Advisory Circular
Subject: FLIGHTDECK Date: 10/24/08 AC No: 25.795-2A PENETRATION RESISTANCE Initiated By: ANM-100
1. PURPOSE. This advisory circular (AC) sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of the airworthiness standards for transport category airplanes related to the airplane design for flightdeck penetration resistance.
2. APPLICABILITY. While these guidelines are not mandatory, they are derived from extensive Federal Aviation Administration (FAA) and industry experience in determining compliance with the pertinent regulations. If, however, we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance. The material in this AC does not change, create any additional, authorize changes in, or permit deviations from regulatory requirements.
3. CANCELLATION. This AC cancels AC 25.795-2, issued on January 10, 2001.
4. RELATED DOCUMENTS.
a. Title 14, Code of Federal Regulations (14 CFR) part 25, §§ 25.365, 25.771, 25.772,
25.795, 25.803, and 25.853.
b. 14 CFR part 91, § 91.11.
c. 14 CFR part 121, §§ 121.313, and 121.587.
d. International Civil Aviation Organization (ICAO) Annex 8 to the Convention on International Civil Aviation, titled “Airworthiness of Aircraft.”
e. Policy memorandum PS-ANM100-2001-115-11, Certification of Strengthened Flightdeck Doors on Transport Category Airplanes, dated December 3, 2002, available at:
http://rgl.faa.gov/1
5. REFERENCES.
a. 14 CFR part 25, § 25.795(d).
b. SRI International, “Fourth Workshop on Uncontained Engine Debris Characterization, Mitigation and Modeling, Aircraft Catastrophic Failure Prevention Program,” May 2-4, 2000.
c. National Institute of Justice (NIJ), Ballistic Resistance of Personal Body Armor, NIJ Standard-0101.04, Office of Science and Technology, Washington, D.C. 20531, September 2000.
6. DEFINITIONS. Terms that are unique to ballistic testing and firearms, or that may not be in general use, are as follows:
a. Angle of Incidence: The angle between the line of flight of the bullet and the perpendicular to the front surface of the barrier. (See Figure 1.)
Figure 1. Angle of Incidence Angle of Incidence Perpendicular to Front Surface of Barrier Front Surface of Barrier Bullet Line of Flight
b. Full Metal Jacketed Bullet (FMJ): A lead core bullet completely covered with a copper alloy jacket (approximately 90 percent copper and 10 percent zinc), except for the base.
Total Metal Jacket (TMJ), Totally Enclosed Metal Case (TEMC), and other commercial 1 Select Policy, select Final, and search for ANM100-2001-115-11.
terminology for bullets with electro-deposited copper and copper alloy coatings are considered comparable to FMJ bullets.
c. Hazardous Trajectory: A shotline, from any ballistic threat, originating from any passenger-accessible compartment that passes through the flight-critical zone defined by flightcrew positions, flight-critical instrumentation, or flight-critical systems within the flightdeck. When establishing a hazardous trajectory, an applicant should consider trajectories originating in areas beyond the main cabin seating zones, if a passenger has access to them. (See Figure 2.) Such areas would include any comp artment that is not locked. Crew rest compartments accessible from the cabin should be evaluated, if they are not locked or do not have some other means of physically preventing unwanted access. This applies even though they are intended only for crew use and are so marked.
Figure 2. Example of Hazardous Trajectory (Shotline Intersects within the Critical Zone of the Flightdeck) Flightdeck Critical Zone Hazardous Trajectory Shotline
d. Jacketed Hollow Point Bullet (JHP): A lead core bullet with a hollow cavity or hole located in the nose of the bullet and completely covered with a copper-alloy jacket (approximately 90 percent copper and 10 percent zinc), except for the hollow point.
e. Penetration, Complete: Full passage of a bullet or bullet fragment through a test panel without being stopped, i.e., brought to zero velocity.
f. Penetration, Partial: An impact to a test panel in which the bullet and all of its fragments are stopped. Any portion of the bullet may protrude.
g. Reference Bullet Velocity: The designated impact velocity.
h. Round Nose Bullet (RN): A bullet with a generally blunt or rounded nose that may have a small flat surface at the tip of the nose.
i. Test Panel: The protective barrier, consisting of ballistic resistant materials, that is representative of production structure that shields the flightdeck from potential ballistic threats and is used to demonstrate actual capability in resisting projectile penetrations. It has representative arrangements and features, as they will appear on the airplane.
