(2) The occurrence of any other failure condition which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions is improbable.
Flightdeck door systems must be shown to comply with §§ 25.1309(b)(1) and (b)(2). In showing compliance with § 25.1309(b)(1) the applicant must consider that the failure of the flightdeck door locking system to unlock during a decompression event may be catastrophic.
If the probability of the decompression event is used then the probability of occurrence must be based on statistically valid data or supporting service experience. Further, the applicant must show the independence between the decompression event and the failure of the system to unlock.
In addition to the decompression scenario, less severe failure conditions such as the crew “lock out” scenarios discussed elsewhere in this Memorandum may become a more stringent requirement and should be assessed when showing compliance to § 25.1309(b)(2).
It is assumed that a failure of the system to lock the door will be detected within one flight. Therefore, the period of latency in this case is reasonable for the failure of the door to unlock. The applicant should provide substantiation that the failure mode is not intermittent. In this case the latency period could be much greater and should factor into the method for showing compliance to § 25.1309(c). Failures of the system to lock the door should be indicated and only be evident to the cockpit crew.
Based on the above rationale, the FAA considers a suitable reliability level to be on the order of 10-5 failure per flight-hour for both lock and unlock operations. Applicants should provide specific rationale if a lower reliability target is requested. This should be accomplished via the issue paper process.
FAQ:
Q: Some designs use decompression panels for venting instead of the opening of the door. Does the above guidance apply to these designs?
A: The reliability target of 10-5 for the door lock and unlock functions is also applicable to the decompression detection and venting functions.
Q: How do you show that a decompression event, a catastrophic event, to be extremely improbably using the 10-5 reliability target?
823 A: There is no agreed probability of occurrence for a decompression event. However, the FAA considers the probability of a decompression event to occur during flight to be much less than 10-4. Using a decompression venting system that is on the order of 10-5 failure per flight-hour, the probability of a catastrophic event becomes extremely improbable (10-9).
Intrusion Protection:
Background: Section 25.795 (a)(1) requires that the flightdeck door installation be designed to resist intrusion by any person who attempts to enter the flightdeck by physically forcing his or her way through the door. The door installation includes the door, its means of attachment to the surrounding structure, and the attachment structure to the bulkhead itself. Of concern are the integrity of the locking/latching/hinge mechanism, any decompression venting panels included as part of the door panel, the door panel itself, and the attachment of the door to the surrounding structure.
It is important to understand that the intent of this regulation is not to make the flightdeck door impenetrable, rather to deter attempts at entry and delay any attempts until other actions can be taken to prevent entry.
Advisory Circular 25.795-1 includes test methods and procedures that result in acceptable methods for demonstrating compliance. Other methods, or deviations from methods described in the AC, may be acceptable to demonstrate compliance.
Alternative compliance methods should be coordinated with the Transport Directorate Staff and documented in an issue paper.
FAQ:
Q: How much of the structure surrounding the door must be representative for the test set-up, and how representative must it be? For example, doors may be installed in airplanes with interior configurations that result in the door being installed on various types of bulkheads from multiple suppliers, with different strength and stiffness characteristics. In some cases, the original mounting structure is no longer available.
A: Section 25.795(a)(1) identifies intrusion requirements for the door installation. The preamble to this amendment states, “the door installation includes the door, its means of attachment to the surrounding structure, and the attachment structure on the bulkhead itself.” Therefore, the test article should be representative of that installation. If the structure to which the door frame attaches is not available, it may be possible to test with the extreme conditions of stiffness (i.e., soft and firm). Conversely, an installation that does not rely on the existing monuments for structural capabilities (strength and stiffness) would avoid this issue.
Q: Do interface loads (static and dynamic) between the door/surround structure need to be collected during the testing? If required, how are these loads applied?
824 A: As discussed above, the relevant structure should be included in the test. If the door, the door frame, and the surround structure to which the door frame is attached is represented in the test, collection of interface loads during testing should not be necessary. Testing that is proposed to be conducted with non-representative structure should be coordinated in advance with the appropriate Aircraft Certification Office. In this case, interface loads may be required to substantiate the installation of the door system.
Ballistic Penetration:
Background: Section 25.795 (a)(2) requires design precautions be taken to minimize the penetration of shrapnel from a fragmentation device and small arms fire which might be fired through the flightdeck doors from occupied compartments. The intent of the ballistic requirements is twofold: (1) to ensure that the integrity of the flightdeck door is not compromised from a ballistic threat that could enable an intruder to gain access to the flightdeck, and (2) to protect the pilot and critical flight instruments from projectiles penetrating into the flightdeck. Again, the intent is not to make the flightdeck “impenetrable,” but to provide a high level of protection.
