AMC 25-19 Certification Maintenance Requirements

• ED Decision 2018/005/R found in: CS-25 Amdt 27 - Large Aeroplanes (Jan 2023)

AMC 25-19 Certification Maintenance Requirements ED Decision 2018/005/R 1 PURPOSE This Acceptable Means of Compliance (AMC) provides guidance on the selection, documentation and control of Certification Maintenance Requirements (CMRs). This AMC also provides a rational basis for coordinating the CMR selection process and the Maintenance Review Board (MRB) process if the latter is used. The applicant should ensure that the maintenance tasks and intervals identified in the system safety analyses to support compliance with [CS 25.1309](#_DxCrossRefBm1709820691) and other system safety requirements (such as [CS 25.671](#_DxCrossRefBm1709820687), [CS 25.783](#_DxCrossRefBm1709821203), [CS 25.901](#_DxCrossRefBm1709820973), and [CS 25.933](#_DxCrossRefBm1709821386)) are protected in service. For those aeroplanes whose initial maintenance programme is developed under a different process than the MRB process, the coordination and document aspects have to be adapted to the particular case. This AMC describes an acceptable means, but not the only means, for selecting, documenting and managing CMRs. Terms such as ‘shall’ and ‘must’ are used only in the sense of ensuring applicability of this acceptable means of compliance. 2 RELATED CERTIFICATION SPECIFICATIONS a. [CS 25.671](#_DxCrossRefBm1709820687) Control Systems — General b. [CS 25.783](#_DxCrossRefBm1709821203) Fuselage Doors c. [CS 25.901](#_DxCrossRefBm1709820973) Powerplant — Installation d. [CS 25.933](#_DxCrossRefBm1709821386) Reversing systems e. [CS 25.1309](#_DxCrossRefBm1709820691) Equipment, systems and installations f. [CS 25.1529](#_DxCrossRefBm1709821031) Instructions for Continued Airworthiness 3 RELATED DOCUMENTS a. Airlines for America (A4A), MSG–3, Operator/Manufacturer Scheduled Maintenance Development Document. b. International Maintenance Review Board/Maintenance Type Board Process Standard (IMPS) 4 NOT USED 5 CERTIFICATION MAINTENANCE REQUIREMENTS (CMR) DEFINITION A CMR is a required scheduled maintenance task, established during the design certification of the aeroplane systems as an airworthiness limitation of the type certificate (TC) or supplemental type certificate (STC). The CMRs are a subset of the Instructions for Continued Airworthiness (ICA) identified during the certification process. A CMR usually result from a formal, numerical analysis conducted to show compliance with the requirements applicable to catastrophic and hazardous failure conditions as defined in paragraph 6e, below. A CMR may also result from a qualitative, engineering judgment-based analysis. a. The CMRs are required tasks, and associated intervals, developed to achieve compliance with [CS 25.1309](#_DxCrossRefBm1709820691) and other requirements requiring safety analyses (such as [CS 25.671](#_DxCrossRefBm1709820687), [25.783](#_DxCrossRefBm1709821203), [25.901](#_DxCrossRefBm1709820973), and [25.933](#_DxCrossRefBm1709821386)). A CMR is usually intended to detect latent failures that would, in combination with one or more other specific failures or events, result in a Hazardous or Catastrophic Failure Condition. A CMR can also be used to establish a required task to detect an impending wear out of an item whose failure is associated with a hazardous or catastrophic failure condition. A CMR may also be used to detect a latent failure that would, in combination with one specific failure or event, result in a major failure condition, where the SSA identifies the need for a scheduled maintenance task. b. CMRs are derived from a fundamentally different analysis process than the maintenance tasks and intervals that result from MSG–3 analysis associated with MRB activities (if the MRB process is used). Although both types of analysis may produce equivalent maintenance tasks and intervals, it is not always appropriate to address a Candidate Certification Maintenance Requirement (CCMR) with a Maintenance Review Board Report (MRBR) task. c. CMRs verify that a certain failure has or has not occurred, indicate that corrective maintenance or repair is necessary if the item has failed, or identify the need to inspect for impending failures (e.g. wear out or leakage). Because the exposure time to a latent failure is a key element in the calculations used in a safety analysis, limiting the exposure time will have a significant effect on the resultant overall failure probability of the system. The intervals for CMR tasks interval should be designated in terms of flight hours, cycles, or calendar time, as appropriate. d. The type certification process assumes that the aeroplane will be maintained in a condition or airworthiness equal to its certified condition. The process described in this AMC is not intended to establish routine maintenance