7. BACKGROUND.
a. Historical Events. Numerous hijackings and armed confrontations with passengers have occurred aboard commercial transport flights. These incidents have usually involved the use of various types of weapons, including handguns, knives, hand grenades, and explosives. In some cases, the weapons were actually used or discharged during flight.
b. Vulnerability. Although inherent features of airplanes provide high levels of safety, the flightdeck remains comparatively vulnerable to weapon attacks. Not only are pilots susceptible to trauma, but the potential loss of critical flight instrumentation and control is also of concern. The disabling of critical systems from a single ballistic penetration is achievable with the concentration of most systems control within a small sector of the flightdeck. Electronic displays of basic flight information are similarly vulnerable.
c. Active Measures. To counter weapon threats and intentional acts of destruction, measures have been taken to prevent the introduction of dangerous objects aboard transport flights. Recognizing that these efforts may neve r be fully effective, the ICAO sought to improve the survivability of airplanes in the event that these dangerous objects escape detection and are employed during flight. A series of Standards and Recommended Practices, established in Annex 8 to the Convention of International Civil Aviation, titled “Airworthiness of Aircraft,” were incorporated that addressed these concerns.
8. OBJECTIVE. Regions of the flightdeck that are vulnerable to ballistic threats originating from passenger compartments will be protected from small-arms projectiles and fragment debris from hand grenades (kinetic-energy weapons).
a. The goal is to ensure that safe flight and landing is not compromised through discharges of a firearm or fragmenting device.
b. Protection is expected to occur at the flightdeck bulkhead or at any interior equipment that serves as the bulkhead as well as at the floor and ceiling if on a hazardous trajectory.
Boundary segments that are not on a direct hazardous trajectory or can only become hazardous from ricochets need not be resistant to ballistic penetrations. In determining trajectories, it may 4
be assumed that weapon discharges or fragmentation devices will be a threat only from any normal passenger-accessible location.
c. Features of the boundary between the flightdeck and passenger cabin, such as decompression panels, louvers, grills, doorknobs, latches, hinges, lugs, and peepholes, do not require testing if it can be shown that their failure would not degrade the penetration resistance.
Such a feature would be one that is not on a hazardous trajectory, as defined above, or that, if it fails, does not create an opening into the flightdeck that is on a hazardous trajectory.
d. Joints between panels should not have gaps, or should be protected from penetration by, for example, an overlapping of protective material.
(1) If the gap is protected with an equivalent amount of material that passed the material ballistic tests, testing of the gap is generally not necessary. Surfaces of protective material that are butted flush against each other may also be acceptable without testing, if it is clear that penetration is not on a hazardous trajectory or that the ballistic impact does not degrade the penetration resistance of the material.
(2) If it is determined that a gap needs to be tested, however, the same pass/fail criteria as for the material ballistic test would apply. Unless the gap has a very specific orientation, it is tested with a single shot normal to the surface.
9. PRINCIPLES AND TECHNIQUES.
a. Several materials and concepts, designed to defeat ballistic threats, have been evaluated.
Useful materials include metallic alloys, ceramics, polymers, strong fibers, and composites. For lightweight and relatively low-energy applications, strong fibers, sometimes coated in a matrix material, may offer the best protection.
b. For woven fabrics, the mesh or tightness of weave (yarns/inch) also has an effect on performance, but limited data suggest that this effect is minor when compared to the specific energy absorbed (energy/areal density).
c. The size and shape of the projectile also affects material response. The larger the fragment, the more fibers that have to be broken before penetration can occur.
d. The technique used to secure the material to its supports can have a significant effect on energy absorption. A material entirely glued to a surface or encased in a resin matrix is normally unable to yield or dissipate as much energy as a material that is only restrained at its outer boundaries. The data even suggest that restraining the material on ly at opposite ends instead of all four sides is appreciably better. The more flexible the attachment, the better able the material is to stretch and redistribute loads over larger areas and dissipate more energy through friction and deformation. Increasing distance between attachment points has also been shown to be beneficial, since more material deforms and more energy can dissipate over larger areas.