Advisory Circular 25.795-2 includes test methods and procedures that result in acceptable methods for demonstrating compliance. Other methods, or deviations from methods described in the AC, may be acceptable to demonstrate compliance.
Alternative compliance methods should be coordinated with the Transport Directorate Staff and documented in an issue paper.
FAQ:
Q: How will certification of ballistics labs be handled?
A: There are two ballistics test facilities, U.S. Test Laboratories and H.P. White, that have been accepted by the National Institute of Justice (NIJ) as being capable of conducting tests in accordance with NIJ 0101.04. The FAA has discussed these laboratories qualifications with the NIJ. Based on their qualifications, the FAA will accept either of these laboratories for testing. Conformity inspections would still be required using the normal processes. Other test facilities may be acceptable; however, additional FAA review and oversight will be required. Note, test witnessing may be delegated to the above two laboratories, however, the pass/fail determination will be made by the FAA or an authorized designated engineering representative (DER).
Q: If the door contains decompression panels as part of the design, does the door need to pass the ballistic penetration tests with the panels deployed?
A: The door is not required to provide ballistic penetration protection after a decompression event.
Q: Some designs may contain louvers or openings in panels that are installed at angles greater or less than the 0-30 degree angle required in AC 25.795-2. Since the bullet would be deflected by these louvers/openings and not allow penetration into the
825 flightdeck at the test angles required by the test, would additional testing be required at other angles that may allow the bullet to enter the flightdeck?
A: The 0-30 degree test described in AC 25.795-2 is basically a material test. The two test conditions are used to evaluate the penetration resistance of the material and to verify that there is no significant difference in performance based on angle of incidence.
With regard to the door design, a shotline that originates in the passenger cabin, and enters the flightdeck, should be evaluated to determine if it constitutes a hazardous trajectory. If it’s determined that no hazardous trajectory can result, additional protection may not be required.
Q: Advisory Circular 25.795-2 addresses projectiles targeted at the edge of the door.
Our understanding is that the intent was to arrest an errant projectile not an intentionally aimed projectile. Based on the above, would we be expected to aim a shot at the door knob/lock mechanism, the hinges, the gaps or other such door features for ballistic testing?
A: The preamble to Amendment 25-106 states, “any compromise to the integrity of the flightdeck door from a ballistic threat could enable an intruder to gain access to the flightdeck. It would be impracticable to protect the door without including a ballistic protection component.” Thus, the features mentioned above would require substantiation if their failure compromises the penetration resistance of the door, or would allow the door to open. For example, if a penetration failure results in a hazardous trajectory or enables an intruder to gain access to the flightdeck, these results would be unacceptable. For a feature with one of these potential types of failures, the feature should be tested, or shown to meet the requirement through some other means.
Q: What is the FAA's position on the ballistic testing of gaps?
A: Based upon AC 25.795-2, if the gap is protected with an equivalent amount of material that passed the material ballistic tests, testing of the gap is generally not necessary. Surfaces of protective material that are butted flush against each other may also be acceptable without testing, if it is clear that penetration is not an issue. If it’s determined that a gap needs to be tested, however, the same pass/fail criteria for the material ballistic test would apply.
826 Q: Is it necessary to test at angles other than 0 and 30 degrees for features where other angles might be critical?
A: The intent of the requirement is to provide a ballistic penetration barrier across the door, that will prevent compromise to the flightdeck, either by the ballistic threat itself, or by an intruder. To the extent that this barrier contains features and details that are not homogeneous, they may behave differently with shots at different angles of incidence.
Based on experience gathered to date, assuming that there are no discontinuities in the barrier, (Refer to figure), it is sufficient to address these features with shots at 0 and 30 degrees only. It is not necessary to try and define some other angle. Where there are discontinuities, this effectively results in no protective barrier for the part of the door where the discontinuity exists, which is contrary to the intent of the requirement.
Q: Since the revised NIJ standard calls for semi-jacketed bullets, can these types of bullets be used in lieu of jacketed hollow point bullets specified in AC 25.795-2?