tasks (e.g. greasing, fluid-level checks, etc.) that should be defined through the MSG–3 analysis process. Also, this process is not intended to establish CMRs for the purpose of providing supplemental margins of safety for concerns arising late in the type design approval process. Such concerns should be resolved by appropriate means, which are unlikely to include CMRs not established via normal safety analyses. e. CMRs should not be confused with required structural inspection programmes, that are developed by the TC applicant to meet the inspection requirements for damage tolerance, as required by [CS 25.571](#_DxCrossRefBm1709820942) or [CS 25.1529](#_DxCrossRefBm1709821031), and Appendix [H25.4](#_DxCrossRefBm1709821427) (Airworthiness Limitations Section). CMRs are to be developed and managed separately from any structural inspection programs. 6 OTHER DEFINITIONS The following terms apply to the system design and analysis requirements of CS 25.1309(b) and (c), and to the guidance material provided in this AMC. (for a complete definition of these terms, refer to the applicable specifications and acceptable means of compliance, (e.g. CS and [AMC 25.1309](#_DxCrossRefBm1709821113))). a. Catastrophic. Refer to [AMC 25.1309](#_DxCrossRefBm1709821113). b. Compatible MRBR task. An MRBR task whose intent addresses the CCMR task intent and whose interval is equal to or lower than the interval that would otherwise be required by a CMR. c. Crew. The cabin crew, or flight crew, as applicable. d. Failure. Refer to [AMC 25.1309](#_DxCrossRefBm1709821113). e. Failure Condition. Refer to [AMC 25.1309](#_DxCrossRefBm1709821113). f. Failure Effect Category 5 task (FEC5). Refer to MSG-3, Operator/Manufacturer Scheduled Maintenance Development. g. Failure Effect Category 8 task (FEC8). Refer to MSG-3, Operator/Manufacturer Scheduled Maintenance Development. h. Hazardous. Refer to [AMC 25.1309](#_DxCrossRefBm1709821113). i. Latent Failure. Refer to [AMC 25.1309](#_DxCrossRefBm1709821113). j. Major. Refer to [AMC 25.1309](#_DxCrossRefBm1709821113). k. Qualitative. Refer to [AMC 25.1309](#_DxCrossRefBm1709821113). l. Quantitative. Refer to [AMC 25.1309](#_DxCrossRefBm1709821113). m. Significant Latent Failure. A latent failure that would, in combination with one or more other specific failures or events, result in a hazardous or catastrophic failure condition. n. Task. Short description (e.g. descriptive title) of what is to be accomplished by a procedure. Example: ‘Operational check of the static inverter’. o. Wear out. A condition where a component is worn beyond a predetermined limit. 7 SYSTEM SAFETY ASSESSMENTS (SSA) a. [CS 25.1309(b)](#_DxCrossRefBm1709820691) specifies required safety levels in qualitative terms, and a safety assessment must be conducted to show compliance. Various assessment techniques have been developed to help applicants and EASA in determining that a logical and acceptable inverse relationship exists between the probability and the severity of each Failure Condition. These techniques include the use of service experience data of similar, previously approved systems, and thorough qualitative and quantitative analyses. b. In addition, difficulties have been experienced in assessing the acceptability of some designs, especially those of systems, or parts of systems, that are complex, that have a high degree of integration, that use new technology, or that perform safety-critical functions. These difficulties led to the selective use of rational analyses to estimate quantitative probabilities, and the development of related criteria based on historical data of accidents and hazardous incidents caused or contributed to by failures. These criteria, expressed as numerical probability ranges associated with the terms used in CS 25.1309(b), became commonly accepted for evaluating the quantitative analyses that are often used in such cases to support experienced engineering and operational judgement and to supplement qualitative analyses and tests. NOTE: See AMC 25.1309 for a complete description of the inverse relationship between the probability and severity of Failure Conditions, and the various methods of showing compliance with CS 25.1309. 