Annex B: Design Change Categorization Checklist – Advisory Material

1.  Instructions for the Completion of the Categorization Checklist in Annex A

1.1  This checklist is intended to be used by TAA-Acceptable Organizations (Acceptable Design Organizations (ADOs) and Acceptable Technical Organizations (ATOs)) and Authorized Individuals (AI) in the process of categorizing design changes as either ‘Minor’ or ‘Major’.

1.2  This checklist is to be used only for Modifications/Alterations to DND/CAF aircraft, including changes to the physical design and configuration, aircraft software, aircraft roles and missions, operating environment; and aircraft flight avionics and mission.

1.3  To improve readability, the checklist questions use the words ‘has an effect’ or ‘affects’. These terms are to be taken as a contraction of the phrase ‘has an appreciable effect’ and ‘appreciably affect(s)’

1.4  This checklist is not applicable to design changes that involve Structural Repairs, changes to the Approved Maintenance Program, the Approved Flight Manual (AFM) and the Master Minimum Equipment List (MMEL). As described in paragraph 2.2 of the advisory, each of these types of changes have their own categorization procedure.

1.5  Checklist - Part 1 – Design Change Information. Insert the relevant design change information.

1.6  Checklist - Part 2 – Design Change Categorization Question Set. A response must be provided for all of the questions provided in Part 2. The questions in this checklist have been developed such that, if the response to any of the checklist questions is ‘Yes’, then the design change has an appreciable effect on airworthiness and therefore, must be categorized as ‘Major’. If the response to all of the questions is ‘No’, then there are no appreciable effects and the change is ‘Minor’. The ‘Comments’ column in the checklist may be used to provide additional substantiation for the assessment. The person(s) answering the Part 2 questions is(are) not required to be formally designated as a TAA AI.

1.7  Checklist - Part 3 – Design Change Categorization Review and Approval. This section is to be completed by an individual authorized by the TAA to review the checklist question responses and approve the categorization results.

1.8   Annex B Advisory Material. The advisory material provided in paragraph 2 of this annex is intended to assist respondents in answering the checklist categorization questions. The advisory material provides additional criteria and examples of major design changes.

1.9   The individual(s) involved in the categorization of design changes should be aware of the impact that a change to one aircraft system may have on the airworthiness of the systems of the aircraft.

2.  Advisory Material – Checklist Questions

2.1   A – General Criteria Applicable to all of the Aircraft Systems. The following are criteria that apply to changes to any system in the aircraft. A design change shall be classified major when one or more of the following conditions are met:

A1.  Does the System Safety Assessment (SSA)/Functional Hazard Assessment (FHA) for the design change result in an increase in the severity of the hazard classification level?  For example from ‘Minor’ to ’Major’, from ’Major’ to ’Hazardous’ or from ’Hazardous’ to ’Catastrophic’.

A2.  Will the change require the addition of any new airworthiness requirements or a new interpretation of the certification requirements in the design certification basis? Examples include:

1. requiring compliance with additional certification requirements;
2. requiring the addition of a special condition.

A3.  Will the change require the use of a means/methods of demonstrating compliance that is appreciably different from the one previously used in certifying the type, or one that the TAA had not previously accepted?  For example, if the change requires a significantly expanded flight and/or lab testing program, as compared to that used during the original design certification program, then the change is likely to be appreciable.

A4.  Will the change alter (add, remove or amend) any of the aircraft limitations or restrictions? By definition, any alteration to the limitations or restrictions listed for the type design is considered a major change.

A5.  Will the change introduce a new or revised standard or means of compliance as compared to those used in the original certification of the design? Where a new or different design standard, or a new/different means of compliance is used in place of the one used during the original certification, then the associated design change should be categorized as “major”, since the findings of compliance, for the portions of the design affected by the change, must be repeated using the new standard or means of compliance.

2.2   B – Aircraft Usage, Performance and Flight Characteristics. A design change must be considered major if it appreciably affects the certified aircraft performance and flight characteristics, according to the following criteria:

B1.   Will there be an appreciable change to the aircraft roles, missions or capabilities? An example of appreciable change would be expanding the operating envelope of a helicopter from land-based-only operations to include operation from a naval vessel. Other examples include:

1. changes to the aircraft Statement of Operating Intent (SOI);
2. changes to the maximum allowable weight of the aircraft;
3. changes to the exposure to flight in icing conditions;
4. changes to the minimum or maximum operating altitudes;
5. changes to the extended over-water operating limits;
6. installation of flare and chaff systems;
7. installation of systems integrating a high-power laser; and
8. change in the intensity and/or frequency of high-g manoeuvers.

