the sensitive details of the identified security vulnerability.

6.11 DADH campaigns as part of an approved corrective action plan to rectify an unsafe condition

  1. (1) Generally, TCCA is required to issue an AD if an unsafe condition exists in the aeronautical product and the condition is likely to exist or develop in other aeronautical products, under paragraph 521.427(1)(a) of the CARs.
  2. (2) The AD itself is a regulatory tool used to set the requirements in-service aircraft meet to correct an unsafe condition. Section 605.84 of the CARs prohibits the take-off of an aircraft unless it meets the requirements of an applicable AD.
  3. (3) Under subsection 521.427(3) of the CARs, TCCA is not required to issue an AD if the unsafe condition has been rectified by an approved corrective action taken under section 521.356 of the CARs.
  4. (4) As such, if the DADH’s approved corrective action plan includes corrective action(s) directly addressing the unsafe condition in-service, and TCCA concludes the DADH can manage the unsafe condition in-service effectively, an AD to mandate the requirements in-service may not be needed.
  5. (5) When such corrective action(s) are approved as part of a corrective action plan, they are referred to as a monitored fleet campaign by TCCA.
  6. (6) In general, for a monitored fleet campaign to be approved as part of a corrective action plan, it should provide for faster incorporation of the corrective action(s) in-service than would be achieved through the issuance of an AD. The DADH is expected to demonstrate the campaign actions are achievable in coordination with the affected operators and a campaign management plan should be in place to ensure implementation at the individual aeronautical product level.
  7. (7) Typically, for a monitored fleet campaign to be considered for approval by TCCA:
    1. (a) There should be a safety benefit to approving the monitored fleet campaign compared to an AD, in terms of overall reduced risk exposure to the fleet;
    2. (b) TCCA should have a high degree of confidence the monitored fleet campaign is completed successfully. A successful monitored fleet campaign is one in which 100% of the affected aeronautical products implement the corrective action within a timeframe acceptable to TCCA. The DADH’s procedure for monitoring monitored fleet campaigns, history of monitored fleet campaign success, and the affected operators’ history of monitored fleet campaign compliance are factors affecting the likelihood of monitored fleet campaign success;
    3. (c) A schedule should be provided for corrective action implementation across the affected fleet. The proposed timeframe is shorter than the compliance time agreed by TCCA for correcting the unsafe condition. Should the monitored fleet campaign fail, this permits sufficient time to issue an AD and incorporate the corrective action(s) within the compliance time agreed by TCCA at the outset of the monitored fleet campaign;
    4. (d) Monitored fleet campaigns are more likely to be successful if they affect a smaller number of aeronautical products and operators, and if the corrective action is not extensive in scope. Other factors such as maintenance agreements with affected operators, commercial support by the DADH to the operators, and the alignment of the monitored fleet campaign compliance time with other maintenance tasks, to reduce the associated maintenance burden, may also influence the level of risk for a proposed monitored fleet campaign;
    5. (e) Some corrective action(s) are not appropriate for monitored fleet campaigns, for instance:
      1. (i) Action(s) which require an ongoing commitment rather than one-time action(s);
      2. (ii) Changes to documents (e.g., AFM/RFM, CMP, AWLs, MRBR tasks or maintenance procedures);
      3. (iii) Prohibiting the installation of certain parts;
      4. (iv) Repetitive maintenance action(s), due to the difficulty, and thus risk, inherent with managing these on an ongoing basis;
      5. (v) Where the affected aeronautical products are not known;
      6. (vi) If it is known affected aeronautical products may be transferred between operators within the compliance time, unless the new operators agree to the monitored fleet campaign;
      7. (vii) Where it is necessary to make the unsafe condition and/or corrective action visible outside of Canada (e.g., to encourage visibility with other CAAs);
      8. (viii) Prohibiting the use of certain maintenance procedures; and
      9. (ix) Operational limitations, including imposing restrictions or prohibitions on operational approvals.
    6. (f) A proposal for ongoing management and progress reporting of monitored fleet campaigns is provided by the DADH for approval by TCCA. Such a plan should include milestones for implementation (such as progress vs time, operators not meeting commitments, etc.) and a recovery plan in case of delay; and
    7. (g) At the time of monitored fleet campaign proposal, DADHs assess the applicability of each monitored fleet campaign to any aeronautical products which have not entered service and track the compliance of those products to the applicable monitored fleet campaigns, so the information is readily available if the product enters service or if flight permits are requested:
      1. (i) For example, monitored fleet campaigns applicable to any flight test vehicles in a DADH’s possession should be tracked as these are candidates to be retrofitted for sale or entry into service later, and the application for a flight authority does not specifically include a step to verify compliance to monitored fleet campaigns; and
      2. (ii) Given the flight permit process includes a review of open ADs but not a review of monitored fleet campaigns, the DADH demonstrates a process which ensures all flight test vehicles which may apply for flight authorities in the future include a verification of compliance to mandatory corrective action(s) implemented by a monitored fleet campaign.
  8. (8) Following approval of a monitored fleet campaign:
    1. (a) After agreement, the affected operators need to be informed by the DADH:
      1. (i) The monitored fleet campaign is agreed with TCCA;
      2. (ii) It is required to rectify an unsafe condition;
      3. (iii) An AD is issued if the monitored fleet campaign is not completed on all the affected aeronautical products within the agreed schedule; and
      4. (iv) In the event of monitored fleet campaign failure, the AD may have a short compliance time.
    2. (b) The monitored fleet campaign is managed appropriately with progress reported to TCCA, at a frequency and level of detail acceptable to TCCA, in accordance with the DADH’s approved corrective action plan;
    3. (c) The progress of the monitored fleet campaign is expected to remain aligned with the approved corrective action plan throughout implementation; and
    4. (d) The DADH proactively identifies to the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch if, at any time, they lose confidence in their ability to meet the commitment for monitored fleet campaign completion and provide a recovery plan or recommend the issuance of an AD to the TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch.
  9. (9) TCCA is not required to agree to monitored fleet campaigns and may issue an AD at any time. If either TCCA or the DADH determine the monitored fleet campaign is unlikely to be successfully completed in line with the approved corrective action plan, an AD is likely to be issued:
    1. (a) Such an AD is applicable to all affected aeronautical products and not only those remaining with the identified unsafe condition;
    2. (b) Such an AD requires rectification of the unsafe condition within the originally agreed upon compliance time; and
    3. (c) Such an AD does not require additional action for those aeronautical products which have already incorporated the corrective action but includes them in the scope to ensure full visibility of the unsafe condition on all the affected aeronautical products.

6.12 Tracking of corrective action(s) against the aeronautical product configuration

  1. (1) The DADH should maintain awareness of mandatory corrective action(s)-affected areas on the aeronautical product to ensure corrective action(s) are not undone through changes to the design in the future.

6.13 Reporting investigation and corrective action progress to the Minister

  1. (1) To summarize the requirements for reporting progress to the Minister stated throughout this AC the following information should be communicated by the DADH to TCCA within reasonable timeframes acceptable to TCCA. The DADH is encouraged to further define the information exchange in the context of their processes, in a documented procedure accepted by TCCA. The reports to TCCA should, as a minimum, include:
    1. (a) Identification or tracking references used by the DADH to manage the investigation internally clearly linked to the SDR number assigned by WSDRS, to facilitate communication with TCCA;
    2. (b) Acknowledgement of receipt and confirmation the DADH has opened an investigation upon notification of an SDR entered in WSDRSincluding the results of the triage such as a summary of the initial risk profile and planned next steps, if any;
    3. (c) Upon identification of a safety critical deficiency, or potential unsafe condition, as outlined in this AC,provide:
      1. (i) The results and details of the initial risk assessment;
      2. (ii) Any available information related to the nature of the deficiency and/or potential unsafe condition; and
      3. (iii) Periodic updates as the analysis progresses including the results of any testing or design reviews conducted.
    4. (d) Upon conclusion of the SDR analysis, provide:
      1. (i) The results of the analysis including whether a deficiency was identified; and
      2. (ii) If a deficiency was detected, a summary of the deficiency in relation to the certification basis along with a summary of the risk profile.
    5. (e) Upon formulation of a corrective action plan:
      1. (i) For a safety critical deficiency or unsafe condition: Providea complete and documented corrective action plan containing the elements outlined in this document; or
      2. (ii) For all other deficiencies: Provide a summary of the corrective action plan, including estimated implementation timelines when appropriate.
    6. (f) Upon commencement of corrective action(s) for safety critical deficiencies or unsafe conditions, provide:
      1. (i) Status updates at critical points of the corrective action implementation, including the development of any documents (e.g. SBs) and their expected publishing timelines;
      2. (ii) Notification when documents are published or otherwise available for use; and
      3. (iii) Progress reports for any approved monitored fleet campaigns, including any indications the campaign may not be successful.
    7. (g) Upon conclusion of corrective action(s), or closure of an investigation, provide notification when the SDR investigation is closed (e.g. within WSDRS) as well as:
      1. (i) For safety critical deficiencies: A copy of any supporting technical data, such as published documents (e.g. SBs) or documented cause or risk analysis; or
      2. (i) For unsafe conditions: Any documentation required as part of the approved corrective action plan.
  2. (2) TCCA communicates with the DADH:
    1. (a) To send SDRs to the DADH via the WSDRS when TCCA receives SDRs which affect their aeronautical products;
    2. (b) Upon receipt of the results of a DADH’s preliminary risk assessment respond if additional information is required; if the risk level should be increased; and/or request the SDR to be re-investigated even if the DADH’s preliminary risk assessment indicates further investigation is not necessary. In the latter two cases, TCCA provides an explanation to the DADH;
    3. (c) Upon receipt of the results of a DADH’s investigation into whether a SDR represents a deficiency in the aeronautical product and whether it is an unsafe condition or safety critical deficiency to confirm agreement, disagreement or a need for additional data or analysis on the part of the DADH;
    4. (d) To confirm what corrective action is required to rectify the deficiency or unsafe condition. This often comes in the form of a response to a corrective action plan proposal from the DADH;
    5. (e) To request additional technical data in support of evaluating SDR investigations or proposed corrective action(s);
    6. (f) To approve mandatory corrective action(s);
    7. (g) In the case of unsafe conditions, to issue an AD unless a monitored fleet campaign is proposed by the DADH and approved by TCCA as part of the corrective action plan;
    8. (h) After a monitored fleet campaign is approved, to issue an AD if TCCA determines the monitored fleet campaign is unlikely to be successful; and
    9. (i) To make other inquiries in relation to the continuing airworthiness of the DADH’s products.
  3. (3) The TCCA point of contact for reporting progress of SDR investigations, corrective action plan development and corrective action progress is the office of the Chief, Continuing Airworthiness Division of the National Aircraft Certification Branch. The TCCA Continuing Airworthiness Division of the National Aircraft Certification Branch coordinates with a TCCA regional office as required for design approval documents issued or overseen by a TCCA regional office.

7.0 Design approval document transfer obligations under section 521.357 of the CARs

  1. (1) It is possible for a DADH to transfer a design approval document. To do this, the DADH notifies TCCA in writing of their intention to transfer the document, provides the details of the transfer and transferee, and returns the original design approval document to TCCA.
  2. (2) The transferee applies to TCCA and demonstrates they have the technical capabilities under section 521.352 of the CARs. Technical capability includes having the resources and abilities to comply with the holder responsibilities under Division VIII of Subpart 521 of the CARs.
  3. (3) The transferee submits a signed undertaking (see Section 4.1) to comply with the holder’s responsibilities under Division VIII of Subpart 521 of the CARs.
  4. (4) When a transfer takes place between a Canadian holder and a transferee in another country, or vice versa, the SoD changes. In these situations, both the holder and the transferee comply with any applicable airworthiness agreements or similar arrangements between the states.
  5. (5) Refer to SI 500-018 for more information.

8.0 Holder responsibilities specific to the certification basis

8.1 Extended Diversion Time Operations (EDTO) reporting and corrective action

  1. (1) Sections 705.26 and 701.16 of the CARs define the conditions in which certain aeroplanes can operate routes requiring one engine inoperative diversion times exceeding 60 minutes, called EDTO (formerly ETOPS) routes. Operators are issued an approval to operate EDTO for specific aeroplane-engine combinations which are also issued an EDTO design approval. More information is available in Transport Canada Publication (TP) 6327.

  2. (2) The requirements for EDTO design approvals including EDTO reporting requirements of occurrences for Early EDTO are documented in part in sections 525.3, 525.1535, and appendix K of Chapter 525 of the AWM. The CARs do not contain EDTO reporting requirements for reliability of two-engine aeroplanes, which are documented in Special Conditions – Airworthiness (SCA) when required. These EDTO reporting requirements are analogous to Title 14 United States (U.S.) Code of Federal Regulations (14 CFR) 21.4(a) and 14 CFR 21.4(b).

    Note: Some products were issued EDTO design approvals in accordance with TP 6327.

  3. (3) For EDTO design approvals issued in accordance with TP 6327, reliability reporting is required in accordance with TP 6327.
  4. (4) For other EDTO design approvals, the applicable SCA defines the reporting requirements for an aeroplane type, however at a high level the requirements for reliability of two-engine aeroplanes are:

    1. (a) To submit reports to TCCA, at intervals defined in the SCA, on the reliability of the world fleet of the aeroplanes and engines. Reporting includes certain engine In-Flight Shutdowns (IFSDs), the world fleet twelve (12) month rolling average IFSD rates, and fleet utilization;

      Note: Although the SCA text allows for combining reporting reliability of two-engine aeroplanes with service difficulty reporting under section 521.353 of the CARs, WSDRS does not accommodate this type of reporting. As such, for practical purposes, reliability reporting is accomplished separately from service difficulty reporting.

    2. (b) To investigate any cause of an IFSD resulting from an occurrence attributable to the design of its product and report the results of the investigation to TCCA; and
    3. (c) To issue service information to maintain the world fleet twelve (12) month rolling average IFSD rate at or below certain levels.
  5. (5) Corrective action specific to EDTO aeroplanes and engines may involve changes to the CMP, MMEL, AFM, maximum diversion times, de-pairing engines of specific populations, etc. TCCA may determine an unsafe condition exists in the EDTO fleet only, or in the entire fleet, and mandatory corrective action(s) are structured accordingly.

8.2 Fuel tank flammability reduction means reliability reporting and corrective action

  1. (1) This section applies to holders of type certificates or STCs for transport category aeroplanes which include in their basis of certification a requirement to report fuel tank Flammability Reduction Means (FRM) reliability, under section 525.981 and appendix M of Chapter 525 of the AWM.
  2. (2) The effects of aeroplane component failures on FRM reliability are assessed on an on-going basis. The holder is responsible for the following:
    1. (a) Demonstrate effective means to ensure collection of FRM reliability data. The means provide data affecting FRM reliability, such as component failures:
      1. (i) Contractual agreements are established and maintained with the suppliers of FRM system components, confirming the suppliers submit reports and issue service information, as appropriate, in accordance with the requirements below; and
      2. (ii) It is not sufficient to rely on SDRs for collection of this data, since the FRM is typically on the MMEL and items on the MMEL are not always SDR-reportable. Refer to AC 521-009 for more information on reportable service difficulties.
    2. (b) Unless alternative reporting procedures are approved by TCCA, provide a report to TCCA every six months for the first five years after service introduction. After this period, continued reporting every six months may be replaced with other reliability tracking methods found acceptable to TCCA or eliminated if it is established the reliability of the FRM meets, and continues to meet, the exposure requirements under appendix M of Chapter 525 of the AWM; and
    3. (c) Develop service instructions or revise the applicable aeroplane manual, according to a schedule approved by TCCA, to correct any failures of the FRM occurring in service which could increase any fuel tank’s Fleet Average Flammability Exposure to more than required under appendix M of Chapter 525 of the AWM. The service instructions or aeroplane manual revisions may be rendered mandatory if TCCA determines the underlying failures are unsafe conditions. While individual failures of the FRM system components may not on their own be unsafe conditions, their collective impact on FRM reliability may constitute an unsafe condition requiring the implementation of corrective action(s).

8.3 Cybersecurity reporting and corrective action

  1. (1) This section applies to holders of type certificates, STCs, and CAN-TSOs for aeronautical products which include in their basis of certification requirements related to network/cyber security.
  2. (2) Aircraft systems and parts are increasingly connected, and those interconnections may be susceptible to cybersecurity threats. These threats have the potential to affect the airworthiness of an aircraft due to unauthorized access, use, disclosure, denial, disruption, modification or destruction of electronic information or electronic aircraft system interfaces. The threats mentioned do not include physical security threats or attacks on persons or equipment.
  3. (3) The DADH gathers information on cybersecurity threats, incidents and events from operators of its products and from the wider aviation community, e.g. the Canadian Centre for Cyber Security and Aviation Information Sharing & Analysis Center, to fulfill continuing airworthiness expectations with respect to cybersecurity. Alerts and emergency directives issued by the Cybersecurity and Infrastructure Security Agency (CISA) are additional sources of information. These cybersecurity threats, incidents and events may expose vulnerabilities in the aeronautical product which may have an effect on safety.
  4. (4) Canadian operators have requirements to report cybersecurity threats, incidents, and events to the DADH, in accordance with the Aircraft Network Security Program (ANSP) Special Authorization in TP 4711 Volume 3.
  5. (5) Vulnerabilities in the aeronautical product are reported and investigated in the same way as any other service difficulty. However, the text of any reported service difficulty should be sufficiently vague so members of the public reviewing the SDR cannot gain sufficient knowledge of the vulnerability to exploit it. Details of the vulnerability should be communicated directly to TCCA in a secure manner to follow the investigation process.
  6. (6) Once a vulnerability has been discovered, it could be exploited rapidly. As a result, investigation and rectification of cybersecurity vulnerabilities should be completed more rapidly than traditional continuing airworthiness issues and in a timeframe commensurate with the risk to the aircraft.
  7. (7) Corrective action(s) developed to resolve such unsafe conditions should similarly be handled carefully to avoid spreading knowledge of the vulnerability before it is corrected. As a result, it is necessary to keep distribution of the corrective action to essential personnel only until the corrective action has been completely implemented. See guidance from TCCA (AC 521-010), the FAA (FAA-IR-M-8040-1C) and EASA (https://www.easa.europa.eu/easa-and-you/aircraft-products/airworthiness-directives-ad) for more information.

9.0 Record keeping and loss or disposal of records

9.1 Record keeping under section 521.365 of the CARs

  1. Reserved

9.2 Loss or disposal of records under section 521.366 of the CARs

  1. Reserved

10.0 Manuals, instructions for continued airworthiness and supplemental integrity instructions

10.1 Manuals under section 521.367 of the CARs

  1. Reserved

10.2 Instructions for continued airworthiness under section 521.368 of the CARs

  1. Reserved

10.3 Supplemental integrity instructions under section 521.369 of the CARs

  1. Reserved

11.0 Other continuing airworthiness inquiries

  1. (1) TCCA may request information from a DADH regarding continuing airworthiness concerns or accident investigations.
  2. (2) Airworthiness agreements or similar arrangements exist between TCCA and many other foreign civil aviation authorities. These airworthiness agreements or similar arrangements may detail the method for foreign civil aviation authorities to request from a Canadian DADH information regarding continuing airworthiness concerns or accident investigations. In some cases, such as when there is no airworthiness agreement or similar arrangement, or the airworthiness agreement or similar arrangement does not provide these details, foreign civil aviation authorities may request information through a letter or other form of communication. These requests and associated responses should be routed through TCCA Continuing Airworthiness Division.
  3. (3) Responding to such requests provides valuable information used for determining unsafe conditions and for contributing to ADs or new design standards.

12.0 Incident awareness

  1. (1) TCCA recommends a DADH to maintain awareness of incidents and accidents occurring to similar aeronautical products around the world. Incident awareness is helpful in identifying if similar issues exist on Canadian DADH products. This can be accomplished by reviewing CASAs, SAIBs (FAA), SIBs (EASA), and accident/incident reports. Useful links include:
    1. (a) https://www.tc.gc.ca/en/services/aviation/reference-centre/safety-alerts.html;
    2. (b) https://www.faa.gov/aircraft/safety/alerts/SAIB/; and
    3. (c) https://ad.easa.europa.eu/sib-docs/page-1.

13.0 Information management

  1. (1) Not Applicable.

14.0 Document history

  1. (2) Not Applicable.

15.0 Contact us

For more information, please contact:
Aircraft Certification Standards Division (AARTC)
E-mail: TC.AARTQuestions.TC@tc.gc.ca

We invite suggestions for amendments to this document. Submit your comments to:
AART Documentation Services
E-mail: AARTDocServices-ServicesdocAART@tc.gc.ca

Original signed by

Jamie-Lee MacDermid
Executive Director, Standards Branch
Civil Aviation

Appendix A: Responsibilities of foreign DADHs

A-1 Regulation

  1. (1) Applicability of Division VIII of Subpart 521 of the CARs:
    1. (a) Division XI of Subpart 521 of the CARs applies to applicants for and holders of a design approval document in respect of a foreign aeronautical product. Subsection 521.453(1) requires applications to be made for a design approval document under the applicable Division II through VII of Subpart 521 of the CARs. Issuance of a design approval document under subsection 521.455(1) requires the applicant to submit a signed undertaking to carry out the responsibilities specified in Division VIII of Subpart 521 of the CARs. Section 521.351 of the CARs states Division VIII of Subpart 521 of the CARs applies to “holders of a design approval document”. Therefore, foreign DADH are subject to Division VIII of Subpart 521 of the CARs when an application is submitted in accordance with airworthiness agreements or similar arrangements, whether the design approval document is Canadian or TCCA accepts the foreign design approval document under subsection 521.455(3) of the CARs.
  2. (2) Canadian service difficulty reporting to foreign DADH:
    1. (a) The CARs require specific persons and organizations to be responsible for reporting service difficulties. Section 5.0 of this AC identifies the specific requirements for each; however, consistently in the CARs service difficulty reporting is required to be made to TCCA under Division IX of Subpart 521 of the CARs. There are no requirements in the CARs for service difficulties to be reported to foreign DADH, foreign authorities, or other entities;
    2. (b) TCCA complies with ICAO Annex 8 Part II Standard 4.2.4.1, which describes the transmitting of service difficulty information to the organization responsible for the type design. TCCA complies by transmitting, via the WSDRS, all SDRs received meeting the reporting requirements of Division IX of Subpart 521 of the CARs, to the organization responsible for the type design of the affected product. When these reports are generated, an accompanying e-mail is forwarded to the e-mail address provided of the organization responsible for the aeronautical product’s type design;
    3. (c) TCCA also provides access to service difficulty information forwarded to organizations responsible for type design to the CAA having type design oversight responsibility. Foreign authorities wishing to receive this electronic information should contact TC.WSDRS-SWRDS.TC@tc.gc.ca for access. TCCA continues to notify in writing the responsible SoD regarding any significant airworthiness concerns; and
    4. (d) It is therefore incumbent on the SoD to require their DADHs to assess these SDRs to meet the intent of ICAO Annex 8 Part II Standard 4.2.1 and ICAO Doc 9760 Part V paragraph 6.6.1.

A-2 Airworthiness agreements or similar arrangements

  1. (1) Canada has entered into airworthiness agreements or similar arrangements with some SoD, including the European Union and the United States of America. The airworthiness agreements or similar arrangements provide acceptable means as to how the authorities can cooperate to fulfill or enhance their fulfillment of their obligations under ICAO Annex 8. The airworthiness agreements or similar arrangements may also establish alternative means of treating SDR report requirements on behalf of their regulated organizations.
  2. (2) These airworthiness agreements or similar arrangements can be found on TCCA’s International Agreements and Arrangements website (https://tc.canada.ca/en/aviation/aircraft-airworthiness/international-agreements-arrangements).

A-3 Practical application of Division VIII of Subpart 521 of the CARs to foreign DADH

  1. (1) Although the requirements of Division VIII of Subpart 521 of the CARs apply to all DADHs equally, TCCA takes a risk-based approach to safety oversight and relies on foreign SoD to oversee DADHs of certain design approval documents. The guidelines below are applicable to all DADHs except where indicated.
  2. (2) The guidelines below represent a typical expectation by TCCA; however, these do not diminish the responsibility for DADHs to meet all requirements of Division VIII of Subpart 521 of the CARs. TCCA can change the expectations below up to and including the full responsibilities of Division VIII of Subpart 521 of the CARs, as for a domestic DADH, if TCCA determines this is warranted.
  3. (3) TCCA expects the actions identified below for the following requirements of Division VIII of Subpart 521 of the CARs:
    1. (a) Investigation of service difficulty reports under section 521.355 of the CARs:
      1. (i) Foreign holders are expected to meet the requirements of paragraph 521.355(1)(a) of the CARs, this can be achieved through maintaining an account with the WSDRS in order to receive notice when SDRs have been submitted in relation to their aeronautical product and to investigate these service difficulties. Foreign holders are then expected to develop corrective action(s) as required by the holders’ local regulations;
      2. (ii) Additionally, for holders of STCs, PDAs, RDAs and CAN-TSOs:
        1. (A) The requirement of paragraph 521.355(1)(b) of the CARs to report to TCCA the progress of the investigation and any proposed corrective action is only required if TCCA makes a specific request. Otherwise, TCCA relies on reporting of the investigation to the SoD, and TCCA does not expect reporting of investigation progress.
      3. (iii) Additionally, for holders of type certificates:
        1. (A) The requirement of paragraph 521.355(1)(b) of the CARs to report to TCCA the progress of the investigation and any proposed corrective action is only required if TCCA makes a specific request. Otherwise, TCCA relies on reporting of the investigation to the SoD, and TCCA does not expect reporting of investigation progress;
        2. (B) For certain type certificate holders, TCCA may require periodic meetings to review the status of investigations. These meetings are generally held annually, involve the SoD Civil Aviation Authority (CAA), and discuss the type certificate holder’s continuing airworthiness process, the SoD’s oversight process, the status of open service difficulty investigations, fleet statistics, accident and incident investigations, safety recommendations, SBs, CARIs, SDRs, issued and planned ADs, and any other concerns; and
        3. (C) When airworthiness agreements or similar arrangements are in place, typically the communication between the foreign DADH and TCCA described in the paragraphs above is conducted through the SoD of the foreign DADH.
    2. (b) Mandatory changes under section 521.356 of the CARs:
      1. (i) TCCA relies on the SoD to issue MCAI to rectify all unsafe conditions; and
      2. (ii) TCCA as State of Registry (SoR) maintains a responsibility to issue ADs on products registered in Canada. Therefore, if TCCA determines a corrective action is required to rectify an unsafe condition in an aeronautical product, and the SoD has not issued ADs for this corrective action, TCCA follows procedures outlined in airworthiness agreements or similar arrangements and if required issues a unilateral AD. TCCA also takes associated actions to protect the safety of its civil aircraft fleet:
        1. (A) The DADH in respect of the aeronautical product submits to TCCA for approval the corrective action required to rectify the unsafe condition; and on approval of the corrective action, makes available to each owner and each operator of the aeronautical product the information needed to rectify the unsafe condition; or
        2. (B) If such a corrective action is not forthcoming, TCCA may take actions which do not require DADH support, up to and including prohibiting the use of the aeronautical product within Canada and/or by Canadian operators.
    3. (c) Transfers under section 521.357 of the CARs:
      1. (i) Where an airworthiness agreement or similar arrangement is in place, the airworthiness agreement or similar arrangement addresses design approval document transfers; or
      2. (ii) Where an airworthiness agreement or similar arrangement is not in place or the airworthiness agreement or similar arrangement does not contain information on transfers, the same requirements apply to foreign holders for transferring design approval documents as apply to domestic holders. More information on design approval document transfers may be found in section 7.0 of this AC and in SI 500-018.
    4. (d) Record keeping under section 521.365 of the CARs:
      1. (i) For the requirements of paragraphs 521.365(a) and 521.365(c) of the CARs, TCCA relies on the SoD; and
      2. (ii) The requirement of paragraph 521.365(b) of the CARs to provide information is no different for foreign DADHs than for domestic DADHs.
    5. (e) Manuals under section 521.367 of the CARs:
      1. (i) For the requirements of subsections 521.367(1) and 521.367(2) of the CARs, TCCA relies on the SoD; and
      2. (ii) The requirement of subsection 521.367(3) of the CARs for provision of copies of the manuals is no different for foreign DADHs than for domestic DADHs.
    6. (f) Supplemental integrity instructions under section 521.369 of the CARs:
      1. (i) For DADHs where the SoD has regulations similar to section 521.369 of the CARs which TCCA finds to be equivalent or similar, TCCA relies on the SoD. Otherwise, the requirements are the same for foreign and domestic DADHs.
    7. (g) Holder responsibilities specific to the type design:
      1. (i) TCCA relies on the SoD for the majority of the ongoing reporting requirements related to ETOPS, FRM and cybersecurity; and
      2. (ii) For DADHs of aeronautical products meeting any of these requirements, a brief summary of the aeronautical products’ status with respect to these requirements may be required as part of the periodic meetings described above.
    8. (h) Other continuing airworthiness inquiries:
      1. (i) The same requirements apply to foreign DADHs for responding to continuing airworthiness inquiries, as apply to domestic DADHs.

