Appendix 2 to AMC 20-6B - Aircraft systems reliability assessment

• ED Decision 2021/006/R found in: AMC-20 Amdt 22 - Airworthiness of Products, Parts and Appliances (May 2021)

Appendix 2 to AMC 20-6B – Aircraft systems reliability assessment ED Decision 2021/006/R 1. ASSESSMENT PROCESS The intent of this Appendix is to provide additional clarification to Sections 7 and 8 of Chapter II of this AMC. Airframe systems are required to show compliance with CS 25.1309. To establish whether a particular airframe/engine combination has satisfied the reliability requirements concerning the aircraft systems for extended-range operations, an assessment will be made by EASA, using all pertinent systems data provided by the applicant. To accomplish this assessment, EASA will need world-fleet data (where available) and data from various sources (operators, (S)TC holder, original equipment manufacturers (OEMs)). This data should be extensive enough and of sufficient maturity to enable EASA to assess with a high level of confidence, using engineering and operational judgement, that the risk of systems failures during a normal ETOPS flight or a diversion, is sufficiently low in direct relationship with the consequence of such failure conditions, under the operational environment of ETOPS missions. EASA will declare whether or not the current system reliability of a particular airframe/engine combination satisfies the relevant criteria. Included in the declaration, if the airframe/engine combination satisfies the relevant criteria, will be the airframe build standard, systems configuration, operating conditions and limitations, that are required to qualify the ETOPS significant systems as suitable for extended-range operations. Alternatively, where type design approval for Early ETOPS is sought at first entry into service, the engineering assessment can be based on substantiation by analysis, test, in-service experience or other means to show that the airframe significant systems will minimise failures and malfunctions, and will achieve a failure rate that is compatible with the specified safety target. 2. SYSTEM SAFETY ASSESSMENT ‘SSA’ (including reliability analysis) The system safety assessment (SSA) which should be conducted in accordance with CS 25.1309 for all ETOPS significant systems should follow the steps below: a. Conduct a (supplemental) functional hazard assessment (FHA) considering the ETOPS missions. In determining the effect of a failure condition during an ETOPS mission, the following should also be reviewed: (1) Crew workload over a prolonged period of time; (2) Operating conditions at single engine altitude; (3) Lesser crew familiarity with the procedures and conditions to fly to and land at diversion aerodromes. b. Introduce any additional failure scenario/objectives necessary to comply with this AMC. c. For compliance demonstration of ETOPS significant system reliability to CS 25.1309 there will be no distinction made between ETOPS group 1 and group 2 systems. For qualitative analysis (FHA), the maximum flight time and the maximum ETOPS diversion time should be considered. For quantitative analysis (SSA), the average ETOPS mission time and maximum ETOPS diversion time should be considered. Consideration should be given to how the particular airframe/engine combination is to be utilised, and analyse the potential route structure and city pairs available, based upon the range of the aeroplane. d. Consider effects of prolonged time and at single engine altitude in terms of continued operation of remaining systems following failures. e. Specific ETOPS maintenance tasks, intervals and specific ETOPS flight procedures necessary to attain the safety objectives, shall be included in the appropriate approved documents (e.g. CMP document, MMEL). f. Safety assessments should consider the flight consequences of single or multiple system failures leading to a diversion and the probability and consequences of subsequent failures or exhaustion of the capacity of time critical systems, which might occur during the diversion. Safety assessments should determine whether a diversion should be conducted to the nearest aerodrome or to an aerodrome presenting better operating conditions, considering: (1) The effect of the initial failure condition on the capability of the aeroplane to cope with adverse conditions at the diversion aerodrome, and (2) The means available to the crew to assess the extent and evolution of the situation during a prolonged diversion. The aircraft flight manual and the flight crew warning and alerting and display systems should provide clear information to enable the flight crew to determine when failure conditions are such that a diversion is necessary. 3. RELIABILITY VALIDATION METHODS There are two extremes in the ETOPS process with respect to maturity; one is the demonstration of stable reliability by the accumulation of in-service experience and the other is by a design, analysis and test programmes, agreed between the (S)TC holders and the EASA/the authority. a. In-service experience/systems safety assessment (SSA) In-service experience should generally be in accordance with that identified in [Appendix 1](#_DxCrossRefBm1701657982) for each airframe/engine combination. When considering the acceptability of airframe systems for ETOPS, maturity should be assessed in terms of used technology and the particular design under review. In performing the SSA, defined in paragraph 2 of this Appendix 2, particular account will be taken of the following: (1) For identical or similar equipment to those used on other aeroplanes, the SSA failure rates should be validated by in-service experience: (i) The amount of in-service experience (either direct or related) should be indicated for each equipment of an ETOPS significant system. (ii) Where related experience is used to validate failure modes and rates, an analysis should be produced to show the validity of the in-service experience. (iii) In particular, if the same equipment is used on a different airframe/engine combination, it should be shown that there is no difference in operating conditions (e.g. vibrations, pressure, temperature) or that these differences do not adversely affect the failure modes and rates. (iv) If in-service experience with similar equipment on other aeroplanes is claimed to be applicable, an analysis should be produced substantiating the reliability figures used on the quantitative analysis. This substantiation analysis should include details of the differences between the similar and new equipment, details of the in-service experience of the similar equipment and details of any ‘lessons learnt’ from modifications introduced and included in the new equipment. (v) For certain equipment (e.g. IDGs, TRUs, bleeds and emergency generators), this analysis may have to be backed up by tests. This should be agreed with EASA. (2) For new or substantially modified equipment, account should be taken in the SSA for the lack of validation of the failure