B2.   Will there be any appreciable changes to the aircraft operating environment? An example of change to the approved operating environment would be expanding the areas of allowable operation to include Northern Domestic Airspace and Polar Regions, which requires a means of establishing direction that is not dependent upon a magnetic source. Other examples include expanding the aircraft limits for:

1. geo-location;
2. temperature;
3. visibility;
4. low-altitude operations;
5. exposure to potential icing conditions;
6. exposure to salt spray; or
7. exposure to lightning.

B3.  Will the change appreciably affect the ability of the aircraft to operate in controlled airspace? An example would be the installation of a capability for performance-based operation, which includes the following:

1. Required Navigation Performance (RNP);
2. Area Navigation (RNAV);
3. Automatic Dependant Surveillance Broadcast (ADS-B); and
4. Reduced Vertical Separation Minimum (RVSM).

B4.  Will the change have an appreciable effect on the aircraft’s performance characteristics or limitations? Examples of changes that may have an appreciable effect include:

1. alterations to the wings, tail surfaces and fuselage;
2. alterations to the flight control systems and handling qualities, including changes to the flight controls function (gains adjustments, functional modification to software), or changes to the flight protection or warning system;
3. changes that have the potential to affect the flutter or vibration characteristics;
4. alterations to the design airspeeds, airspeed limitations, acceleration (g’s) and altitude limits;
5. alterations to the take-off, climb or landing performance, including the take-off or landing decision points;
6. alterations to the longitudinal, lateral or directional control or stability;
7. alterations to the performance or functioning of any lift or drag devices,
8. alterations to the height-velocity envelope of the rotorcraft;
9. alterations to the stalling speed or stalling characteristics, including changes to the stall protection and warning systems;
10. alterations to the hover or auto-rotation performance of the rotorcraft;
11. alterations to the structural flight envelope (V-n diagram);
12. alterations to the performance or function of any lift or drag devices;
13. alterations to the approved weight or center of gravity (C of G) limits,
14. alterations to the ground handling characteristics, including now-wheel steering; or
15. alterations to the compartment capacity limits, specifically the maximum weight allowable for the various compartments of the aircraft.

B5.  Will the change have an appreciable effect on the exterior profile of the aircraft? Examples of changes to the exterior profile of the aircraft include:

1. significantly increase drag, or exceed aerodynamic smoothness limits;
2. a change in the shape of the wing, empennage or flight control surfaces;
3. the addition of winglets, radome or antenna; or
4. the installation of new external tanks or stores.

B6.  Will the change appreciably affect the installation, configuration, service life or performance of any propellers, main rotor or tail rotors? Examples include:

1. alterations to the propeller/rotor blade: diameter, material; airfoil shape, planform; number of rotor blades and material; and
2. alterations to the propeller/rotor drive system, hubs including dampers and controls, the blade retention system and blade lubrication systems.

B7.   Will the change appreciably affect the ability of the aircraft to continue to meet the environmental noise standards established during the original certification of the design? Aircraft noise consists of engine noise and airframe noise. Engine noise emanates from the fans and compressors inside the jet engine. Airframe noise is generated when air passes over the plane’s body (the fuselage) and its wings. This causes friction and turbulence, which make a noise. Sources of airframe noise include the fuselage, main wings, landing gear and wheel-bays, trailing edge flaps, leading edge slats, etc. Typically, engine noise is the dominant aircraft noise source during takeoffs, while airframe noise is a bigger contributor to noise source during landings.

2.3  C – Structures, Mechanical and Hydraulic Systems. A design change is appreciable and must be considered major if it affects any of the areas or conditions described in the following:

C1.   Changes to the structural strength, loads applied or dynamic response related to the airframe, dynamic components, flight controls, mechanical systems or mission equipment, including:

1. changes, such as a cargo door cut-out, fuselage plugs, change of dihedral, addition of floats;
2. changes that affect primary structural element loads and their path;
3. changes to materials, processes or methods of manufacture of primary structural elements, such as spars, frames and critical parts;
4. changes that affect dynamic components, flight controls, mechanical systems or mission equipment;
5. structural changes that involve the use of alternate material or production methodology,
6. changes that affect the flight control system or control system loads;
7. changes that affect any stability augmentation or any automatic or power-operated control system;
8. changes that affect the structural strength and/or loads applied to the stressed-skin wing, vertical and horizontal stabilizer, engine mounts, nacelles or landing gear support structure;
9. changes that affect the structural strength or dynamic response of the main/tail rotor structure, rotorcraft fuselage and/or rotor pylon;
10. changes that affect the mass distribution of a structural component;
11. changes that affect the structural flight envelope (V-n diagram);
12. the structural strength and/or loads applied to the crew and occupants harnesses, seats and seat attachment points, during an emergency landing or crash;
13. changes that affect the strength and/or crashworthiness of compartment interiors, equipment racks, mission consoles and furnishings; or
14. changes that affect the compartment capacity limits, specifically the maximum weight allowable for the various compartments of the aircraft.

