825 flightdeck at the test angles required by the test, would additional testing be required at other angles that may allow the bullet to enter the flightdeck?
A: The 0-30 degree test described in AC 25.795-2 is basically a material test. The two test conditions are used to evaluate the penetration resistance of the material and to verify that there is no significant difference in performance based on angle of incidence.
With regard to the door design, a shotline that originates in the passenger cabin, and enters the flightdeck, should be evaluated to determine if it constitutes a hazardous trajectory. If it’s determined that no hazardous trajectory can result, additional protection may not be required.
Q: Advisory Circular 25.795-2 addresses projectiles targeted at the edge of the door.
Our understanding is that the intent was to arrest an errant projectile not an intentionally aimed projectile. Based on the above, would we be expected to aim a shot at the door knob/lock mechanism, the hinges, the gaps or other such door features for ballistic testing?
A: The preamble to Amendment 25-106 states, “any compromise to the integrity of the flightdeck door from a ballistic threat could enable an intruder to gain access to the flightdeck. It would be impracticable to protect the door without including a ballistic protection component.” Thus, the features mentioned above would require substantiation if their failure compromises the penetration resistance of the door, or would allow the door to open. For example, if a penetration failure results in a hazardous trajectory or enables an intruder to gain access to the flightdeck, these results would be unacceptable. For a feature with one of these potential types of failures, the feature should be tested, or shown to meet the requirement through some other means.
Q: What is the FAA's position on the ballistic testing of gaps?
A: Based upon AC 25.795-2, if the gap is protected with an equivalent amount of material that passed the material ballistic tests, testing of the gap is generally not necessary. Surfaces of protective material that are butted flush against each other may also be acceptable without testing, if it is clear that penetration is not an issue. If it’s determined that a gap needs to be tested, however, the same pass/fail criteria for the material ballistic test would apply.
826 Q: Is it necessary to test at angles other than 0 and 30 degrees for features where other angles might be critical?
A: The intent of the requirement is to provide a ballistic penetration barrier across the door, that will prevent compromise to the flightdeck, either by the ballistic threat itself, or by an intruder. To the extent that this barrier contains features and details that are not homogeneous, they may behave differently with shots at different angles of incidence.
Based on experience gathered to date, assuming that there are no discontinuities in the barrier, (Refer to figure), it is sufficient to address these features with shots at 0 and 30 degrees only. It is not necessary to try and define some other angle. Where there are discontinuities, this effectively results in no protective barrier for the part of the door where the discontinuity exists, which is contrary to the intent of the requirement.
Q: Since the revised NIJ standard calls for semi-jacketed bullets, can these types of bullets be used in lieu of jacketed hollow point bullets specified in AC 25.795-2?
A: AC 25.795-2 was based on the National Institute of Justice Ballistic Resistance of Personal Body Armor, NIJ Standard 0101.04, dated September 2000. This standard called out a jacketed hollow point bullet. The standard was later revised in June 2001 to call out a semi-jacketed bullet. To promote standardization, the NIJ requires a specific bullet, the Remington R44MG3 semi-jacketed bullet, to be used when testing to the standard. The FAA considers this same bullet as acceptable for testing in accordance with AC 25.795-2. Otherwise, a jacketed bullet should be used as per the AC.
Pilot Compartment Doors:
Background: In part, § 25.772 requires that a means be provided for the flight crew members to directly enter the passenger compartment from the pilot compartment if the cockpit door becomes jammed. Compliance with this requirement is usually accomplished by way of frangible access panels in the door, removable panels in the door, or quick release hinges. Strengthening of the door may involve removing or covering frangible panels to prevent forced entry, and reducing clearances for ballistic resistance. A possible acceptable design approach would be removable panels in the door, or surrounding structure, that are openable from the flightdeck, but do not allow access from the passenger compartment.
