for which the airplane is not designed, and in which the airplane is not normally approved to operate. It also indicates that a random condition may be used in the analysis even when the system under analysis is designed to protect against the occurrence of the random condition. The AC provides, as an example, that it would be reasonable and rational to use a probability of less than one of encountering hazardous turbulence or gust levels after the failure of a structural load alleviation system. A probability less than one of fire occurring after a failure of the fire protection system is similar to this example, and may be used in the analysis. Advisory Circular
25.1309-1A also provides counter-examples for conditions which should not be considered random, and for which a probability of one should be used. These are conditions for which the airplane is designed. The examples provided, instrument meteorological conditions and Category III weather operations, are conditions in which the airplane would be expected to operate as a matter of course, and for which operational approval would be granted.
(b) The second issue concerns what value less than one should be assigned to the probability of the occurrence of a fire. Advisory Circular 25.1309-1A, paragraph 8e, provides guidance that the statistically-derived probability used in the analysis should be based on an applicable supporting database and a valid statistical distribution. When requesting approval for the use of the probability of a random condition in a safety analysis, it is incumbent on the applicant to supply the data, show the applicability of the database from which the data is supplied, and derive a valid statistical conclusion. The ACO should then evaluate the applicant's statistical information and determine if the value used in the analysis is supported by the data presented. This value must be reassessed for subsequent programs, as service experience gained in the future may require the probability of the occurrence to be re-evaluated.
(c) The third issue is whether the required safety level reached through the use of the Maintenance Steering Group, Revision 3 (MSG-3) procedures is higher than that reached using a § 25.1309 related analysis. We contend that this is not so, and that a like-comparison of the two sets of procedures is not valid. The § 25.1309 analysis process is directed at assessing the contributions of failures to given failure conditions, and to directing the airplane or system design appropriately. The MSG-3 process is directed at determining appropriate maintenance actions given the contribution of a failure to a reduction in safety. Findings from the § 25.1309 analysis process are used as starting points for certain MSG-3 processes to determine maintenance activities and intervals, or whether the maintenance process can adequately minimize the risk elements assigned to it. The MSG-3 procedures must assume the combination of a system failure with the occurrence of the condition, which the system was designed to protect against, in order to account for hidden failures when determining maintenance actions.
Expected or allowable probabilities related to system failures are not derived through the MSG-3 process. In applying the above guidance, note that § 25.1309 is a rule of general applicability, and should not be used to replace a more specific and stringent requirement. Cargo compartments, and compartment fire detection and protection systems must meet requirements specified in §§ 25.855, 25.857, and 25.858, regardless of probabilities as determined in a § 25.1309 related analysis.
(2) Examples. For an example of compliance with § 25.1309(c), see paragraph d(1) under § 25.1441, Oxygen equipment and supply, of this AC. Another example of compliance is included under paragraph d(2), § 25.855, Cargo or baggage compartments, of this AC.
(3) Safe and Reliable. The following is extracted from an FAA memorandum dated October 26, 1990, and addresses an inquiry regarding (i) The meaning of "safe and reliable" used in §§ 25.109(b) and 25.125(b)(3) in terms of AC 25.1309-1A probability, and (ii) The acceptable failure probability for deceleration devices like anti-skid and ground spoilers that have relatively large and small effects on landing distance. The FAA response follows:
(a) Safe and reliable is generally used to mean that a failure condition is improbable. In terms of AC 25.1309-1A quantitative probability terms, improbable failure conditions are those having a probability on the order of 1 X 10-5 or less.
(b) Each deceleration device, such as anti-skid and ground spoilers, would be expected to have a failure condition that is at least improbable (i.e. 1 X 10-5 or less) regardless of its effect on stopping distance.
e. References. For policy and guidance on compliance with this requirement, see AC 25.1309-1A, System Design Analysis, issued June 21, 1988, or latest revision, and AC 25-19, Certification Maintenance Requirements, issued November 28, 1994, or latest revision.
49 - 51. [RESERVED]
Section 2. INSTRUMENTS: INSTALLATION
52. SECTION 25.1325 - STATIC PRESSURE SYSTEMS.
a. Rule Text.
(a) Each instrument with static air case connections must be vented to the outside atmosphere through an appropriate piping system.
(b) Each static port must be designed and located in such manner that the static pressure system performance is least affected by airflow variation, or by moisture or other foreign matter, and that the correlation between air pressure in the static pressure system and true ambient atmospheric static pressure is not changed when the airplane is exposed to the continuous and intermittent maximum icing conditions defined in Appendix C of this Part.
(c) The design and installation of the static pressure system must be such that-
(1) Positive drainage of moisture is provided; chafing of the tubing and excessive distortion or restriction at bends in the tubing is avoided; and the materials used are durable, suitable for the purpose intended, and protected against corrosion;
and
(2) It is airtight except for the port into the atmosphere. A proof test must be conducted to demonstrate the integrity of the static pressure system in the following manner:
(i) Unpressurized airplanes. Evacuate the static pressure system to a pressure differential of approximately 1 inch of mercury or to a reading on the altimeter, 1,000 feet above the airplane elevation at the time of the test. Without additional pumping for a period of 1 minute, the loss of indicated altitude must not exceed 100 feet on the altimeter.
(ii) Pressurized airplanes. Evacuate the static pressure system until a pressure differential equivalent to the maximum cabin pressure differential for which the airplane is type certificated is achieved. Without additional pumping for a period of 1 minute, the loss of indicated altitude must not exceed 2 percent of the equivalent altitude of the maximum cabin differential pressure or 100 feet, whichever is greater.
(d) Each pressure altimeter must be approved and must be calibrated to indicate pressure altitude in a standard atmosphere, with a minimum practicable calibration error when the corresponding static pressures are applied.
(e) Each system must be designed and installed so that the error in indicated pressure altitude, at sea level, with a standard atmosphere, excluding instrument calibration error, does not result in an error of more than +/- 30 feet per 100 knots speed for the appropriate configuration in the speed range between 1.3 Vso with flaps extended and 1.8 Vs1 with flaps retracted. However, the error need not be less than +/- 30 feet.
(f) If an altimeter system is fitted with a device that provides corrections to the altimeter indication, the device must be designed and installed in such manner that it can be bypassed when it malfunctions, unless an alternate altimeter system is provided. Each correction device must be fitted with a means for indicating the occurrence of reasonably probable malfunctions, including power failure, to the flight crew. The indicating means must be effective for any cockpit lighting condition likely to occur.
(g) Except as provided in paragraph (h) of this section, if the static pressure system incorporates both a primary and an alternate static pressure source, the means for selecting one or the other source must be designed so that-
(1) When either source is selected, the other is blocked off; and
(2) Both sources cannot be blocked off simultaneously.
(h) For unpressurized airplanes, paragraph (g)(1) of this section does not apply if it can be demonstrated that the static pressure system calibration, when either static pressure source is selected, is not changed by the other static pressure source being open or blocked.
[Doc. No. 5066, 29 FR 18291, Dec. 24, 1964, as amended by Amdt. 25-5, 30 FR 8261, Jun. 29, 1965; Amdt. 25-12, 32 FR 7587, May 24, 1967; Amdt. 25- 41, 42 FR 36970, Jul. 18, 1977]
b. Intent of Rule. This rule provides minimum design and certification requirements for static pressure systems to ensure proper static system operation in varying operating conditions.
c. Background. Effective February 1, 1965, part 25 was added to Title 14, Code of Federal Regulations (14 CFR) to replace part 4b of the Civil Air Regulations (CAR). Many of the requirements in § 4b.612(b) of the CAR were carried over essentially unchanged to § 25.1325 of 14 CFR.
(1) Amendment 25-5 (June 29, 1965) added requirements for (1) operation in icing conditions and (2) devices that provide corrections to the altimeter indication.
(2) Amendment 25-12 (May 24, 1967) added requirements for static system proof testing for pressurized and unpressurized airplanes.
(3) Amendment 25-41 (July 18, 1977) added standards for static pressure systems, which incorporate the ability to select one or the other of primary and alternate static systems.
d. Policy/Compliance Methods. For policy and guidance on compliance with this requirement, refer to Advisory Circular (AC) 25-XX, Electrical Systems Handbook.
e. References. None.
Section 3. SAFETY EQUIPMENT
53. SECTION 25.1419 ICE PROTECTION.
a. Rule Text.
If certification with ice protection provisions is desired, the airplane must be able to safely operate in the continuous maximum and intermittent maximum icing conditions of appendix C. To establish that the airplane can operate within the continuous maximum and intermittent maximum conditions of appendix C:
(a) An analysis must be performed to establish that the ice protection for the various components of the airplane is adequate, taking into account the various airplane operational configurations; and
(b) To verify the ice protection analysis, to check for icing anomalies, and to demonstrate that the ice protection system and components are effective, the airplane or its components must be flight tested in the various operational configurations, in measured natural atmospheric icing conditions and, as found necessary, by one or more of the following means:
(1) Laboratory dry air or simulated icing tests, or a combination of both, of the components or models of the components.
(2) Flight dry air tests of the ice protection system as a whole, or of its individual components.
(3) Flight tests of the airplane or its components in measured simulated icing conditions.
(c) Caution information, such as an amber caution light or equivalent, must be provided to alert the flightcrew when the anti-ice or de-ice system is not functioning normally.
(d) For turbine engine powered airplanes, the ice protection provisions of this section are considered to be applicable primarily to the airframe. For the powerplant installation, certain additional provisions of Subpart E of this Part may be found applicable.
[Doc. No. 5066, 29 FR 18291, Dec. 24, 1964, as amended by Amdt. 25-23, 35 FR 5680, Apr. 8, 1970; Amdt. 25-72, 55 FR 29785, Jul. 20, 1990]
b. Intent of Rule. This rule provides standards for certification of an airplane with ice protection provisions. Certification for flight in icing conditions is optional at the discretion of the applicant. If the airplane is not certificated for flight in icing condition, appropriate limitations shall be placed in the type certificate data sheet and the airplane flight manual.
c. Background. Effective February 1, 1965, part 25 was added to Title 14, Code of Federal Regulations (14 CFR) to replace part 4b of the Civil Air Regulations (CAR). Many of the provisions in section 4b.640 of the CAR were carried over with minor word changes to § 25.1419 of 14 CFR. However, the intent of the CAR 4b.640 was unchanged.
Amendment 25-23 revised paragraph (c) to require flight tests in measured natural atmospheric icing conditions. Prior to Amendment 25-23 flight tests in measured natural atmospheric icing conditions were optional.
(1) Amendment 25-23 (April 8, 1970) added the requirements for flight testing in natural icing conditions contained in § 25.1419(c).
(2) Amendment 25-72 (July 20, 1990) rearranged the sub-paragraphs and inserted a new paragraph (c), which requires caution information when the anti-ice or de-ice system is not functioning normally. Prior to this amendment, a means to determine that a pneumatic de-icing boot system was working normally was required by § 25.1416. Section 25.1416 was removed to allow for the concept of the "dark cockpit.” (The term “dark cockpit” is descriptive language that refers to the absence of annunciation lights in the cockpit unless a system is operating abnormally.)
d. Policy/Compliance Methods. For guidance on compliance with this requirement, refer to the preamble of this rule and AC 20-73 and AC 25.1419-1.
e. References. The addresses for ordering the latest revision of advisory circulars, and other referenced documents listed below can be found in the Appendix to this AC.
AC 20-73, Aircraft Ice Protection.
AC 23.1419-2, Certification of Part 23 Airplanes for Flight in Icing Conditions.
AC 25.1419-1, Certification of Transport Category Airplanes for Flight in Icing Conditions.
Report No. DOT/FAA/CT-88/8-1 - Aircraft Icing Handbook (three volumes) FAA Technical Report ADS-4 - Engineering summary of Airframe Icing Technical Data, December 1963. (Although most of the information contained in this report is still valid, some is outdated, and more usable information is now available through recent research and experience and is included in the Aircraft Icing Handbook.)
54 - 58. [RESERVED]
Section 4. MISCELLANEOUS EQUIPMENT
59. SECTION 25.1433 - VACUUM SYSTEMS.
a. Rule Text.
There must be means, in addition to the normal pressure relief, to automatically relieve the pressure in the discharge lines from the vacuum air pump when the delivery temperature of the air becomes unsafe.
[Amdt. 25-72, 55 FR 29785, Jul. 20, 1990]
b. Intent of Rule. This rule provides minimum design and certification requirements for vacuum systems, specifically to require automatic pressure relief in the presence of high delivery air temperatures.
c. Background. Effective February 1, 1965, part 25 was added to Title 14, Code of Federal Regulations (14 CFR) to replace part 4b of the Civil Air Regulations (CAR). The requirements in section 4b.658 of the CAR were carried over essentially unchanged to § 25.1433 of 14 CFR.
(1) Amendment 25-72 (July 20, 1990) moved §§ 25.1433(b) and 25.1443(c), which dealt with fire protection for vacuum air systems, to § 25.869, Fire protection: Systems.
d. Policy/Compliance Methods. There is no existing written policy or guidance related to this subject in our files.
e. References. None.
60. SECTION 25.1435 - HYDRAULIC SYSTEMS.
a. Rule Text.
(a) Design.
(1) Each element of the hydraulic system must be designed to withstand, without deformation that would prevent it from performing its intended function, the design operating pressure loads in combination with limit structural loads which may be imposed.
(2) Each element of the hydraulic system must be able to withstand, without rupture, the design operating pressure loads multiplied by a factor of 1.5 in combination with ultimate structural loads that can reasonably occur simultaneously. Design operating pressure is maximum normal operating pressure, excluding transient pressure.
(b) Tests and analysis.
(1) A complete hydraulic system must be static tested to show that it can withstand
1.5 times the design operating pressure without a deformation of any part of the system that would prevent it from performing its intended function. Clearance between structural members and hydraulic system elements must be adequate and there must be no permanent detrimental deformation. For the purpose of this test, the pressure relief valve may be made inoperable to permit application of the required pressure.
(2) Compliance with 25.1309 for hydraulic systems must be shown by functional tests, endurance tests, and analyses. The entire system, or appropriate subsystems, must be tested in an airplane or in a mockup installation to determine proper performance and proper relation to other aircraft systems. The functional tests must include simulation of hydraulic system failure conditions. Endurance tests must simulate the repeated complete flights that could be expected to occur in service. Elements which fail during the tests must be modified in order to have the design deficiency corrected and, where necessary, must be sufficiently retested. Simulation of operating and environmental conditions must be completed on elements and appropriate portions of the hydraulic system to the extent necessary to evaluate the environmental effects. Compliance with 25.1309 must take into account the following:
(i) Static and dynamic loads including flight, ground, pilot, hydrostatic, inertial and thermally induced loads, and combinations thereof.
(ii) Motion, vibration, pressure transients, and fatigue.
(iii) Abrasion, corrosion, and erosion.
(iv) Fluid and material compatibility.
(v) Leakage and wear.
(c) Fire protection. Each hydraulic system using flammable hydraulic fluid must meet the applicable requirements of 25.863, 25.1183, 25.1185, and 25.1189.
[Amdt. 25-13, 32 FR 9154, Jun. 28, 1967, as amended by Amdt. 25-41, 42 FR 36971, Jul. 18, 1977; Amdt. 25-72, 55 FR 29786, Jul. 20, 1990]
b. Intent of Rule. The intent of this rule is to provide minimum design, performance, and safety requirements for transport category airplane hydraulic systems addressing the following aspects of component design and qualification, subsystem/system design, and system integration:
(1) Design operating loads in combination with limit and ultimate structural loads.
(2) Pressure transients and cyclic pressures.
(3) Environmental conditions.
(4) Fatigue and endurance life.
(5) Single and multiple failure modes.
(6) Indication and warning.
(7) Installation and support.
(8) Pump/engine interface.
(9) Fire protection.
(10) Continued safe flight and landing .
c. Background. Effective February 1, 1965, part 25 was added to Title 14, Code of Federal Regulations (14 CFR) to replace part 4b of the Civil Air Regulations (CAR). Sections 4b.653, 4b.654, and 4b.655 respectively became §§ 25.1435(a), 25.1435(b), and 25.1435(c) of 14 CFR for hydraulic systems. Since then, § 25.1435 has been revised under Amendment 25-13, Amendment 25-41, and Amendment 25-72 to make the regulations more comprehensive and to delete redundancies.