A: AC 25.795-2 was based on the National Institute of Justice Ballistic Resistance of Personal Body Armor, NIJ Standard 0101.04, dated September 2000. This standard called out a jacketed hollow point bullet. The standard was later revised in June 2001 to call out a semi-jacketed bullet. To promote standardization, the NIJ requires a specific bullet, the Remington R44MG3 semi-jacketed bullet, to be used when testing to the standard. The FAA considers this same bullet as acceptable for testing in accordance with AC 25.795-2. Otherwise, a jacketed bullet should be used as per the AC.
Pilot Compartment Doors:
Background: In part, § 25.772 requires that a means be provided for the flight crew members to directly enter the passenger compartment from the pilot compartment if the cockpit door becomes jammed. Compliance with this requirement is usually accomplished by way of frangible access panels in the door, removable panels in the door, or quick release hinges. Strengthening of the door may involve removing or covering frangible panels to prevent forced entry, and reducing clearances for ballistic resistance. A possible acceptable design approach would be removable panels in the door, or surrounding structure, that are openable from the flightdeck, but do not allow access from the passenger compartment.
FAQ:
Dicontinuity where angle exceeds 30 deg Door Ballistic Material Ballistic Material Discontinuity where angle exceeds 30 deg
827 Q: Are the performance tests for ballistic and intrusion protection independent of the requirements of § 25.772?
A: Any performance tests for ballistic and intrusion protection would be independent of the requirements of § 25.772. That is, evaluation of the door design for egress from the flightdeck is accomplished without taking into consideration damage resulting from the intrusion or ballistic testing.
Q: What is the applicability of § 25.772(b) to strengthened flightdeck door certification programs?
A: The requirement that the flightcrew be able to enter the passenger cabin in the event that the flightdeck door becomes jammed was adopted by amendment 25-47 to § 25.772.
This rule is not in the certification basis of many airplanes currently in the fleet. While it might seem that this requirement would be adopted for strengthened flightdeck door certification programs under the provisions of § 21.101, this was not clearly delineated in this original guidance memo, and there are some projects that have not added this requirement to the certification basis. The FAA has determined that, for airplanes that have exits on the flightdeck, it is not necessary to add Amendment 25-47 to the certification basis for strengthened flightdeck door projects to retain the level of safety intended. For airplanes that do not have exits on the flightdeck, Amendment 25-47 should be included in the certification basis for strengthened flightdeck door projects.
Q: The original type certificate evaluation for demonstrating compliance to § 25.772 allowed overcoming the jam (i.e., pushing on the door to remove the jam). Based on the above guidance, can I use this same approach?
A: The following explanation for addressing egress out of a jammed flightdeck door is provided in the preamble of the notice of proposed rulemaking for § 25.772, at amendment 25-47: “The National Transportation Safety Board Recommendation A-74- 102 cites cases where, in an emergency situation, flight crewmembers had to exit through cockpit sliding windows because the pilot compartment to passenger compartment door was jammed. As a result, the flight crew was not in a position to assist in the evacuation of the passengers from the airplane.”
Further, the preamble to the final rule at Amendment 25-47 responded to several commenters objections that (1) the possibility of door jamming is remote due to aircraft design, (2) cockpit crash axes offer an equivalent method, and (3) cockpit security would be adversely affected. The preamble states: “Some airplanes are designed to preclude floor deformation and subsequent door jamming; however, this proposal provides for any door jamming condition which could occur regardless of aircraft design. The use of a crash axe does not provide the same degree of access to the passenger compartment from the cockpit. Under certain conditions, the crash axe may not provide access until a considerable period of time has elapsed. Cockpit security
828 would not be compromised since the requirement applies to new designs and allows sufficient design flexibility.”
As noted above, it is clear that § 25.772 intends to address a situation where a door is jammed, irrespective of design features that are intended to preclude such jamming. It is not clear that past compliance findings have approached the requirement in this way, although it is clear that features have been incorporated to enable the crew to mitigate a jammed door. However, in some cases, the features appear to have been intended to overcome the jammed condition, i.e., the door is forcibly unjammed, rather than providing means of entry into the cabin, even though the door remains jammed. For the purposes of addressing reinforced flightdeck door approvals, previous test methods to show compliance are considered acceptable for a given airplane type. However, we intend to revisit this subject with respect to the methods of compliance intended by the regulation and, if necessary, publish a policy statement for future approvals. Methods of compliance that depend on features intended to overcome a jammed door should be documented in an issue paper.