8 DESIGN CONSIDERATIONS RELATED TO SIGNIFICANT LATENT FAILURES a. The applicant should implement practical and reliable failure monitoring and flight crew indication systems to detect failures that would otherwise be significant latent failures. A reliable failure monitoring and flight crew indication system should utilise current state-of-the-art technology to minimise the probability of falsely detecting and indicating non-existent failures. Experience and judgement should be applied when determining whether or not a failure monitoring and flight crew indication system would be practical and reliable. Comparison with similar, previously approved systems is sometimes helpful. b. Supplemental design considerations are provided in Appendix 1 to this AMC. 9 OVERVIEW OF THE CERTIFICATION MAINTENANCE REQUIREMENTS DEVELOPMENT PROCESS a. Figure 1 shows the development process of CMRs. The details of the process to be followed in defining, documenting, and handling CMRs are given in paragraphs 10 through 13. Figure 1 — CMR development process  10 IDENTIFICATION OF CANDIDATE CMRs (CCMRs) a. The SSA should address all significant latent failures. b. Credit may be taken for correct flight crew performance of the periodic checks required to demonstrate compliance with [CS 25.1309(b)](#_DxCrossRefBm1709820691). Unless these flight crew actions are accepted as normal airmanship, they should be included in the approved Aeroplane Flight Manual procedures. Similarly, credit may be taken from self-initiated checks (e.g. power-up built-in tests). In both cases, these significant latent failures do not need a CCMR. c. Tasks that are candidates for selection as CMRs come from safety analyses (e.g. SSAs), which establish whether there is a need for tasks to be carried out periodically to comply with CS 25.1309, and other requirements (such as [CS 25.671](#_DxCrossRefBm1709820687), [CS 25.783](#_DxCrossRefBm1709821203), [CS 25.901](#_DxCrossRefBm1709820973), and [CS 25.933](#_DxCrossRefBm1709821386)) requiring this type of analysis. The SSA should identify as CCMRs the maintenance tasks intended to detect significant latent failures. Tasks may also be selected from those intended to inspect for impending failures due to wear out. d. As the safety analysis may be qualitative or quantitative, some task intervals may be derived in a qualitative manner (e.g. engineering judgment and service experience). As per [AMC 25.1309](#_DxCrossRefBm1709821113), numerical analysis supplements, but does not replace, qualitative engineering and operational judgment. Therefore, other tasks that are not derived from numerical analysis of significant latent failures, but are based on properly justified engineering judgment, can also be candidates for CMRs. The justification should include the logic leading to identification of CCMRs, and the data and experience base supporting the logic. e. In some situations, a Catastrophic or Hazardous Failure Condition might meet the quantitative probability objective, yet it might contain one or more components that, as per the quantitative analysis, do not require a periodic maintenance task to meet that objective (i.e. could be failed latent for the life of the aeroplane). In such cases, the SSA should include a qualitative assessment to determine whether a periodic maintenance task is needed. Unless otherwise substantiated, a CCMR should be identified to: — reduce exposure to a single failure or event that would cause the failure condition, — ensure the availability of backup or emergency systems, and — ensure the availability of equipment/systems required to be installed as per CS-25. f. For failure conditions involving multiple significant latent failures, the SSA should identify a CCMR for each significant latent failure unless otherwise justified (e.g. one CCMR may cover multiple significant latent failures, or the significant latent failure could exist for the life of the aeroplane without compromising compliance with the safety objectives and paragraph 10.e considerations). g. For each identified CCMR, the applicant should indicate: — the failure mode to be detected, — the failure condition of concern, — the intended maintenance task, and — the task interval (the allowable value coming from the SSA or other relevant analysis). 11 SELECTION OF CMRs a. Each CCMR should be reviewed and a determination made as to whether or not it should be a CMR. Criteria and guidance are provided below for CMR selection or non-selection. The applicant may seek additional input from an advisory committee, as described in Appendix 2, before proposing CMRs to EASA for final review and approval. b. The applicant should provide sufficient information to enable an understanding of the Failure Conditions and the failure or event combinations that result in the CCMRs. CCMRs are evaluated in the context of the Failure Conditions in which they are involved, e.g. whether the significant latent failure is part of a dual failure, a triple failure, or more. c. The CMR designation should be applied in the case of catastrophic dual failures where one failure is latent. The CMR designation should also be applied to tasks that address wear out of a component involved in a Catastrophic Failure Condition that results from two failures. d. In all other cases, the CMR designation may not be necessary if there is a compatible MRBR task to accommodate the CCMR, provided that the applicant has the means in place to ensure that the CCMRs are protected in service. Appendix 3 provides