Advisory Circular
Subject: SURVIVABILITY OF Date: 10/24/08 AC No: 25.795-7 SYSTEMS Initiated By: ANM-100
1. PURPOSE. This advisory circular (AC) describes an acceptable means for showing compliance with the requirements of Title 14, Code of Federal Regulations (CFR), part 25, § 25.795(c)(2), “Survivability of systems.” This section requires that, except where impracticable, redundant airplane systems necessary for continued safe flight and landing must be physically separated by certain minimum distances, as defined by the sphere described in § 25.795(c)(2)(i). The means of compliance desc ribed in this document provides guidance to supplement the engineering and operational judgment that must form the basis of any compliance findings relative to separation of redundant airplane systems, which are necessary for continued safe flight and landing.
2. APPLICABILITY.
a. The guidance provided in this document is directed to manufacturers and modifiers of large passenger transport airplanes and repair facilities for such airplanes.
b. The material in this AC is neither mandatory nor regulatory in nature and does not constitute a regulation. It desc ribes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. Furthermore, if we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance.
c. The material in this AC does not change, create any additional, authorize changes in, or permit deviations from, regulatory requirements.
3. RELATED SECTIONS OF 14 CFR. Part 25, §§ 25.365, 25.1309, and 25.1707.
4. BACKGROUND.
a. The International Civil Aviation Organization (ICAO) adopted certain Standards and Recommended Practices related to security aspects of airplane design in Amendment 97 to
Annex 8. Included is a standard that manufacturers design and separate flight-critical systems to maximize airplane survival for any event—such as detonation of an explosive or incendiary device—that damages such systems. This requirement addresses only damage to flight-critical systems and the effect of that damage on continued safe flight and landing. Manufacturers must identify flight-critical systems.
b. A draft of this AC was harmonized with the European Joint Aviation Authorities (JAA).
The draft provided a method of compliance that both the Federal Aviation Administration (FAA) and JAA have found acceptable. Subsequently, the European Aviation Safety Agency (EASA) was formed as the principal aviation regulatory agency in Europe. The FAA will work with EASA to ensure that this proposed AC is harmonized with ACs referred to in EASA’s Certification Specifications.
5. DISCUSSION.
a. There are at least two approaches that will satisfy the requirement for systems survivability: (1 ) system separation and, when separation is not practicable, (2) system protection. The concept behind system separa tion is that the designer can separate any flight-critical system and its redundant system sufficiently to create a high probability that no single event will damage both systems. Systems protection involves shielding flight-critical systems from a harmful event. One should rely on designing for systems protection only if system separation is impracticable. This requirement addresses only the loss of system functionality that can result from events (such as activation of an explosive or incendiary device). Compliance with § 25.795(c)(2) does no t require an assessment of potential airframe structural damage or its consequences, except as it relates to system function when protective measures are utilized as discussed in paragraph 6b. Design of a “least risk bomb location” can also affect system architecture locally. (See AC 25.795-6.)
b. Other sections of 14 CFR part 25 contain requirements that either dictate system separation or are most effectively met with system separation. These include § 25.729(f) for protection of equipment in wheel wells, § 25.903(d) for protection against engine rotor failure, and § 25.1707 for protection of, and failure by, electrical wiring interconnection systems. These are all separate and independent requirements. Showing compliance with one of them does not ensure compliance with the others. Should a conflict occur such that compliance with § 25.795(c)(2) would preclude compliance with one of the above sections, compliance with § 25.795(c)(2) would be “impracticable” in accordance with the regulatory provisions of § 25.795(c)(2)(ii), and the applicant should use other measures to maximize survivability. The applicant must, of course, show direct compliance with the other relevant sections. In reviewing the various requirements, the FAA has not identified any situations where such a conflict exists.
6. DEMONSTRATION OF COMPLIANCE.
a. System Separation.
(1) Although airplane fuselage diameters vary widely, the percentage of space devoted to systems installations generally decreases in larger airplanes. In part, this is true because the 2
size of systems is driven more by their function than by the size of the airplane. In other words, the space needed for individual systems does not vary significantly with the size of the airplane.