FAQ:
Dicontinuity where angle exceeds 30 deg Door Ballistic Material Ballistic Material Discontinuity where angle exceeds 30 deg
827 Q: Are the performance tests for ballistic and intrusion protection independent of the requirements of § 25.772?
A: Any performance tests for ballistic and intrusion protection would be independent of the requirements of § 25.772. That is, evaluation of the door design for egress from the flightdeck is accomplished without taking into consideration damage resulting from the intrusion or ballistic testing.
Q: What is the applicability of § 25.772(b) to strengthened flightdeck door certification programs?
A: The requirement that the flightcrew be able to enter the passenger cabin in the event that the flightdeck door becomes jammed was adopted by amendment 25-47 to § 25.772.
This rule is not in the certification basis of many airplanes currently in the fleet. While it might seem that this requirement would be adopted for strengthened flightdeck door certification programs under the provisions of § 21.101, this was not clearly delineated in this original guidance memo, and there are some projects that have not added this requirement to the certification basis. The FAA has determined that, for airplanes that have exits on the flightdeck, it is not necessary to add Amendment 25-47 to the certification basis for strengthened flightdeck door projects to retain the level of safety intended. For airplanes that do not have exits on the flightdeck, Amendment 25-47 should be included in the certification basis for strengthened flightdeck door projects.
Q: The original type certificate evaluation for demonstrating compliance to § 25.772 allowed overcoming the jam (i.e., pushing on the door to remove the jam). Based on the above guidance, can I use this same approach?
A: The following explanation for addressing egress out of a jammed flightdeck door is provided in the preamble of the notice of proposed rulemaking for § 25.772, at amendment 25-47: “The National Transportation Safety Board Recommendation A-74- 102 cites cases where, in an emergency situation, flight crewmembers had to exit through cockpit sliding windows because the pilot compartment to passenger compartment door was jammed. As a result, the flight crew was not in a position to assist in the evacuation of the passengers from the airplane.”
Further, the preamble to the final rule at Amendment 25-47 responded to several commenters objections that (1) the possibility of door jamming is remote due to aircraft design, (2) cockpit crash axes offer an equivalent method, and (3) cockpit security would be adversely affected. The preamble states: “Some airplanes are designed to preclude floor deformation and subsequent door jamming; however, this proposal provides for any door jamming condition which could occur regardless of aircraft design. The use of a crash axe does not provide the same degree of access to the passenger compartment from the cockpit. Under certain conditions, the crash axe may not provide access until a considerable period of time has elapsed. Cockpit security
828 would not be compromised since the requirement applies to new designs and allows sufficient design flexibility.”
As noted above, it is clear that § 25.772 intends to address a situation where a door is jammed, irrespective of design features that are intended to preclude such jamming. It is not clear that past compliance findings have approached the requirement in this way, although it is clear that features have been incorporated to enable the crew to mitigate a jammed door. However, in some cases, the features appear to have been intended to overcome the jammed condition, i.e., the door is forcibly unjammed, rather than providing means of entry into the cabin, even though the door remains jammed. For the purposes of addressing reinforced flightdeck door approvals, previous test methods to show compliance are considered acceptable for a given airplane type. However, we intend to revisit this subject with respect to the methods of compliance intended by the regulation and, if necessary, publish a policy statement for future approvals. Methods of compliance that depend on features intended to overcome a jammed door should be documented in an issue paper.
Emergency Exits and Emergency Exit Arrangement:
Background: Current regulations require that exits be openable from both the inside and outside (Ref. § 25.809). Additionally, the flightdeck requires access to two emergency exits (one on each side of the airplane) or a single top hatch (Ref. § 25.807).
For airplanes with flightdeck windows, or a top hatch, where each are openable from the inside and outside, there is no requirement for the flightdeck door to have provisions for egress from the flightdeck or entry by rescue personnel. On some aircraft, one or both of the window exits are not openable from the outside; access for rescue personnel to the flight crew area in this case is provided from nearby passenger exit(s) through the flightdeck door. The regulations allow flightdeck window exits to not be openable from the outside if other approved exits are convenient and readily accessible to the flight crew area.