examples of acceptable means of protection. Any means should be presented to EASA for acceptance. These means of protection should address future evolutions of the compatible MRBR task proposed by the applicant or by the operator. In this respect, these means should ensure that in service: — the compatible MRBR task would not be changed to the extent that the CCMR task intent is adversely affected, and — the compatible MRBR task would not be escalated beyond the interval that would otherwise be required by a CMR. The TC applicant should adequately describe the selected means of protection in the associated technical publication in order for the operator to be aware of the process to be followed if there are modifications to any compatible MRBR tasks that are included in the operator’s aeroplane maintenance program (AMP). e. The rationale for the disposition of each CCMR should be presented to EASA for acceptance. f. Since the MSG-3 logic may not consider a Failure Condition containing three or more failures, it is possible that a CCMR might not have any identified MRBR tasks. In this case, a CMR will be required. g. Where the SSA identifies the need for a scheduled maintenance task, the CMR designation may also be used to detect a latent failure that would, in combination with one specified failure or event, lead to a Major Failure Condition. This CMR designation may be necessary if no adequate scheduled maintenance task has been identified in any other Instructions for Continued Airworthiness. h. If the SSA does not specify an interval shorter than the life of the aeroplane, an interval may be established by considering the factors that influence the outcome of the Failure Condition, such as the nature of the fault, the system(s) affected, field experience, or task characteristics. 12 DOCUMENTATION AND HANDLING OF CMRs a. CMRs are considered functionally equal to airworthiness limitations, therefore they should be included in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness. b. The CMR data location should be referenced in the type certificate data sheet (TCDS). The latest version of the applicant’s CMR documentation should be controlled by a log of pages approved by EASA. In this way, changes to CMRs following certification will not require an amendment to the TCDS. c. Since CMRs are based on statistical averages and reliability rates, an ‘exceptional short-term extension’ for CMR intervals may be made on one aeroplane for a specific period of time without jeopardising safety. Any exceptional short-term extensions to CMR intervals must be defined and fully explained in the applicant’s CMR documentation. The competent authority must concur with any exceptional short-term extension allowed by the applicant’s CMR documentation before it takes place, using procedures established with the competent authority in the operators’ manuals. The exceptional short-term extension process is applicable to CMR intervals. It should not be confused with the operator’s ‘short-term escalation’ program for normal maintenance tasks described in the operators’ manuals. (1) The term ‘exceptional short-term extension’ is defined as an increase in a CMR interval that may be needed to cover an uncontrollable or unexpected situation. Any allowable increase must be defined either as a percent of the normal interval, or a stated number of flight hours, flight cycles, or calendar days. If no exceptional short-term extension is to be allowed for a given CMR, this restriction should be stated in the applicant’s CMR documentation. (2) Repeated use of exceptional short-term extensions, either on the same aeroplane or on similar aeroplanes in an operator’s fleet, should not be used as a substitute for good management practices. Exceptional short-term extensions must not be used for the systematic escalation of CMR intervals. (3) The applicant’s CMR documentation should state that the competent authority must approve, prior to its use, any desired exceptional short-term extension not explicitly listed in the CMR document. 13 POST-CERTIFICATION CHANGES TO CMRs (New, revised or deleted) a. The introduction of a new CMR or any change to an existing CMR should be reviewed by the same entities that were involved in the process of CCMR/CMR determination (refer to paragraphs 10 and 11 of this AMC) at the time of initial certification. To allow operators to manage their own maintenance programs, it is important that they be afforded the same opportunity for participation that they were afforded during the initial certification of the aeroplane. b. Any post-certification changes to CMRs must be approved by EASA which approved the type design. c. Since the purpose of a CMR is to limit the time of exposure to a given significant latent failure, or a given wear out, as part of an engineering analysis of the overall system safety, instances