834 requirement of § 25.772(c) the system must be designed so that the means by which routine access is requested cannot activate the automatic lock release mechanism.
In addition, the routine and emergency entry functions should be distinctive in the method of activation. The intent is to ensure that the undesired mode will not be activated. While not all possible designs can be described here, the following examples are intended to provide additional insight: (1) using one dedicated key (e.g., the number “1”) for routine access and a three-digit code for emergency access would be considered distinctive methods of activation, (2) using a guarded button for one function and a keypad entry for the other would be considered distinctive methods of activation, (3) if a keypad were used, having different three- digit codes for routine and emergency access would not be considered distinctive in the method of activation, and (4) if dedicated pushbuttons were used, having two unguarded buttons for the two modes would not be considered distinctive in the method of activation.
The flightdeck alerts (aural and visual) for routine and emergency access functions should be distinctly different from each other. While the emergency access request should result in a caution or warning level alert (due to consequences of failing to respond to the alert), this level of alert is not appropriate for the routine access request, which will not automatically unlock the door. Distinctly different alerts will help ensure that there is never any momentary confusion between the two alerts.
The crew response to an emergency access request should be distinct from the response to a routine access request. This is because routine access requests will be orders of magnitude more frequent than emergency access requests, so the most habitual response of the pilot will be to unlock the door. In the rare event of an emergency access request, that habitual response (unlocking the door) is a foreseeable error that would defeat the purpose of the new security measures for the flightdeck doors.
If a proposed design has similarities between the routine and emergency access alerts (similar sounds or sound sources) or if the pilot response to the emergency access request is similar to the response to a routine access request (e.g., activating the same switch in a different direction), an alternative method of compliance would be to inhibit the unlock function during the emergency unlock time delay period, to prevent inadvertent activation. In such cases, the time delay should not be less than 30 seconds.
Flight crew and cabin crew procedures should clearly distinguish between the two functions, when they are to be used, and the response to the alerts.
Irrespective of the system design, there are issues with obtaining positive verification of the personnel requesting entry. FAA Flight Standards is currently in the process of developing guidance on positive verification.
Multi-function designs (revised May 24, 2002): The above guidance identifies the potential for a specific pilot error if there are similarities between the alerts and the controls for routine and emergency access requests (i.e., they are not “distinctly different”). This potential error would involve the inadvertent selection of the "unlock"
835 function, rather than the "inhibit unlock" function, and could thus allow an unauthorized person access to the flightdeck. In order to prevent this foreseeable error and its consequences, the FAA suggested two methods of compliance: 1) make the alerts for routine access and emergency distinctly different and also make the control actions distinctly different, or 2) inhibit the unlock function during an emergency access request.
Other methods of compliance could also be acceptable. The FAA has revisited the above guidance and, while it is still considered valid and prudent, the FAA has concluded that strict adherence to this guidance may not be required.
If unauthorized persons were to use the system in an attempt to gain access, they could choose either the routine access function or the emergency access function. The FAA has considered which function would be the most likely to be used. Routine access is activated using a single button press, which could be determined by watching flight attendants or by looking at fairly accessible manuals; the button to use does not change over time; use of this function by cabin crew is routine and would raise no special alarms in the flightdeck. Emergency access is activated using a coded entry which must be retrieved from somewhat obscure sources or forcibly extracted from a flight attendant (if they are required to commit it to memory); the code is programmable and is subject to change; use of this function will produce an alarm in the flightdeck that is likely to raise pilot alertness and signifies a non-normal situation; access would only be granted if, in addition to not following procedures, the pilot makes the error at issue.
The FAA has concluded that while error potential still exists, it is much more likely that an unauthorized person would use the routine access function, if they were trying to use the system to gain access to the flightdeck. In such situations, the pilot does nothing
(i.e., does not touch the door switch) and the door stays locked. The error potential only exists if the emergency access function is used, which we judge to be much less likely because the intruder would correctly determine that it is much less likely to succeed.
Therefore, the potential for the pilot error represents a lesser risk than originally assumed.
In the interest of furthering timely design and installation of the new flightdeck doors, the FAA has concluded that the pilot error discussed above, while still possible, represents a small enough risk to justify a more relaxed interpretation of the earlier policy with respect to "distinctly different" alerts and controls. However, it is still important that the pilots be able to reliably discriminate between the alerts for routine and emergency access. That is because, if the pilot determines that an unauthorized person is attempting to gain access, the action that must be taken differs based on the type of alert: (1) For routine access alerts, the pilot does not move the switch and the door remains locked, and (2) For emergency access alerts, the pilot MUST move the switch to the “inhibit unlock” position or the door will automatically unlock.