For airplanes that use other approved exits, which are convenient and readily accessible to the flight crew area (i.e., forward passenger exits), the flightdeck door design must have provisions for entry by rescue personnel to meet the “readily accessible” requirement. Previously, the frangible nature of the flightdeck door provided ready access to the flightdeck for rescue personnel. Flightdeck doors designed to resist intrusion will not provide access as readily as previous doors. Two design approaches that may be employed to demonstrate that airplanes with strengthened door designs continue to meet § 25.809(b) are: (1) providing two exits or one hatch in the flightdeck, each openable from the outside, or (2) showing that the door in the closed and locked position can be entered by rescue personnel using normally available non-powered hand carried rescue tools (e.g., crowbar, ax, etc) in a reasonable time. The FAA expects that most, if not all, rescue personnel would have axes or crowbars at their disposal to gain access to the flightdeck, but not necessarily more sophisticated devices such as the “jaws of life.” Provided rescue personnel can be shown to be able to enter the flightdeck as described above, there is no need to consider structural deformation (jamming) for
829 § 25.809. It should be noted that what may be considered “readily accessible” regarding entry into the flightdeck through strengthened doors by rescue personnel, is likely to be beyond the limits of what is acceptable for “readily accessible” or similar terms used in other sections of part 25.
FAQ:
Q: Are the performance tests for ballistic and intrusion protection independent of the requirements of § 25.809?
A: Any performance tests for ballistic and intrusion protection would be independent of the requirements of § 25.809. That is, evaluation of the door design for ingress and egress from the flightdeck is accomplished without taking into consideration damage resulting from the intrusion or ballistic testing.
Q: In the event that the crew is trapped in the cockpit, what is the maximum amount of time allotted for rescue personnel to gain access to the cockpit through the improved flightdeck doors?
A: It is expected that with the improvements that are being incorporated into the flightdeck doors that the time needed by rescue personnel to gain access to the cockpit will be increased over that of the existing doors. The existing doors are considered frangible, therefore access by rescue personnel was not previously deemed a critical issue, but with the introduction of the intrusion and ballistic resistance requirements, the door can no longer be considered frangible and therefore the access time must be reevaluated. Based on information gathered from various sources, the FAA has determined that a maximum of 10 minutes is a reasonable and achievable goal for rescue personnel to gain access to the flightdeck through the strengthened flightdeck door. The FAA will evaluate any demonstrated time over the limit of 10 minutes on a case-by-case basis in order to determine its acceptability.
Q: How does an applicant show compliance with flightdeck accessibility by rescue personnel and is a compliance test required?
A: Since the doors were previously considered frangible, no known test data exist at this time that could be used as a basis for an analytical analysis Therefore, it is expected that a compliance test will be required. Subsequent certification programs may be candidates for an analytical approach provided they can be shown to be suitably similar to the previously certified doors. Other considerations that need to be addressed are the test parameters. It is expected that the test be conducted using trained rescue personnel, who are naive about the door design, using axes and/or crowbars, or other normally available non-powered hand carried tools. The timing for rescue personnel to gain access into the flightdeck should start with the first contact on the door.
Ventilation and Smoke:
Background: The previously mentioned decompression venting changes could negatively impact compliance with § 25.831. Venting changes should allow a sufficient
830 amount of uncontaminated air to enter the flight crew environment in order to provide a comfortable working environment and exclude harmful or hazardous concentrations of gases or vapors.
The ability of the ventilation system to evacuate hazardous quantities of smoke in the flight deck must also be maintained.
Venting changes must also not affect the ability to exclude hazardous quantities of smoke or extinguishing agent from the cargo compartments in compliance with §§ 25.855 and 25.857. Previous certification tests have demonstrated that smoke can migrate from a cargo compartment to the flightdeck unless the proper ventilation balance and compartment sealing are provided. Hazardous quantities of smoke or extinguishing agent could also enter other occupied areas (e.g., the main cabin) from the cargo compartment due to changes in the ventilation balance.