e. Combining multiple layers of material can also improve energy absorption more than the sum from individual layers. The interaction of overlaid materials disperses additional energy through friction.
f. It would also be expected that two fragments with the same basic shape and equal energies, but with different masses, would perform differently. The higher velocity fragment would be more easily stopped than the slower fragment. This is expected because of higher momentum exchange to the material (energy losses from accelerating the material) and higher strain rates, which normally delay material failures.
g. While laboratory tests of ballistic fabrics soaked in water have displayed reductions in ballistic resistance compared with identical dry fabrics, the flightdeck operates within normal humidity ranges, so testing the installed shielding in a soaked condition is not required.
Materials stored where they could absorb moisture should be checked to ensure that they retain their ballistic resistance.
h. Based on material selection, configuration, and installation arrangement, areal densities less than one pound per square foot should be achievable for shielding protection against the defined threat in this AC.
i. A series of tests will require projectile impacts at both perpendicular and at an angle of incidence to the surface because most random shots would be unlikely to hit exactly perpendicular to the surface. Some materials offer lower protection by as much as 20 percent when a bullet strikes at an angle. The shield ing must provide the minimum level of protection, regardless of the angle of impact.
(1) To the extent that the boundary contains features and details that are not homogeneous, they may behave differently with shots at different angles of incidence. Based on experience gathered to date, assuming that there are no discontinuities in the barrier, it is sufficient to address these features with shots at 0 and 30 degrees only. (See paragraph 11c(8).)
It is not necessary to define some other angle.
(2) Where there are discontinuities (see Figure 3), however, this approach effectively results in no protective barrier for the part of the boundary where the discontinuity exists. This situation is contrary to the intent of the requirement. In that case, if the discontinuity presents a hazardous trajectory, it is not acceptable.
Figure 3. Hazardous Trajectory Because of Discontinuity Ballistic Material Door or panel Discontinuity where angle exceeds 30 deg
j. Limited studies of ballistic-resistant material capabilities under extended periods of use were conducted in 1983. Some of the material tested had been in service for more than 8 years.
This testing and a 1986 study by the NIJ (Ballistic Tests of Used Body Armor) found that age alone does not degrade the ballistic properties of such armor. Material manufactured in 1975 that remained in inventory without issue exhibited ballistic-resistant properties identical to those at the time of manufacture. Both research studies included body armor that had been in use for as long as 10 years and had ballistic properties that were indistinguishable from those of unused armor manufactured at the same time. Age alone , therefore, is not considered to be a significant factor for ballistic resistance. An applicant that is aware of other environmental effects, and other effects such as cleaning, that do influence the ballistic resistance of the material should address these in the Instructions for Continued Airworthiness.
10. COMPLIANCE CRITERIA.2
a. Standardization. The NIJ, a research, evaluation, and development branch under the U.S. Department of Justice, advanced a voluntary national procedure to provide minimum performance requirements for soft body armor. The regulatory requirements and means to demonstrate compliance described in this AC are based in part on this nationally recognized standard found in NIJ Ballistic Resistance of Personal Body Armor, NIJ Standard-0101.04, dated September 2000. This is the fourth revision since the original release of the standard in March 1972.
b. Applicability. NIJ Standard-0101.04, dated September 2000, specifically addresses protection of the torso from ballistic threats. Since the intent of this AC is to protect the flightdeck and not body torsos, various requirements within the NIJ standard are not integrated into this AC. Specific guidance to achieve compliance is found within this AC.
c. Classification. The NIJ standard identifies seven levels of protection through a type classification. Type IIIA is an acceptable level to show compliance with § 25.795(a)(3). This level offers protection against most handguns and is considered to provide an adequate level of 2 See Appendix 1 for a list of units of measure and the abbreviations for them, which are used in this AC.
protection from fragmentation devices as well as the Type I, IIA, and II threats. Demonstration of penetration resistance for Type IIIA rounds is accomplished with two different projectiles.
(1) Demonstration Projectile #1. A 9 mm full metal jacket, round nose (FMJ RN) bullet with nominal mass of 8.0 g (124 grain) and reference velocity 436 m/s (1,430 ft/s)
(2) Demonstration Projectile #2. A .44 Magnum, jacketed hollow point (JHP) bullet with nominal mass of 15.6 g (240 grain) and reference velocity 436 m/s (1,430 ft/s)
d. Alternative Projectile. The regulation was based on the criteria in NIJ Standard- 0101.04, dated September 2000. This standard called out a jacketed hollow point bullet. The standard was later revised in June 2001, to call out a semi-jacketed bullet. To promote standardization, the NIJ requires a specific bullet, the Remington R44MG3 semi-jacketed bullet, to be used when testing to the standard. The FAA considers this bullet acceptable for testing in accordance with this AC. Otherwise, a jacketed bullet should be used as per the reference in the rule.
11. COMPLIANCE DEMONSTRATION.
a. Compliance may be shown by analysis, tests, or by comparison with previously approved configurations. If tests are used to demonstrate compliance, specimens must be representative of the arrangements used on the airplane. All configurations must be tested, unless the performance of the configurations not tested is rationally shown to be equal or better.
Previously approved test data may be used as a basis for compliance for other airplane configurations, provided that their applicability is demonstrated in a rational manner. However, features such as decompression panels, louvers, doorknobs, latches, hinges, lugs, and peepholes should be addressed, as discussed in paragraph 8c.
b. Validation tests are not required, if the ballistic performance of the configuration will meet certification requirements based on comparative analysis, provided that the methods used are shown to be rational. In order for the comparative analysis to demonstrate compliance without a test, the following factors must be assessed to show that the fabrication and/or installation have not degraded the material performance:
(1) Material properties;
(2) Fabric weave (direction and density)—if applicable;
(3) Material thicknesses and interactions (multiple plies);
(4) Attachment arrangements and supporting structure;
(5) Energy absorption methods; and
(6) Fabrication of the surfaces affected (e.g., door, bulkhead, etc.).
c. Test Procedures. This procedure provides an acceptable method to demonstrate adequate protection for the flightdeck against ballistic threats. The tests demonstrate the ability of the shield to prevent bullet penetrations with a pass/fail criterion. In order to pass, all portions of the projectile must be stopped by the shielding on each of the required tests. Partial penetrations of the bullet through the shielding are acceptable.
(1) Hand loads. Hand-loaded ammunition may be used and is typically necessary on any of the tests. Adjustments are normally ma de to powder quantity to assure velocity requirements are met.
(2) Test barrels. Use of test barrels or actual weapons appropriate for the ammunition are acceptable, provided that impact locations, projectile orientations, and impact velocities can be maintained.
(3) Ambient test conditions. Ambient conditions of the test range will be maintained at:
(a) Temperature: 21°C ± 2.9°C (70°F ± 5°F);
(b) Relative humidity: 50% ± 20%; and
(c) No additional environmental effects need be considered.
(4) Test specimens. Test specimens should be manufactured using the materials and manufacturing processes used for production parts. A sufficient number of specimens should be provided to accomplish all tests. They should be conditioned to ambient conditions for at least 24 hours prior to testing, unless the materials used are shown to be insensitive to variations in temperature and humidity.
(5) Timing screens. Projectile impact velocities will be measured on every test. Any systems that can measure velocities to within 3 m/s (10 ft/s) are acceptable. Individual recording devices must be capable of discriminating to 0.3 m/s (1.0 ft/s) or 0.1 microseconds (10-7 seconds). Recommended velocity measuring equipment includes:
(a) Photo electric light screens;
(b) Printed make circuit screens;
(c) Printed break circuit screens; or
(d) Ballistic radar.
(6) Timing screen arrangement. The first timing screen should be placed a minimum of 2 m (78.7 in) from the end of the test barrel. (See Figure 4.) The second screen should be placed 1.5 m (59.05 in) ± 6 mm (0.24 in) from the first screen. The test specimen should be placed 5 m (196.85 in) ± 25 mm (1.0 in) from the end of the test barrel. Although the spacing between the gun barrel and the test panel is substantial (5 meters), this is neither indicative nor representative of the distances that may be experienced from an actual in-flight incident. Design 9
considerations must assume that weapon use may occur at distances ranging from point-blank range to the length of the passenger cabin. The test evaluation distances were selected as compromises for competing requirements.