C2.  Changes to the physical characteristics or performance of a life-limited part or structural components that are subject to damage tolerance or fatigue evaluation, including:

1. changes that adversely affect fatigue or damage tolerance or life limit characteristics; or
2. changes that affect physical characteristics or performance of a life-limited part or structural components that are subject to damage tolerance or fatigue evaluation.

C3.  Changes to the configuration, operation, function or performance of the following aircraft systems:

1. changes that affect undercarriage and wheels, including:
   1. the operation of the landing gear, including retraction and extension;
   2. the ground handling characteristics, including nose-wheel steering;
   3. the performance or functioning of the brakes.
2. changes that affect the hydraulic system, including:
   1. the function or performance of any hydraulic actuating systems;
   2. the introduction of new fluid types; or
   3. hydraulic line routing/clamping and separation from wiring and other ignition sources.
3. changes that affect fire detection and suppression;
4. changes that affect the functioning of an electrical actuating system or component;
5. changes that affect compressed gas system, including valves and piping;
6. changes that affect airframe or rotor deicing and or ice protection system;
7. changes that affect any external structure that may affect anti icing systems;
8. changes that affect flight control systems, including:
   1. hydraulic systems and actuators; or
   2. mechanical and electro-mechanical actuators.
9. changes that affect vulnerability to the effects of lightning; or
10. changes that affect air data systems, including the altitude, airspeed sensing and pitot heat functions.

C4.  Changes to, or the introduction of, new structural components to the aircraft compartments, such as mission consoles, equipment racks or crew seats, including:

1. changes that affect structural strength and/or loads applied to the crew and occupants harnesses, seats and seat attachment points; or
2. changes that affect new composite materials or fabrication procedures, such that recertification would be required, e.g., flammability and material compatibility.

2.4  D – Flight Avionics. An avionics design change is appreciable and must be considered major if it affects any of the areas or conditions described in the following:

D1.   Will the change replace, modify or introduce any avionic systems, functions or capabilities that have failure effects with a system safety hazard classification of ‘Catastrophic’, ‘Hazardous’ or ‘Major’, including the changes to the following:

1. flight instruments and displays, such as:
   1. Head-Up Display (HUD);
   2. Helmet-Mounted Display (HMD); and
   3. Electronic Flight Instrument System (EFIS).
2. flight control systems, including the motion and effect of controls;
3. the Electronic Flight Control System (EFCS), Autopilot and/or Flight Director system, or their displays;
4. the magnetic direction indicating system;
5. communications systems;
6. navigation systems/capabilities, such as:
   1. Area Navigation capability (RNAV);
   2. Required Navigation Performance capability (RNP); and
   3. Global Navigation Satellite System (GNSS).
7. the ATC surveillance systems/capabilities, such as:
   1. Traffic Collision Avoidance Systems (TCAS);
   2. Terrain/Ground Collision Avoidance Systems (T/GCAS);
   3. Precision Approach capability; and
   4. Automatic Dependent Surveillance capability (ADS).
8. the cockpit voice or flight data recording systems; or
9. introduction of new flight avionics capabilities, functions or systems.

2.5   E – Airborne Software. A software design change is appreciable and must be considered major if it affects any of the areas or conditions described in the following:

E1.   Will the change modify, add or remove functions, features, capabilities or software life cycle data that affect existing airborne software that has a system safety classification requirement of ‘Catastrophic’, ‘Hazardous’ or ‘Major’, including the following changes to software life cycle data:

1. changes to software requirements, design, architecture and code components (especially those affecting safety-related functions, partitioning, redundancy or safety monitors);
2. changes to code (source, object, and executable object) components that perform a safety-related function, or changes to a component providing input to another component, which performs a safety-related function. (For this order, a safety-related function is one that could potentially induce or allow a major, hazardous, or catastrophic failure condition to go undetected);
3. changes to characteristics of the development environment impacting the executable object code;
4. modifications to Operational Flight Programs (OFPs) that affect flight controls/limits;
5. changes to memory allocation requirements so that memory margins are adversely impacted (for example, less than five percent margin remaining);
6. changes to timing requirements so that timing margins are adversely impacted (for example, margins are unpredictable or less than 10 percent margin remains);
7. changes to input/output requirements (such as bus loading) so that input or output performance is adversely impacted (for example, less than five percent margin remains);
8. data and control coupling characteristics are adversely impacted (for example, to the extent that more than 50 percent of the coverage analysis must be redone); and
9. changes to interface characteristics.