FAQ:
None at this time.
Compartment Interiors:
Background: All materials in the cabin, including the flightdeck door, are subject to the flammability requirements of § 25.853. Strengthening of the flightdeck doors may introduce materials that have not been traditionally used in Transport Category aircraft construction. In particular, material used to provide ballistic and shrapnel protection to the flightdeck should be evaluated for compliance to the flammability requirements of § 25.853.
FAQ:
Access into Flightdeck During Flight for §121.313(j):
Background: The effect of strengthening the flightdeck doors to enhance intrusion resistance, and removing access to the flightdeck for the cabin crew could result in a new unsafe design feature with respect to § 21.21(b)(2). In addition, § 121.313(j)(2), at Amendment 121-288, requires that each operator establish methods to enable a flight attendant to enter the pilot compartment in the event that a member of the flight crew becomes incapacitated. Consideration should be given to the following two situations that result in the crew not being able to access the flightdeck: (1) A pilot leaves the flightdeck, and the remaining pilot becomes incapacitated. The able-bodied pilot in this case may be effectively “locked out” of the flightdeck; or, (2) One pilot becomes incapacitated and the remaining pilot requires assistance to continue flying the airplane.
Previously, crew members were able to access the flightdeck via a common key to the flightdeck door, and provide any necessary assistance. Without a key, and behind a
831 strengthened door, assistance may not be available from crew members. One acceptable approach to address both situations would be to (a) add an Airplane Flight Manual (AFM) limitation requiring another crew member to be present in the flightdeck when one of the required flight crew leaves the flightdeck, and (b) providing a method to unlock the door from each pilot seat. Other proposed methods should be agreed upon using the issue paper process.
Access into Flightdeck During Flight for §25.772(c):
Background: As stated above, §121.313(j) requires that operators establish methods for a flight attendant to enter the flightdeck in the event that a member of the flight crew becomes incapacitated. This requirement differs from that of the new §25.772(c), in that the latter rule requires consideration of incapacitation of the entire flight crew.
Nonetheless, many manufacturers and modifiers have elected to design systems that comply with §25.772(c), even though this is not required for retrofit applications and is more stringent. The following guidance addresses systems designed to meet §25.772(c).
This guidance assumes that (1) the immediate response of a flight crewmember to an entry system alert will be to deny entry, and (2) the cabin crew will be instructed to use this system’s entry method only in the case of suspected incapacitation of the flight crew.
For the purposes of illustration only, a typical design and associated scenario would consist of the following:
1. Cabin crew attempts to contact flight crew using inter-phone system, knocking on flightdeck door, and any other available means.
2. If contact with the flight crew cannot be established and the cabin crew suspects that the flight crew may be incapacitated, the flight attendant requests emergency access to the flightdeck by entering a code using a numeric keypad or by some other method.
3. An alert is generated in the flightdeck to notify the flight crew that the emergency door unlocking sequence has been initiated from the cabin.
4. If the flight crew is capable of doing so (i.e., they are not incapacitated), one flight crew member will immediately respond to the alert by inhibiting the system, so that the door will not unlock. Then the flight crew will assess the situation to determine whether or not someone is attempting unauthorized access to the flightdeck.
5. If the flight crew is incapacitated, and as a result the system is not inhibited, after some period of time (time delay) the door will be automatically unlocked.
Time delay: The time delay for the emergency unlock feature is used to give the flight crew a reasonable amount of time to inhibit the alert while at the same time allowing flight attendants access to the flightdeck in the case of an incapacitated flight crew. The flight attendant would only activate this emergency door unlocking sequence if s/he
832 believes the flight crew is incapacitated, and thus needs access to the flightdeck. If the airplane is near the ground (especially while descending), and/or seriously out of control, the ability of the cabin crew to successfully intervene is very unlikely.