Figure 4. Test Arrangement for Ballistic Test Panels
(7) Test panels. Through-thickness construction of the test panels should not be greater than the minimum configuration to be used in service. The test panels may be simplified with respect to peripheral size, geometry, and boundary conditions. It must be shown that the simplifying assumptions are rational and lead to a conservative representation when compared to the actual airplane configuration. Six impact sites will be identified on the test panel for the first ammunition type. These sites will be uniformly spaced throughout the panel with no site closer than 76 mm (3.0 in) from center of impact to any edge of the protection shield and 51 mm
(2.0 in) measured center-to-center between any two impact sites. If space is available on the test panel, using the same criteria, the next six sites for the second ammunition type can be identified for the second test series. Otherwise, a new te st panel will be required. If the mechanism for stopping projectiles is lost after any shot, replacement panels may be used to complete the test series. However, the same relative impact locations must continue to be employed, as previously assigned. The test panels should be tested in dry conditions.
(8) Detail features. The airplane may contain detail features that do not consist of the baseline ballistic material. As mentioned in paragraph 8d(2), a feature such as a gap is generally tested with a single shot, oriented normal to the surface. The same is true for other features, such as a latch, hinge, or louver. As discussed in paragraphs 11a and 11b, te sts on features may be needed if there is not sufficient data available to make a comparative analysis. Under the test conditions, it is possible to very accurately target small features on the order of the bullet diameter.
(9) Test shots. Table 1 provides the test conditions that are sufficient to demonstrate compliance. The shielding devices are required to prevent penetration from the impact of six bullets at the designated velocities and locations for two ammunition types. Two of the impacts in each six-shot sequence must be at a 30 degree angle of incidence. After each shot, the panel will be inspected to determine if the projectile was fully arrested, and either a pass or failure will be recorded. The velocity will also be computed and recorded. If the velocity is less than the minimum acceptable or the impact site is outside of the allowable limits, a retrial may be necessary. The projectile may be remove d, if desired, before subsequent shots.
Table 1. Performance Test Summary Test Round Test Bullet Bullet Weight Bullet Diameter Reference Velocity Hits at 0º Angle of Incidence Hits at 30º Angle of Incidence Shots per Panel Total Shots Required 1 9 mm FMJ RN 8.0 g (124 grains) 9 mm (.355 in) 436 m/s (1430 ft/s) 4 2 6 12 2 .44 Magnum JHP
15.6 g (240 grains)
10.9 mm (.429 in) 436 m/s (1430 ft/s) 4 2 6
(10) Witness sheet. A witness sheet of suitable material should be placed six inches behind the test specimen for verification that there was not complete penetration of the sample by the projectile or fragments. However, if the witness sheet is butcher paper or equivalent, only actual penetrations of the witness sheet are considered as having penetrated the specimen. Tiny particles that do not have sufficient energy to penetrate paper do not pose a concern with the design and are not considered penetrations.
12. PASS/FAIL CRITERIA.
a. To be a valid shot, several criteria must be met. The bullet must impact the panel at an angle of incidence ± 5 degrees from the intended angle of incidence, at a yaw angle (of the bullet) within ± 5 degrees, at an impact velocity within ± 9.1 m/s (30 ft/s) of the reference velocity, and no closer to an edge or adjacent impact site than given in paragraph 11c(7). When shooting detail features, the bullet must strike the feature.
b. If all conditions are met and the impact velocity equals or exceeds the minimum acceptable velocity without penetration, it is considered a pass. However, shots that cause the opening of panels, grills, etc., such that there is no longer a barrier between the cabin and the flightdeck, are considered failures.
c. If all conditions are met, except the impact velocity occurs at or less than the maximum acceptable velocity with penetration, it is considered a failure. If all conditions are met but 11
penetration occurs above the maximum acceptable velocity, a retrial may be performed without making any design changes.
Ali Bahrami Manager, Transport Airplane Directorate Aircraft Certification Service 12