of a CMR task repeatedly finding that no failure has occurred may not be sufficient justification for deleting the task or increasing the time between repetitive performances of the CMR task. In general, a CMR task change or interval escalation should only be made if experience with the aeroplane fleet in service worldwide indicates that certain assumptions regarding component failure rates made early during the engineering analysis were too conservative, and a re-calculation of the system’s reliability with revised failure rates of certain components reveals that the task or interval may be changed. d. If later data provides a sufficient basis for the relaxation of a CMR (less restrictive actions to be performed), the change may be documented by a revision to the applicant’s CMR documentation and approved by EASA. e. To address an unsafe condition, EASA may determine that the requirements of an existing CMR must be modified (more restrictive actions to be required) or a new CMR must be created. These modified requirements will be mandated by an Airworthiness Directive (AD) and the applicant’s CMR documentation will be revised to include the change. f. New CMRs that are unrelated to in-service occurrences may be created and they should be documented and approved by EASA. New CMRs can arise in situations such as: (1) the certification of design changes, or (2) updates of the applicant’s certification compliance documentation. These may result from regulatory changes, actions required by an AD on similar systems or aeroplanes, awareness of additional Hazardous or Catastrophic Failure Conditions, revised failure rates, consideration of extended service goals, etc. APPENDIX 1 SUPPLEMENTAL GUIDANCE FOR THE USE OF CMRs 1. The TC/STC applicant should choose a system design that minimises the number of significant latent failures, with the ultimate goal that no such failures should exist, if this is practical. A practical and reliable failure monitoring and flight crew indication system should be considered as the first means to detect a significant latent failure. If the cost of adding practical and reliable failure monitoring and flight crew indication system is high, and the added maintenance cost of a CMR is low, the addition of a CMR may be the solution of choice for both the type certificate applicant and the operator, provided all applicable regulations are met. Substituting a CMR with an MRBR task does not necessarily reduce maintenance costs. 2. The decision to create a CMR may include a trade-off of the cost, weight, or complexity of providing mechanism or device that will expose the latent failure, versus the requirement for the operator to conduct a maintenance or inspection task at fixed intervals. 3. The following points should be considered in any decision to create a CMR in lieu of a design change. a. What is the magnitude of the changes to the system and/or aeroplane needed to add a reliable failure monitoring and flight crew indication system that would expose the latent failure? What is the cost in added system complexity? b. Is it possible to introduce a self-test on power-up? c. Is the monitoring and flight crew indication system reliable? False warnings must be considered, as well as a lack of warnings. d. Does the failure monitoring or flight crew indication system itself need a CMR due to its latent failure potential? e. Is the CMR task reasonable, considering all aspects of the failure condition that the task is intended to address? f. How long (or short) is the CMR task interval? g. Is the proposed CMR task labour intensive or time consuming? Can it be done without having to ‘gain access’ and/or without workstands? Without test equipment? Can the CMR task be done without removing equipment from the aeroplane? Without having to re-adjust equipment? Without leak checks and/or engine runs? h. Can a simple visual inspection be used instead of a complex one? Can a simple operational check suffice in lieu of a formal functional check against measured requirements? i. Is there ‘added value’ to the proposed task (i.e. will the proposed task do more harm than good if the aeroplane must be continually inspected)? j. Have all alternatives been evaluated? APPENDIX 2 ROLE OF THE CERTIFICATION MAINTENANCE COORDINATION COMMITTEE (CMCC) 1. The CMCC functions as an advisory committee for the applicant and proposes the disposition of each presented CCMR. EASA is the authority that ultimately approves CMRs as airworthiness limitations of the type certificate as per Part-21. 