Therefore, it is unnecessary to require the time delay to be short enough to allow cabin crew intervention in such situations. If the airplane is in stable flight, it may be possible for the cabin crew to successfully intervene. However, in such cases, access should be timely, but a reasonable delay is acceptable. The flight crew needs a reasonable amount of time to inhibit the alert (to ensure intruders do not gain access before the flight crew responds to the alert), since they may be attending to other high priority tasks. This time delay should be consistent with the selected level of alert. Based on the above rationale, the FAA considers the appropriate time delay for the emergency unlock function to be between 30 and 60 seconds.
If applicants (the manufacturer and/or operator) desire time delays shorter than 30 seconds, they should provide specific rationale for a shorter time period. This rationale should be weighed against the need to prevent access to the flightdeck by unauthorized persons (if pilots fail to inhibit the unlock sequence within the time delay period). In addition, the applicant should provide information on the design features and/or procedures that will ensure that the pilots will respond to the alert by denying access within the time delay period (i.e., prior to automatic unlocking of the door). These features and/or procedures should account for other potential high priority tasks or high workload phases of flight. Notwithstanding the above, the FAA does not envision approving time delays shorter than 15 seconds.
If applicants desire time delays longer than the 60 seconds, they should provide specific rationale for a longer time period. This rationale should be weighed against the need to allow timely access to the flightdeck in case of incapacitation of the flight crew.
Notwithstanding the above, the FAA does not envision approving time delays longer than 120 seconds.
If manufacturers develop systems that allow operators to reprogram the time delay after delivery, the approval of the selected time delay for each operator will be managed by the FAA Flight Standards Service, using the guidance provided above. However, the range of programmable time delays allowed by the design should not exceed the maximum range specified above (15- 120 seconds). The approved time delay should be identified on the type design.
When the flight crew inhibits the system (i.e., denies entry) after responding to an emergency access alert, the duration time of the system in a disabled mode (i.e., unable to make an access request) should not be more than 30 minutes. Any longer duration needs to be substantiated by the applicant and documented in an issue paper. Once the door is unlocked using the emergency access system due to flight crew incapacitation, the door should remain unlocked for a minimum of 5 seconds after the specified time delay.
Level of alert: If the flight crew is in fact incapacitated, the level of alert is irrelevant.
If the flight crew is not incapacitated, they must assume one of the two conditions: (1)
833 the cabin crew has already tried to contact the flight crew by other means which were unsuccessful. In this case, the cabin crew believes there may be an emergency, or (2) an intruder is attempting to gain access to the flightdeck. This represents an immediate threat to safety of flight.
A crew procedure should be associated with this alert, including an action to immediately inhibit the emergency unlock system. If the pilots do not respond to the unlock alert within the specified time period, the system will unlock the door and could allow an intruder access to the flightdeck. This is considered to be a potentially catastrophic event. This alert most closely fits the warning category (reference § 25.1322 and AC 25-11, Section 10). It may be possible for an applicant to substantiate using the caution category, based on the design philosophy for the existing caution and warning system and the time period within which the pilot must respond. The delay time is important because the shorter the time delay, the more urgent the alert, and the more quickly pilots must take action to deny entry.
Visual and aural alerts should be consistent with the existing flightdeck design of the airplane’s caution and warning system. If the airplane has master alerts for warnings and/or cautions, it is desirable that the appropriate master alert be triggered in response to the emergency request for flightdeck access. It would also be desirable to integrate the alert into the crew alerting system display, if one is installed. However, the FAA recognizes that it may not be practicable (due to cost and schedule constraints) to fully incorporate the alerts into a centralized alerting system, especially in retrofit designs.
However, even if not fully integrated, the emergency access request alert should provide a level of awareness and urgency that is appropriate for the identified alert level (caution or warning). In general, the alert for emergency flightdeck access requests should include an aural alert, unless other suitable attention-getting features are incorporated.