Emergency Exits and Emergency Exit Arrangement:
Background: Current regulations require that exits be openable from both the inside and outside (Ref. § 25.809). Additionally, the flightdeck requires access to two emergency exits (one on each side of the airplane) or a single top hatch (Ref. § 25.807).
For airplanes with flightdeck windows, or a top hatch, where each are openable from the inside and outside, there is no requirement for the flightdeck door to have provisions for egress from the flightdeck or entry by rescue personnel. On some aircraft, one or both of the window exits are not openable from the outside; access for rescue personnel to the flight crew area in this case is provided from nearby passenger exit(s) through the flightdeck door. The regulations allow flightdeck window exits to not be openable from the outside if other approved exits are convenient and readily accessible to the flight crew area.
For airplanes that use other approved exits, which are convenient and readily accessible to the flight crew area (i.e., forward passenger exits), the flightdeck door design must have provisions for entry by rescue personnel to meet the “readily accessible” requirement. Previously, the frangible nature of the flightdeck door provided ready access to the flightdeck for rescue personnel. Flightdeck doors designed to resist intrusion will not provide access as readily as previous doors. Two design approaches that may be employed to demonstrate that airplanes with strengthened door designs continue to meet § 25.809(b) are: (1) providing two exits or one hatch in the flightdeck, each openable from the outside, or (2) showing that the door in the closed and locked position can be entered by rescue personnel using normally available non-powered hand carried rescue tools (e.g., crowbar, ax, etc) in a reasonable time. The FAA expects that most, if not all, rescue personnel would have axes or crowbars at their disposal to gain access to the flightdeck, but not necessarily more sophisticated devices such as the “jaws of life.” Provided rescue personnel can be shown to be able to enter the flightdeck as described above, there is no need to consider structural deformation (jamming) for
829 § 25.809. It should be noted that what may be considered “readily accessible” regarding entry into the flightdeck through strengthened doors by rescue personnel, is likely to be beyond the limits of what is acceptable for “readily accessible” or similar terms used in other sections of part 25.
FAQ:
Q: Are the performance tests for ballistic and intrusion protection independent of the requirements of § 25.809?
A: Any performance tests for ballistic and intrusion protection would be independent of the requirements of § 25.809. That is, evaluation of the door design for ingress and egress from the flightdeck is accomplished without taking into consideration damage resulting from the intrusion or ballistic testing.
Q: In the event that the crew is trapped in the cockpit, what is the maximum amount of time allotted for rescue personnel to gain access to the cockpit through the improved flightdeck doors?
A: It is expected that with the improvements that are being incorporated into the flightdeck doors that the time needed by rescue personnel to gain access to the cockpit will be increased over that of the existing doors. The existing doors are considered frangible, therefore access by rescue personnel was not previously deemed a critical issue, but with the introduction of the intrusion and ballistic resistance requirements, the door can no longer be considered frangible and therefore the access time must be reevaluated. Based on information gathered from various sources, the FAA has determined that a maximum of 10 minutes is a reasonable and achievable goal for rescue personnel to gain access to the flightdeck through the strengthened flightdeck door. The FAA will evaluate any demonstrated time over the limit of 10 minutes on a case-by-case basis in order to determine its acceptability.
Q: How does an applicant show compliance with flightdeck accessibility by rescue personnel and is a compliance test required?
A: Since the doors were previously considered frangible, no known test data exist at this time that could be used as a basis for an analytical analysis Therefore, it is expected that a compliance test will be required. Subsequent certification programs may be candidates for an analytical approach provided they can be shown to be suitably similar to the previously certified doors. Other considerations that need to be addressed are the test parameters. It is expected that the test be conducted using trained rescue personnel, who are naive about the door design, using axes and/or crowbars, or other normally available non-powered hand carried tools. The timing for rescue personnel to gain access into the flightdeck should start with the first contact on the door.
Ventilation and Smoke:
Background: The previously mentioned decompression venting changes could negatively impact compliance with § 25.831. Venting changes should allow a sufficient
830 amount of uncontaminated air to enter the flight crew environment in order to provide a comfortable working environment and exclude harmful or hazardous concentrations of gases or vapors.
The ability of the ventilation system to evacuate hazardous quantities of smoke in the flight deck must also be maintained.
Venting changes must also not affect the ability to exclude hazardous quantities of smoke or extinguishing agent from the cargo compartments in compliance with §§ 25.855 and 25.857. Previous certification tests have demonstrated that smoke can migrate from a cargo compartment to the flightdeck unless the proper ventilation balance and compartment sealing are provided. Hazardous quantities of smoke or extinguishing agent could also enter other occupied areas (e.g., the main cabin) from the cargo compartment due to changes in the ventilation balance.
