Appendix B in the EWIS leading up to that panel. Identification of components inside the panel is just as important as for those outside the panel since the wiring inside the panel is treated much the same. Also, while this type of equipment is designed for its intended function and is manufactured and installed to the same standards as other EWIS, it is typically not qualified to an environmental standard such as RTCA DO-160.
Section 25.1703 Function and installation: EWIS.
Proposed § 25.1703 would require that applicants select EWIS components that are of a kind and design appropriate to their intended function. Factors such as the components’ design limitations, functionality, and susceptibility to arc tracking and moisture must be considered when selecting EWIS components.
Section 25.1301 requires that each item of installed equipment be of a kind and design appropriate to its intended function, be labeled (identified), be installed according to any limitations specified for it, and function properly when installed. This is a general “catch-all” regulation applicable to equipment and systems certified under subpart F. Because of its generality and the fact that the FAA has not published any advisory circular for this rule, § 25.1301 has not been applied in a standardized way. Currently, § 25.1301 is applicable to wire and its associated components but it does not provide sufficient wire-specific requirements to ensure proper function and installation of EWIS. It does not adequately cover all factors that need to be considered when selecting, identifying, and installing wiring components.
The requirements of § 25.1301 are the basis for the new § 25.1703, but those requirements are supplemented by new ones.
Requirements from other existing sections are also moved into the new regulation, so that the proposed rule would specifically apply to EWIS components. Adoption would ensure that the selection of wires and other EWIS components, and their installation, are carried out in a safe, consistent, and standardized manner.
Section 25.1703(a)(1) would require that each EWIS component be of a kind and design appropriate to its intended function. While § 25.1301(a) contains the same requirements, § 25.1703(a)(1) is specific to EWIS components. In this context, the requirement means that components must be qualified for airborne use, or otherwise specifically assessed as acceptable for their intended use.
To be “appropriate” means that the equipment is used in a manner B-5
Appendix B for which it was designed. For example, a wire rated at 150 degrees Celsius would not be appropriate for installation in an airplane zone where the temperature exceeds 150 degrees Celsius. Wire and other components made for household or consumer products use would not be appropriate for airborne use because they are manufactured for the consumer market and not for use in an airborne environment.
Exceptions to this would be wire or other consumer components shown to comply with all the applicable airworthiness requirements of part 25. In the past this showing of compliance has proven to be difficult because manufacturers of consumer products have been reluctant to modify their designs to accommodate aviation use.
Aviation use of consumer products represents too small a market.
Other factors that must be considered for EWIS component selection are mechanical strength, voltage drop, required bend radius, and expected service life. Expected service life means the expected service lifetime of the EWIS. This is not normally less than the expected service life of the aircraft structure. If the expected service life requires that all or some of the EWIS components be replaced at certain intervals, then these intervals must be specified in the ICA as required by § 25.1529.
Section 25.1703(a)(2) requires that EWIS components be installed according to their limitations. As used here, limitations means the design and installation requirements of the particular EWIS component. Examples of EWIS component limitations are maximum operating temperature, degree of moisture resistance, voltage drop, maximum current-carrying capability, and tensile strength. Section 25.1301(c) contains that requirement, but fails to specifically address the unique characteristics of EWIS. EWIS component selection and installation design must take into account various environmental factors including, but not limited to, vibration, temperature, moisture, exposure to the elements or chemicals (deicing fluid, for instance), insulation type, and type of clamp. For example, wire bundle adhesive clamps are known to work loose during aircraft operation. Attention must be given to the selection of and methods of affixing this type of wire bundle support and it must be shown that this type of clamp is appropriate for the environment in which it will be used.
Section 25.1703(a)(3) would require that EWIS function properly when installed. This is the same requirement as § 25.1301(d).