rates by service experience. A study should be conducted to determine the sensitivity of the assumed SSA failure condition probabilities to the failure rates of the subject equipment. Should a failure case probability be sensitive to this equipment failure rate and close to the required safety objective, particular provision precautions should be applied (e.g. temporary dispatch restrictions, inspections, maintenance procedures, crew procedures) to account for the uncertainty, until the failure rate has been appropriately validated by in-service experience. b. Early ETOPS Where type design approval for Early ETOPS is sought at the first entry into service of the airframe/engine combination, the engineering assessment can be based on substantiation by analysis, test, in-service experience (the same engine or airframe with different engines) or other means, to show that the ETOPS significant systems will achieve a failure rate that is compatible with the specified safety objective. An approval plan, defining the early ETOPS reliability validation tests and processes, should be submitted by the (S)TC holders to EASA for agreement. This certification plan should be completed and implemented to the satisfaction of EASA before an ETOPS type design approval will be granted. (1) Acceptable early ETOPS approval plan In addition to the above considerations, the following should be complied with for an early ETOPS approval: (i) Aeroplane testing For each airframe/engine combination that has not yet accumulated at least 15 000 engine hours in service, to be approved for ETOPS, one or more aeroplanes should conduct flight testing which demonstrates that the airframe/engine combination, its components and equipment are capable for, and function properlyduring, ETOPS flights and ETOPS diversions. These flight tests may be coordinated with, but they are not in place of flight testing required in Part 21.A.35(b)(2). The flight test programme should include: (A) Flights simulating actual ETOPS operation, including normal cruise altitude, step climbs and APU operation if required for ETOPS; (B) Demonstration of the maximum normal flight duration with the maximum diversion time for which eligibility is sought; (C) Engine inoperative maximum time diversions to demonstrate the aeroplane and propulsion system’s capability to safely conduct an ETOPS diversion, including a repeat of an MCT diversion on the same engine; (D) Non-normal conditions to demonstrate the aeroplane’s capability to safely conduct an ETOPS diversion under worst-case probable system failure conditions; (E) Diversions into representative operational diversionary airports; (F) Repeated exposure to humid and inclement weather on the ground followed by long-range operations at normal cruise altitude; (G) Validation of the adequacy of the aeroplane’s flying qualities, performance and flight crew’s ability to deal with the conditions of paragraphs (C),(D) and (E) above. (H) Engine-inoperative diversions evenly distributed among the number of engines except as required by paragraph (C) above. (I) Provisions for the test aeroplane(s) to be operated and maintained using the recommended operations and maintenance manual procedures during the aeroplane demonstration test. (J) At the completion of the aeroplane(s) demonstration testing, an operational or functional check of the ETOPS significant systems must undergo as per the Instructions for Continued Airworthiness of CS 25.1529. The engines must also undergo a gas path inspection. These inspections are intended to identify any abnormal conditions that could result in an in-flight shutdown or diversion. Any abnormal conditions must be identified, tracked and resolved in accordance with subpart (2) below. This inspection requirement can be relaxed for ETOPS significant systems similar in design to proven models. (K) Maintenance and operational procedures. The applicant must validate all ETOPS significant systems maintenance and operational procedures. Any problems found as a result of the validation must be identified, tracked and resolved in accordance with subpart (2) below. (ii) APU testing If an APU is required for ETOPS, one APU of the type to be certified with the aeroplane should complete a test consisting of 3 000 equivalent aeroplane operational cycles. Following completion of the demonstration test, the APU must be disassembled and inspected. Any potential sources of in-flight start and/or run events should be identified, tracked and resolved in accordance with subpart (2) below. (2) Early ETOPS occurrence reporting & tracking (i) The holder of a (S)TC of an aeroplane which has been approved for ETOPS without service experience in accordance with this AMC, should establish a system to address problems and occurrences encountered on the airframe and propulsion systems that could affect the safety of ETOPS operations in order to timely resolve these events. (ii) The system should contain a means for the prompt identification of ETOPS‑related events, the timely notification of the event to EASA and for proposing to, and obtaining EASA’s approval for the resolution of this event. The implementation of the problem resolution can be accomplished by way of an EASA-approved change(s) to the type design, the manufacturing process, or an operating or maintenance procedure. (iii) The reporting system should be in place for at least the first 100 000 flight hours. The reporting requirement remains in place until the airframe and propulsion systems have demonstrated stable reliability in accordance with the required safety objectives. (iv) If the airframe/engine combination certified is a derivative of a previously certified aeroplane, these criteria may be amended by EASA, to require reporting on only those changed systems. (v) For the early ETOPS service period, an applicant must define the sources and content of in-service data that will be made available to them in support of their occurrence reporting and tracking system. The content of this data should be adequate to evaluate the specific cause of all service incidents reportable under Part 21.A.3A(b), in addition to the occurrences that could affect the safety of ETOPS operations and should be reported, including: (A) In-flight shutdown events; (B) Inability to control the engine or obtain desired power; (C) Precautionary thrust reductions (except for normal troubleshooting as allowed in the aircraft flight manual); (D) Degraded propulsion in-flight start capability; (E) Inadvertent fuel loss or availability, or uncorrectable fuel imbalance in flight; (F) Technical air turn-backs or diversions associated with an ETOPS Group 1 system; (G) Inability of an ETOPS Group 1 system, designed to provide backup capability after failure of a primary system, to provide the required backup capability in-flight; (H) Any loss of electrical power or hydraulic power system, during a given operation of the aeroplane; (I) Any event that would jeopardise the safe flight and landing of the aeroplane during an ETOPS flight. 