Therefore, even if the alerts are not “distinctly different,” they must be sufficiently different to allow the pilot to readily discriminate between these two conditions. The FAA recommends that the alert sound continuously for all emergency access requests.
836 The procedures which detail the pilot procedures in response to both routine and emergency access requests should be included in the Airplane Flight Manual (AFM).
Airplane Flight Manual (AFM): For flightdeck doors with remote access systems, the functional check of the remote access system should be identified in the AFM as a limitation (reference section on “Verification of Alerting System Functionality”). It is recommended, but not required to have a cross-reference to the operating procedure for conducting the functional check. There may be other items that should also be contained in the AFM limitations depending on the peculiarities of individual door designs.
Emergency procedures should note that the automated remote access system will not perform its intended function in the event of a loss of electrical power and explain the use of any other alternative methods for locking the door (e.g., deadbolts). Emergency procedures should also include instructions for emergency egress (e.g., removal of decompression blowout panels).
The normal operating procedures should provide the instructions for performing the daily functional check and an explanation of the various functions of the remote access system.
Detailed operating procedures may be provided for operators to use “as is” or reformat to standardize with their company manuals.
Indication of Unlocked Flightdeck Door (CFR 25.1309(c)) Since September 11, 2001, an unlocked flightdeck door has been considered a potential hazard.
This is a different characterization than existed prior to September 11, but one that is both appropriate and applicable, given the potential consequences of unrestricted access to the flightdeck.
Section 14 CFR 25.1309(c) requires that, “Systems, controls, and associated monitoring and warning means must be designed to minimize crew errors which could create additional hazards.” The door locking mechanism is a system (whether mechanical or electro-mechanical) under the terms of § 25.1309(c) and, as noted above, a door that is unlocked is considered a potential hazard.
During flight, it is expected that the door may be opened for various reasons (e.g., pilot use of restroom or meal/refreshment service for the flightcrew). For the designs that incorporate a manual locking/unlocking mechanism, it is considered likely that the door will be closed in many cases by persons other than the pilots (e.g., cabin crew or observers’ seat occupant). In such situations, that person may be unable to lock the door or may fail to lock the door. Pilots, who may be occupied with other tasks, may fail to ensure that the door is locked. Therefore, flightdeck door designs should include features that will reduce the likelihood of this foreseeable crew error, which would result in unrestricted access to the flightdeck.
There are a number of possible and feasible design modifications and/or operational procedures that would satisfy this requirement, including, but not limited to:
• Provide indications to the flight crew that will remind them that the door is not locked. If a visual indication is used, it should be in the pilot’s normal field of view.
• Designing the latch/lock mechanism so that it automatically locks when the door is closed. This would minimize the potential for crew error to result in an unlocked door.
• Incorporate a partial hardware solution (e.g., spring load the bolt to prop the door open or spring load the door open) along with appropriate operational procedures to ensure the door is not inadvertently left unlocked. For this situation, the following limitation should be added to the AFM:
The flightdeck door must be kept closed and locked at all times during flight except to permit access and egress in accordance with the FAA approved procedures for opening, closing, and locking the door.
• Address the issue entirely through required operational procedures. In addition to the above AFM limitation, incorporate operational procedures to include the following challenge and response procedure as an AFM limitation:
The flightdeck door must be kept closed and locked at all times during flight except to permit access and egress in accordance with the FAA approved procedures for opening, closing, and locking the door.
Any time the flightdeck door is opened in flight, a challenge and response closing and locking verification procedure must be used to verify that the door is closed and locked.
This approach necessitates an equivalent level of safety finding and is expected to be utilized on smaller transport category airplanes with shorter average flight segments.
Electromagnetic Compatibility and Lightning The strengthened flightdeck doors may include electrical and electronic equipment and associated wiring. This equipment may cause unwanted electromagnetic interference (EMI) to other airplane systems, particularly airplane radio receivers.
In addition, the flightdeck door electrical and electronic equipment may be susceptible to radio frequency fields from airplane systems, external high intensity radiated fields (HIRF), and lightning-induced transients.
The flightdeck door electrical and electronic equipment must comply with FAA regulations regarding equipment installation compatibility, specifically §§ 25.1353(a) and 25.1431(c). The flightdeck door electrical and electronic equipment should be tested and meet the requirements of RTCA/DO-160D Section 21.
Category M is recommended. If the flightdeck door electrical and electronic
838 equipment meet the requirements of RTCA/DO-160D Section 21 Category M, then airplane ground testing to ensure no adverse interference with existing systems on the airplane is adequate, and no flight tests to demonstrate electromagnetic compatibility are required. Flight tests to demonstrate compatibility with other systems on the airplane would only be necessary if, a) the ground test demonstrates unresolved electromagnetic interference from the flightdeck door electrical and electronic equipment that may be due to the ground specific test configuration and not representative of in-flight conditions, or b) the RTCA/DO-160D Section 21 test results show significant RF emissions that exceed Category L within airplane communication, navigation or surveillance radio frequency bands. In these cases, the flight tests should assess any possible interference with radio systems required for continued safe flight and landing, such as auto-land, and Instrument Landing Systems during flightdeck door operations which potentially cause the most interference.
In general, flightdeck door systems have not been categorized as having catastrophic, hazardous or major failure conditions with respect to HIRF and lightning-induced transients. This must be confirmed by the specific flightdeck door installation applicant. If confirmed by the applicant, then § 25.1316 for system lightning protection and the HIRF special condition do not apply to the flightdeck door system.
Although the HIRF special condition generally will not be applied to the flightdeck door system, RF susceptibility tests for the flightdeck door electrical and electronic equipment are recommended as part of the compliance with §§ 25.1353(a) and
25.1431(c). Tests performed according to RTCA/DO-160D Section 20 Category T are acceptable.
All airplane wiring associated with the installation of the strengthened flightdeck door should comply with FAA policy statement, ANM-01-04, System Wiring Policy for Certification of Part 25 Airplanes, published in the Federal Register, February 5, 2002. The policy statement addresses wiring installation drawings, safety analysis and instructions for continued airworthiness. The safety analysis should specifically address interference on adjacent wiring and wire bundles in the airplane, especially any wire associated with systems required for safe flight and landing. For example, any potential interference with auto-land systems needs to be specifically addressed.
Although not specifically addressed in this memorandum, the following information is provided for reference and consideration on flightdeck door certification projects.
Video Camera Monitoring Systems: As part of the flightdeck door modification, applicants may choose to incorporate a video camera monitoring system in the door design. Policy and guidance relating to video systems used to view the cabin from the flightdeck is not addressed by this Memorandum, but is available in FAA Memorandum 01-111-196, dated October 5, 2001, “Interim Summary of Policy and Advisory Material Available for Use In the Certification of Cabin Mounted Video Cameras Systems with Flightdeck Displays on Title 14 CFR Part 25 Aircraft.”
839 For questions regarding the guidance in this memo, please contact Jeff Gardlin at (425) 227-2136, or via email at jeff.gardlin@faa.gov.
/s/ Vi Lipski Vi Lipski
DISTRIBUTION All Managers, Aircraft Certification Offices Manager, Aircraft Engineering Division, AIR-100 Manager, Transport Standards Staff, ANM-113 Manager, International Branch, ANM-116 Manager, SEA-AEG Manager, LGB-AEG
841 APPENDIX 12
ESTABLISHING THE MAXIMUM PASSENGER SEATING CAPACITY FOR AN
AIRPLANE MODEL For airplanes intended to be used in passenger carrying operations, the establishment of the maximum passenger seating capacity is one of the most important activities to be accomplished by the airplane manufacturer. The maximum passenger seating capacity is important because the commercial viability of an airplane is often dependent on its passenger seating capacity. The maximum passenger seating capacity must be established considering evacuation on land (emergency evacuation and exits requirements of §§ 25.803 and 25.807), and in the water (the ditching exit requirements of § 25.807). Additionally, if the airplane is proposed to be certified for extended overwater operations, compliance with the ditching requirements of § 25.801 must be demonstrated. If the airplane is to be utilized in extended overwater operations, compliance with all of the ditching requirements is necessary.
a. For an airplane not certified for extended overwater operations:
There are two or three requirements (depending on the maximum passenger seating capacity sought) that determine the maximum passenger seating capacity. For this appendix, the current amendment level of each regulation is noted. The requirements are as follows:
1. Type and number of emergency exits, § 25.807(g), Amendment 25-94. Paragraph (g) of § 25.807 establishes a maximum passenger seating capacity for land evacuation. Paragraph (g) stipulates the type (e.g., A, B, III) and number of exit pairs (except for ventral and tail cone exits) that need to be installed by adding up the “ratings” of each exit pair. There are some limitations regarding how exit types may be combined in getting the maximum passenger seating capacity, particularly for capacities up to 110.
2. Ditching emergency exits for passengers, § 25.807(i), Amendment 25-94. Paragraph (i) of § 25.807 establishes a maximum passenger seating capacity for water evacuation. Ditching exits are required whether or not the airplane is intended for extended overwater operations. It must be shown that, under reasonably probable water conditions, the flotation time and trim of the airplane will allow the occupants to leave the airplane. For airplanes not certified for extended overwater operations the flotation time and trim of the airplane must provide adequate time for the occupants to leave the airplane either into the water or on to the wing. For airplanes certified for extended overwater operations the flotation time and trim of the airplane must provide adequate time for the occupants to leave the airplane and enter the liferafts required by § 25.1415. Note that ditching exit capacity is based on individual exits, rather than exit pairs.
Type A exits are allowed 70 passengers per exit, whereas all other exits are allowed 35 passengers per exit.
3. Emergency evacuation demonstration, § 25.803(c), Amendment 25-72. This demonstration is conducted to ensure that the airplane, with its combination of exits, exit locations, seating and furnishing arrangements, etc., can be evacuated in a timely manner under
842 prescribed conditions. This demonstration is only required for airplanes with a maximum passenger seating capacity of 45 or more.
The maximum passenger seating capacity is determined by the smaller (smallest) number of passengers obtained under (a)(1), (a)(2) and, if applicable, (a)(3) above.
Example: if an airplane has 4 pairs of Type I exits, (a)(1) would allow a capacity of 180 passengers (4 x 45) and (a)(2) would allow 280 passengers (8 x 35), then the limit would be 180 passengers (the smaller of the two numbers). If a successful evacuation demonstration were conducted with 180 passengers, then the maximum passenger seating capacity would be 180. If, however, the manufacturer conducts the demonstration with only 165 passengers, then the maximum passenger seating capacity would be limited to 165.
b. For an airplane certified for extended overwater operations.
In addition to the requirements applicable for non-extended overwater operations certified airplanes, there is an additional requirement related to liferaft capacity, which may affect the total passenger seating capacity. Certification for ditching requires the installation of certain ditching equipment, in particular, liferafts, § 25.1415 (b), Amendment 25-82. These capacities liferaft include flight deck seats, flight attendant seats, and passengers’ seats that are occupiable for taxi, takeoff, and landing (TT&L) but does not include lap children (children who have not reached their second birthday who are seated on the lap of a passenger). Two calculations are necessary for determining the liferaft capacity of an airplane, as follows:
1. Maximum capacity of installed liferafts using there “rated” capacities (either remotely stowed, or integrated as part of emergency escape slides, known as “slide rafts”).
2. Maximum capacity of installed liferafts using their “overload” capacities but with one raft of the largest capacity considered to be unavailable.
Note: The rated and overload capacities for slide rafts and liferafts are established in Technical Standard Orders (TSO) C69 and C70 respectively.
The liferaft capacity is the smaller of the two capacities determined in (b)(1) and (b)(2) above.
This number is now compared to the number established for non-extended overwater airplanes.
If it is larger than the number established in (a), then the capacity remains as in (a). If it is smaller than the number established in (a), then the capacity is reduced to the number established in (b), during extended overwater operations.
Example: If an airplane has two pairs of Type A exits (one pair located at the forward end of the passenger cabin and the other pair located at the aft end of the passenger cabin), one pair of Type B exits, and one pair of Type I exits. The exit arrangement is ABIA. The maximum passenger seating capacity is as follows:
843 For (a)(1): two pairs of Type A gives a capacity of 220 (2 x 110), one pair of Type B exits 75, and one pair of Type I exits 45 for a total of 340 passengers.
For (a)(2): two pairs of Type A gives a capacity of 280 (4 x 70), one pair of Type B exits 70 (2 x
35), and one pair of Type I exits 70 (2 x 35) for a total of 420 passengers.
For (a)(3): the evacuation demonstration was successfully conducted with 340 passengers.
For (b)(1): the rated capacity of the slide rafts or liferafts installed on the airplane gives a capacity of for the forward pair of Type A exits 132 (2 x 66), aft pair of Type A exits 120 (2 x
60), for the pair of Type B exits 60 (2 x 30), and for the pair of Type I exits 60 (2 x 30) for a total of 372 occupants (flight deck seats, flight attendant seats, and passenger seats occupiable for TT&L).
For (b)(2): the largest slide raft or liferaft is one of the forward Type A exit side rafts. The remaining slide rafts and life rafts provide the overload capacity for the airplanes of for the forward pair of Type A exits 88 (1 x 88), aft pair of Type A exits 160 (2 x 80), for the pair of Type B exits 72 (2 x 36), and for the pair of Type I exits 90 (2 x 45) for a total of 410 occupants (flight deck seats, flight attendant seats, and passenger seats occupiable for TT&L).
Provided there are less than 32 crew seats (flight deck seats and flight attendant seats) the airplane is limited by (a)(1) and (a)(3).
THIS PAGE INTENTIONALLY LEFT BLANK
845 APPENDIX 13 FAA POLICY MEMO ANM-03-115-31, “POLICY STATEMENT ON CONDUCTING COMPONENT LEVEL TESTS TO DEMONSTRATE COMPLIANCE WITH §§ 25.785(B) AND (D)” DATED MAY 9, 2005