However, the § 25.1301(d) requirement is so general that it is applied in a nonstandardized manner. Sometimes the term “function properly when installed” has been interpreted to mean that even nonsafety-related functions of a given system must function in the B-6
Appendix B manner for which it was designed. The key word in understanding the intent of this proposed section is “properly,” as that relates to airworthiness of the airplane in which the electrical wiring interconnection systems are installed. For an EWIS component to function properly means that it must be capable of safely performing the function for which it was designed. For example, the fact that an airplane’s in-flight entertainment (IFE) system fails to deliver satisfactory picture or sound quality is not what the term “properly” refers to and is not a certification issue. However, the failure of an EWIS component has the potential for being a safety hazard whether it is part of a safety-related system or an IFE system. Therefore, EWIS components must always function properly when installed, no matter what system they are part of. The guidance material being prepared to accompany the subpart H AC 25.1701-1, “Certification of Electrical Wiring Interconnection Systems on Transport Category Airplanes,” will clarify these distinctions.
Section 25.1703(a)(4) is a new requirement to ensure that EWIS components be designed and installed so mechanical strain is minimized. This means the EWIS installation must be designed such that strain on the wires would not be so great as to cause wire or other components to fail. This requirement would ensure that adequate consideration is given to mechanical strain when selecting wire and cables, clamps, strain reliefs, stand-offs, and other devices used to route and support the wire bundle.
Proposed § 25.1703(b) would require that selection of wires for installation takes into account known characteristics of different wire types in relation to each specific application, to minimize risk of damage. It is important to select the aircraft wire type whose construction matches the application environment. The wire type selected must be constructed for the most severe environment likely to be encountered in service. Among other things, the proposed section would ensure that insulation types susceptible to arc tracking be used only in environments that will minimize the likelihood of that phenomenon. Arc tracking is a phenomenon in which a conductive carbon path forms across an insulating surface. A breach in the insulation allows arcing. The arcing carbonizes the insulation.
The carbon residue is electrically conductive. The carbon path then provides a short circuit path through which current can flow. This can occur on either dry or wet wires. Certain types of wire insulation are more susceptible to arc tracking than others. Wire insulated with aromatic polyimide is one type that is susceptible to arc tracking. While this type of insulation is well suited for use in very low or high temperature environments, it generally should not be used in areas of an airplane prone to excessive moisture or B-7
Appendix B vibration, such as those areas designated as severe wind and moisture problem (SWAMP) areas without taking into account this insulation property’s unique characteristics. Installations exposed to vibration and constant flexing in a moisture-prone area would need wire type suitable for that environment. Proposed § 25.1703(c) would require that design and installation of the main power cables allow for a reasonable degree of deformation and stretching without failure. This requirement now resides in § 25.869(a)(3).
Proposed § 25.1703(d) requires that EWIS components located in areas of known moisture build-up be adequately protected to minimize moisture’s hazardous effects. This is to ensure that all practical means are used to ensure damage from fluid contact with components does not occur. Wires routed near a lavatory, galley area, hydraulic lines, severe wind and moisture problem areas such as wheel wells and wing trailing edges, and any other area of the airplane where moisture collection could be a concern must be adequately protected from possible adverse effects of exposure to the types of moisture in these areas.
If a TC includes subpart H in its certification basis, the TC holder would have to show compliance with the proposed EWIS requirements. For future modifications of those TCs, use of the same design practices as those used by the TC holder will enable the modifier to substantiate compliance with the subpart H requirements based on a comparison with the TC holder’s methods. If modifiers choose to deviate from those design practices, they would have to substantiate compliance independently. They would also have to consider the design practices used by the TC holder in order to justify their own choice of components.
In summary, these new rules would require the designer and installer to be careful in wire type choices, system design, and installation design. The existing § 25.1301 would be amended to contain a reference to § 25.1703 for EWIS component requirements.
Section 25.1709 System safety: EWIS.
Proposed § 25.1705 would require applicants to perform a system safety assessment of the EWIS. The safety assessment must consider the effects that both physical and functional failures of EWIS would have on the airplane’s safety. Based on that safety assessment, it must be shown that each EWIS failure considered to be hazardous is extremely remote. Each EWIS failure considered to B-8
Appendix B be catastrophic must be shown to be extremely improbable and not result from a single failure.
The current regulation requiring system safety assessments is § 25.1309. But current § 25.1309 practice does not lead to the type of analysis that fully ensures all EWIS failure conditions affecting airplane-level safety are considered. This is because the current § 25.1309(a) only covers systems and equipment that are “required by this subchapter,” and wiring for nonrequired systems is sometimes ignored. The current safety analysis requirements of § 25.1309(b) and (d) have not always been applied to wire associated with the airplane systems that are covered by the same rule. When they are, there is evidence of inadequate and inconsistent application.
This is especially true for miscellaneous electrical equipment that is not required, such as IFE systems. Traditional thinking about these nonrequired systems has been that, since they are not required, and the function they provide is not necessary for the safety of the airplane, their failure could not affect the safety of the airplane. This is not a valid assumption because failure of an electrical wire can have hazardous or even catastrophic results regardless of the system it is associated with. Wire failure can cause serious physical and functional damage whether the wire or other EWIS components are associated with an autoland system or an IFE system. An example of this is arcing from a shorted wire cutting through flight control cables.
The Aviation Rulemaking Advisory Committee (ARAC), based on the work of its System Design and Analysis Harmonization Working Group, has made recommendations to the FAA for changes to the current § 25.1309. We are evaluating those recommendations.
(A copy of those recommendations has been placed in the docket for reference.) We have considered the ARAC recommendations in developing the proposed § 25.1705.
One of the factors we considered in developing the proposed § 25.1705 is that the proposed ARAC revisions to § 25.1309 would exempt certain airplane systems, including the EWIS components associated with those systems, from having to comply with its requirements. Specifically, ARAC recommends that jamming of flight control surfaces or pilot controls covered by § 25.671(c)(3) be exempt from the requirements of § 25.1309. Single failures covered by § 25.735(b)(1) and the failure effects covered by §§ 25.810(a)(1)(v) and 25.812 would also be excepted from the revision to § 25.1309(b) recommended by ARAC. This includes wiring or other EWIS components associated with those systems. In B-9
Appendix B part, proposed § 25.1705 would ensure coverage of the EWIS associated with those systems.
There are many examples of inadequate EWIS designs that have later been determined to be unsafe. Adoption of proposed § 25.1705 would help ensure that those unsafe design practices are not repeated in the future by requiring that EWIS failure conditions affecting airplane-level safety are fully considered. The current § 25.1309 does not provide that assurance.
The FAA has issued over 100 wire-related airworthiness directives (AD) since 1998. Over 50 of those were issued since 1999 to correct wiring deficiencies on the Model MD-11 airplane as delivered by the manufacturer. Airplanes as delivered from all transport category airplane manufacturers have been the subject of mandatory corrective action to correct safety-related wiring problems.
Similarly, the FAA has issued many ADs to correct unsafe EWIS installations because of postdelivery modifications. One example of this involves the IFE system installed on the Swissair MD-11 airplane that crashed off the coast of Nova Scotia and was discussed previously in this document. That modification is a clear case of not considering the effect that EWIS failures can have on airplane safety.
The airplane was modified using the supplemental type certification process to add the IFE system. That system contained roughly 750 separate electronic boxes and was installed without an adequate safety assessment per § 25.1309. Although this IFE system consumed relatively large amounts of electrical power and its components and wiring were distributed throughout, below, and above the entire passenger cabin, the applicant did not thoroughly address the safety implications of routing the system wire in the same bundles as wire from other airplane systems, thus raising a concern for common cause failure to multiple essential systems. In many instances the applicant could not identify what airplane systems were associated with the wire in the bundles modified to route the IFE wiring. With the adoption of the proposed § 25.1705, this IFE system, as designed and installed on an airplane with the proposed subpart H in its type certification basis, would be subjected to a more rigorous safety assessment that would identify any inappropriate routing and force a design change.
Many other examples of type design modifications provide evidence that modifiers do not always give due consideration to the impact on safety that installation of a new or modified system may have. Modifiers continue to route the EWIS needed for modifications with, or in close proximity to, B-10
Appendix B wiring from other airplane systems without identifying protection mechanisms for those systems. The current § 25.1309 and revisions to it recommended by ARAC do not contain sufficient requirements to ensure such modifications maintain the level of safety intended by the regulation.
Accordingly, a more comprehensive and specific safety assessment regulation for EWIS is necessary. The objective of the proposed § 25.1705 is to focus attention on EWIS and the safety issues associated with them by using the concepts of § 25.1309 to provide for consistent use of a more thorough and structured analysis of aircraft wiring and its associated components.
The integrated nature of wiring and the potential severity of failures demand a more structured safety analysis approach than that traditionally used under the current, or the ARAC’s proposed revision to, § 25.1309.
There are more failure modes that need to be addressed than have been addressed previously with traditional analyses (arcing events that occur without tripping circuit breakers, resulting in complete wire bundle failures and fire; or wire bundle failures that lead to structural damage, for example).
Current § 25.1309 system safety assessments typically evaluate effects of wire failures on system functions. But they have not considered physical wire failure as a cause of the failure of other wires within the EWIS. The traditional assessments look at external factors like rotor burst, lightning, and hydraulic line rupture, but not at internal factors, like a single wire chafing or arcing event, as the cause of the failure of functions supported by the EWIS. Compliance with the proposed § 25.1705 would require addressing those failure modes at the airplane level. This means that EWIS failures would need to be analyzed to determine what effect they would have on the safe operation of the airplane.
The proposed rule language is consistent with § 25.1309 and is meant to work in conjunction with the § 25.1309 assessments performed on airplane systems. It would require that the probability of a hazardous failure condition be extremely remote and that the probability of a catastrophic failure condition be extremely improbable and not result from a single failure. The terminology and meaning of the classifications of EWIS failure conditions are identical to those proposed by ARAC in August 2002. The proposed AC produced by that working group discussing this, titled “System Design and Analysis,” is in the docket for this NPRM. The following table identifies and explains the failure condition terms.
B-11
Appendix B Classification of Failure Conditions
Term Explanation No Safety Effect Failure conditions that would have no effect on safety; for example failure conditions that would not affect the operational capability of the airplane or increase flightcrew workload.
Minor Failure conditions that would not significantly reduce airplane safety, and involve flightcrew actions that are well within their capabilities. Minor failure conditions may include, for example:
• a slight reduction in safety margins or functional capabilities;
• a slight increase in flightcrew workload, such as routine flight plan changes; or
• some physical discomfort to passengers or cabin crew.
Major Failure conditions that would reduce the capability of the airplane or the ability of the flightcrew to cope with adverse operating conditions to the extent that there would be, for example:
• a significant reduction in safety margins or functional capabilities;
• a significant increase in flightcrew workload or in conditions impairing flightcrew efficiency;
• discomfort to the flightcrew; or
• physical distress to passengers or cabin crew, possibly including injuries.
Hazardous Failure conditions that would reduce the capability of the airplane or the ability of the flightcrew to cope with adverse operating conditions to the extent that there would be, for example:
• a large reduction in safety margins or functional capabilities; or
• physical distress or excessive workload such that the flightcrew cannot be relied upon to perform their tasks accurately or completely; or
• serious or fatal injuries to a relatively small number of persons other than the flightcrew.
Catastrophic Failure conditions that would result in multiple fatalities, usually with the loss of the airplane. (NOTE: A catastrophic failure condition was defined differently in previous versions of § 25.1309 and in accompanying advisory material as “a failure condition that would prevent continued safe flight and landing.”)
B-12
Appendix B The proposed § 25.1705 would complement the § 25.1309 assessments by raising the quality of the safety assessment with respect to EWIS failures that would not be identified using the traditional methods of compliance with § 25.1309. The analysis required to show compliance with the proposed regulation is based on a qualitative approach to assessing EWIS safety as opposed to a numerical probability-based quantitative analysis.
The intent is not to examine each individual wire and its relation to other wires, but rather to ensure that there are no unacceptable hazards to the airplane. This does not preclude the possibility that, should the analysis identify a failure in a given wire bundle or component(s) that may lead to a catastrophic failure condition, the design mitigation process may lead to performing a complete analysis of each wire in the relevant bundle.
The type of analysis used to show compliance with the proposed § 25.1705 can vary depending on the knowledge of the designers or modifiers of an EWIS. As stated earlier, it is important that there is thorough knowledge of what systems and functions the other wires in the same and surrounding bundles support. In the case of a post-TC modification, without this information it would be impossible to state that the modified system could not fail in a way that would cause a hazardous or catastrophic event. If this information is not available to the modifier, then the EWIS system must be designed to accommodate this lack of knowledge.
This would typically mean that wire being added for the modification would need to be routed separately from existing airplane wiring.
Flowchart 1 and Flowchart 2, contained in Appendix E of this notice, illustrate the type of analysis necessary to show compliance with the proposed § 25.1705. Two separate cases are considered. Flowchart 1 is applicable to pre-type-certification work and to TCs and STCs when the modifier has all the data necessary to perform the analysis. If the analysis is conducted according to this flowchart, the available data must include identification of systems supported by the EWIS under consideration for modification and the functions associated with them. The original aircraft manufacturer has most of this data and would normally follow the Flowchart 1 method. However, this may not always be the case when the manufacturer modifies an airplane that has been previously modified by another party.
The analysis depicted in Flowchart 2 would apply to modifiers for post- TC modification who cannot identify the systems or functions contained in EWIS being considered for modification.
In both analyses, EWIS functional and physical failures are addressed. It is the physical portion that has been neglected in past system safety analyses.
The proposed regulation would require an applicant to identify any physical failure of EWIS that can cause damage to co-located EWIS or other surrounding systems or structure, or injury to people. Once those physical B-13
Appendix B failures are identified, their severity can be determined and design mitigation strategies can be developed and applied. The process is repeated until all known unsafe features are eliminated. The difference between the processes identified in the two flowcharts is that in Flowchart 1, all the systems and associated functions whose wires are in a bundle are known. In Flowchart 2, new wire is routed separately from existing wire. Otherwise, the analysis is the same.
In summary, the need for this new regulation is shown by experience on the part of the FAA and other governmental regulatory authorities and by service histories. Many wire-related incidents and accidents have occurred.
Post-TC modifications have repeatedly introduced wiring safety problems.
Airplane manufacturers have delivered airplanes that have wiring problems when they leave the factory, or such problems have later developed in service, as evidenced by resulting mandatory corrective actions. Adoption of this proposal would ensure that such problems are fully considered and addressed as part of the type certification process.
Section 25.1709 System separation: EWIS.
Proposed § 25.1709 would require applicants to design EWIS with appropriate separation to minimize the possibility of hazardous effects upon the airplane or its systems.
Safe operation of airplanes depends in part on the safe transfer of electrical energy, a function provided by airplane EWIS. If an EWIS failure should occur, the separation between the failed EWIS and other EWIS and airplane systems plays an important role in ensuring that any hazardous effects of the failure are mitigated to an acceptable level. Thus, it is vital to design and install wiring systems with adequate separation from those systems whose interaction with the wire could create hazardous effects.
Currently, part 25 certification rules do not adequately address wire system separation. The rules currently used to require system separation are § 25.1353(a), (b), and (c), but service experience has shown that compliance with these requirements, with regard to wiring systems, has not always been adequate. This is due in part to their lack of specific wording about which wiring systems are covered and which systems those wires are meant to be separated from. The proposed rule corrects these inadequacies by stating specifically that it applies to each EWIS on the airplane, and mandating specific separation requirements for certain airplane systems known to have potential for creating a hazardous condition. The term “hazardous condition” in this proposed rule is used in a different context than it is used in the proposed § 25.1705. Proposed § 25.1705 uses the terms “hazardous” and “catastrophic” in the context of assigning a numerical probability to failures that can cause a failure condition. Hazardous failure conditions and B-14
Appendix B catastrophic failure conditions are defined in the discussion of the proposed § 25.1705. In proposed § 25.1709, the term hazardous condition means that the applicant must perform a qualitative design assessment of the installed EWIS. This assessment would involve using reasonable engineering and manufacturing judgment and assessing relevant service history to decide whether an EWIS, any other type of system, or any structural component could fail in such a way that a condition affecting the airplane’s ability to continue safe operation could result. A numerical probability assessment may still be required under the requirements of the proposed § 25.1705 if the airplane-level functional hazard assessment identifies failures that could affect safe operation of the airplane.
