Advisory Circular
Subject: FLIGHTDECK INTRUSION Date: 10/24/08 AC No: 25.795-1A RESISTANCE Initiated By: ANM-100
1. PURPOSE. This advisory circular (AC) sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of the airworthiness standards for transport category airplanes related to the airplane design for flightdeck (also referred to as the pilot compartment or cockpit) intrusion resistance. Intrusion resistance, in the context of this AC, refers to the ability to resist forced entry by a person who is not authorized by the pilot in command to enter the flightdeck. Intrusion resistan ce also includes the ability to resist attempts to enter the flightdeck through use of simple tools, such as pocket knives, nail files, or keys.
2. APPLICABILITY. While these guidelines are not mandatory, they are derived from Federal Aviation Administration (FAA) and industry experience in determining compliance with the pertinent regulations. If, however, we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance. The materi al in this AC does not change, create any additional, authorize changes in, or permit deviations from regulatory requirements.
3. CANCELLATION. This AC cancels AC 25.795-1.
4. RELATED DOCUMENTS.
a. Title 14, Code of Federal Regulations (14 CFR) part 25, §§ 25.365, 25.771, 25.772,
25.795, 25.809, and 25.853.
b. 14 CFR part 91, § 91.11.
c. 14 CFR part 121, §§ 121.313, and 121.587.
d. International Civil Aviation Organization (ICAO) Annex 8 to the Convention on International Civil Aviation, titled “Airworthiness of Aircraft.”
e. Policy memorandum PS-ANM100-2001-115-11, Certification of Strengthened Flightdeck Doors on Transport Category Airplanes, dated December 3, 2002, available at:
http://rgl.faa.gov/1
5. DEFINITIONS.
a. Bolt: A bar which, when actuated, is moved (or “thrown”) either horizontally or vertically into a retaining member, such as a strike plate, to prevent a door from moving or opening.
b. Cylinder: The cylindrical subassembly of a lock, containing the cylinder core, tumbler mechanism, and the keyway.
c. Door Assembly: For the purposes of this AC, a door assembly consists of the following parts: door (including any and all panels and mechanisms intended for decompression and/or egress purposes); hinges, locking or other devices; operation contacts (such as handles and knobs); miscellaneous hardware and closures; the frame (including the header and jamb structures plus the attachment to the surrounding airplane structure); and representative structure to which the frame attaches.
d. Flightdeck Boundary: Any of the features that divide the flightdeck from the areas of the airplane occupied by passengers. It could be a vertical wall (e.g., a bulkhead), floor, ceiling, a monument whose structure makes up part of the boundary, or any combination of these. It includes the flightdeck door. An accessible flightdeck boundary is one whose location provides direct access to the flightdeck by passengers.
e. Jamb: The fixed vertical members of a doorframe to which the door is secured.
f. Jamb/Strike: The component of a door assembly that receives and secures the extended lock bolt. The strike and jamb, us ed together, are considered a single unit.
g. Jamb/Wall: The component of a door assembly to which a door is attached and secured by means of hinges. The hinges and jamb, used together, are considered a unit.
h. Latch (or Latch Bolt): A beveled, spring-actuated bolt.
i. Lock (or Lock Set): A keyed device (complete with cylinder, latch and/or an electrical, pneumatic or mechanical means of preventing normal operation, strike and trim such as knobs, levers, escutcheons, etc.) for securing a door in a closed position against forced entry.
j. Strike: A metal plate mounted to the jamb to receive and hold the latch bolt in order to secure the door to the jamb.
1 Select Policy, select Final, and search for ANM100-2001-115-11.
6. DISCUSSION.
a. Background.
(1) When a passenger gains unauthorized entry to the flightdeck, the safety of the airplane and all aboard is at risk.
(2) The flightdeck door is subjected to several requirements that affect its construction.
For example, §§ 121.313 and 121.587 require that there be a lockable door between the pilot and passenger compartments and that the pilot-in-command ensures that the door is closed and locked during operation.