Verification of Alerting System Functionality: While specific designs for flightdeck door access systems may allow for alternate approaches to ensure proper system functioning, the following generic policy is applicable: (1) proper functioning of visual and aural alerts must be verified at least daily, and (2) if power can be removed from the flightdeck door system via means other than by pulling a circuit breaker, a preflight verification must be accomplished to ensure that the system is powered. The system should either have visual indication of the system state or flightcrew procedures should incorporate a preflight verification of the system state. It is recommended that the requirements to check the system be implemented to provide maximum flexibility in how they are carried out. With respect to verification of the alerting system, for those systems that include a “doorbell” function (as discussed below under “multi-function designs”), where the same device is used to generate the routine and emergency access signals, use of the doorbell would be sufficient to verify functioning of the aural alert.
Multi-function designs: Some proposed designs are intended to provide functionality for the cabin crew to request routine access to the flightdeck (i.e., “doorbell” function) as well as provide emergency access to the flightdeck. In order to be compliant with the
834 requirement of § 25.772(c) the system must be designed so that the means by which routine access is requested cannot activate the automatic lock release mechanism.
In addition, the routine and emergency entry functions should be distinctive in the method of activation. The intent is to ensure that the undesired mode will not be activated. While not all possible designs can be described here, the following examples are intended to provide additional insight: (1) using one dedicated key (e.g., the number “1”) for routine access and a three-digit code for emergency access would be considered distinctive methods of activation, (2) using a guarded button for one function and a keypad entry for the other would be considered distinctive methods of activation, (3) if a keypad were used, having different three- digit codes for routine and emergency access would not be considered distinctive in the method of activation, and (4) if dedicated pushbuttons were used, having two unguarded buttons for the two modes would not be considered distinctive in the method of activation.
The flightdeck alerts (aural and visual) for routine and emergency access functions should be distinctly different from each other. While the emergency access request should result in a caution or warning level alert (due to consequences of failing to respond to the alert), this level of alert is not appropriate for the routine access request, which will not automatically unlock the door. Distinctly different alerts will help ensure that there is never any momentary confusion between the two alerts.
The crew response to an emergency access request should be distinct from the response to a routine access request. This is because routine access requests will be orders of magnitude more frequent than emergency access requests, so the most habitual response of the pilot will be to unlock the door. In the rare event of an emergency access request, that habitual response (unlocking the door) is a foreseeable error that would defeat the purpose of the new security measures for the flightdeck doors.
If a proposed design has similarities between the routine and emergency access alerts (similar sounds or sound sources) or if the pilot response to the emergency access request is similar to the response to a routine access request (e.g., activating the same switch in a different direction), an alternative method of compliance would be to inhibit the unlock function during the emergency unlock time delay period, to prevent inadvertent activation. In such cases, the time delay should not be less than 30 seconds.
Flight crew and cabin crew procedures should clearly distinguish between the two functions, when they are to be used, and the response to the alerts.
Irrespective of the system design, there are issues with obtaining positive verification of the personnel requesting entry. FAA Flight Standards is currently in the process of developing guidance on positive verification.
Multi-function designs (revised May 24, 2002): The above guidance identifies the potential for a specific pilot error if there are similarities between the alerts and the controls for routine and emergency access requests (i.e., they are not “distinctly different”). This potential error would involve the inadvertent selection of the "unlock"
835 function, rather than the "inhibit unlock" function, and could thus allow an unauthorized person access to the flightdeck. In order to prevent this foreseeable error and its consequences, the FAA suggested two methods of compliance: 1) make the alerts for routine access and emergency distinctly different and also make the control actions distinctly different, or 2) inhibit the unlock function during an emergency access request.
Other methods of compliance could also be acceptable. The FAA has revisited the above guidance and, while it is still considered valid and prudent, the FAA has concluded that strict adherence to this guidance may not be required.