To illustrate the type of assessment required by proposed § 25.1709, consider the following simple example involving the use of wire bundle clamps. Clamps are used to secure a wire bundle to structure in order to hold the bundle in place and route the bundle from one location to another along a predetermined path. An airplane manufacturer, using the criteria contained in the proposed advisory material for § 25.1709, determines that a 2-inch separation from hydraulic lines is necessary. The manufacturer further decides that one clamp every 10 inches is needed to maintain that separation.
However, there is one localized area where a single clamp failure would potentially create a hazard. This is because the area in question is a high vibration, high temperature area, subject to exposure to moisture. So the clamp in this particular area is exposed to severe environmental conditions that could lead to its accelerated degradation. The manufacturer decides that using just a single clamp every 10 inches in this area would not suffice to preclude a hazardous event. The manufacturer prescribes use of double clamps every 10 inches in that area.
The requirements of proposed § 25.1709 do not preclude use of valid component failure rates if the applicant chooses to use a probability argument in addition to the design assessment to demonstrate compliance. It also does not preclude the FAA from requiring such an analysis if the applicant cannot adequately demonstrate that hazardous conditions will be prevented solely by using the qualitative design assessment.
As used in the proposed rule, the term “separation” is a measure of physical distance. The purpose of separation is to prevent hazards of arcing between wires in a single bundle, between two or more bundles, or between an electrical bundle and a non-electrical system or structure. In some cases, the proposal would allow separation to be achieved with a barrier or other means shown to be at least equivalent to the necessary physical distance.
However, distance separation is preferred because service experience shows that use of barriers such as conduits can cause wire damage or lead to maintenance errors. In some cases, wire bundle sleeving is used to provide B-15
Appendix B separation, although the sleeving itself is susceptible to the same types of damage as wire insulation.
Determining the necessary amount of physical separation distance is essential. However, the proposed rule does not mandate specific separation distances because each system design and airplane model can be unique, and because manufacturers have differing design standards and installation techniques. Instead it requires that the chosen separation be adequate so that an EWIS component failure will not create a hazardous condition. The following factors must be considered when determining the separation distance:
(1) The electrical characteristics, amount of power, and severity of failure condition of the system functions performed by the signals in the EWIS and adjacent EWIS.
(2) Installation design features, including the number, type, and location of support devices along the wire path.
(3) The maximum amount of slack wire resulting from wire bundle build tolerances and other wire bundle manufacturing variabilities.
(4) Probable variations in the installation of the wiring and adjacent wiring, including position of wire support devices and amount of wire slack possible.
(5) The intended operating environment, including amount of deflection or relative movement possible and the effect of failure of a wire support or other separation means.
(6) Maintenance practices as defined by the airplane manufacturer’s standard wiring practices manual and the ICA required by § 25.1529 and proposed § 25.1739.
(7) The maximum temperature generated by adjacent wire/wire bundles during normal and fault conditions.
The FAA recognizes that some airplane models may have localized areas where maintaining the minimum physical separation distance is not feasible.
In those cases, other means of ensuring equivalent minimum physical separation may be acceptable, if testing or analysis demonstrates that safe operation of the airplane is not jeopardized. The testing or analysis program must be conservative and consider the worst possible conditions.
Paragraphs (a), (b), (c), and (d) of proposed § 25.1709 contain EWIS- related requirements derived from the existing regulations applying to electrical power generation systems and electrical equipment and installations (§§ 25.1351 and 25.1353). Section 25.1351 does not need any revision to support the proposed § 25.1709, but § 25.1353 is amended to reference § 25.1709.
B-16