This fact means that larger airplanes can separate flight-critical systems to a greater extent than can small airplanes. Even if systems were scaled to the size of the airplane, the allowable separation distances would naturally increase with the size of the airplane. The separation requirement provided below recognizes this physical relationship.
(2) To provide a reasonable and practical method for establishing a minimum separation between redundant systems, § 25.795(c)(2)(i) defines the following formula, which is derived from § 25.365(e), governing hole size for consideration of rapid decompression:
PA3H0D = 2 = 2π π Where:
H0 = PAs = the hole size from § 25.365(e);
D = the diameter of a sphere that represents minimum separation distance between redundant systems in feet;
As = maximum cross-sectional area of pressurized shell normal to the longitudinal axis in square feet; and AsP = + 0.0246240
(3) The separation distance, D, need not exceed 5.05 feet. The designer should use this formula anywhere within the pressurized fuselage. The actual separation between systems should be such that the sphere derived above can pass between any parts of the systems. The FAA does not intend to apply the requirement to maintain system separation distances—based on this formula—to areas outside the fuselage inner mold line (IML), such as the wing root or empennage.
(4) The designer may exclude certain areas within the fuselage from strict application of the separation criteria, but is expected to achieve the best separation distances possible.
Specific areas that meet this limited exclusion include:
(a) Fuel tanks. They are not a system that the designer can separate (fuel lines, on the other hand, would be included).
(b) Flightdeck. Airplane geometry and convergence of systems in this area preclude full system separation.
(c) Electronic and equipment bays. The concentration of many systems in a confined area prevents full separation. These areas should receive special consideration, since 3
they contain a large number of flight-critical systems. In this case, the designer should separate redundant systems within the compartment to maximize the potential for continued function after an event. This could be achieved, for example, by locating one of the redundant flight-critical systems in the portion of an electronic and equipment bay furthest from the passenger or cargo compartments, and other as far away as practicable. Blast shielding is not a substitute for system separation, but may be a useful approach for an electronic and equipment bay.
(d) Other areas. Areas where physical separation is impractical due to airplane geometry or other constraints. An example is the aft fuselage area where the fuselage diameter tapers, preventing full separation.
(5) Figure 1 shows the regions where the designer must separate critical systems.
Compliance should be shown by design and analysis for each affected zone and flight-critical system. The sphere diameter represents the acceptable minimum separation. Although it is not required, we encourage greater separation where it is practicable.
Figure 1. Regions Requiring Separati on of Critical Redundant Systems
(6) For areas that are within the fuselage but outside the pressurized area, one-half the sphere should be applied beyond the cabin boundary, e.g., aft of the aft pressure bulkhead.
b. System Protection.
(1) If separation of redundant systems is unattainable (i.e., impracticable) in a specific area required to be addressed, then one of the redundant systems and its vital components should be protected in that area. For system pairs that are not 100% redundant, the system providing the greater functionality should be the one that is protected.
(2) Acceptable systems shielding and/or inherent protection should be able to withstand fragment impacts from 0.5-inch diameter 2024-T3 aluminum spheres traveling 430 feet per second without disabling the system. The ballistic resistance of 0.09-inch thick 2024-T3 aluminum plate offers an equivalent level of protection. The manufacturer may take credit for any permanent barriers between the system and a potential explosive device location that can be shown to offer fragment protection. Any specific point on the barrier need only withstand one such impact.
(3) In addition, the system design should incorporate features that minimize the risk of its failure due to relative displacement of the structure to which it is attached. These features may include flexibility in the system and/or in its mountings. Without test evidence, alleviating rationale, or special circumstances, the designer should provide for a minimum 6-inch relative displacement capability (except where such displacement would go beyond the fuselage contour) in any direction from a single-point force applied anywhere within the protected region. The designer may also incorporate frangible attachments or other features that would preclude system failure.
(4) The designer should provide shielding to protect the systems against ballistic threats described in paragraph 6b(2), but not against blast pressures. Tests conducted by the FAA have shown that blast pressures do not affect the systems, and that efforts to defend the system against blast pressures will likely increase damage rather than mitigate it. Therefore, ballistic shielding should be no larger than absolutely necessary to allow the blast pressures to pass without resistance.
Ali Bahrami Manager, Transport Airplane Directorate Aircraft Certification Service 5