Appendix B: SDR investigation and corrective action flowchart

SDR investigation and corrective action flowchart.
Text description

Flowchart which shows the process for “SDR investigation and corrective action”. The flowchart is divided into two phases “SDR Investigation” and “Corrective Action”. The flowchart outlines responsibilities for the “Design Approval Document Holder (DADH)” and “Transport Canada Continuing Airworthiness Division”.

  1. The process begins in phase 1: “SDR investigation” with the first step “SDR submission reviewed and DADH notified” by “Transport Canada Continuing Airworthiness Division”. Then “receipt and review” by the “Design Approval Document Holder” and “Minister determines unsafe condition” by “Transport Canada Continuing Airworthiness Division”.
  2. Question for “Design Approval Document Holder”: Is this a “reportable service difficulty?”
    1. If No, then the process “end” and “report to Minister” by “Design Approval Document Holder”.
    2. If Yes, then “Preliminary Analysis: Evaluate risk and prioritize” by the “Design Approval Document Holder”.
  3. After, “Preliminary Analysis: Evaluate risk and prioritize” is done by the “Design Approval Document Holder”, the “Design Approval Document Holder” ask the following question: Is this a “reportable service difficulty?”
    1. If No, then the process “end” and “report to Minister” by “Design Approval Document Holder”.
    2. If Yes, then question for “Design Approval Document Holder”: Is this a “potential unsafe condition?”
      1. If No, the “Design Approval Document Holder” “Analyze the SDR” and respond to the question “Does this SDR “result from a deficiency?”
      2. If Yes, the “Design Approval Document Holder” “Report to Minister” and “Analyze the SDR” by answering the question “Does this SDR “result from a deficiency?”
        1. If No, then the process “end” and “report to Minister” by “Design Approval Document Holder”.
        2. If Yes, then “report to Minister” by “Design Approval Document Holder” and proceed to phase 2 “Corrective Action”.
  4. Phase 2: Corrective actions: The first step is to “Develop Corrective Action Plan” by “Design Approval Document Holder”.
  5. Then “Implement Corrective Actions” by “Design Approval Document Holder”.
  6. Then “Make information available to Owner/Operator if applicable” by “Design Approval Document Holder”.
  7. Then “Airworthiness Directive, if applicable” by “Transport Canada Continuing Airworthiness Division”.
  8. Then process ends.
  9. After “Report to the Minister” there are two options:
    1. “Minister determines deficiency requires corrective action” or
    2. “Minister determines unsafe condition”
  10. After “Minister determines deficiency requires corrective action” then proceed to Phase 2 “Corrective Action”.
    1. The first step is “Submit technical data to the Minister” by “Design Approval Document Holder”.
    2. Then “Minister requires corrective actions to be undertaken” by “Transport Canada Continuing Airworthiness Division”.
    3. Then “Implement Corrective Actions” by “Design Approval Document Holder”.
    4. Then “Make information available to Owner/Operator if applicable” by “Design Approval Document Holder”.
    5. Then “Airworthiness Directive, if applicable” by “Transport Canada Continuing Airworthiness Division”.
    6. Then process ends.

  11. After “Minister determines unsafe condition” then proceed to Phase 2 “Corrective Action” then there are two options:

    1. The first step is “Submit corrective action plan for approval to the Minister” by “Design Approval Document Holder”.
    2. Then question for “Transport Canada Continuing Airworthiness Division”: “Minister approves corrective action plan”.
      1. If Yes, then “Implement Corrective Actions” by “Design Approval Document Holder”. Then “Make information available to Owner/Operator if applicable” by “Design Approval Document Holder”. Then “Airworthiness Directive, if applicable” by “Transport Canada Continuing Airworthiness Division”. Then process ends.
      2. If No, then “Submit corrective action plan for approval to the Minister” by “Design Approval Document Holder” and return to this question.

    “Airworthiness Directive, if applicable” by “Transport Canada Continuing Airworthiness Division”.

    Then process ends.

RDIMS # 15822980 – v9

Appendix C: Guidelines for the identification of a potential unsafe condition

  1. (1) For unsafe condition determination, TCCA recognizes EASA AMC 21A.3B(b) Unsafe Condition and Guidance Material (GM) 21A.3B(b) Determination of an Unsafe Condition at Issue 2 dated 30 October 2012, with the following considerations:
    1. (a) EASA-specific references should be read in the context of TCCA, for instance:
      1. (i) European Technical Standard Order (ETSO) becomes CAN-TSO;
      2. (ii) Certification Specification (CS) E-510 (engines) becomes section 533.75 of Chapter 533 of the AWM; and
      3. (iii) Certification Specification (CS) P-70 (propellers) becomes section 535.15 of Chapter 535 of the AWM which is analogous to CS P-150 Propeller Safety Analysis.
    2. (b) In the analysis supporting the DADH’s assessment of a deficiency’s level of risk, the DADH should consider not only the occurrence which took place, but the potential outcomes which could have taken place, with their associated assessed likelihoods;
    3. (c) A systems safety assessment or numerical probability analysis approach is generally only suitable for systems failures. In fact, EASA AMC 25.1309, upon which the systems failure approach is based, includes exceptions for performance and flight characteristics, structural aspects of many design requirements, among other exceptions. EASA GM 21A.3B(b) emphasizes the approach varies depending on the nature of the service difficulty;
    4. (d) For systems failures:
      1. (i) Quantitative analysis can be useful especially for complex systems, however, as with certification, quantitative analysis should be used as an aid to inform judgement and qualitative analysis, and not as the sole method. See associated references:
        1. (A) FAA AC 25.1309-1A states numerical probability ranges became commonly accepted “to support experienced engineering and operational judgment and to supplement qualitative analyses and tests”;
        2. (B) EASA AMC 25.1309 states “descriptions of the probability terms used in this requirement and this AMC have become commonly accepted as aids to engineering judgement”;
        3. (C) FAA PS-ANM110-1999-115-99-22 states “The Transport Airplane Directorate (TAD) has discouraged the use of numerical probability analysis as the sole method in making a pass/fail compliance determination at a fixed numerical level, rather than to use such an analysis as an aid in making a finding”;
        4. (D) FAA AC 23.1309-1E states “A quantitative analysis is intended to supplement, but not replace, qualitative methods based on engineering and operational judgment.”; and
        5. (E) FAA AC 29-C states “Various methods for assessing the causes, severity, and probability of Failure Conditions are available to support experienced engineering and operational judgment.”
      2. (ii) TCCA assumes an unsafe condition if it cannot be shown the safety objectives for hazardous and catastrophic failure conditions are still achieved. TCCA may also consider an unsafe condition for major or minor failure conditions if the risk level shows safety objectives cannot be achieved;
      3. (iii) The term “Safety Objectives” refers to the top-level hazard to which each component or system is attributed, in addition to the individual failure (loss of function or malfunction) of the item. They include any safety objectives which are part of the certification basis of the aeronautical product. For example, for large transport aeroplanes this may include (among others):
        1. (A) Design and construction general under section 525.601 of Chapter 525 of the AWM;
        2. (B) Control systems general under paragraph 525.671(c) of Chapter 525 of the AWM;
        3. (C) Fuselage doors under section 525.783 of Chapter 525 of the AWM;
        4. (D) Powerplant general installation under section 525.901 of Chapter 525 of the AWM;
        5. (E) Reversing systems under paragraph 525.933(a) of Chapter 525 of the AWM;
        6. (F) Fuel tank explosion prevention under subparagraph 525.981(a)(3) of Chapter 525 of the AWM;
        7. (G) Function and installation under section 525.1301 of Chapter 525 of the AWM;
        8. (H) Installed systems and equipment for use by flight crew members under section 525.1302 of Chapter 525 of the AWM;
        9. (I) Equipment, systems and installations under section 525.1309 of Chapter 525 of the AWM; and
        10. (J) May be contained within any applicable Special Conditions – Airworthiness (SCAs), exemptions, equivalent safety findings and equivalent levels of safety.
    5. (e) Some service difficulties are generally considered unsafe. Examples include, but are not limited to:
      1. (i) Deficiencies related to the following emergency-related equipment may require corrective action even if probabilistic analysis (whether qualitative or quantitative) does not identify the presence of an unsafe condition, as they are expected to function when needed:
        1. (A) Design features intended to minimize the effects of emergency situations or survivable accidents, including but not limited to:
          1. (I) Systems intended for use during an emergency situation or emergency evacuation;
          2. (II) Equipment or structures preventing cabin objects coming loose due to less than certified loading; and
          3. (III) Components which are involved in fire protection and detection (including shut-off means) or intended to minimize/retard the effects of fire/smoke in a survivable crash.
        2. (B) Equipment required by regulation;
        3. (C) Back-up emergency systems;
        4. (D) Systems used to locate the site of a crash; and
        5. (E) Systems used to assist in the enquiry following an accident or serious incident.
      2. (ii) Over the life of an aeronautical product, new or revised limitations which are more restrictive may be issued affecting the AWLs, CMP, MMEL, and AFM or RFM. These limitations may result from refined analysis, test results or continuing airworthiness issues. Regardless of the origin, failure to implement these limitations could result in an unsafe condition and, as a result, the DADH should consider potential continuing airworthiness impact when issuing new or revised limitations. It may not be sufficient to rely on the operator to adopt the latest revisions. Regulations vary between local authorities, and as such the only means of preventing further unsafe conditions and ensuring revisions to flight manuals, CMP and AWLs are adopted by all operators is to issue an AD:
        1. (A) The exception is the MMEL, whereby most authorities generally require incorporation of revisions into operators’ Minimum Equipment Lists (MELs) within 90 days of MMEL revision. Should it be necessary for safety reasons for MELs to be revised in shorter timeframes, an AD may be required; and
        2. (B) An AD is not required to mandate incorporation of AWLs, flight manual changes and ICAs when they are associated with design changes incorporated on an aeronautical product, as these are already required by regulation.
      3. (iii) Finding the design is non-compliant with its certification basis is a deficiency. Section 521.427 of the CARs replaced section 593.02 of the CARs for AD conditions of issuance, and in so doing removed a requirement to issue ADs for all non-compliances. TCCA acknowledges not all non-compliances are considered unsafe conditions, but the standards of airworthiness are generally written to create a minimum level of safety; therefore, non-compliances may require corrective action by the DADH in some form; or
      4. (iv) Security and cybersecurity threats and vulnerabilities are difficult to assess probabilistically. Once a vulnerability has been discovered, it could be exploited rapidly. As a result, investigation and rectification of cybersecurity threats and vulnerabilities should be completed more rapidly due to their potentially large exposure. The investigation of such occurrences is conducted in a confidential manner to avoid exposing the vulnerabilities. Threats and vulnerabilities having greater than a negligible effect on the effectiveness of the security measure, may require corrective action even if probabilistic analysis (whether qualitative or quantitative) does not identify the presence of an unsafe condition. See section 525.795 of Chapter 525 of the AWM for large transport aeroplane security considerations, and section 8.3 of this AC for Cybersecurity considerations.
    6. (f) The risk assessment for the SDR investigation considers all operational approvals which may change the level of risk (probability, severity, or both) during certain phases of flight. It also considers degraded operation such as under MMEL relief and in the presence of latent failures and overlapping risks due to other service difficulties in the aeronautical product.
  2. (2) The following references may help inform a determination whether a service difficulty represents an unsafe condition. Some also contain guidance with respect to the timeframe of corrective action implementation:
    1. (a) For any aircraft, engine or propeller:
      1. (i) EASA GM 21A.3B(d)(4) Defect correction – Sufficiency of proposed corrective action; and
      2. (ii) EASA AMC 21A.3B(b) Unsafe Condition & GM 21A.3B(b) Determination of an Unsafe Condition.
    2. (b) For large aeroplanes:
      1. (i) Policy Letter 525-001 Implementation of the FAA SFAR 88 – Mandatory Action Decision Criteria Memorandum;
      2. (ii) FAA PS-ANM-25-05 and attached Transport Airplane Risk Assessment Methodology Handbook;
      3. (iii) FAA PS-ANM-25-11 Guidance for Hazard Classifications of Failure Conditions that Lead to Runway Excursions;
      4. (iv) EASA CM 21.A-A-001 Parts Detached from Aeroplanes; and
      5. (v) SAE ARP 5150 Rev A Safety Assessment of Transport Airplanes in Commercial Service.
    3. (c) For small aeroplanes and helicopters:
      1. (i) FAA PS-AIR-21.8-1602 Approval of Non-Required Safety Enhancing Equipment (NORSEE);
      2. (ii) SAE ARP 5151 Rev A Safety Assessment of General Aviation Airplanes and Rotorcraft in Commercial Service; and
      3. (iii) FAA Small Airplane Risk Analysis (SARA) Handbook.
    4. (d) For engines and propellers:
      1. (i) FAA AC 39-8 Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes;
      2. (ii) FAA PS-ANE-2011-33-1 Engine Reliability in Extended Operations (ETOPS) – Continued Operational Safety (COS) Assessments; and
      3. (iii) FAA ANE-2007-33.70-1 Policy for Continued Airworthiness Assessment Methodology for Turbine Engine Rotating Life-Limited Parts Life Shortfall.

Appendix D: Guidelines for deficiency and unsafe condition correction

  1. (1) For deficiency and unsafe condition correction guidance, TCCA recognizes EASA GM 21A.3B(d)(4) Defect correction – Sufficiency of proposed corrective action with the following considerations:
    1. (a) To manage fleet and individual risk exposure, deficiency and unsafe condition corrective action should be implemented as soon as reasonably practical unless analysis indicates a quicker implementation time is required:
      1. (i) In general, as soon as reasonably practical means, in the context of any individual aircraft, the next opportunity to carry out the corrective action with minimal operational impact. DADHs should monitor and analyse fleet usage data to identify practical opportunities and incorporate them into their corrective action timelines; and
      2. (ii) Factors influencing “as soon as reasonably practical” rectification time may include:
        1. (A) Maintenance intervals facilitating access and/or downtime required to perform the corrective action(s);
        2. (B) Availability of parts and instructions to perform the corrective action(s); and
        3. (C) Other corrective action(s) or out of schedule maintenance requirements which could present rectification opportunities.
    2. (b) In all cases, the identified next practical opportunity is demonstrated to provide adequate management of fleet-level and/or individual risk exposure. For many cases, such as unsafe conditions, adequate exposure management can be demonstrated through calculation of reaction time and comparing it to the identified next practical opportunity. So long as the next practical opportunity is reasonably aligned within the calculated average reaction time, the implementation is likely to be adequate. If the first practical opportunity goes beyond the average reaction time (but not beyond the maximum), it may be acceptable but would require a case to be made based on engineering judgment, and mitigating actions to justify going beyond the average;
    3. (c) It is important to note, as indicated in sections 4.3 and 4.4 of the EASA GM 21A.3B(d)(4), the guidance for reaction time is not intended to avoid quicker reaction times but represents a theoretical maximum reaction time and is a departure point for the exercise of judgement. The goal of the risk assessment is not to find the most lenient program possible within acceptable risk levels. This is discussed in FAA AC 39-8 Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes. This approach is necessary because the model underlying the GM makes assumptions with respect to cumulative risk (see section 3.6 of the GM 21A.3B(d)(4)) represented by all known, uncorrected unsafe conditions. The principles of cumulative risk are also discussed in FAA PS-ANM-25-05 Transport Airplane Risk Assessment Methodology Handbook and can be referenced for additional information;
    4. (d) The EASA GM 21A.3B(d)(4) reaction time guidelines are based on a cumulative risk exposure model. While the EASA GM21A.3B(d)(4) does not indicate a start time from which the reaction time should be measured, the exposure to the aircraft is independent of and generally pre-dates the DADH’s knowledge or discovery of the risk. However, since it is only possible to correct risks once they are discovered, the reaction time should be measured from the commencement of the SDR investigation (i.e. upon notification of a reportable service difficulty to the DADH) in most cases. In some cases (e.g. structural failures), the reaction time could be measured based on accumulated utilization (e.g. hours, cycles) since entry into service to mitigate the cumulative risk to within an acceptable level; and
    5. (e) The reaction time guidance is based on a probability model which is applicable to average rates. For the following types of failures, reaction time should be assessed differently:
      1. (i) Structural failures: The time to failure can often be estimated; as a result, the issues should be corrected before failure is expected to occur;
      2. (ii) Non-random failure mode: Failures related to environmental factors such as corrosion or hydrogen embrittlement, among others, are not accurately modeled as random system failures;
      3. (iii) Time dependent failure modes: Can occur on non-structural components, for example, solder joints in electronics which are exposed to manufacturing defects, environmental conditions like humidity, vibration, and thermal stress cycling;
      4. (iv) Failures for which calculated reaction times are not representative of TCCA’s expectations: Failures of the nature described in the following paragraphs occur infrequently, and the reaction time formulas in the GM 21A.3B(d)(4) generally yield unacceptably long results:
        1. (A) Failures related to environmental conditions such as high intensity radiated field (HIRF) and lightning, because they are part of the approved flight envelope and the events and the failures they cause are not independent;
        2. (B) Any of the following, due to the probabilities of fire or other emergencies:
          1. (I) Deficiencies in components involved in fire protection or which are intended to minimize/retard the effects of fire/smoke in a survivable crash preventing them from performing their intended function;
          2. (II) Design features intended to minimize the effects of survivable accidents not performing their intended function;
          3. (III) Back up emergency systems, or fire detection and protection systems; and
          4. (IV) Deficiencies affecting systems used during an emergency evacuation.
        3. (C) Deficiencies in systems used to assist an enquiry following an accident or serious incident preventing them from performing their intended function, due to the devices not usually having a safety effect, but being needed to investigate occurrences and advance aviation safety; and
        4. (D) Human factors related failures, due to the lack of predictability and unevenly applied probabilities across the affected fleet.
      5. (v) The guidelines in the GM only provide guidance for catastrophic and hazardous failures which do not meet the 1 x 10-9 per flight hour and 1 x 10-7 per flight hour safety objectives, respectively. However, failure to meet other safety probability objectives (e.g., significant latent failure, no single failure can be catastrophic, particular risks, and others) is also usually considered unsafe, and as a result judgement should be relied upon to determine a reasonable and safe reaction time.