(1) Amendment 25-13 (June 28, 1967) prescribed more comprehensive design and test requirements by requiring (1) cockpit indication of system fluid quantity, (2) a means to prevent harmful or hazardous concentrations of the fluid or vapors in the crew or passenger compartments during flight due to hydraulic fluid leakage/release, and (3) compliance with § 25.1309 by functional tests, endurance tests, and analysis of the entire system or appropriate subsystems tested in an airplane or in a mockup installation to determine proper performance and proper relation to other aircraft systems.
(a) Regarding compliance with § 25.1435(b)(2), the preamble to the final rule states in part that, "the FAA agrees that the proposed environmental testing of the assembled system is not necessary in order to achieve a reasonable and effective testing program for improving hydraulic system reliability." The final rule was changed to allow applicants to meet endurance test requirements by performing endurance testing on components as long as the test program was representative of the airplane installation and environment.
(b) Applicants have shown compliance to the endurance testing requirements of § 25.1435 by conducting endurance tests on components or subassemblies using fixtures that represent the airplane installation and environmental conditions. The FAA normally accepts endurance test programs that vary hydraulic fluid temperature during endurance testing. The other environmental conditions are usually tested independent of the endurance test program.
The regulation does not specify the number of repeated cycles to meet endurance test requirements. As a minimum, the applicant must show that the reliability of components will meet the airplane system reliability requirements of § 25.1309.
(2) Amendment 25-23 (April 8, 1970) expanded § 25.1435(a)(4) to require means to ensure that no pressure will exceed a safe limit above design operating pressure by specifying pressure variation tolerances of +/- 10% on the pump discharge pressures and an upper limit of 125% of the design operating pressure for transients. These tolerances were based on in-service experience with such systems.
(3) Amendment 25-41 (July 18, 1977) clarified under § 25.1435(a)(2) that the pressure and quantity indication requirement was applicable to systems performing a function that is essential for continued safe flight and landing, or requiring corrective crew action when a system malfunction has occurred. It also recognized that means other than gages (e.g., warning lights) were an acceptable means of compliance. Sections 25.1435(a)(7) and 25.1435(a)(8) were added to allow certain transient pressures to exceed prescribed limits under (a)(4)(ii), provided the resulting fatigue strength was accounted for, and to require pump design such that loss of fluid condition could not create a hazard preventing continued safe flight and landing.
(4) Amendment 25-72 (July 20, 1990). Prior to this amendment, § 25.1435(b) was labeled "Tests," and contained references to a hydraulic system proof test, which was needed in order to comply with § 25.1309. Under Amendment 25-72, the general requirements of the old §§ 25.1435(a)(2) through 25.1435(a)(8), relative to indication, system pressures, transients, volumetric changes, pump discharge pressure limits, ripple damping devices, vibration, abrasion, corrosion, mechanical damage, inertia loads, hazardous vapors, relative motion, differential vibration, transient pressures, fatigue strength and loss of fluid to the pumps, were consolidated under a general listing as "Tests and Analyses" in the new § 25.1435(b)(2).
(5) Exemptions. In October 1993, pursuant to the authority contained in §§ 313(a) and 601(c) of the Federal Aviation Act of 1958, an applicant was granted an exemption (refer to exemption 5758A) from § 25.1435(b)(1) of Title 14, Code of Federal Regulations (14 CFR) to the extent necessary to permit type certification of a new airplane by testing of the complete hydraulic system at the system relief pressure, but not less than 3400 psig, in lieu of 1.5 times the design operating pressure (4500 psig). Additional similar exemptions have been granted (Refer to Exemptions 6086, 6504, and 6577).
(6) Harmonization. This regulation is the subject of a Federal Aviation Regulations/Joint Aviation Requirements (FAR/JAR) harmonization effort under the Aviation Rulemaking Advisory Committee (ARAC). The ARAC working group has recommended revisions to § 25.1435 and a new Advisory Circular (AC) 25.1435-1. The harmonized rule will reflect the exemptions granted, see (5) above. The notice of proposed rulemaking (NPRM 96-6) and accompanying proposed AC 25.1435-1, were published in the Federal Register on July 3, 1996 (61 FR 35056) and public comments were invited. The final rule is at the FAA headquarters for a regulatory evaluation. The final rule and AC are expected to be adopted in 2000.
d. Policy/Compliance Methods. For guidance on compliance with this requirement, refer to the preamble of this rule and the following information.
(1) Hydraulic Fluid Contamination. The following was extracted from an FAA letter to the National Transportation Safety Board (NTSB), dated June 29, 1998, and related correspondence. The NTSB accepted the FAA-Industry (Society of Automotive Engineers Committee A-6) task force resolution concerning the NTSB safety recommendation, A-96-116.
(a) Background. Following the crash of the USAir flight 427, a Boeing 737-300, on September 8, 1994, an NTSB investigation team found hydraulic fluid with a high particulate count in the main rudder power control unit (PCU). While the effect of contaminated hydraulic fluid on the different aircraft systems was not known at that time, it was examined as a potential factor. In October 1996, the NTSB made safety recommendation, A-96-116, which recommended that the FAA define and implement standards for in-service hydraulic fluid cleanliness and sampling intervals for all transport-category aircraft.
(b) Discussion. An April 1995, FAA study concluded that the existing standard, NAS 1638, was adequate for classifying the particulate contamination levels for aircraft hydraulic fluid. At the FAA's request, an industry task force formed by the Society of Automotive Engineers (SAE) Committee A-6 studied the fluid contamination issues. The industry task force concluded that (i) flight control servoactuators had demonstrated operation at contamination levels up to NAS 1638 class 17 and higher and, (ii) an in-service limit of NAS 1638 class 9 prescribed by the majority of current airframe manufacturers was conservative, adequate, and the maximum recommended limit. The task force also studied chemical contamination effects and provided in-service limits for fluid properties such as specific gravity, moisture content, viscosity, and chlorine content.
(c) Chemical Sensitivity. Actuation systems are insensitive to chemical contamination within normal in-service operational limits (see tabulation below). Gross contamination with other fluids is prohibited.
Chemical Quality Recommendations for In-Service Hydraulic Fluid
Analysis Limit Reason
Appearance No cloudiness or phase separation or precipitation Particulate and/or chemical contamination
Moisture 1.0 percent maximum Corrosion, fluid stability (acidity), low temperature pumpability
Neutralization number 1.5 mg KOH/gm maximum Corrosion, deposit formation
Kinematic viscosity @ 100ºF/38ºC
6.0 - 12.5cs Lubricity
Chlorine contamination* 200 ppm maximum Fluid purity, erosion
* This limitation is in addition to the amount already contained in the base stock.
(d) Sensitivity Methods. The task force recognized that the inconsistencies in the existing hydraulic fluid sampling procedures gave wide variations in the measured levels of particulate contamination. As a result, an Aerospace Recommended Practice ARP-5376, "Methods, Locations and Criteria for System Sampling and Measuring the Solid Particle Contamination of Hydraulic Fluids," was developed and published in September 1998.
(e) Sampling. The fluid sampling interval requirement for particulate contamination check is the same as the current one for checking chemical contamination.
Typical fluid sampling intervals used by airlines are on-condition, C-check, and 2C-check. In addition, manufacturers recommend fluid sampling when a suspected hydraulic contamination may exist (for example, due to or indicated by excessive component wear or deterioration).
(f) In summary. The FAA has identified an existing industry standard, NAS 1638, that defines fluid cleanliness levels as Classes 00 to 12; has defined NAS 1638 class 9, as the inservice limit, verified that the manufacturers already recommend these limits in their maintenance manuals including a sampling interval, and helped develop an SAE ARP document for sampling and testing techniques. The intent of the safety recommendation has been met and no regulatory corrective action is deemed necessary.
(2) Certification of Hydraulic Lines for Temporary Repairs. The following was extracted from an FAA letter dated April 23, 1992, which addresses certification of hydraulic lines for use as temporary repairs.
(a) It is not clear from the applicant's letter whether the hydraulic tubing assemblies being discussed are rigid or flexible, but it is assumed that the discussion involves various lengths of flexible hydraulic hose assemblies which can be joined together to replace 140