(3) Section 25.772 requires that the pilot compartment door has features that allow the crew to directly enter the passenger compartment from the flightdeck in the event that the door becomes jammed. If there are passenger emergency exits in close proximity to the flightdeck, compliance with § 25.809, “Emergency exit arrangement,” can be shown using a method in which the flightdeck openable windows need not be openable from the outside. In this case, the door needs to facilitate entry by rescue personnel.
(4) Many airplanes are designed to utilize the flightdeck door opening as a decompression pathway to demonstrate compliance with the requirements of § 25.365.
Therefore, the locks and/or other features may be designed to allow for extremely rapid opening times.
(5) Due to the fact that § 25.777 requires that the flight controls be designed for pilots from 5 feet, 2 inches to 6 feet, 3 inches in height, consideration must be given to these statures in complying with the egress requirements of §§ 25.772 and 25.809.
(6) Considered a part of the airplane interior, the flightdeck boundary must also meet the requirements of § 25.771 with regard to noise, light and odors, and the flammability requirements of § 25.853.
(7) All of these requirements continue to apply, and the flightdeck door and other boundary assembly designs must consider their impacts.
b. Vulnerability.
(1) Due to the previously referenced regulations, the flightdeck door was historically designed to prevent only unintentional and incidental entrance into the crew compartment and not that of a determined person. The loads required to overcome the locking mechanisms typically are much lower than the loads on the flightdeck door caused by kicking or ramming the door assembly. Features of the door, such as hinges and locking mechanisms, should not be easily overridden (e.g., by insertion of a credit card or prying). The door knob is also susceptible to pulling force and should be designed to limit the ability of a person to exert high loads (e.g., by shape and the use of frangible features).
(2) The remainder of the flightdeck boundary elements are generally considered less vulnerable than the flightdeck door but should satisfy the same standards. The bulkhead 3
separating the flightdeck from the passenger cabin has inherent structural capabilities that should satisfy the intrusion resistance requirements. Intrusion tests may not be necessary in most cases.
On multi-deck airplanes, the floor and/or ceiling of the flightdeck may also be affected, although the ceiling might be high enough that it would not be considered “accessible” for the purposes of intrusion resistance compliance. A boundary is accessible if it could be exposed to loads from attempts at forcible intrusion. If the flightdeck bulkhead is either composed or installed forward of other interior structures, such as a galley or closet, the contribution of those interior structures (and any space between them and the bulkhead) to intrusion resistance may be included when assessing the acceptability of the boundary.
(3) Although the flightdeck door (along with other boundary elements) is intended to resist forced entry, it is only one element of several in-flight security measures that work in conjunction with one another.
c. Tests.
(1) The tests described in this AC apply to all elements making up the flightdeck boundary where testing is required. The various types of flightdeck door designs (see Figure 1 for examples) will likely require the most testing.
Figure 1. Examples of Door Types and Features Dutch Panel Removable Panel Pocket Door Standard Door Telescoping Panel BiFold Door 4
(2) The goal of the tests discussed in this AC is to demonstrate that the flightdeck door and other elements making up the flightdeck boundary can resist the unauthorized entrance of a person.
(3) Features of the door (such as telescoping panels, Dutch panels, and removable panels, as shown in Figure 1) that are designed to comply with, or to aid in compliance with, decompression or egress requirements do not require testing if their failure would not appreciably degrade the intrusion resistance offered by the flightdeck door. If this cannot be shown, testing will be required. Similarly, features of the other boundary elements should be reviewed for their effect on intrusion resistance if they were to fail under intrusion loads. Such features should be tested when the review indicates that the failure would negatively affect intrusion resistance.
(4) With respect to intrusion resistance, the size and location of a movable panel are the key factors in determining whether or not it affords intrusion resistance. Panels that are small and are located at the extreme bottom or top of the door are typically less vulnerable to intrusion.
An example of a design feature that could also address ballistic protection is shown in Figure 2.
Figure 2. Example of a Protectiv e Device for a Blow-out Panel Membrane to prevent weapon introduction and permit pressurization Flight deck door Bullet-proof backing Blow-out panel or grate
d. Standardized Test Procedures. The tests described below are standardized procedures that are generally regarded as necessary to demonstrate compliance with the intrusion resistance requirement.
(1) National Institute of Law Enforcement and Criminal Justice (NILECJ) Standard 0306.00, released in May 1976, for the Physical Security of Door Assemblies and Components, was formulated by the Law Enforcement Standards Laboratory of the National 5
Bureau of Standards under the sponsorship of the National Institute of Justice (NIJ), and was used as the basis for the development of this AC.
(2) The purpose of NILECJ-STD-0306.00 is to establish performance requirements and methods of test for the resistance of door assemblies and components to forced entry. The standard is primarily concerned with typical entry doors for residences and small businesses.
While the standard does not address persons using skilled methods of entry, it does address the capability to frustrate determined persons from committing forced entry. To this end, portions of this standard and its test methods are applicable to this requirement.
(3) Portions of NILECJ-STD-0306.00 were excerpted for definitions, sampling, apparatus, procedures, and test assembly use. Th is standard contains four levels of security.
This AC uses the highest level identified in the standard as the basis for the tests described below but has significantly increased the demonstrated performance levels.
7. GENERAL TESTING CONSIDERATIONS. There are four basic types of testing that are relevant for the door, as noted in Table 1. Thes e address resistance to impacts on the door, its locking bolt and hinge, and resistance to forcible opening by pulling on the doorknob or handle.
A new specimen may be used for each of the four test conditions.2 Table 1. Test Criteria for Door Assembly Test Test Method Measured Parameter Requirements per NILECJ Panel Impact
6.d.1 Impact resistance of door or boundary panel* 2 blows of 300 J (221.3 ft•lbf) Bolt Impact*
6.d.2 Impact resistance at bolt 2 blows of 300 J (221.3 ft•lbf) Hinge Impact
6.d.3 Impact resistance at hinge 2 blows of 300 J (221.3 ft•lbf) Pulling** 6.d.4 Pulling resistance at doorknob or handle A tensile load of up to 250 lb or until handle no longer supports load.
Notes: * Depending on the design, the boundary may no t have detailed features requiring a test.
However, if such features exist, they should be addressed as with door features.
** Doors that do not open in a conventiona l manner (that is, doors that do not swing on hinges) should have the pulling force applied with respect to the opening direction of the door.
A pocket door is an example of a door that does not swing on hinges. In this case, the pocket door would require loading in a transverse direction. Acceptance of such procedures is at the discretion of the FAA Administrator. While it is less likely to be an issue, other boundaries should also be assessed for their susceptibility to pulling and their ability to resist pulling on handholds should be substantiated, as necessary.
2 See Appendix 1 for a list of units of measure and the abbreviations for them, which are used in this AC.
8. TEST METHODS. This paragraph describes test methods that have been shown to satisfactorily demonstrate compliance with the flightdeck door requirements of § 25.795(a)(1) and (2). Alternative methods may also be used if shown to satisfactorily demonstrate compliance with those requirements.
a. Test Equipment.
(1) The ram must be a pendulum system with a steel weight of at least 45 kg (99.2 lb), capable of delivering horizontal impacts of at least 300 Joules (221.3 ft•lbf). Figure 3 illustrates the arrangement of this pendulum system in both the pre-release and impact position. The ram is a steel cylinder 15.2 cm (6 in) in diameter and 39.4 cm (15.5 in) long. The striking end of the weight must be hemispherical and have a diameter of approximately 15.2 cm (6 in), as shown in Figure 3. The impact nose used in this equipmen t can be made from cast epoxy-polyamide resin.
However, any durable impact resistant material is satisfactory. The suspension system for the door ram consists of four flexible steel cables providing a swing radius of 171 cm (5.61 ft), as shown in Figure 4. These cables are adjusted to equal length through turnbuckles such that the ram swings in a straight, true arc and are attached to a rigid frame that is adjusted to level.
Figure 3. Door Ram Pendulum System R H L R 2 − L 2 H = R − 7
Figure 4. Door Ram and Suspension System
31.8 cm 1,12 1/2 In)
PARAFFIN PLUC- 15 2 cm LEAD SHOT * EPOXY & CHOPPED FIBER Door Ram " RUBBER GASKET
59.7 cm
(23.5 in) 25.4 cm (10 in) CABLES 7,6 cm (3 in) 171 cm 1/2-in EYE BOLTS (5.61 ft) 45 Kg (99.2 Lb.)
WEIGHT Suspension System
(2) It is convenient to clamp the pendulum system to the forks of a forklift truck, which allows rapid horizontal and vertical adjustment of the impact point of the ram. A winch and snap ring system may also be used to raise and pull back the door ram. The use of a calibrated elevation stand is a convenient means of quickly and reproducibly establishing the proper ram elevation for each required impact.
(3) The impact energy must not be less than the prescribed value.
(4) The door handle pulling equipment must be capable of attaching to the doorknob or handle and providing the required tension load without slippage. The equipment may be hydraulic or mechanical and must include a load cell, strain gauge, or other calibrated load-measuring device.
b. Assembly Support Fixture. The fixture for tests must consist of representative airplane framing members and representative wall structure, providing rigid, transverse restraint around the periphery of the assembly. The restraint provided by this fixture must simulate the rigidity provided in the airplane by the ceiling, floor, and walls, including the door installation.
The test-panel fixture should not provide a significant increase in damping or energy absorption compared to the airplane configuration. That is, the fixture should not artificially contribute to the performance of the door. Figure 5 shows an example test fixture. If other boundaries require testing, the fixture should be modified to accommodate the particular geometry.
Figure 5. Door Assembly Support Fixture Door Ram Pendulum System Representative Airplane Framing Test Door and Jamb Representative Structure
c. Test Preparation. The assemblies to be tested, including the door and doorknob or handle, must consist of all relevant components, such as locks, jambs, hinges, grills, etc. Attach and orient these assemblies to the assembly support fixture as they will be installed in the airplane, with the ram on the passenger cabin side.
(1) Ambient test conditions. Ambient conditions of the test range will be maintained at:
(a) Temperature: 21°C + 2.9°C (70°F + 5°F);
(b) Relative humidity: 50% + 20%; and
(c) No additional environmental effects need be considered for the test.
(2) Test specimens. The test specimens must be manufactured using the materials and manufacturing processes used for production parts. A sufficient number of specimens will be provided to accomplish all tests. They will be conditioned to ambient conditions for at least 9
24 hours prior to testing unless the materials used are shown to be insensitive to variations in temperature and humidity.
d. Test Procedures.
(1) Door impact test.
(a) Prepare the test specimen in accordance with paragraph 8c and lock the door in the closed position. Set up the door ram pendulum weight (paragraph 8a(1)) so that its axis is horizontal and perpendicular to the face of the door at the point determined to be the most critical for door strength and distortion from impact, accounting for door design and load reaction points.
If the door is of uniform construction, the impact point may be defined by the intersection of the vertical centerline of the door and a line from the center of the bolt at the door edge to the center of the mid-height hinge, or the mid point between hinges when the door is hung with two hinges, or horizontally across the door if the door is hung with a continuous hinge or integrated hinge pins. (See Figure 6.)
Figure 6. Door Impact Test Location s for Different Hinge Configurations (Uniform Door Design)
(b) Attach to the door, centered on the impact point, an impact buffer with a diameter no greater than 15.2 cm (6 in) and a thickness no greater than 5 cm (2 in). The recommended buffer material is a 25.6 Kg / m3 (1.6 Lb / ft3) rigid, cellular, polystyrene thermal insulation (ASTM Standard Specification C578-00 Type IV). Other buffer materials may be used provided they have similar response characteristics in terms of energy losses, peak impact loads, and rise times. Position the door ram such that its striking nose just touches the surface of the buffer when at rest. Pull back the pendulum weight to a drop height (H) of 68 cm (2.23 ft) and horizontal swing distance (L) of 136.5 cm (4.48 ft) to produce the required energy of 300 Joules (221.3 ft•lbf) and release. Subject the same test specimen to two impacts, attaching a new buffer for each impact. This test procedure assumes consistent structure throughout the door panel. Any significant detail variations may require further substantiation.
(2) Bolt impact test.
(a) Prepare the test specimen in accordance with paragraph 8c and lock the door in the closed position. Set up the door ram pendulum weight (paragraph 8a(1)) so that its axis is horizontal and perpendicular to the face of the door at the point 8.9 cm (3.5 in) from the door edge and horizontally in line with the door bolt. If the doorknob interferes with the impact point, the impact point may be moved vertically above or below the doorknob, whichever is closer to the bolt. (See Figure 7.)
Figure 7. Impact Test Locations for Doorknob and Hinge Bolt Impact Test Location Hinge Impact Test Location
8.9 cm8.9 cm (3.5 in) Doorknob
(3.5 in)
8.9 cm
(3.5 in) Bolt Impact Point and Buffer Impact point may be adjusted vertically to avoid doorknob
(b) Attach to the door, centered on the impact point, an impact buffer with specifications provided in paragraph 8d(1)(b), and perform the impact tests also specified in that paragraph.
(3) Hinge test.
(a) Prepare the test specimen in accordance with paragraph 8c and lock the door in the closed position. Set up the door ram pendulum weight (paragraph 8a(1)), so that its axis is horizontal and perpendicular to the face of the door at the point 8.9 cm (3.5 in) down from the top door edge and 8.9 cm (3.5 in) in from the vertical door edge containing the door hinge (as shown in Figure 6). If the hinge interferes, th e impact point may be moved at the discretion of the FAA Administrator or its designee.
Impact Point and Buffer Impact point may be adjusted to avoid hinge 11
(b) Attach to the door, centered on the impact point, an impact buffer with specifications provided in paragraph 8d(1)(b) and perform the impact tests also specified in that paragraph.
(4) Pull test.
(a) Prepare the test specimen in accordance with paragraph 8c and lock the door in the closed position. Attach th e tension-loading device (paragraph 8a(4)) to a rigid support in front of the handle or knob on the cabin side of the door, and align the pulling axis to match the initial door opening direction. Attach the tension loading device to the handle or doorknob by means that will require minimum alteration of the doorknob or handle (i.e., friction devices, drilling holes, or cutting slots) ensuring that it will not slip during the test.
(b) Apply a minimum tensile load of 250 pounds to the knob or handle for three seconds or until the knob or handle separates from the door, whichever occurs sooner. Where design features would not permit a 250-pound tensile load to be applied by a person, an artificial method of applying the load may be necessary.
(5) Boundary tests. When testing is necessary to substantiate that a flightdeck boundary meets the intrusion resistance requirements, tests are carried out in the manner discussed above for door assemblies. Detailed features of the boundary, the failure of which would compromise either the intrusion resistance of the flightdeck, should be included in the test setup as with the detailed features of the door. An applicant should propose the test setup and identification of critical features for approval by the FAA Administrator or its designee. In most cases, however, it should be possible to substantiate the boundary elements without tests. Floors and ceilings may have inherent intrusion resistance based on their location and may not require testing on that basis. However, as noted prev iously, given the structural requirements already imposed on these features, it is likely that they can be shown to satisfy the intrusion resistance requirements without testing.
9. PASS/FAIL CRITERIA.
a. The assembly fails a test if:
(1) A door is forced open by any of the test impacts to the door, bolt, or hinge area, or from the tensile load applied to the knob or handle.
(2) A person can easily enter, relatively unimpeded, from the outside even though it might not be possible to open the door. For example, such entry may be through removable panels on the door or boundary, or gaps formed as a result of the impacts.
(3) The failure of the door handle enables the door to be opened, including failure resulting from the use of simple tools, such as pocket knives, nail files, or keys.
b. A method for determining acceptability under paragraph 9a is to apply a constant 100 pound load on the door in the direction of the flightdeck while making the assessments.