E2.  Will the change introduce the use of a “new” airborne software that has a system safety classification requirement of ‘Catastrophic’, ‘Hazardous’ or ‘Major’?  The term “new” is used in this context to designate a software that has never been certified for this particular platform (aircraft). This includes a newly developed software or a previously certified software from other civil or military platforms.

1. new software with a DAL of A, B, C (RTCA DO-178C or  SwCl 1, 2, 3 is a major change; and
2. new software with a DAL of D or E or a SwCI 4 and 5 are considered to be minor changes.

E3.  Will the change modify the software DAL classification or the SwCl classification?  Changes to software are classified as either major or minor as follows:

1. changes to DAL A, B or C (or Level 1 and 2 for DO-178/A) are considered to be major changes; and
2. changes to SwCl 1, 2, or 3 (using the Mil-Std-882 classification system for failure effects corresponding to catastrophic, critical and marginal) are considered to be major changes; and
3. changes to DAL D and E or SwCI 4 and 5 are considered to be minor changes.

E4.  Will the change affect software that has design assurance levels of DAL A, B or SwCI 1, 2, or 3?

2.6    F – Airborne Electronic Hardware (AEH). The term AEH refers to complex electronic hardware in airborne systems. Complex electronic hardware includes devices like Field Programmable Gate Arrays (FPGAs), Programmable Logic Devices (PLDs) and Application Specific Integrated Circuits (ASICs).  RTCA’s DO-254 standard is the counterpart to the software standard DO-178 and is recognized by the TAA as a means of demonstrating compliance for the design of complex electronic hardware in airborne systems. An AEH design change is appreciable and must be considered major if it affects any of the areas or conditions described in the following:

F1.   Will the change modify, add or remove functions, features, capabilities or AEH life cycle data that affect an existing AEH that has a system safety classification requirement of ‘Catastrophic, ‘Hazardous’ or ‘Major’, including the following changes to the AEH life cycle data:

1. changes to AEH requirements, design, architecture and code components (especially those affecting safety-related functions, redundancy or safety monitors);
2. changes to code (HDL, netlist and binary code) components that perform a safety-related function, or changes to a component providing input to another component, which performs a safety-related function (For this order, a safety-related function is one that could potentially induce or allow a major, hazardous, or catastrophic failure condition to go undetected);
3. changes to characteristics of the development environment impacting the netlist and binary code, and
4. changes to interface characteristics.

F2.   Will the change introduce the use of a “new” AEH that has a system safety classification requirement of ‘Catastrophic’, ‘Hazardous’ or ‘Major’? The term “new” is used in this context to designate an AEH that has never been certified for this particular platform (aircraft). This includes a newly developed AEH or a previously certified AEH from other civil or military platforms.

1. This includes DAL A, B and C AEH.
2. Changes to DAL D and E AEH are considered to be minor.

F3.   Will the change modify the AEH DAL classification?

1. DAL classification of A, B or C?
2. Changes to DAL D and E are minor changes.

2.7   G – Electrical.  An electrical design change is appreciable and must be considered major if it affects any of the areas or conditions described in the following:

G1.   Will the change increase the load or affect the electrical generation capacity, including:

1. an electrical generation device, or the electrical distribution system between the generating source and either it primary distribution bus, or any other bus designated as an essential bus;
2. any of the electrical system control or protection devices; and
3. the electrical load analysis of the aircraft? A modification must be assessed to determine the effect on the capacity of the electrical power system to accommodate the change and does not negatively impact power availability for previously-installed required systems.

G2.  Will the change have an appreciable effect on any instrument lights, landing lights, wing icing detection lights or position lights, emergency lighting or other flight critical lights, including lighting required by regulation?  Significant changes may include:

1. light location, orientation or field-of view; and
2. light intensity, colour or compatibility with Night Vision Goggles (NVG).