2. In order to grant aeroplane operators the opportunity to participate in the selection of CMRs, and to assess the CCMRs and the proposed MRBR tasks and intervals in an integrated process, the applicant should convene a CMCC as early as possible in the design phase of the aeroplane program, and at intervals as necessary. This CMCC should comprise TC/STC holder representatives (typically maintenance, design, and safety engineering personnel), operator representatives designated by the Industry Steering Committee (ISC) chairperson, EASA certification specialist(s), and the MRB chairperson(s). EASA certification specialist participation in the CMCC is necessary to provide regulatory guidance on the disposition of CCMRs. 3. The CMCC should review CCMRs and their purposes, the Failure Conditions and their classifications, the intended tasks and their intervals, and other relevant factors. In addition, where multiple tasks result from a quantitative analysis, it may be possible to extend a given interval at the expense of one or more other intervals, in order to optimise the required maintenance activity. However, once a decision is made to create a CMR, then the CMR interval should be based solely on the results of the SSA or other relevant analysis. If the SSA does not specify an interval shorter than the life of the aeroplane, then the CMR interval may be proposed by the CMCC considering factors that influence the outcome of the failure condition, such as the failure mode(s) to be detected, the system(s) affected, field experience, or task characteristics. 4. The CMCC should address all CCMRs. Alternatively, the applicant may coordinate with EASA to define a subset of CCMRs to be presented to the CMCC. 5. The CMCC discusses compatible tasks (if any) that the MRB generates. The CMCC may select an MRBR task in lieu of a CMR in accordance with paragraph 11 of this AMC. 6. The CMCC may request the ISC to review selected CMCC results (e.g. proposed revised MRBR tasks and/or intervals). Upon ISC review, the proposed revised MRBR tasks and/or intervals accepted by the ISC are reflected in the MRBR proposal, and the proposed revised MRBR tasks and/or intervals rejected by the ISC result in CMRs. Following consideration by the ISC, the applicant submits the CMRs to EASA for final review and approval. APPENDIX 3 MEANS OF PROTECTION PROPOSED BY THE DESIGN APPROVAL HOLDER (DAH) AGAINST FUTURE EVOLUTIONS OF THE COMPATIBLE MRBR TASKS AND DERIVED TASKS OF THE OPERATOR’S AEROPLANE MAINTENANCE PROGRAM — EXAMPLES 1. With reference to paragraph 11.c of this AMC, this Appendix provides examples to facilitate the implementation of the means to ensure that the CCMRs are protected in service. 2. These examples describe acceptable means, but not the only means. Any means should be presented to EASA for acceptance. EXAMPLE 1 — Traceability of CCMRs and MRBR tasks in the Airworthiness Limitations Section a. The CMR designation may not be necessary if there is a compatible MRBR task to accommodate the CCMR, provided that the design approval holder (DAH) shows direct traceability between the MRBR task and the accommodated CCMR in the airworthiness limitations section (ALS). b. The compatible MRBR task and its interval are not airworthiness limitations. The status of the compatible MRBR task with regard to the MRB process remains unchanged. c. Traceability between the CCMR and the compatible MRBR task should be provided in the ALS of the instructions for continued airworthiness to ensure that the CCMR is respected during in-service operation of the aeroplane and any future evolution of the maintenance program. Table 1 illustrates one possible means for traceability. <table border="1" cellpadding="0" cellspacing="0" width="531"><tr><td valign="top" width="165"><p><b>CCMR task reference</b></p></td><td valign="top" width="165"><p><b>CCMR interval</b></p></td><td valign="top" width="201"><p><b>Compatible MRBR task reference</b></p></td></tr><tr><td valign="top" width="165"><p>CCMR task #NN</p></td><td valign="top" width="165"><p>60 months</p></td><td valign="top" width="201"><p>MRBR task #XX</p></td></tr><tr><td valign="top" width="165"><p>CCMR task #MM</p></td><td valign="top" width="165"><p>10 000 flight hours</p></td><td valign="top" width="201"><p>MRBR task #YY</p></td></tr><tr><td valign="top" width="165"><p>…</p></td><td valign="top" width="165"><p>…</p></td><td valign="top" width="201"><p>…</p></td></tr></table> Appendix 3 — Table 1 d. If the DAH changes the compatible MRBR task to the extent that the intent of the corresponding CCMR task is adversely affected, this corresponding CCMR task is no longer accommodated. Therefore, the DAH could either propose a new compatible MRBR task, if one exists, or create a new CMR in line with the intent of the previously referenced CCMR limitation. These changes to the ALS require EASA approval. e. If the DAH escalates the interval of the compatible MRBR task beyond the corresponding CCMR limitation, this corresponding CCMR is no longer accommodated and the DAH needs to create a CMR in order to satisfy the corresponding CCMR limitation. Alternatively, the DAH could assess the feasibility of escalating