FAQ:
None at this time.
Compartment Interiors:
Background: All materials in the cabin, including the flightdeck door, are subject to the flammability requirements of § 25.853. Strengthening of the flightdeck doors may introduce materials that have not been traditionally used in Transport Category aircraft construction. In particular, material used to provide ballistic and shrapnel protection to the flightdeck should be evaluated for compliance to the flammability requirements of § 25.853.
FAQ:
Access into Flightdeck During Flight for §121.313(j):
Background: The effect of strengthening the flightdeck doors to enhance intrusion resistance, and removing access to the flightdeck for the cabin crew could result in a new unsafe design feature with respect to § 21.21(b)(2). In addition, § 121.313(j)(2), at Amendment 121-288, requires that each operator establish methods to enable a flight attendant to enter the pilot compartment in the event that a member of the flight crew becomes incapacitated. Consideration should be given to the following two situations that result in the crew not being able to access the flightdeck: (1) A pilot leaves the flightdeck, and the remaining pilot becomes incapacitated. The able-bodied pilot in this case may be effectively “locked out” of the flightdeck; or, (2) One pilot becomes incapacitated and the remaining pilot requires assistance to continue flying the airplane.
Previously, crew members were able to access the flightdeck via a common key to the flightdeck door, and provide any necessary assistance. Without a key, and behind a
831 strengthened door, assistance may not be available from crew members. One acceptable approach to address both situations would be to (a) add an Airplane Flight Manual (AFM) limitation requiring another crew member to be present in the flightdeck when one of the required flight crew leaves the flightdeck, and (b) providing a method to unlock the door from each pilot seat. Other proposed methods should be agreed upon using the issue paper process.
Access into Flightdeck During Flight for §25.772(c):
Background: As stated above, §121.313(j) requires that operators establish methods for a flight attendant to enter the flightdeck in the event that a member of the flight crew becomes incapacitated. This requirement differs from that of the new §25.772(c), in that the latter rule requires consideration of incapacitation of the entire flight crew.
Nonetheless, many manufacturers and modifiers have elected to design systems that comply with §25.772(c), even though this is not required for retrofit applications and is more stringent. The following guidance addresses systems designed to meet §25.772(c).
This guidance assumes that (1) the immediate response of a flight crewmember to an entry system alert will be to deny entry, and (2) the cabin crew will be instructed to use this system’s entry method only in the case of suspected incapacitation of the flight crew.
For the purposes of illustration only, a typical design and associated scenario would consist of the following:
1. Cabin crew attempts to contact flight crew using inter-phone system, knocking on flightdeck door, and any other available means.
2. If contact with the flight crew cannot be established and the cabin crew suspects that the flight crew may be incapacitated, the flight attendant requests emergency access to the flightdeck by entering a code using a numeric keypad or by some other method.
3. An alert is generated in the flightdeck to notify the flight crew that the emergency door unlocking sequence has been initiated from the cabin.
4. If the flight crew is capable of doing so (i.e., they are not incapacitated), one flight crew member will immediately respond to the alert by inhibiting the system, so that the door will not unlock. Then the flight crew will assess the situation to determine whether or not someone is attempting unauthorized access to the flightdeck.
5. If the flight crew is incapacitated, and as a result the system is not inhibited, after some period of time (time delay) the door will be automatically unlocked.
Time delay: The time delay for the emergency unlock feature is used to give the flight crew a reasonable amount of time to inhibit the alert while at the same time allowing flight attendants access to the flightdeck in the case of an incapacitated flight crew. The flight attendant would only activate this emergency door unlocking sequence if s/he
832 believes the flight crew is incapacitated, and thus needs access to the flightdeck. If the airplane is near the ground (especially while descending), and/or seriously out of control, the ability of the cabin crew to successfully intervene is very unlikely.
Therefore, it is unnecessary to require the time delay to be short enough to allow cabin crew intervention in such situations. If the airplane is in stable flight, it may be possible for the cabin crew to successfully intervene. However, in such cases, access should be timely, but a reasonable delay is acceptable. The flight crew needs a reasonable amount of time to inhibit the alert (to ensure intruders do not gain access before the flight crew responds to the alert), since they may be attending to other high priority tasks. This time delay should be consistent with the selected level of alert. Based on the above rationale, the FAA considers the appropriate time delay for the emergency unlock function to be between 30 and 60 seconds.
If applicants (the manufacturer and/or operator) desire time delays shorter than 30 seconds, they should provide specific rationale for a shorter time period. This rationale should be weighed against the need to prevent access to the flightdeck by unauthorized persons (if pilots fail to inhibit the unlock sequence within the time delay period). In addition, the applicant should provide information on the design features and/or procedures that will ensure that the pilots will respond to the alert by denying access within the time delay period (i.e., prior to automatic unlocking of the door). These features and/or procedures should account for other potential high priority tasks or high workload phases of flight. Notwithstanding the above, the FAA does not envision approving time delays shorter than 15 seconds.
If applicants desire time delays longer than the 60 seconds, they should provide specific rationale for a longer time period. This rationale should be weighed against the need to allow timely access to the flightdeck in case of incapacitation of the flight crew.
Notwithstanding the above, the FAA does not envision approving time delays longer than 120 seconds.
If manufacturers develop systems that allow operators to reprogram the time delay after delivery, the approval of the selected time delay for each operator will be managed by the FAA Flight Standards Service, using the guidance provided above. However, the range of programmable time delays allowed by the design should not exceed the maximum range specified above (15- 120 seconds). The approved time delay should be identified on the type design.
When the flight crew inhibits the system (i.e., denies entry) after responding to an emergency access alert, the duration time of the system in a disabled mode (i.e., unable to make an access request) should not be more than 30 minutes. Any longer duration needs to be substantiated by the applicant and documented in an issue paper. Once the door is unlocked using the emergency access system due to flight crew incapacitation, the door should remain unlocked for a minimum of 5 seconds after the specified time delay.
Level of alert: If the flight crew is in fact incapacitated, the level of alert is irrelevant.
If the flight crew is not incapacitated, they must assume one of the two conditions: (1)
833 the cabin crew has already tried to contact the flight crew by other means which were unsuccessful. In this case, the cabin crew believes there may be an emergency, or (2) an intruder is attempting to gain access to the flightdeck. This represents an immediate threat to safety of flight.
A crew procedure should be associated with this alert, including an action to immediately inhibit the emergency unlock system. If the pilots do not respond to the unlock alert within the specified time period, the system will unlock the door and could allow an intruder access to the flightdeck. This is considered to be a potentially catastrophic event. This alert most closely fits the warning category (reference § 25.1322 and AC 25-11, Section 10). It may be possible for an applicant to substantiate using the caution category, based on the design philosophy for the existing caution and warning system and the time period within which the pilot must respond. The delay time is important because the shorter the time delay, the more urgent the alert, and the more quickly pilots must take action to deny entry.
Visual and aural alerts should be consistent with the existing flightdeck design of the airplane’s caution and warning system. If the airplane has master alerts for warnings and/or cautions, it is desirable that the appropriate master alert be triggered in response to the emergency request for flightdeck access. It would also be desirable to integrate the alert into the crew alerting system display, if one is installed. However, the FAA recognizes that it may not be practicable (due to cost and schedule constraints) to fully incorporate the alerts into a centralized alerting system, especially in retrofit designs.
However, even if not fully integrated, the emergency access request alert should provide a level of awareness and urgency that is appropriate for the identified alert level (caution or warning). In general, the alert for emergency flightdeck access requests should include an aural alert, unless other suitable attention-getting features are incorporated.
Verification of Alerting System Functionality: While specific designs for flightdeck door access systems may allow for alternate approaches to ensure proper system functioning, the following generic policy is applicable: (1) proper functioning of visual and aural alerts must be verified at least daily, and (2) if power can be removed from the flightdeck door system via means other than by pulling a circuit breaker, a preflight verification must be accomplished to ensure that the system is powered. The system should either have visual indication of the system state or flightcrew procedures should incorporate a preflight verification of the system state. It is recommended that the requirements to check the system be implemented to provide maximum flexibility in how they are carried out. With respect to verification of the alerting system, for those systems that include a “doorbell” function (as discussed below under “multi-function designs”), where the same device is used to generate the routine and emergency access signals, use of the doorbell would be sufficient to verify functioning of the aural alert.
Multi-function designs: Some proposed designs are intended to provide functionality for the cabin crew to request routine access to the flightdeck (i.e., “doorbell” function) as well as provide emergency access to the flightdeck. In order to be compliant with the