Appendix E: Guidelines for developing documents in support of in-service corrective action(s)

  1. (1) Typically, in the case of SBs, only the Accomplishment Instructions are referenced within an AD if the Minister has determined the corrective action(s) are required for an unsafe condition. As a result, steps which are necessary parts of the corrective action(s) should be contained within the Accomplishment Instructions. This includes actions such as certain return to service tests which validate the correct accomplishment of the corrective action(s).
  2. (2) Refer to FAA AC 20-176A Service Bulletins Related to Airworthiness Directives and Indicating FAA Approval on Service Documentsfor guidance on User-Friendly SBs, Avoiding Overlapping and Conflicting Actions in SBs, Alternative Means of Compliance (AMOCs), Maintaining Airworthiness of AD-Mandated Design Changes, and Approval of Service Documents (see also EASA CM 21.A-J-001Service Bulletins (SBs) related to Airworthiness Directives (ADs)), with the following exceptions and additions:
    1. (a) Replace all FAA-specific references with the analogous TCCA reference;
    2. (b) Chapter 6, Indicating FAA Approval on Service Documents: Once the corrective action has been approved by TCCA, it is encouraged to indicate this approval in the service documents. ADs and AMOCs often give credit for later revisions approved by TCCA. By identifying whether this approval has been obtained, it is clear to an operator whether the later revision can be used without an AMOC;
    3. (c) Appendix B of FAA AC 20-176A, Examples of Notes that Provide Flexibility in SBs:
      1. (i) To allow deviation from the job set-up and close-out steps of a SB, for instance to allow the work associated with the SB to be integrated with other maintenance tasks, the following statements can be used: “The steps in the Job set-up section of this service bulletin are recommended steps. The steps give a recommendation to get access to the work area. This recommendation is to give a safe work area and to minimize possible damage to surrounding aircraft parts. Alternative steps can be used at the discretion of the operator.”, and “The steps in the Job close-up section of this service bulletin, except for the return to service tests, are recommended steps. The steps give a recommendation to install components removed during the Job set-up. This recommendation is to make sure the aircraft is safe and ready to return to service. Alternative steps can be used at the discretion of the operator.”;
      2. (ii) To allow deviation from the steps of a SB to accommodate configurations not addressed by the SB, the following statement can be used. Note this statement is not always appropriate and is not always approved by TCCA: “If it is not possible to complete all the instructions in this service bulletin because of the configuration of the aircraft, speak with a <DADH> representative at <DADH contact information> for analysis and to get an approved disposition to complete this service bulletin.”;
      3. (iii) To allow for flexibility to obtain repairs from the DADH for damage found during inspections, the following statement can be used: “If you find any cracks or damage, speak with a <DADH> representative at <DADH contact information> for analysis and to get an approved disposition”.; or
      4. (iv) The combination of the statements above and an approved disposition which makes reference to the AD may alleviate the requirement for an AMOC, depending on the aircraft owner’s local authority.
    4. (d) Since mandatory corrective action(s) are approved by TCCA, the revision of documents approved as part of the corrective action(s) should be strictly controlled. For instance, any references to other documents containing accomplishment instructions for the corrective action(s), such as references to a vendor SB or other SB, indicate the revision of the other document.
  3. (3) In general, it is recommended to separate corrective action(s) from other product improvements. This practice simplifies and expedites corrective action development.
  4. (4) Often an issue requires repetitive inspections as a mitigating action and is followed by a terminating action. When a terminating action is developed, it should be communicated in a different service document than the mitigating action to facilitate configuration control.

  5. (5) The compliance time recommendation for corrective action(s) should consider any aeronautical products in the fleet which may have already exceeded the compliance time, and whether a grace period (phase-in time) is justified on the basis of safety to avoid grounding the affected aircraft, where possible.

    Note: Compliance time refers to the period specified in an AD or service document and is measured from the effective date of the document, whereas the reaction time is determined in accordance with section 6.4.2(3) and includes the compliance time of the AD or service document in addition to the exposure to the fleet during the time required to develop them.

  6. (6) Prior to submitting draft service information (e.g. SB) as part of a corrective action for TCCA approval, the DADH should confirm whether a quality verification has been carried out and the document meets the intent of the TCCA-approved corrective action plan. TCCA personnel cease the review and approval process upon finding significant errors in a submitted corrective action document (typically when 5 substantive items invalidating the corrective action are discovered during a preliminary assessment) and return the document to the originator for further action. TCCA provides the DADH with an explanation of why the document was deficient. In addition, the DADH is advised what sections of the document were not reviewed and these sections are still subject to TCCA review and comment. The submitter is expected to review the entire document to ensure the quality is acceptable and not only correct errors identified by TCCA’s review.
  7. (7) Approval of the corrective action and delegation of authority:

    1. (a) The term “approval” in the context of mandatory corrective action(s) under paragraph 521.356(a) of the CARs is intended as the Minister’s approval stating the corrective action(s) can be performed and resolves the unsafe condition. It cannot be delegated and is distinct from design (or design change) approval which may be delegated under some circumstances;

      Note: The corrective action(s) are specified within a document: for instance, in the case of a SB, the corrective action(s) are not the SB but is specified within it. As a result, the approval provided under paragraph 521.356(a) of the CARs is not for the SB itself but for the corrective action(s) specified within it.

    2. (b) The requirement for approval of mandatory corrective action(s) applies equally to those required to be implemented by an AD or by a monitored fleet campaign, and to later revisions of those corrective action(s);
    3. (c) While provisions within Chapter 505 of the AWM authorize Ministerial Delegates who have the privilege to approve design change aspects of SBs and revisions, if TCCA has issued, or intends to issue, an AD which addresses an unsafe condition and the SB forms part of the approved corrective action, then the delegate coordinates with TCCA and obtains concurrence prior to approving the associated design change; and
    4. (d) Approval is indicated by TCCA as follows:
      1. (i) For corrective action(s) identified in an AD: The identification of those corrective action(s) in the AD is confirmation of approval and no further confirmation is provided; or
      2. (ii) TCCA communicates approval to the DADH in writing:
        1. (A) For corrective action(s) implemented by monitored fleet campaign; or
        2. (B) For later revisions of corrective action(s) identified within an AD or implemented by monitored fleet campaign.

AC 521-008 - Responsibilities of a Design Approval Document Holder
(PDF, 676 KB)

Date modified: