d. Each door for which the initial opening movement is inward, and unlatching of the door could result in a hazard, must have a locking means to prevent the latches from becoming disengaged. The locking means must ensure sufficient latching to prevent opening of the door even with a single failure of the latching mechanism. [§ 25.783(d)(4)]
(1) On these doors, the locking means should monitor the latch securing means, but need not directly monitor and lock each latch. Additionally, the locking means could be located such that all latches are locked by locking the latching mechanism.
(2) With any single failure in the latching mechanism, the means must still lock a sufficient number of latches to ensure that the door remains safely latched.
e. It must not be possible to position the lock in the locked position if the latch and the latching mechanism are not in the latched position. [§ 25.783(d)(5)]
(1) The lock should be an effective monitor of the position of the latch such that, if any latch is unlatched, the complete locking system cannot be moved to the locked position.
(2) Although an overcenter feature may be an adequate means of securing the latching mechanism, it is not considered to be the locking means for the latches.
f. It must not be possible to unlatch the latches with the locks in the locked position.
Locks must be designed to withstand the limit loads resulting from [§ 25.783(d)(6)]--
• the maximum operator effort when the latches are operated manually [§ 25.783(d)(6)(i)];
• the powered latch actuators, if installed [§ 25.783(d)(6)(ii)]; and
• the relative motion between the latch and the structural counterpart [§ 25.783(d)(6)(iii)].
(1) Although the locks are not the primary means of keeping the latches engaged, they must have sufficient strength to withstand any loads likely to be imposed during all approved modes of door operation.
(2) The operating handle loads on manually-operated doors should be based on a rational human factors evaluation. However, handle forces in excess of 300 pounds need not be considered.
(3) The loads imposed by the normal powered latch actuators are generally predictable;
however, loads imposed by alternate drive systems are not. For this reason, the locks should have sufficient strength to react to the stall forces of the latch drive system.
(4) Load-limiting devices should be installed in any alternative drive system for the latches in order to protect the latches and the locks from overload conditions.
(5) If the design of the latch is such that it could be subject to ratcheting loads that might tend to unlatch it, the locks should be adequate to resist such loads with the latch operating system disconnected from the latch.
g. Each door for which unlatching would not result in a hazard is not required to have a locking mechanism. [§ 25.783(d)(7)] (See paragraph 15 of this AC for a description of doors for which unlatching is considered not to result in a safety hazard.)
12. WARNING, CAUTION, AND ADVISO RY INDICATIONS (§ 25.783(e)).
a. There must be a positive means to indicate at each door operator’s station that all required operations to close, latch, and lock the door(s) have been completed. [§ 25.783(e)(1)]
(1) To minimize the probability of incomplete door operations, it should be possible to perform all operations for each door at one station. If there is more than one operator’s station for a single door, appropriate indications should be provided at each station.
(2) The positive means to indicate at the door operator’s station that all required operations have been completed are such things as final handle positions or indicating lights.
b. There must be a positive means clearly visible from each operator station for any door that could be a hazard if unlatched to indicate if the door is not fully closed, latched, and locked. [§ 25.783(e)(2)]
(1) A single indication that directly monitors the door in the closed, latched, and locked conditions should be provided, unless the door operator has a visual indication that the door is fully closed, latched, and locked. This indication should be obvious to the door operator.
(2) For example, a vent door or indicator light that monitors the door locks and is located at the door operator’s station may be sufficient.
(3) For doors that are remotely operated, the design of the door itself may need to address this requirement. For example, the position of the door may be difficult to ascertain from the operator’ station such that it is not obvious whether the door is in the closed position, or just close to it. In this case, it will likely be necessary to provide a feature either that prevents closing of the door if the latches are in the latched position, or prevents the latches from being moved unless the door is in the closed position. For doors that are manually operated, or where the position of the door is obviously not closed (e.g., held open by the latches in their latched position), such provisions would not be necessary to satisfy the requirement. For example, a passenger door with “shoot bolts” that extend to prevent the door from being closed any significant amount would typically not need such features to satisfy the requirement.
c. There must be a visual means on the flight deck to signal the pilots if any door is not fully closed, latched, and locked. The means must be designed such that any failure or
15 combination of failures that would result in an erroneous closed, latched, and locked indication is improbable for [§ 25.783(e)(3)]--
• each door that is subject to pressurization and for which the initial opening movement is not inward [§ 25.783(e)(3)(i)]; or
• each door that could be a hazard if unlatched [§ 25.783(e)(3)(ii)].
(1) The visual means may be a simple amber light or it may need to be a red warning light tied to the master warning system, depending on the criticality of the door.
(2) The door closed, latched, and locked functions must be monitored, but only one indicator is needed to signal that the door is in the closed, latched, and locked condition.
(3) Indications should be reliable to ensure that they remain credible. The probability of erroneous closed, latched, and locked indication must be no greater than 10-5 for--
• each door subject to pressurization and for which the initial opening movement is not inward; and
• each door that could be a hazard if unlatched.
d. There must be an aural warning to the pilots prior to or during the initial portion of takeoff roll if any door is not fully closed, latched, and locked, and its opening would prevent a safe takeoff and return to landing. [§ 25.783(e)(4)]
(1) Where an unlatched door could open and prevent a safe takeoff and return to landing, a more conspicuous aural warning is needed in addition to the visual indication. This system should function in a manner similar to the takeoff configuration warning systems required by § 25.703 (“Takeoff warning system”). The visual display for these doors may be either a red light or a display on the master warning system.
(2) Examples of doors requiring these aural warnings include--
• doors for which the structural integrity of the fuselage would be compromised if the door is not fully closed, latched, and locked; or
• doors that, if open, would prevent rotation or interfere with controllability to an unacceptable level.
13. VISUAL INSPECTION PROVISION (§ 25.783(f)) .
a. Each door for which unlatching of the door could be a hazard must have a provision for direct visual inspection to determine, without ambiguity, if the door is fully closed, latched, and locked. The provision must be permanent and discernible under operational lighting conditions, or by means of a flashlight or equivalent light source.
(1) A provision is necessary for direct visual inspection of the closed position of the door and the status of each of the latches and locks. This is because dispatch of an airplane may be permitted in some circumstances when a flight deck or other remote indication of an unsafe door remains after all door closing, latching, and locking operations have been completed. In this case, because the visual indication is used to determine whether to permit flight with a remote indication of an unsafe door, the visual indication should have a higher level of integrity than, and be independent of, the remote indication.
(2) The provisions should:
(a) Allow direct viewing of the positi on of the locks to show, without ambiguity, whether or not each latch is latched and each lock is in the locked position. For doors that do not have a lock for each latch, direct viewing of the position of the latches, and potentially the restraining mechanism, may be necessary for determining that all the latches are latched.
Indirect viewing, such as by optical devices or indicator flags, may be acceptable, provided that there is no failure mode that could allow a false latched or locked indication.
(b) Preclude false indication of the status of the latches and locks as a result of changes in the viewing angle. The status should be obvious without the need for any deductive processes by the person making the assessment.
(c) Be of a robust design so that, following correct rigging, no unscheduled adjustment is required. Furthermore, the design should be resistant to unauthorized adjustment.
(d) Preclude mis-assembly that could result in a false latched and locked indication.
(3) If markings are used to assist the id entification of the status of the latches and locks, such markings must include permanent physical features to ensure that the markings will remain accurately positioned.
(4) Although the visual means should be unambiguous in itself, placards and instructions may be necessary to interpret the status of the latches and locks.
(5) If optical devices or windows are used to view the latches and locks, it should be demonstrated that they provide a clear view and are not subject to fogging, being obstructed from dislodged material, or giving a false indication of the position of each latch and lock. Such
17 optical devices and window materials should be resistant to scratching, crazing, and any other damage from all materials and fluids commonly used in the operation and cleaning of airplanes.
14. CERTAIN MAINTENANCE DOORS, REMOVABLE EMERGENCY EXITS, AND ACCESS PANELS (§ 25.783(g)).
a. Some doors not normally opened except for maintenance purposes or emergency evacuation and some access panels need not comply with certain paragraphs of this section as follows:
• Access panels that are not subject to cabin pressurization and would not be a hazard if open during flight need not comply with paragraphs [25.783](a) through [25.783](f), but must have a means to prevent inadvertent opening during flight.
[§ 25.783(g)(1)]
• Inward-opening removable emergency exits that are not normally removed, except for maintenance purposes or emergency evacuation, and flight deck-openable windows need not comply with paragraphs [25.783](c) and [25.783](f).
[§ 25.783(g)(2)]
• Maintenance doors that meet the conditions of paragraph [25.783](h), and for which a placard is provided limiting use to maintenance access, need not comply with paragraphs [25.783](c) and [25.783](f). [§ 25.783(g)(3)]
b. Panels (doors) permitting access to auxiliary power units (APU) would typically satisfy more than one of the criteria noted above. For example, they are located in non-pressurized portions of the fuselage, require a maintenance action to operate and would not be a hazard to the airplane if left open. The typical APU access would also provide obvious indication that it was not closed. Therefore, in the vast majority of cases, APU access panels or doors would only have to provide means to prevent inadvertent opening during flight. Nonetheless, such access panels or doors would be covered by other provisions in the rule if they were not able to satisfy the conditions noted above.
15. DOORS THAT ARE NOT A HAZARD (§ 25.783(h)) .
a. Section 25.783(h) describes those attributes that are essential before a door in the unlatched condition can be considered not to be a hazard during flight. Section 25.783 in general also recognizes four categories of doors:
• Doors whose initial opening is not inward, and are presumed to be hazardous if they become unlatched.
• Doors whose initial opening is inward, and could be a hazard if they become unlatched.
• Doors whose initial opening is inward, and would not be a hazard if they become unlatched.
• Small access panels outside pressurized compartments whose opening is of little or no consequence to safety.
b. The requirements for doors “that are not a hazard” are self-explanatory and are restated as follows:
For the purposes of [§25.783(h)], a door is considered not to be a hazard in the unlatched condition during flight, provided it can be shown to meet all of the following conditions:
(1) Doors in pressurized compartments would remain in the fully closed position if not restrained by the latches when subject to a [differential] pressure greater than 1/2 psi. Opening by persons, either inadvertently or intentionally, need not be considered in making this determination.
[§ 25.783(h)(1)]
(2) The door would remain inside the airplane or remain attached to the airplane if it opens either in pressurized or unpressurized portions of the flight. This determination must include the consideration of inadvertent and intentional opening by persons during either pressurized or unpressurized portions of the flight. [§ 25.783(h)(2)].
(3) The disengagement of the latches during flight would not allow depressurization of the cabin to an unsafe level. This safety assessment must include the physiological effects on the occupant. [§ 25.783(h)(3)]
(4) The open door during flight would not create aerodynamic interference that could preclude safe flight and landing. [§ 25.783(h)(4)]
(5) The airplane would meet the structural design requirements with the door open. This assessment must include the aeroelastic stability requirements of § 25.629, as well as the strength requirements of this subpart.
[§ 25.783(h)(5)].
(6) The unlatching or opening of the door must not preclude safe flight and landing as a result of interaction with other systems or structures.
[§ 25.783(h)(6)]
16. STRUCTURAL REQUIREMENTS .
a. The door structure, including its mechanical features (such as hinges, stops, and latches) that can be subjected to airframe loading conditions, must be designed either to the damagetolerance requirements of § 25.571 (Amendment 25-45 or later), or to the earlier fail-safe requirements, depending on the certification basis of the airplane. Since applicants may elect to
19 voluntarily comply with Amendment 25-114, the earlier certification bases are relevant with regard to § 25.571.
b. In assessing the extent of damage under §§ 25.571 and 25.783, the applicant should give consideration to single element failures in the primary door structure, such as:
• frames
• stringers
• intercostals
• latches
• hinges
• stops
• stop supports
c. The skin panels on doors that must comply with § 25.571, Amendment 25-45 or later, should be designed to be damage-tolerant, with a high probability of detecting any crack before the crack causes door failure or cabin depressurization. The obvious partial failure criteria or the damage-tolerance criteria may be used for the design of skin panels on doors with an earlier certification basis.
/s/
Ali Bahrami Manager, Transport Airplane Directorate Aircraft Certification Service