the interval of the corresponding CCMR by re‑evaluating the system safety assumptions that lead to the CCMR at the time of initial certification. These changes to the ALS require EASA approval. f. Furthermore, the DAH shall describe in the ALS what the operator needs to observe when changing the operator’s aeroplane maintenance program (AMP). For tasks included in an AMP, which are based on compatible MRBR tasks, the following applies: i. Should the operator propose to change the intent of a task, the operator should ask for the DAH’s confirmation that this change does not adversely affect the intent of the corresponding CCMR task. If the corresponding CCMR task is no longer accommodated, the operator needs to propose to include a mandatory task in the AMP in order to satisfy the intent of the referenced CCMR limitation. These changes to the AMP require the approval of the competent authority responsible for the oversight of the operator. ii. If the operator proposes to escalate the interval of a task, the corresponding CCMR limitation must not be exceeded. EXAMPLE 2 — Uniquely identifying the compatible MRBR tasks a. The CMR designation may not be necessary if there is a compatible MRBR task to accommodate the CCMR, provided that the DAH uniquely identified each compatible MRBR task in the existing MRBR task listing. Table 2 illustrates one possible means for marking. <table border="1" cellpadding="0" cellspacing="0" width="567"><tr><td width="132"><p align="center"><b>MRBR task reference</b></p></td><td width="142"><p align="center"><b>MRBR task description</b></p></td><td width="134"><p align="center"><b>Failure effect category (FEC)</b></p></td><td width="93"><p align="center"><b>Interval</b></p></td><td width="65"><p align="center"><b>Tracking</b></p></td></tr><tr><td valign="top" width="132"><p>MRBR task #XX</p></td><td valign="top" width="142"><p>Functional check of […]</p></td><td valign="top" width="134"><p>FEC 8</p></td><td valign="top" width="93"><p>60 months</p></td><td valign="top" width="65"></td></tr><tr><td valign="top" width="132"><p>MRBR task #YY</p></td><td valign="top" width="142"><p>Detailed inspection of […]</p></td><td valign="top" width="134"><p>-</p></td><td valign="top" width="93"><p>72 months</p></td><td valign="top" width="65"><p>EWIS</p></td></tr><tr><td valign="top" width="132"><p>MRBR task #ZZ</p></td><td valign="top" width="142"><p>Operational check of […]</p></td><td valign="top" width="134"><p>FEC 8</p></td><td valign="top" width="93"><p>10 000 flight hours</p></td><td valign="top" width="65"><p>CCMR</p></td></tr><tr><td valign="top" width="132"><p>…</p></td><td valign="top" width="142"><p>…</p></td><td valign="top" width="134"><p>…</p></td><td valign="top" width="93"><p>…</p></td><td valign="top" width="65"><p>…</p></td></tr></table> Appendix 3 — Table 2 b. The purpose of the marking and the policies to be observed for appropriate change control of the marked MRBR tasks should be stated in the MRB report. c. The status of the compatible MRBR task with regard to the MRB process remains unchanged. d. If the DAH changes the marked MRBR task to the extent that the intent of the corresponding CCMR task is adversely affected, the DAH needs to create a CMR to satisfy the intent of the initial CCMR task. This change to the ALS requires EASA approval. e. For future escalations of MRBR tasks, the DAH should have procedures in place to ensure that these escalations do not increase the interval of the marked MRBR task beyond the corresponding CCMR interval. f. However, should the DAH escalate the marked MRBR task beyond the CCMR interval, the DAH needs to create a CMR in order to satisfy the corresponding CCMR. This change to the ALS requires EASA approval. Alternatively, the DAH could assess the feasibility of escalation of the interval of the corresponding CCMR by re-evaluating the system safety assumptions that lead to the CCMR at the time of initial certification. This change to the CCMR interval requires EASA involvement in accordance with the process described in paragraph 11 of this AMC. g. Furthermore, the DAH shall describe in the MRBR what the operator needs to observe when changing the operator’s aeroplane maintenance program (AMP). For tasks included in the AMP, which are based on marked MRBR tasks, the following applies: i. If the operator proposes to change the intent of a task, the operator should ask for the DAH’s confirmation that this change does not adversely affect the intent of the corresponding CCMR task. ii. If the operator proposes to escalate the interval of a task, the operator should ask for the DAH’s confirmation that this escalation does not increase the interval beyond the corresponding CCMR interval. These changes to the AMP require the approval of the competent authority responsible for the oversight of the operator. [Amdt 25/20] [Amdt 25/21]