4. CONTINUING SURVEILLANCE In order to confirm that the predicted system reliability level is achieved and maintained, the (S)TC holder should monitor the reliability of airframe ETOPS significant systems after entry into service. The (S)TC holder should submit a report to EASA, initially on a quarterly basis (for the first year of operation) and thereafter on a periodic basis and for a time to be agreed with EASA. The monitoring task should include all events on ETOPS significant systems, from both the ETOPS and non-ETOPS fleet of the subject family of airframes. This additional reliability monitoring is required only for ETOPS Group 1 systems. 5. CONTINUED AIRWORTHINESS a. Reliability Tracking Board EASA will periodically review its original findings by means of a reliability tracking board. In addition, the EASA document containing the CMP standard will be revised as necessary. **Note: The reliability tracking board will usually comprise specialists from aeroplane and engine disciplines. (See also** [**Appendix 1**](#_DxCrossRefBm1701657982)**).** Periodic meetings of the ETOPS reliability tracking board are normally frequent at the start of the assessment of a new product. The periodicity is adjusted by EASA upon accumulation of substantial in-service experience if there is evidence that the reliability of the product is sufficiently stable. The periodic meetings of the board are discontinued once an ETOPS product, or family of products, has been declared mature by EASA. b. Mature ETOPS products A family of ETOPS products with a high degree of similarity is considered to be mature when: (1) The product family has accumulated at least 250 000 flight hours for an aeroplane family; (2) The product family has accumulated service experience covering a comprehensive spectrum of operating conditions (e.g. cold, hot, high, humid); (3) Each ETOPS approved model or variant in the family has achieved the reliability objectives for ETOPS and has remained stable at or below the objectives fleet-wide for at least 2 years. New models or significant design changes may not be considered mature until they have individually satisfied the conditions specified above. EASA makes the determination of when a product or a product family is considered mature. c. Surveillance of mature ETOPS products The (S)TC holder of an ETOPS product which EASA has found mature, should institute a process to monitor the reliability of the product in accordance with the objectives defined in this Appendix. In case of occurrence of an event, a series of events or a statistical trend that implies a deviation of the reliability of the ETOPS fleet, or a portion of the ETOPS fleet (e.g. one model or a range of serial numbers), above the limits specified for ETOPS, the (S)TC should: (1) Inform EASA and define a means to restore the reliability through a Minor Revision of the CMP document, with a compliance schedule to be agreed with EASA if the situation has no immediate safety impact; (2) Inform EASA and propose an adhoc follow-up by EASA until the concern has been alleviated, or confirmed if the situation requires further assessment; (3) Inform EASA and propose the necessary corrective action(s) to be mandated by EASA through an AD if a direct safety concern exists. In the absence of a specific event or trend requiring action, the (S)TC holder should provide EASA with the basic statistical indicators prescribed in this Appendix 2 on a yearly basis. d. Minor revision of the ETOPS CMP Document A Minor Revision of the ETOPS CMP document is one that contains only editorial adjustments, configurations, maintenance and procedures equivalent to those already approved by EASA, or new reliability improvements which have no immediate impact on the safety of ETOPS flights and which are introduced as a means to control the continued compliance with the reliability objectives of ETOPS. Minor revisions of the ETOPS CMP document should be approved by authorised signatories of the Design Organisation and under the provisions of its approved Design Organisation Handbook. 6. DESIGN ORGANISATION APPROVAL (S)TC holders of products approved for ETOPS should hold a design organisation approval (DOA) conforming to Part21, with the appropriate terms of approval and privileges. Their approved design organisation handbook (DOH) must contain an appropriate description of the organisation and procedures covering all applicable tasks and responsibilities of Part21 and this AMC. [Amdt 20/7] [Amdt 20/21] Appendix 2 to AMC 20-6B – Aircraft systems reliability assessment ED Decision 2021/006/R 1.         ASSESSMENT PROCESS The intent of this Appendix is to provide additional clarification to Sections 7 and 8 of Chapter II of this AMC. Airframe systems are required to show compliance with CS 25.1309. To establish whether a particular airframe/engine combination has satisfied the reliability requirements concerning the aircraft systems for extended-range operations, an assessment will be made by EASA, using all pertinent systems data provided by the applicant. To accomplish this assessment, EASA will need world-fleet data (where available) and data from various sources (operators, (S)TC holder, original equipment manufacturers (OEMs)). This data should be extensive enough and of sufficient maturity to enable EASA to assess with a high level of confidence, using engineering and operational judgement, that the risk of systems failures during a normal ETOPS flight or a diversion, is sufficiently low in direct relationship with the consequence of such failure conditions, under the operational environment of ETOPS missions. EASA will declare whether or not the current system reliability of a particular airframe/engine combination satisfies the relevant criteria. Included in the declaration, if the airframe/engine combination satisfies the relevant criteria, will be the airframe build standard, systems configuration, operating conditions and limitations, that are required to qualify the ETOPS significant systems as suitable for extended-range operations. Alternatively, where type design approval for Early ETOPS is sought at first entry into service, the engineering assessment can be based on substantiation by analysis, test, in-service experience or other means to show that the airframe significant systems will minimise failures and malfunctions, and will achieve a failure rate that is compatible with the specified safety target. 2.         SYSTEM SAFETY ASSESSMENT ‘SSA’ (including reliability analysis) The system safety assessment (SSA) which should be conducted in accordance with CS 25.1309 for all ETOPS significant systems should follow the steps below: a.         Conduct a (supplemental) functional hazard assessment (FHA) considering the ETOPS missions. In determining the effect of a failure condition during an ETOPS mission, the following should also be reviewed: (1)       Crew workload over a prolonged period of time; (2)       Operating conditions at single engine altitude; (3)       Lesser crew familiarity with the procedures and conditions to fly to and land at diversion aerodromes. b.         Introduce any additional failure scenario/objectives necessary to comply with this AMC. c.         For compliance demonstration of ETOPS significant system reliability to CS 25.1309 there will be no distinction made between ETOPS group 1 and group 2 systems. For qualitative analysis (FHA), the maximum flight time and the maximum ETOPS diversion time should be considered. For quantitative analysis (SSA), the average ETOPS mission time and maximum ETOPS diversion time should be considered. Consideration should be given to how the particular airframe/engine combination is to be utilised, and analyse the potential route structure and city pairs available, based upon the range of the aeroplane. d.         Consider effects of prolonged time and at single engine altitude in terms of continued operation of remaining systems following failures. e.         Specific ETOPS maintenance tasks, intervals and specific ETOPS flight procedures necessary to attain the safety objectives, shall be included in the appropriate approved documents (e.g. CMP document, MMEL). f.          Safety assessments should consider the flight consequences of single or multiple system failures leading to a diversion and the probability and consequences of subsequent failures or exhaustion of the capacity of time critical systems, which might occur during the diversion. Safety assessments should determine whether a diversion should be conducted to the nearest aerodrome or to an aerodrome presenting better operating conditions, considering: (1)       The effect of the initial failure condition on the capability of the aeroplane to cope with adverse conditions at the diversion aerodrome, and (2)       The means available to the crew to assess the extent and evolution of the situation during a prolonged diversion. The aircraft flight manual and the flight crew warning and alerting and display systems should provide clear information to enable the flight crew to determine when failure conditions are such that a diversion is necessary. 3.         RELIABILITY VALIDATION METHODS There are two extremes in the ETOPS process with respect to maturity; one is the demonstration of stable reliability by the accumulation of in-service experience and the other is by a design, analysis and test programmes, agreed between the (S)TC holders and the EASA/the authority. a.         In-service experience/systems safety assessment (SSA) In-service experience should generally be in accordance with that identified in [Appendix 1](#_DxCrossRefBm1926189226) for each airframe/engine combination. When considering the acceptability of airframe systems for ETOPS, maturity should be assessed in terms of used technology and the particular design under review. In performing the SSA, defined in paragraph 2 of this Appendix 2, particular account will be taken of the following: (1)       For identical or similar equipment to those used on other aeroplanes, the SSA failure rates should be validated by in-service experience: (i)        The amount of in-service experience (either direct or related) should be indicated for each equipment of an ETOPS significant system. (ii)       Where related experience is used to validate failure modes and rates, an analysis should be produced to show the validity of the in-service experience. (iii)      In particular, if the same equipment is used on a different airframe/engine combination, it should be shown that there is no difference in operating conditions (e.g. vibrations, pressure, temperature) or that these differences do not adversely affect the failure modes and rates. (iv)      If in-service experience with similar equipment on other aeroplanes is claimed to be applicable, an analysis should be produced substantiating the reliability figures used on the quantitative analysis. This substantiation analysis should include details of the differences between the similar and new equipment, details of the in-service experience of the similar equipment and details of any ‘lessons learnt’ from modifications introduced and included in the new equipment. (v)       For certain equipment (e.g. IDGs, TRUs, bleeds and emergency generators), this analysis may have to be backed up by tests. This should be agreed with EASA. (2)       For new or substantially modified equipment, account should be taken in the SSA for the lack of validation of the failure rates by service experience. A study should be conducted to determine the sensitivity of the assumed SSA failure condition probabilities to the failure rates of the subject equipment. Should a failure case probability be sensitive to this equipment failure rate and close to the required safety objective, particular provision precautions should be applied (e.g. temporary dispatch restrictions, inspections, maintenance procedures, crew procedures) to account for the uncertainty, until the failure rate has been appropriately validated by in-service experience. b.         Early ETOPS Where type design approval for Early ETOPS is sought at the first entry into service of the airframe/engine combination, the engineering assessment can be based on substantiation by analysis, test, in-service experience (the same engine or airframe with different engines) or other means, to show that the ETOPS significant systems will achieve a failure rate that is compatible with the specified safety objective. An approval plan, defining the early ETOPS reliability validation tests and processes, should be submitted by the (S)TC holders to EASA for agreement. This certification plan should be completed and implemented to the satisfaction of EASA before an ETOPS type design approval will be granted. (1)       Acceptable early ETOPS approval plan In addition to the above considerations, the following should be complied with for an early ETOPS approval: (i)        Aeroplane testing For each airframe/engine combination that has not yet accumulated at least 15 000 engine hours in service, to be approved for ETOPS, one or more aeroplanes should conduct flight testing which demonstrates that the airframe/engine combination, its components and equipment are capable for, and function properlyduring, ETOPS flights and ETOPS diversions. These flight tests may be coordinated with, but they are not in place of flight testing required in Part 21.A.35(b)(2). The flight test programme should include: (A)      Flights simulating actual ETOPS operation, including normal cruise altitude, step climbs and APU operation if required for ETOPS; (B)       Demonstration of the maximum normal flight duration with the maximum diversion time for which eligibility is sought; (C)       Engine inoperative maximum time diversions to demonstrate the aeroplane and propulsion system’s capability to safely conduct an ETOPS diversion, including a repeat of an MCT diversion on the same engine; (D)      Non-normal conditions to demonstrate the aeroplane’s capability to safely conduct an ETOPS diversion under worst-case probable system failure conditions; (E)       Diversions into representative operational diversionary airports; (F)       Repeated exposure to humid and inclement weather on the ground followed by long-range operations at normal cruise altitude; (G)      Validation of the adequacy of the aeroplane’s flying qualities, performance and flight crew’s ability to deal with the conditions of paragraphs (C),(D) and (E) above. (H)      Engine-inoperative diversions evenly distributed among the number of engines except as required by paragraph (C) above. (I)        Provisions for the test aeroplane(s) to be operated and maintained using the recommended operations and maintenance manual procedures during the aeroplane demonstration test. (J)        At the completion of the aeroplane(s) demonstration testing, an operational or functional check of the ETOPS significant systems must undergo as per the Instructions for Continued Airworthiness of CS 25.1529. The engines must also undergo a gas path inspection. These inspections are intended to identify any abnormal conditions that could result in an in-flight shutdown or diversion. Any abnormal conditions must be identified, tracked and resolved in accordance with subpart (2) below. This inspection requirement can be relaxed for ETOPS significant systems similar in design to proven models. (K)       Maintenance and operational procedures. The applicant must validate all ETOPS significant systems maintenance and operational procedures. Any problems found as a result of the validation must be identified, tracked and resolved in accordance with subpart (2) below. (ii)       APU testing If an APU is required for ETOPS, one APU of the type to be certified with the aeroplane should complete a test consisting of 3 000 equivalent aeroplane operational cycles. Following completion of the demonstration test, the APU must be disassembled and inspected. Any potential sources of in-flight start and/or run events should be identified, tracked and resolved in accordance with subpart (2) below. (2)       Early ETOPS occurrence reporting & tracking (i)        The holder of a (S)TC of an aeroplane which has been approved for ETOPS without service experience in accordance with this AMC, should establish a system to address problems and occurrences encountered on the airframe and propulsion systems that could affect the safety of ETOPS operations in order to timely resolve these events. (ii)       The system should contain a means for the prompt identification of ETOPS‑related events, the timely notification of the event to EASA and for proposing to, and obtaining EASA’s approval for the resolution of this event. The implementation of the problem resolution can be accomplished by way of an EASA-approved change(s) to the type design, the manufacturing process, or an operating or maintenance procedure. (iii)      The reporting system should be in place for at least the first 100 000 flight hours. The reporting requirement remains in place until the airframe and propulsion systems have demonstrated stable reliability in accordance with the required safety objectives. (iv)      If the airframe/engine combination certified is a derivative of a previously certified aeroplane, these criteria may be amended by EASA, to require reporting on only those changed systems. (v)       For the early ETOPS service period, an applicant must define the sources and content of in-service data that will be made available to them in support of their occurrence reporting and tracking system. The content of this data should be adequate to evaluate the specific cause of all service incidents reportable under Part 21.A.3A(b), in addition to the occurrences that could affect the safety of ETOPS operations and should be reported, including: (A)      In-flight shutdown events; (B)       Inability to control the engine or obtain desired power; (C)       Precautionary thrust reductions (except for normal troubleshooting as allowed in the aircraft flight manual); (D)      Degraded propulsion in-flight start capability; (E)       Inadvertent fuel loss or availability, or uncorrectable fuel imbalance in flight; (F)       Technical air turn-backs or diversions associated with an ETOPS Group 1 system; (G)      Inability of an ETOPS Group 1 system, designed to provide backup capability after failure of a primary system, to provide the required backup capability in-flight; (H)      Any loss of electrical power or hydraulic power system, during a given operation of the aeroplane; (I)        Any event that would jeopardise the safe flight and landing of the aeroplane during an ETOPS flight. 4.         CONTINUING SURVEILLANCE In order to confirm that the predicted system reliability level is achieved and maintained, the (S)TC holder should monitor the reliability of airframe ETOPS significant systems after entry into service. The (S)TC holder should submit a report to EASA, initially on a quarterly basis (for the first year of operation) and thereafter on a periodic basis and for a time to be agreed with EASA. The monitoring task should include all events on ETOPS significant systems, from both the ETOPS and non-ETOPS fleet of the subject family of airframes. This additional reliability monitoring is required only for ETOPS Group 1 systems. 5.         CONTINUED AIRWORTHINESS a.         Reliability Tracking Board EASA will periodically review its original findings by means of a reliability tracking board. In addition, the EASA document containing the CMP standard will be revised as necessary. **Note: The reliability tracking board will usually comprise specialists from aeroplane and engine disciplines. (See also** [**Appendix 1**](#_DxCrossRefBm1926189226)**).** Periodic meetings of the ETOPS reliability tracking board are normally frequent at the start of the assessment of a new product. The periodicity is adjusted by EASA upon accumulation of substantial in-service experience if there is evidence that the reliability of the product is sufficiently stable. The periodic meetings of the board are discontinued once an ETOPS product, or family of products, has been declared mature by EASA. b.         Mature ETOPS products A family of ETOPS products with a high degree of similarity is considered to be mature when: (1)       The product family has accumulated at least 250 000 flight hours for an aeroplane family; (2)       The product family has accumulated service experience covering a comprehensive spectrum of operating conditions (e.g. cold, hot, high, humid); (3)       Each ETOPS approved model or variant in the family has achieved the reliability objectives for ETOPS and has remained stable at or below the objectives fleet-wide for at least 2 years. New models or significant design changes may not be considered mature until they have individually satisfied the conditions specified above. EASA makes the determination of when a product or a product family is considered mature. c.         Surveillance of mature ETOPS products The (S)TC holder of an ETOPS product which EASA has found mature, should institute a process to monitor the reliability of the product in accordance with the objectives defined in this Appendix. In case of occurrence of an event, a series of events or a statistical trend that implies a deviation of the reliability of the ETOPS fleet, or a portion of the ETOPS fleet (e.g. one model or a range of serial numbers), above the limits specified for ETOPS, the (S)TC should: (1)       Inform EASA and define a means to restore the reliability through a Minor Revision of the CMP document, with a compliance schedule to be agreed with EASA if the situation has no immediate safety impact; (2)       Inform EASA and propose an adhoc follow-up by EASA until the concern has been alleviated, or confirmed if the situation requires further assessment; (3)       Inform EASA and propose the necessary corrective action(s) to be mandated by EASA through an AD if a direct safety concern exists. In the absence of a specific event or trend requiring action, the (S)TC holder should provide EASA with the basic statistical indicators prescribed in this Appendix 2 on a yearly basis. d.         Minor revision of the ETOPS CMP Document A Minor Revision of the ETOPS CMP document is one that contains only editorial adjustments, configurations, maintenance and procedures equivalent to those already approved by EASA, or new reliability improvements which have no immediate impact on the safety of ETOPS flights and which are introduced as a means to control the continued compliance with the reliability objectives of ETOPS. Minor revisions of the ETOPS CMP document should be approved by authorised signatories of the Design Organisation and under the provisions of its approved Design Organisation Handbook. 6.         DESIGN ORGANISATION APPROVAL (S)TC holders of products approved for ETOPS should hold a design organisation approval (DOA) conforming to Part21, with the appropriate terms of approval and privileges. Their approved design organisation handbook (DOH) must contain an appropriate description of the organisation and procedures covering all applicable tasks and responsibilities of Part21 and this AMC. [Amdt 20/7] [Amdt 20/21] Appendix 2 to AMC 20-6B – Aircraft systems reliability assessment ED Decision 2021/006/R 1.         ASSESSMENT PROCESS The intent of this Appendix is to provide additional clarification to Sections 7 and 8 of Chapter II of this AMC. Airframe systems are required to show compliance with CS 25.1309. To establish whether a particular airframe/engine combination has satisfied the reliability requirements concerning the aircraft systems for extended-range operations, an assessment will be made by EASA, using all pertinent systems data provided by the applicant. To accomplish this assessment, EASA will need world-fleet data (where available) and data from various sources (operators, (S)TC holder, original equipment manufacturers (OEMs)). This data should be extensive enough and of sufficient maturity to enable EASA to assess with a high level of confidence, using engineering and operational judgement, that the risk of systems failures during a normal ETOPS flight or a diversion, is sufficiently low in direct relationship with the consequence of such failure conditions, under the operational environment of ETOPS missions. EASA will declare whether or not the current system reliability of a particular airframe/engine combination satisfies the relevant criteria. Included in the declaration, if the airframe/engine combination satisfies the relevant criteria, will be the airframe build standard, systems configuration, operating conditions and limitations, that are required to qualify the ETOPS significant systems as suitable for extended-range operations. Alternatively, where type design approval for Early ETOPS is sought at first entry into service, the engineering assessment can be based on substantiation by analysis, test, in-service experience or other means to show that the airframe significant systems will minimise failures and malfunctions, and will achieve a failure rate that is compatible with the specified safety target. 2.         SYSTEM SAFETY ASSESSMENT ‘SSA’ (including reliability analysis) The system safety assessment (SSA) which should be conducted in accordance with CS 25.1309 for all ETOPS significant systems should follow the steps below: a.         Conduct a (supplemental) functional hazard assessment (FHA) considering the ETOPS missions. In determining the effect of a failure condition during an ETOPS mission, the following should also be reviewed: (1)       Crew workload over a prolonged period of time; (2)       Operating conditions at single engine altitude; (3)       Lesser crew familiarity with the procedures and conditions to fly to and land at diversion aerodromes. b.         Introduce any additional failure scenario/objectives necessary to comply with this AMC. c.         For compliance demonstration of ETOPS significant system reliability to CS 25.1309 there will be no distinction made between ETOPS group 1 and group 2 systems. For qualitative analysis (FHA), the maximum flight time and the maximum ETOPS diversion time should be considered. For quantitative analysis (SSA), the average ETOPS mission time and maximum ETOPS diversion time should be considered. Consideration should be given to how the particular airframe/engine combination is to be utilised, and analyse the potential route structure and city pairs available, based upon the range of the aeroplane. d.         Consider effects of prolonged time and at single engine altitude in terms of continued operation of remaining systems following failures. e.         Specific ETOPS maintenance tasks, intervals and specific ETOPS flight procedures necessary to attain the safety objectives, shall be included in the appropriate approved documents (e.g. CMP document, MMEL). f.          Safety assessments should consider the flight consequences of single or multiple system failures leading to a diversion and the probability and consequences of subsequent failures or exhaustion of the capacity of time critical systems, which might occur during the diversion. Safety assessments should determine whether a diversion should be conducted to the nearest aerodrome or to an aerodrome presenting better operating conditions, considering: (1)       The effect of the initial failure condition on the capability of the aeroplane to cope with adverse conditions at the diversion aerodrome, and (2)       The means available to the crew to assess the extent and evolution of the situation during a prolonged diversion. The aircraft flight manual and the flight crew warning and alerting and display systems should provide clear information to enable the flight crew to determine when failure conditions are such that a diversion is necessary. 3.         RELIABILITY VALIDATION METHODS There are two extremes in the ETOPS process with respect to maturity; one is the demonstration of stable reliability by the accumulation of in-service experience and the other is by a design, analysis and test programmes, agreed between the (S)TC holders and the EASA/the authority. a.         In-service experience/systems safety assessment (SSA) In-service experience should generally be in accordance with that identified in [Appendix 1](#_DxCrossRefBm421436788) for each airframe/engine combination. When considering the acceptability of airframe systems for ETOPS, maturity should be assessed in terms of used technology and the particular design under review. In performing the SSA, defined in paragraph 2 of this Appendix 2, particular account will be taken of the following: (1)       For identical or similar equipment to those used on other aeroplanes, the SSA failure rates should be validated by in-service experience: (i)        The amount of in-service experience (either direct or related) should be indicated for each equipment of an ETOPS significant system. (ii)       Where related experience is used to validate failure modes and rates, an analysis should be produced to show the validity of the in-service experience. (iii)      In particular, if the same equipment is used on a different airframe/engine combination, it should be shown that there is no difference in operating conditions (e.g. vibrations, pressure, temperature) or that these differences do not adversely affect the failure modes and rates. (iv)      If in-service experience with similar equipment on other aeroplanes is claimed to be applicable, an analysis should be produced substantiating the reliability figures used on the quantitative analysis. This substantiation analysis should include details of the differences between the similar and new equipment, details of the in-service experience of the similar equipment and details of any ‘lessons learnt’ from modifications introduced and included in the new equipment. (v)       For certain equipment (e.g. IDGs, TRUs, bleeds and emergency generators), this analysis may have to be backed up by tests. This should be agreed with EASA. (2)       For new or substantially modified equipment, account should be taken in the SSA for the lack of validation of the failure rates by service experience. A study should be conducted to determine the sensitivity of the assumed SSA failure condition probabilities to the failure rates of the subject equipment. Should a failure case probability be sensitive to this equipment failure rate and close to the required safety objective, particular provision precautions should be applied (e.g. temporary dispatch restrictions, inspections, maintenance procedures, crew procedures) to account for the uncertainty, until the failure rate has been appropriately validated by in-service experience. b.         Early ETOPS Where type design approval for Early ETOPS is sought at the first entry into service of the airframe/engine combination, the engineering assessment can be based on substantiation by analysis, test, in-service experience (the same engine or airframe with different engines) or other means, to show that the ETOPS significant systems will achieve a failure rate that is compatible with the specified safety objective. An approval plan, defining the early ETOPS reliability validation tests and processes, should be submitted by the (S)TC holders to EASA for agreement. This certification plan should be completed and implemented to the satisfaction of EASA before an ETOPS type design approval will be granted. (1)       Acceptable early ETOPS approval plan In addition to the above considerations, the following should be complied with for an early ETOPS approval: (i)        Aeroplane testing For each airframe/engine combination that has not yet accumulated at least 15 000 engine hours in service, to be approved for ETOPS, one or more aeroplanes should conduct flight testing which demonstrates that the airframe/engine combination, its components and equipment are capable for, and function properlyduring, ETOPS flights and ETOPS diversions. These flight tests may be coordinated with, but they are not in place of flight testing required in Part 21.A.35(b)(2). The flight test programme should include: (A)      Flights simulating actual ETOPS operation, including normal cruise altitude, step climbs and APU operation if required for ETOPS; (B)       Demonstration of the maximum normal flight duration with the maximum diversion time for which eligibility is sought; (C)       Engine inoperative maximum time diversions to demonstrate the aeroplane and propulsion system’s capability to safely conduct an ETOPS diversion, including a repeat of an MCT diversion on the same engine; (D)      Non-normal conditions to demonstrate the aeroplane’s capability to safely conduct an ETOPS diversion under worst-case probable system failure conditions; (E)       Diversions into representative operational diversionary airports; (F)       Repeated exposure to humid and inclement weather on the ground followed by long-range operations at normal cruise altitude; (G)      Validation of the adequacy of the aeroplane’s flying qualities, performance and flight crew’s ability to deal with the conditions of paragraphs (C),(D) and (E) above. (H)      Engine-inoperative diversions evenly distributed among the number of engines except as required by paragraph (C) above. (I)        Provisions for the test aeroplane(s) to be operated and maintained using the recommended operations and maintenance manual procedures during the aeroplane demonstration test. (J)        At the completion of the aeroplane(s) demonstration testing, an operational or functional check of the ETOPS significant systems must undergo as per the Instructions for Continued Airworthiness of CS 25.1529. The engines must also undergo a gas path inspection. These inspections are intended to identify any abnormal conditions that could result in an in-flight shutdown or diversion. Any abnormal conditions must be identified, tracked and resolved in accordance with subpart (2) below. This inspection requirement can be relaxed for ETOPS significant systems similar in design to proven models. (K)       Maintenance and operational procedures. The applicant must validate all ETOPS significant systems maintenance and operational procedures. Any problems found as a result of the validation must be identified, tracked and resolved in accordance with subpart (2) below. (ii)       APU testing If an APU is required for ETOPS, one APU of the type to be certified with the aeroplane should complete a test consisting of 3 000 equivalent aeroplane operational cycles. Following completion of the demonstration test, the APU must be disassembled and inspected. Any potential sources of in-flight start and/or run events should be identified, tracked and resolved in accordance with subpart (2) below. (2)       Early ETOPS occurrence reporting & tracking (i)        The holder of a (S)TC of an aeroplane which has been approved for ETOPS without service experience in accordance with this AMC, should establish a system to address problems and occurrences encountered on the airframe and propulsion systems that could affect the safety of ETOPS operations in order to timely resolve these events. (ii)       The system should contain a means for the prompt identification of ETOPS‑related events, the timely notification of the event to EASA and for proposing to, and obtaining EASA’s approval for the resolution of this event. The implementation of the problem resolution can be accomplished by way of an EASA-approved change(s) to the type design, the manufacturing process, or an operating or maintenance procedure. (iii)      The reporting system should be in place for at least the first 100 000 flight hours. The reporting requirement remains in place until the airframe and propulsion systems have demonstrated stable reliability in accordance with the required safety objectives. (iv)      If the airframe/engine combination certified is a derivative of a previously certified aeroplane, these criteria may be amended by EASA, to require reporting on only those changed systems. (v)       For the early ETOPS service period, an applicant must define the sources and content of in-service data that will be made available to them in support of their occurrence reporting and tracking system. The content of this data should be adequate to evaluate the specific cause of all service incidents reportable under Part 21.A.3A(b), in addition to the occurrences that could affect the safety of ETOPS operations and should be reported, including: (A)      In-flight shutdown events; (B)       Inability to control the engine or obtain desired power; (C)       Precautionary thrust reductions (except for normal troubleshooting as allowed in the aircraft flight manual); (D)      Degraded propulsion in-flight start capability; (E)       Inadvertent fuel loss or availability, or uncorrectable fuel imbalance in flight; (F)       Technical air turn-backs or diversions associated with an ETOPS Group 1 system; (G)      Inability of an ETOPS Group 1 system, designed to provide backup capability after failure of a primary system, to provide the required backup capability in-flight; (H)      Any loss of electrical power or hydraulic power system, during a given operation of the aeroplane; (I)        Any event that would jeopardise the safe flight and landing of the aeroplane during an ETOPS flight. 4.         CONTINUING SURVEILLANCE In order to confirm that the predicted system reliability level is achieved and maintained, the (S)TC holder should monitor the reliability of airframe ETOPS significant systems after entry into service. The (S)TC holder should submit a report to EASA, initially on a quarterly basis (for the first year of operation) and thereafter on a periodic basis and for a time to be agreed with EASA. The monitoring task should include all events on ETOPS significant systems, from both the ETOPS and non-ETOPS fleet of the subject family of airframes. This additional reliability monitoring is required only for ETOPS Group 1 systems. 5.         CONTINUED AIRWORTHINESS a.         Reliability Tracking Board EASA will periodically review its original findings by means of a reliability tracking board. In addition, the EASA document containing the CMP standard will be revised as necessary. **Note: The reliability tracking board will usually comprise specialists from aeroplane and engine disciplines. (See also** [**Appendix 1**](#_DxCrossRefBm421436788)**).** Periodic meetings of the ETOPS reliability tracking board are normally frequent at the start of the assessment of a new product. The periodicity is adjusted by EASA upon accumulation of substantial in-service experience if there is evidence that the reliability of the product is sufficiently stable. The periodic meetings of the board are discontinued once an ETOPS product, or family of products, has been declared mature by EASA. b.         Mature ETOPS products A family of ETOPS products with a high degree of similarity is considered to be mature when: (1)       The product family has accumulated at least 250 000 flight hours for an aeroplane family; (2)       The product family has accumulated service experience covering a comprehensive spectrum of operating conditions (e.g. cold, hot, high, humid); (3)       Each ETOPS approved model or variant in the family has achieved the reliability objectives for ETOPS and has remained stable at or below the objectives fleet-wide for at least 2 years. New models or significant design changes may not be considered mature until they have individually satisfied the conditions specified above. EASA makes the determination of when a product or a product family is considered mature. c.         Surveillance of mature ETOPS products The (S)TC holder of an ETOPS product which EASA has found mature, should institute a process to monitor the reliability of the product in accordance with the objectives defined in this Appendix. In case of occurrence of an event, a series of events or a statistical trend that implies a deviation of the reliability of the ETOPS fleet, or a portion of the ETOPS fleet (e.g. one model or a range of serial numbers), above the limits specified for ETOPS, the (S)TC should: (1)       Inform EASA and define a means to restore the reliability through a Minor Revision of the CMP document, with a compliance schedule to be agreed with EASA if the situation has no immediate safety impact; (2)       Inform EASA and propose an adhoc follow-up by EASA until the concern has been alleviated, or confirmed if the situation requires further assessment; (3)       Inform EASA and propose the necessary corrective action(s) to be mandated by EASA through an AD if a direct safety concern exists. In the absence of a specific event or trend requiring action, the (S)TC holder should provide EASA with the basic statistical indicators prescribed in this Appendix 2 on a yearly basis. d.         Minor revision of the ETOPS CMP Document A Minor Revision of the ETOPS CMP document is one that contains only editorial adjustments, configurations, maintenance and procedures equivalent to those already approved by EASA, or new reliability improvements which have no immediate impact on the safety of ETOPS flights and which are introduced as a means to control the continued compliance with the reliability objectives of ETOPS. Minor revisions of the ETOPS CMP document should be approved by authorised signatories of the Design Organisation and under the provisions of its approved Design Organisation Handbook. 6.         DESIGN ORGANISATION APPROVAL (S)TC holders of products approved for ETOPS should hold a design organisation approval (DOA) conforming to Part21, with the appropriate terms of approval and privileges. Their approved design organisation handbook (DOH) must contain an appropriate description of the organisation and procedures covering all applicable tasks and responsibilities of Part21 and this AMC. [Amdt 20/7] [Amdt 20/21]