If unauthorized persons were to use the system in an attempt to gain access, they could choose either the routine access function or the emergency access function. The FAA has considered which function would be the most likely to be used. Routine access is activated using a single button press, which could be determined by watching flight attendants or by looking at fairly accessible manuals; the button to use does not change over time; use of this function by cabin crew is routine and would raise no special alarms in the flightdeck. Emergency access is activated using a coded entry which must be retrieved from somewhat obscure sources or forcibly extracted from a flight attendant (if they are required to commit it to memory); the code is programmable and is subject to change; use of this function will produce an alarm in the flightdeck that is likely to raise pilot alertness and signifies a non-normal situation; access would only be granted if, in addition to not following procedures, the pilot makes the error at issue.
The FAA has concluded that while error potential still exists, it is much more likely that an unauthorized person would use the routine access function, if they were trying to use the system to gain access to the flightdeck. In such situations, the pilot does nothing
(i.e., does not touch the door switch) and the door stays locked. The error potential only exists if the emergency access function is used, which we judge to be much less likely because the intruder would correctly determine that it is much less likely to succeed.
Therefore, the potential for the pilot error represents a lesser risk than originally assumed.
In the interest of furthering timely design and installation of the new flightdeck doors, the FAA has concluded that the pilot error discussed above, while still possible, represents a small enough risk to justify a more relaxed interpretation of the earlier policy with respect to "distinctly different" alerts and controls. However, it is still important that the pilots be able to reliably discriminate between the alerts for routine and emergency access. That is because, if the pilot determines that an unauthorized person is attempting to gain access, the action that must be taken differs based on the type of alert: (1) For routine access alerts, the pilot does not move the switch and the door remains locked, and (2) For emergency access alerts, the pilot MUST move the switch to the “inhibit unlock” position or the door will automatically unlock.
Therefore, even if the alerts are not “distinctly different,” they must be sufficiently different to allow the pilot to readily discriminate between these two conditions. The FAA recommends that the alert sound continuously for all emergency access requests.
836 The procedures which detail the pilot procedures in response to both routine and emergency access requests should be included in the Airplane Flight Manual (AFM).
Airplane Flight Manual (AFM): For flightdeck doors with remote access systems, the functional check of the remote access system should be identified in the AFM as a limitation (reference section on “Verification of Alerting System Functionality”). It is recommended, but not required to have a cross-reference to the operating procedure for conducting the functional check. There may be other items that should also be contained in the AFM limitations depending on the peculiarities of individual door designs.
Emergency procedures should note that the automated remote access system will not perform its intended function in the event of a loss of electrical power and explain the use of any other alternative methods for locking the door (e.g., deadbolts). Emergency procedures should also include instructions for emergency egress (e.g., removal of decompression blowout panels).
The normal operating procedures should provide the instructions for performing the daily functional check and an explanation of the various functions of the remote access system.
Detailed operating procedures may be provided for operators to use “as is” or reformat to standardize with their company manuals.
Indication of Unlocked Flightdeck Door (CFR 25.1309(c)) Since September 11, 2001, an unlocked flightdeck door has been considered a potential hazard.
This is a different characterization than existed prior to September 11, but one that is both appropriate and applicable, given the potential consequences of unrestricted access to the flightdeck.
Section 14 CFR 25.1309(c) requires that, “Systems, controls, and associated monitoring and warning means must be designed to minimize crew errors which could create additional hazards.” The door locking mechanism is a system (whether mechanical or electro-mechanical) under the terms of § 25.1309(c) and, as noted above, a door that is unlocked is considered a potential hazard.
During flight, it is expected that the door may be opened for various reasons (e.g., pilot use of restroom or meal/refreshment service for the flightcrew). For the designs that incorporate a manual locking/unlocking mechanism, it is considered likely that the door will be closed in many cases by persons other than the pilots (e.g., cabin crew or observers’ seat occupant). In such situations, that person may be unable to lock the door or may fail to lock the door. Pilots, who may be occupied with other tasks, may fail to ensure that the door is locked. Therefore, flightdeck door designs should include features that will reduce the likelihood of this foreseeable crew error, which would result in unrestricted access to the flightdeck.
There are a number of possible and feasible design modifications and/or operational procedures that would satisfy this requirement, including, but not limited to: