Subject: FUSELAGE DOORS AND
HATCHES Date: 4/25/05 Initiated By: ANM-115 AC No: 25.783-1A Change:
1. PURPOSE. This advisory circular (AC) describes an acceptable means for showing compliance with the requirements of § 25.783, “Fuselage doors,” and other applicable sections of Title 14, Code of Federal Regulations (CFR), part 25. Part 25 contains the airworthiness standards applicable to transport category airplanes. The means of compliance described in this document provides guidance to supplement the engineering and operational judgment that must form the basis of any compliance findings about the structural and functional safety standards for fuselage doors and their operating systems.
2. APPLICABILITY.
a. The guidance provided in this document is directed to airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration transport airplane type certification engineers and their designees.
b. Like all advisory circular material, this AC is not, in itself, mandatory, and does not constitute a regulation. It describes an acceptable means, but not the only means, for showing compliance with the requirements for transport category airplanes. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. On the other hand, if we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance.
c. This material does not change, create any additional, authorize changes in, or permit deviations from, regulatory requirements.
3. CANCELLATION. Advisory Circular 25.783-1, “Fuselage Doors, Hatches, and Exits,” dated 12/10/86, is canceled, but remains applicable for airplanes with older certification bases.
4. RELATED DOCUMENTS.
a. Title 14, Code of Federal Regulations (14 CFR), part 25 :
Section Title
25.571 Damage-tolerance and fatigue evaluation of structure
25.607 Fasteners
25.703 Takeoff warning system
25.783 Fuselage doors
25.809 Emergency exit arrangement
25.813 Emergency exit access
b. FAA Advisory Circulars (AC) :
AC No. Title Date 20-71 Dual Locking Devices on Fasteners 12/8/70 25-17 Transport airplane Cabin Interiors Crashworthiness Handbook 7/15/91
5. DEFINITIONS . Inconsistent or inaccurate use of terms may lead to installing doors and hatches that do not fully meet the safety objectives of the regulations. To ensure that such installations fully comply with the regulations, the following definitions should be used when showing compliance with § 25.783.
a. Door includes all doors, hatches, openable windows, access panels, covers, etc., on the exterior of the fuselage that do not require the use of tools to open or close. This also includes each door or hatch through a pressure bulkhead, including any bulkhead that is specifically designed to function as a secondary bulkhead under the prescribed failure conditions of part 25.
b. Initial opening movement refers to that door movement, caused by operation of a handle or other door control mechanism, which is required to place the door in a position that is free of structure that would interfere with continued opening of the door.
c. Inward means having a directional component of movement that is in opposition to the mean (pressure) plane of the body cutout.
d. Closed means the door has been placed within the doorframe in such a position that the latches can be operated to the “latched” condition. Fully closed means the door is placed within the doorframe in the position it will occupy when the latches are in the latched condition.
e. Latches are movable mechanical elements that, when engaged, prevent the door from opening.
f. Latched means the latches are fully engaged with their structural counterparts and held in position by the latch operating mechanism.
g. Latching system means the latch operating mechanism and the latches.
h. Locks are mechanical elements, in addition to the latch operating mechanism, that monitor the latch positions and, when engaged, prevent latches from becoming disengaged.
i. Locked means the locks are fully engaged.
j. Locking system means the lock operating mechanism and the locks.
k. Stops are fixed structural elements on the door and doorframe that, when in contact with each other, limit the directions in which the door is free to move.
l. Exit is a door designed to allow egress from the airplane. (Note that most exits are required to be emergency exits.)
m. Emergency exit is an exit designated for use in an emergency evacuation.
n. Flight refers to that period of time from the start of takeoff roll until the airplane comes to rest after landing.
o. Door operator’s station is the location(s) where the door closing, latching, and locking operations are performed.
p. Inadvertent action by persons means an act committed, whether deliberate or not, that has unintended consequences.
6. BACKGROUND .
a. There is a history of incidents and accidents in which doors, fitted in pressurized airplanes, have opened inadvertently during pressurized and unpressurized flight. Some of these inadvertent openings have resulted in fatal accidents. After one fatal accident that occurred in 1974, the FAA and industry representatives formed a design review team to examine the existing regulatory requirements for doors to determine if those regulations were adequate to ensure safety. The team’s review and eventual recommendations led to the FAA issuing Amendment 25-54 to part 25 in 1980, which significantly improved the safety standards for doors installed on transport category airplanes. Included as part of Amendment 25-54 was § 25.783, “Doors,” which provides the airworthiness standards for doors installed on transport category airplanes.
b. Although there have been minor revisions to § 25.783 since Amendment 25-54, the safety standards for doors had remained essentially the same until we adopted Amendment 25-
114. Despite the improved standards established by Amendment 25-54, there have continued to be safety problems, especially for cargo doors. Cargo doors are often operated by people having little formal instruction in their operation. Sometimes the operator is required to carry out several actions in sequence to complete the door opening and closing operations. Failure to complete all actions in sequence during closure can have serious results. Service history shows that several incidents of doors opening during flight have been caused by the failure of the operator to complete the door closing, latching, and locking sequence. Other incidents have been attributable to incorrect adjustment of the door mechanism, or to failure of a vital part.
c. Experience also has shown that, in some cases, the flight deck indication system has not been reliable. In other instances, the door indication system performed correctly, but the flightcrew, for unknown reasons, was not alerted to the unsafe condition. A reliable indication of door status on the flight deck is particularly important on airplanes used in operations where the flightcrew does not have an independent means readily available to verify that the doors are properly secured.
d. On some airplanes, large cargo doors form part of the basic fuselage structure, so that, unless the door is properly closed, latched, and locked, the basic airframe structure is unable to carry the design aerodynamic and inertial loads. Large cargo doors also have the potential for creating control problems when an open door acts as an aerodynamic surface. In such cases, failure to secure the door properly could have catastrophic results, even when the airplane is unpressurized.
e. After two accidents occurred in 1989 due to the failure of cargo doors on transport category airplanes, the Air Transport Association (ATA) of America initiated another study of the door design and operational issues. The ATA finished its study in 1991 and made recommendations to the FAA for improving the design standards of doors. The FAA considered those recommendations, as well as other recommendations from the National Transportation Safety Board, in developing the improved standards for doors adopted by Amendment 25-114 on May 3, 2004 (69 FR 24496).
7. CURRENT REQUIREMENTS - GENERAL .
a. Service history has shown that, to prevent doors from becoming a hazard by opening during flight, it is necessary to provide multiple layers of protection against failures, malfunctions, and human error. Section 25.783 addresses these multiple layers of protection by requiring:
• a latching system
• a locking system
• indication systems
• a pressure prevention means
b. These features provide a high degree of tolerance to failures, malfunctions, and human error. Section 25.783 requires the latching system to be designed so that it is inherently or specifically restrained from being back-driven from the latches. Even so, the latches are designed to eliminate, as much as possible, all forces from the latch side that would tend to unlatch the latches. In addition to these features that prevent the latches from inadvertently opening, a separate locking system is required for doors that could be a hazard if they become unlatched. Despite these safety features, it could still be possible for the door operator to make errors in closing the door, or for mechanical failures to occur during or after closing. Therefore, an indicating system is required that will signal to the flightcrew if the door is not fully closed, latched, and locked. However, since it is still possible for the indication to be missed or unheeded, a separate system is required that prevents pressurization of the airplane to an unsafe level if the door is not fully closed, latched, and locked.
c. A discussion of acceptable compliance criteria is provided in paragraphs 8 through 15 of this AC. To make this AC easier to use, the applicable rule text and section reference is provided, followed by the compliance discussion.
8. GENERAL DESIGN CONSIDERATIONS (§ 25.783(a)) .
a. Each door must have means to safeguard against opening in flight as a result of mechanical failure, or failure of any single structural element. [§ 25.783(a)(1)]
(1) The applicant should consider failures when safeguarding the door against opening due to mechanical failure or the failure of a single structural element.
(2) Such failures include those caused by:
• wear
• excessive backlash
• excessive friction
• jamming
• incorrect assembly
• incorrect adjustment
• parts becoming loose, disconnected, or unfastened
• parts breaking, fracturing, bending, or flexing beyond the extent intended.
b. Each door that could be a hazard if it unlatches must be designed so that unlatching during pressurized and unpressurized flight from the fully closed, latched, and locked condition is extremely improbable. This must be shown by safety analysis. [§ 25.783(a)(2)]
(1) All doors should incorporate features in the latching mechanism that provide a positive means to prevent the door from opening as a result of such things as:
• vibrations
• structural loads and deflections
• positive and negative pressure loads, positive and negative “g” loads
• aerodynamic loads
(2) The means should be effective throughout the approved operating envelope of the airplane, including the unpressurized portions of flight.
(3) The applicant may conduct the safety assessment required by this regulation by qualitative or quantitative analysis, or a combination, as appropriate to the design. In evaluating a failure condition that results in total failure or inadvertent opening of the door, the applicant should consider all contributing events, including:
• failure of the door and door supporting structure
• flexibility in structures and linkages
• failure of the operating system
• erroneous signals from the door indication systems
• likely errors in operating and maintaining the door
c. Each element of each door operating system must be designed or, where impracticable, [distinctly] and permanently marked, to minimize the probability of incorrect assembly and adjustment that could result in a malfunction. [(§ 25.783(a)(3)].
(1) Experience has shown that the level of protection against mechanical failure can be significantly improved by careful attention to detail design. Therefore, the applicant should take the following points into account:
(a) To minimize the risk of incorrect assembly and adjustment, parts should be designed to prevent incorrect assembly if, as a result of such incorrect assembly, door functioning would be adversely affected. “Adverse effects” could be such things as preventing or impeding the opening of the door during an emergency, or reducing the capability of the door to remain closed. If such designs are impracticable and marking is used instead, the marking should remain clearly identifiable during service. In this respect, markings could be made using material such as permanent ink, provided it is resistant to typical solvents, lubricants, and other materials used in normal maintenance operations.
(b) To minimize the risk of the door operating mechanism being incorrectly adjusted in service, adjustment points that are intended for “in-service” use only should be clearly identified and limited to a minimum number consistent with adequate adjustment capability. Any points provided solely to facilitate adjustment at the initial build and not intended for subsequent use should be made non-adjustable after initial build, or should be highlighted in the maintenance manual as a part of the door mechanism that is not intended to be adjusted.
d. All sources of power that could initiate unlocking or unlatching of any door must be automatically isolated from the latching and locking systems prior to flight and it must not be possible to restore power to the door during flight. [§ 25.783(a)(4)].
(1) For doors that use electrical, hydraulic, or pneumatic power to initiate unlocking or unlatching, those power sources must be automatically isolated from the latching and locking systems before flight. Additionally, it should not be possible to restore power to them during flight.
(2) It is particularly important for doors with powered latches or locks to have all power removed that could power these systems or that could energize control circuits to these systems in the event of electrical short circuits. This does not include power to the door indicating system, auxiliary securing devices (if installed), or other systems not related to door operation.
Power to those systems should not be sufficient to cause unlocking or unlatching unless each failure condition that could result in energizing the latching and locking systems is extremely improbable.
e. Each removable bolt, screw, nut, pin, or other removable fastener must meet the locking requirements of § 25.607 [“Fasteners”]. (Note: Refer to FAA Advisory Circular 20-71, “Dual Locking Devices on Fasteners,” dated 12/8/70, for guidance on complying with § 25.607.)
[§ 25.783(a)(5)]
f. Certain doors, as specified by § 25.807(h), must also meet the applicable requirements of §§ 25.809 through 25.812 for emergency exits. [§ 25.783(a)(6)]
9. OPENING BY PERSONS (§ 25.783(b) .
a. There must be a means to safeguard each door against opening during flight due to inadvertent action by persons.
(1) The door should have inherent design features that achieve this objective. It is not considered acceptable to rely solely on cabin pressure to prevent inadvertent opening of doors during flight, because there have been instances where doors have opened during unpressurized flight, such as during landing.
(2) All doors should therefore incorporate features to prevent the door from being opened inadvertently by people on board the airplane, such as orienting the handle so that deliberate action is required to operate it.
b. In addition, design precautions must be taken to minimize the possibility for a person to open a door intentionally during flight. If these precautions include the use of auxiliary devices, those devices and their controlling systems must be designed so that--
• no single failure will prevent more than one exit from being opened [§ 25.783(b)(1)]; and
• failures that would prevent opening of the exit after landing are improbable [§ 25.783(b)(2)].
(1) The intentional opening of a door by people on board while the airplane is in flight should be considered. This rule is intended to protect the airplane and passengers, but not necessarily the person who intentionally tries to open the door. Suitable design precautions should therefore be taken; however, the precautions should not compromise the ability to open an emergency exit in an emergency evacuation. In this context, single failures include hardware failures as well as maintenance and logical (e.g., software) errors. Note that certain maintenance or logical errors may have the potential to affect more than one door.
(2) The applicant should consider the following precautions:
(a) Doors in pressurized compartments . It should not normally be possible to open the door when the compartment differential pressure is above 2 psi. The ability to open the door will depend on the door operating mechanism and the handle design, location, and operating force. Operating forces in excess of 300 pounds should be considered sufficient to prevent the door from being opened. During approach, takeoff, and landing, when compartment differential pressure is lower, intentional opening may be possible; however, these phases are brief and all passengers are expected to be seated with seat belts fastened.
(b) Doors that cannot meet the guidance of paragraph 9b(2)(a) of this AC, and Doors in non-pressurized airplanes. The use of auxiliary devices (for example, a speed-activated or barometrically-activated means) to safeguard the door from opening should be considered.
The need for such auxiliary devices should depend upon the consequences to the airplane and other occupants if the door is opened in flight.
(c) Auxiliary devices installed on emergency exits . The failure of an auxiliary device should normally result in an unsecured position of the device. Failures of the device that would prevent opening of the exit after landing should be improbable.
(3) The opening of exits on the ground should also be considered in the design, relative to the effects of differential pressure. While it is desirable and required to be able to open exits under normal residual differential pressure, opening of the exit with significant differential pressure can be a hazard to the person opening the exit. Clearly, emergency conditions may
9 dictate that the exit be opened regardless of the differential pressure. Devices that restrict opening of the door, or affect the pressurization system, can have failure modes that create other safety concerns. However, the manufacturer should consider this issue in the design of the door and provide warnings where necessary, if it is possible to open a door under differential pressure that may be hazardous to the exit operator. Ideally, the door would be openable with the highest differential pressure that is safe for the operator, but no higher than that.
10. PRESSURIZATION PREVENTION MEANS (§ 25.783(c)).
a. There must be a provision to prevent pressurization of the airplane to an unsafe level if any door subject to pressurization is not fully closed, latched, and locked. The provision must be designed to function after any single failure, or after any combination of failures not shown to be extremely improbable. [§ 25.783(c)(1)]
(1) The provisions for preventing pressurization must monitor the closed, latched, and locked condition of the door. If more than one lock system is used, each lock system must be monitored. Examples of such provisions are vent panels and pressurization inhibiting circuits.
Pressurization to an unsafe level is considered to be prevented when the compartment differential pressure is kept below 1/2 psi. These systems are not intended to function to depressurize the airplane once the fully closed, latched, and locked condition is established and pressurization is initiated.
(2) If a vent panel is used, it should be designed so that, in normal operation or with a single failure in the operating linkage, the vent panel cannot be closed until the door is latched and locked. The vent panel linkage should monitor the position of each door lock.
(3) If automatic control of the cabin pressu rization system is used as a means to prevent pressurization, the control system should monitor each lock. Because inadvertent depressurization at altitude can be hazardous to the occupants, this control system should be considered in showing compliance with the applicable pressurization system reliability requirements. Normally, such systems should be automatically disconnected from the airplane’s pressurization system after the airplane is airborne, provided no prior unsafe condition was detected.
(4) It should not be possible to override the pressurization prevention system unless a procedure is defined in the Master Minimum Equipment List (MMEL) that confirms a fully closed, latched, and locked condition. In order to prevent the override procedure from becoming routine, the override condition should not be achievable by actions solely on the flight deck, and should be automatically reset at each door operational cycle.
b. Doors that meet the conditions described in paragraph [25.783] (h) are not required to have a dedicated pressurization prevention means if, from every possible position of the door, it will remain open to the extent that it prevents pressurization or safely close and latch as pressurization takes place. This must also be shown with each single failure and malfunction, except that [§ 25.783(c)(2)]--
• with failures or malfunctions in the latching mechanism, it need not latch after closing [§ 25.783(c)(2)(i)]; and
• with jamming as a result of mechanical failure or blocking debris, the door need not close and latch if it can be shown that the pressurization loads on the jammed door or mechanism would not result in an unsafe condition [§ 25.783(c)(2)(ii)].
(1) As specified in § 25.783(d)(7), each door for which unlatching would not result in a hazard is not required to have a locking mechanism. Those doors also may not be required to have a dedicated pressurization prevention means.
(2) However, this should be determined by demonstrating that an unsafe level of pressurization cannot be achieved for each position that the door may take during closure, including those positions that may result from single failures or jams.
(a) Excluding jamming and excluding failures and malfunctions in the latching system, for every possible position of the door, it must either remain open to the extent that it prevents pressurization, or safely close and latch as pressurization takes place.
(b) With single failures of the latching system or malfunctions in the latching system the door may not necessarily be capable of latching, but it should either remain open to the extent that it prevents pressurization, or safely move to the closed position as pressurization takes place.
(c) With jamming as a result of mechanical failure in the latching system or blocking debris, the pressurization loads on the jammed door or mechanism may not result in damage to the door or airframe that could be detrimental to safe flight (both the immediate flight or future flights). In this regard, consideration should be given to jams or non-frangible debris that could hold the door open just enough to still allow pressurization, and then break loose in flight after full pressurization is reached.
11. LATCHING AND LOCKING (§ 25.783(d)) .
a. There must be a provision to latch each door. [§ 25.783(d)(1)]
(1) The definitions of latches and locks are revised as of Amendment 25-114, particularly with regard to mechanical and structural elements of doors with an initial inward movement. In this regard, fixed stops are not considered latches. The movable elements that hold the door in position relative to the fixed stops are considered latches. These movable elements prevent the door from opening and will support some loads in certain flight conditions, particularly when the airplane is unpressurized.
(2) For all doors, § 25.783(d)(2) requires that the latching system employ a securing means other than the locking system. The separate locking system may not be necessary for certain doors with an initial inward movement (see § 25.783(d)(4)).
b. The latches and their operating mechanism must be designed so that, under all airplane flight and ground loading conditions, with the door latched, there is no force or torque tending to unlatch the latches. In addition, the latching system must include a means to secure the latches in the latched position. This means must be independent of the locking system. [§ 25.783(d)(2)]
(1) The latches of doors for which the initial opening movement is outward are typically subject to vibrations, structural loads and deflections, positive and negative pressure loads, positive and negative “g” loads, aerodynamic loads, etc. The latches of doors for which the initial opening movement is inward typically share some of these same types of loads with fixed stops.
(2) The design of the latch should be such that, with the latch disconnected from its operating mechanism, the net reaction forces on the latch should not tend to unlatch it during both pressurized and unpressurized flight throughout the approved flight envelope. The effects of possible friction in resisting the forces on the latch should be ignored when considering reaction forces tending to unlatch the door. The effects of distortion of the latch and corresponding structural attachments should be considered in this determination. Any latch element for which “g” loads could result in an unlatching force should be designed to minimize such forces.
(3) Even though the principal back-driving forces should be eliminated by design, it is recognized that there may still be ratcheting forces that could progressively move the latches to the unlatched position. Therefore, each latch should be positively secured in the latched position by its operating mechanism, which should be effective throughout the approved flight envelope.
The location of the operating system securing means will depend on the rigidity of the system and the tendency for any forces (such as ratcheting) at one latch to unlatch other latches.
(4) Overcenter features in the latching mechanism are considered to be an acceptable securing means, provided that an effective retaining feature that functions automatically to prevent back-driving is incorporated. If the design of the latch is such that it could be subject to ratcheting loads that might tend to unlatch it, the securing means should be adequate to resist such loads.
(5) In those designs that use the latch to operate an electrical switch, any back-driving effect of the switch on the latch is permissible, provided the extent of any possible movement of the switch--
• is insufficient to unlatch it, and
• will not result in the latch being subjected to any other force or torque tending to unlatch it.
(6) The latch securing means must be independent of the locking means. However, the latching and locking functions may be fulfilled by a single operating means, provided that it is not possible to back-drive the locks via the latch mechanism when the door is locked.
c. Each door subject to pressurization, and for which the initial opening movement is not inward, must [§ 25.783(d)(3)]--
• have an individual lock for each latch [§ 25.783(d)(3)(i)];
• have the lock located as close as practicable to the latch [§ 25.783(d)(3)(ii)]; and
• be designed so that, during pressurized flight, no single failure in the locking system would prevent the locks from restraining the latches necessary to secure the door [§ 25.783(d)(3)(iii)].
(1) To safeguard doors subject to pressurization and for which the initial opening movement is not inward, each latch must have an individual lock. The lock should directly lock the latch. In this regard, the lock should be located directly at the latch to ensure that, in the event of a single failure in the latch operating mechanism, the lock would continue to restrain the latch in the latched position. Even in those cases where the lock cannot be located directly at the latch, the same objective should be achieved. In some cases, a pair of integrally-connected latches may be treated as a single latch with respect to the requirement for a lock, provided that:
(a) the lock reliably monitors the position of at least one of the load-carrying elements of the latch; and
(b) with any one latch element missing, the airplane can meet the full requirements of part 25 as they apply to the unfailed airplane; and
(c) with the pair disengaged, the airplane can achieve safe flight and landing, and meet the damage tolerance requirements of § 25.571 (“Damage-tolerance and fatigue evaluation of structure”).
(2) In some designs, more latches are provided than necessary to meet the minimum design requirements. The single failure requirement for the locking system is intended to ensure that the number and combination of latches necessary to secure the door will remain restrained by the locking mechanism. Only those latches needed to meet the minimum design requirements need to remain restrained after the single failure.
(3) In meeting this requirement, the indirect locking provided through the latch system by the locks at other latches may be considered. In this case, the locking system and the latching system between the locked latch and the unlocked latch should be designed to withstand the maximum design loads discussed in paragraph 11f of this AC, as appropriate to pressurized flight.