G3.   Will the change impact the battery time available during an emergency, such that it may, for example:

1. reduce the storage capacity of the primary battery;
2. affect any communication, flight instruments or indicators that will be powered by the battery backup system; or
3. require any ground or flight testing to verify that a change to the emergency battery system provides the minimum specified power to the backup flight instruments.

G4.  Will the change involve significant wiring modifications that affect the design features that ensure the separation of aircraft wiring-related ignition sources from flammable fluid lines and storage tanks? Considerations include the following:

1. Examples of significant wiring modifications include, but are not limited to, the installation of new avionics systems, new galley installations and new instrumentation.  Installation procedures for the design change must include instructions for the routing and securing of electrical wiring and flammable fluid-carrying lines (e.g., fuel lines, hydraulic lines, oxygen lines) that ensure the required clearances are provided under all operational conditions.
2. Certification activities may be required to verify that the modifications to the Electrical Wiring Interconnection System (EWIS) meet the airworthiness requirements of the aircraft certification basis, as well as any additional requirements specified for the design change.
3. Modifications that could require EWIS certification include, but are not limited to, those that install new equipment in close proximity to wiring or introduce a wiring-related heat source in an area that might contain material/vapor that could cause a fire to be sustained, in the event of an ignition source arising in adjacent wiring.
4. Design changes that introduce new wiring or significant changes to the existing EWIS must be evaluated to determine the potential effects of deterioration to the EWIS and the need to amend the aircraft Instructions for Continued Airworthiness (ICAs) to ensure that the appropriate inspection and maintenance activities are included.

2.8   H – Occupant/Cabin Safety.  A design change to the flight deck and passenger/mission compartment is appreciable and must be considered major if it affects any of the areas or conditions described in the following:

H1.  Will the change to the cabin or flight deck configuration adversely affect any aspects of passenger/crew safety and survivability, or be appreciable enough, to require a re-assessment of emergency evacuation capability? Items to consider include, but are not limited to the following:

1. changes to cabin layouts that affect evacuation path or access to exits;
2. changes of distance between seat and adjacent obstacle like a divider;
3. changes to pressurization, emergency oxygen, protective breathing systems;
4. changes to occupant restraints and seats;
5. changes to, or introduction of, dynamically tested seats;
6. changes to emergency markings, both interior and exterior;
7. changes to emergency lighting (e.g., exit lights);
8. changes that increase interior noise levels above specified limits; and
9. changes to the mission equipment racks, consoles and crew seats.

H2.  Will a change affect any of the following:  1) the pilot’s ability to fly the aircraft; 2) the crew’s ability to egress the aircraft, or; 3) the seat and seatbelt functionality?, including:

1. the aircrew crew seats, belts or harnesses; and
2. the crew ejection and parachute systems, including:
   1. changes to the ejection seat, actuation system and safety inter-locks;
   2. changes to the ejection envelope of the ejection seat; or
   3. changes that affect the ability of the ejection seat to perform safely over the entire range of authorized occupants?

H3.   Will the change introduce new material to the aircraft interior that may affect flammability, smoke or toxic gas certification requirements, including changes to:

1. seat coverings;
2. interior panel material; and
3. floor panel materials.

H4.   Will a new cargo handling system and/or nets/bulkheads be introduced to protect the occupants in front of the cargo?

H5.   Will the change have an appreciable effect on any of the fire detection and suppression systems in the cabin, flight station or cargo compartment? Appreciable changes may include:

1. the addition or removal of a complete system or part of a system;
2. changes to the type of fire detection method, sensor or zonal coverage;
3. changing the fire extinguishing agent; and
4. changes to the duration of fire suppression operation.

H6.   Will the change have an appreciable effect on the sound pressure levels, as imposed by human factors requirements, in areas of the air vehicle occupied by personnel during flight or ground operations?  Appreciable changes may include:

1. the introduction of new noise sources;
2. an increased noise volume or changes to the noise frequency spectrum; and
3. the removal of, or changes to, noise suppression material.

2.9  I – Powerplant, Propellers and Fuel Systems.  A design change to the propulsion and fuel systems is appreciable and must be considered major if it affects any of the areas or conditions described in the following:

I1.    Will the change alter the installation, configuration or performance of any engine, transmission or gearboxes? Such changes include:

1. changing an aircraft engine model from one type to another;
2. changes in compression ratio or substitution of major engine parts, which require rework and testing of the engine;
3. changes that affect the propeller diameter, number of blades, material, airfoil, planform and blade retention system;
4. changes that affect the propeller or helicopter rotor drive system, rotor hubs including dampers and controls, the blade retention system and lubrication systems;
5. changes that will affect the propeller and rotor drives system endurance; and
6. change the temperature or other environmental factors, such that they will be outside of the limits approved for the aircraft type.

I2.    Will the change have an appreciable effect on any powerplant (including any APU) or transmission operating limitations, caution/warning systems or fire detection and suppression systems, including:

1. powerplant control system changes that affect the engine/propeller/airframe interface;
2. changes that affect operating speeds, temperatures and other limitations;
3. changes that affect, or introduce, parts where the failure effect has been shown to be catastrophic, hazardous or major;
4. changes that affect, or introduce, engine critical parts or their life limits;
5. changes to any part of the engine that adversely affects the existing containment capability of the structure;
6. the installation of an accessory that is not approved for the engine;
7. the removal of accessories that are listed as required equipment on the aircraft or engine specification;
8. new instrumentation displaying operating limits; or
9. changes that affect engine and APU fire detection and suppression.

I3.    Will the change have an appreciable effect on the engine, propeller or rotor ice detection and protection systems, including:

1. changes that affect the propeller or rotor diameter, number of blades, material, airfoil; and
2. changes that affect any engine inlet configuration or inlet-related anti-ice system.

I4.    Will the change have an appreciable effect on the fuel system including the following:

1. modifications to the fuel system and tanks (number, size and configuration);
2. impact on fuel line routing/clamping and separation from wiring and other ignition sources;
3. any conversions for the purpose of using fuel of a rating or grade other than that listed in the engine specifications;
4. changes that adversely affect the fuel, oil and air systems, which alter the method of operation, or require reinvestigation against the type-certification basis;
5. changes to the fuel system pumps, valves or piping;
6. changes to the fuel jettisoning capability;
7. an increase in the engine fuel venting or engine emissions;
8. approved use of any new fuels or lubricants; and
9. change that affect the design or installation of fuel tank(s) (including crashworthiness).

I5.    Will the change have an appreciable effect on the environmental characteristics of noise, fuel venting or engine emissions, including:

1. the ability of the aircraft to meet applicable Canadian and international Aircraft noise restrictions;
2. the ability of the aircraft to meet applicable Canadian and international engine emission restrictions; and
3. the ability of the aircraft to meet applicable Canadian and international fuel venting restrictions.

I6.    Will the change involve a new or different means of propulsion, or type fuel, i.e., turbo-prop to turbo-jet or gas-turbine to electric?

2.10   J – Aircraft Stores – Carriage and Release.  A change to the aircraft stores, carriage and release systems is appreciable and must be considered major if it affects any of the areas or conditions described in the following:

J1.    Will the change add any new stores that require clearance for carriage and/or release, including external fuel tanks, pylons and racks?  Other examples include:

1. the installation of new weapons and stores, including the carriage of an existing weapon or store in a new location or next to a different weapon or store;
2. the installation of flare and chaff systems;
3. the integration of chaff and flares and other countermeasures expendables;
4. the installation of systems integrating a high-power laser; and
5. a modification to the release device of a store.

J2.    Will the change have an appreciable effect on the manner or operational procedures in which a store is carried, released and/or jettisoned from an aircraft, such that it could affect the safe flight of the aircraft?

2.11  K – Electro-Magnetic Compatibility (EMC).  A change to the aircraft systems and components must be considered major if the change meets the criteria requiring an EMC, High-Intensity Radiated Fields (HIRF) or Lightning evaluation and clearance, as described in the following:

K1.   Will the change have an appreciable effect on the EMC, HIRF or Lightning clearance of existing aircraft systems or equipment?

1. Will the defined EMC, HIRF or Lighting environment be affected by a change to the aircraft roles, missions or operating environment?
2. Will the change reduce or degrade the aircraft functions in the defined EMC, HIRF or Lightning environment?

K2.   Does the change include new aircraft equipment or components that will require an EMC, HIRF or Lightning evaluation and clearance, including:

1. new equipment that may affect Electromagnetic Environmental Effects (E3) integrity, e.g., new radar, communication systems, aerial delivery systems;
2. equipment and components that have failure effects with a systems safety hazard severity classification of ‘Catastrophic, ‘Hazardous’ or ‘Major’; and
3. an evaluation of the design change data package to confirm that the EMC, HIRF and Lightning requirements have been included.

K3.   Does the change have an appreciable effect on systems or equipment that could require an assessment for operation in a HIRF environment, including:

1. HIRF operating environment assessment;
2. shielding and bonding requirements; and
3. an impact on existing protection features and a need for additional protection.

K4.   Does the change have an appreciable effect on systems or equipment that could require an assessment for lightning protection, including:

1. a lightning operating environment assessment;
2. shielding and bonding requirements; and
3. an impact on existing protection features and a need for additional protection?

2.12   L – Aircraft Cybersecurity.  In the context of airworthiness, the term “Aircraft Cybersecurity” refers to the protection of the airworthiness of an aircraft from an unauthorized electronic interaction: harm due to human action (intentional or unintentional) using access, use, disclosure, disruption, modification, or destruction of data and/or data interfaces.  This also includes the consequences of malware and forged data, and of access of other systems to aircraft systems.  A change to the aircraft systems and networks that allows access to external systems and networks must be considered major if the change meets the criteria described in the following sub-sections (DTAES 8-2 staff is available to assist in making the determination):

L1.   Does the change introduce a new data connectivity path or modify the configuration of an existing data connectivity path to external systems or networks, which may affect systems with a safety classification of ‘Catastrophic’, ‘Hazardous, or ‘Major’?  As an example, the following should be considered:

1. connectivity to tactical, strategic and enterprise networks, such as: AFTAC, LCSS, CSNI, and GPNet;
2. connectivity mode and/or protocol changes (Ethernet, TCP/IP, Wi-Fi, Radios (HF/UHF/VHF), USB, Bluetooth, SATCOM, etc.);
3. direct and indirect Internet connectivity;
4. field Loadable Software / Mission Planning Systems;
5. mission laptops and Electronic Flight Bags (EFBs);
6. Health Usage and Monitoring (and reporting) Systems; and
7. additions of new and/or modifications (such as firewall reconfigurations) of existing system interconnections within the aircraft.

L2.   Was the design change categorized as ‘Major’ by answering ‘yes’ to any of the questions in section E (Airborne Software and Airborne Electronic Hardware) above? Any ‘Major’ modifications in system software or hardware may introduce new security vulnerabilities and must be assessed by DTAES 8.  As an example, the following should be considered:

1. introduction of a new version of an operating system or reconfiguration of the existing operating systems (new kernel, new services, partitioning changes, etc.);
2. architectural changes that impact data and control flow within the Operational Flight Program (OFP); and
3. hardware updates, such as the introduction of a new processor.

L3.   Will the design change modify a DAL D or a non-safety related system that is connected to a system with a safety classification of ‘Catastrophic’, ‘Hazardous’, or ‘Major’? The following should be considered:

1. As an example, a Directional Infrared Counter Measures (DIRCM) system may have a DAL D or E; however, it may also provide health, status and threat azimuth data to an avionics bus, creating a potential access to safety critical systems (DAL A, B, and C). Given that the DIRCM system will typically allow for configuration data uploads, the potential security impact needs to be assessed by DTAES 8.
2. A drop-in replacement of a legacy mission system (DAL E) with a system that offers new functionality with a potential security impact, such as field loadable software functionality.

2.13  M – Human Factors Engineering (HFE).  Human factors engineering promotes aviation safety by working to reduce the occurrence and impact of human error in aviation systems, and improve human performance.  A change to any of the flight essential systems that impacts critical functions performed by the flight crew must be considered major if the change meets the criteria described in the following:

M1.  Will the change have an appreciable effect on the flight deck design, such that a human factors re-evaluation may be required? For example, does the change affect:

1. the ability of the crew to perform the required tasks;
2. the minimum required flight crew;
3. the flight deck configuration, such that crew performance may be degraded;
4. the pilots’ field of view;
5. the flight instrument arrangements, field of view or night visibility;
6. the function of the cockpit controls, or the motion and effect of cockpit controls;
7. the primary flight reference displays and controls;
8. the flight and navigation instruments, or the arrangement or visibility of any instruments or indicator required for flight, including any change to the flight instrument arrangements, field of view or night visibility;
9. the location or visibility of any powerplant instruments;
10. the visibility or positioning of any warning, caution or advisory lights (or other indicators that may demand crew intervention), such that crew response may be degraded (for example, night vision devices);
11. crew reach capability to controls (in particular those required when harnesses are locked);
12. the external visibility and transmitted visual indications required by the aircrew to maintain flight; conduct all necessary flight tasks; avoid ground or flight obstacles; and command, control and monitor all associated emergency procedures and maneuvers to ensure safe operation in military and civilian airspace;
13. the level of automation;
14. the flight crew emergency egress;
15. the flight crew’s integrated life support systems (e.g., high altitude, "g" protection, ocular protection, and breathing) functionality and accessibility; or
16. the sound pressure levels in the flight deck.

M2.  Will the change have an appreciable effect on the passenger/cabin crew compartment design, such that a human factors re-evaluation may be required? For example, does the change affect:

1. the cabin crew and passenger capability of reach, placard comprehension, or ability to undertake emergency procedures required for continued safe operation of flight;
2. cabin emergency lighting adequacy;
3. cabin crew interaction/communication with flight deck;
4. the ability of the passengers and cabin crew to evacuate the airplane; or
5. the sound pressure levels in areas of the air vehicle occupied by personnel during flight.

M3.  Will the change have an appreciable effect on the flight deck crew or cabin crew safety of flight procedures, such that a human factors re-evaluation may be required? Examples include:

1. changes to the location, function or operation of any of the primary flight controls, instruments and emergency switches; and
2. alteration or negation of standard emergency egress procedures.

2.14  N – Approved Flight Manual. As described in the TAM, Part 2, Chapter 7 – Canadian Armed Forces Flight Publications, changes to information in the AFM that is specified as Technical Airworthiness Data (TAWD) are considered major.  Changes to TAWD require a review by an authorized individual, if the AFM change meets the criteria described in the following:

N1.   Will the change modify the approved set of TAWD information contained in the Flight Manual (FM) or Aircraft Operating Instructions (AOI), including the following:

1. operating limitations;
2. normal and emergency operating procedures;
3. performance information;
4. loading information;
5. additional limitations, procedures and data related to any military-specific configuration, such as:
   1. weapons or other stores;
   2. ejection seats;
   3. helmet-mounted flight crew systems; and
   4. special purpose operations.

6. other information that is necessary for the safe operation because of design, operating or handling characteristics.

N2.   Will the change have an appreciable effect on the system operating information in the AFM or AOI? Such a change may affect:

1. the system description; or
2. the system operation information.

Table M-1 – AFM/AOI Change Categorization Checklist 

Description of Change	Classification
Alterations to definitions and general information contained in the AFM Front Matter specific to the usage instructions for the AFM	Major (TAWD)
Addition, non-editorial change or removal of any operating limitations	Major (TAWD)
Addition, non-editorial change or removal of normal operating procedures	Major (TAWD)
Addition, non-editorial change or removal of emergency operating procedures	Major (TAWD)
Addition, non-editorial change or removal of abnormal operating or malfunction procedures	Major (TAWD)
Changes to the approved performance data	Major (TAWD)
Changes to the aircraft loading information	Major (TAWD)
Changes to the kinds of operation or role	Major (TAWD)
Changes to the crew composition, number of occupants, or payload	Major (TAWD)
Other information that is necessary for the safe operation because of design, operating or handling characteristics	Major (TAWD)
Additional limitations, procedures and data necessary for the safe operation of the aircraft in any military-specific configuration or with any installed military equipment, such as: a. weapons or other stores b. helmet-mounted flight crew systems c. ejection seats d. provisions for input to control the aircraft by crew members other than flight crew e. special purpose operations	Major (TAWD)
Changes which are editorial in nature, correcting typographical, grammatical, spelling and formatting changes or corrections, clarifying descriptions, etc. without changing the intent of the content	Minor (Technical Review not required)
Addition, change or removal of any system description or operating information that is not a procedural check	Major (non-TAWD)
Addition, non-editorial change or removal of a Warning	Major (TAWD)
Addition, non-editorial change or removal of a Caution	Major (TAWD)
Addition, non-editorial change or removal of a Note	Major (non-TAWD)

2.15  O – Mission Equipment. Although mission or role equipment installed in a DND aircraft is not essential for the safe operation of the aircraft, all of the installed mission systems and equipment must be certified to demonstrate that they can safely operate aboard the aircraft. A change to the aircraft mission equipment must be considered major if the change meets the criteria described in the following:

O1.   Will the change have an appreciable effect on the functioning or failure modes of the mission equipment, such that it will affect the safe flight of the aircraft, or the ability of the occupants to safely egress the aircraft?  Examples of such effects include:

1. affecting the emergency egress and crashworthiness mounting/securing features;
2. affecting the electrical installation, including electrical loads, circuit protection and wiring routing, installation and clamping;
3. presenting an EMC or HIRF radiation source hazard; and
4. presenting a hazard to the crew or other aircraft occupants.

O2.  Does the design change to the mission equipment affect any existing hazards that are classified as ‘Major’, Hazardous or Catastrophic, in the Functional Hazard Assessment?