Skip to main content

Easy Access Rules for Large Aeroplanes (CS-25)

CS-25 Amendment 27 · EASA · 2025

EU reuse — source acknowledged · EASAEasy Access Rules

Overview

The consolidated EASA certification specifications and acceptable means of compliance for large turbine-powered aeroplanes (CS-25) — structural, performance, systems and airworthiness design requirements for transport-category aircraft.

Publisher
EASA
Document
CS-25 Amendment 27
Year
2025
Pages
1,495
Chapters
16

Key points

  • The Easy Access Rules (EAR) for Large Aeroplanes (CS-25) provide a consolidated version of EU regulations and EASA certification specifications.
  • The EAR are designed to be user-friendly, featuring advanced navigation tools such as links and bookmarks.
  • EASA eRules is an online database that offers dynamic publications with functionalities like tailored filters and search options.
  • The document includes incorporated amendments and is regularly updated following official publications.
  • EASA disclaims liability for any damage resulting from the use of this document, as it is not an official publication.
Frequently asked questions
What is the purpose of the Easy Access Rules for Large Aeroplanes?

The EAR aim to provide stakeholders with a consolidated and easy-to-read publication of EU regulations and EASA certification specifications.

How are the Easy Access Rules structured?

The document is arranged with certification specifications followed by related acceptable means of compliance, and elements are color-coded for easy identification.

Are the Easy Access Rules regularly updated?

Yes, the EAR are regularly updated following the adoption of an official publication.

What functionalities does the EASA eRules online database offer?

The EASA eRules database provides functionalities such as filters for tailored regulatory material, a search function, and easy navigation for various devices.

Is the Easy Access Rules document an official publication?

No, EASA states that this document is not an official publication and accepts no liability for damage resulting from its use.

Disclaimer

Easy Access Rules for Large Aeroplanes Disclaimer (CS - 25)

D ISCLAIMER

This version is issued by the European Union Aviation Safety Agency (EASA, referred to as both ‘EASA’ and ‘the Agency’) in order to provide its stakeholders with an updated, consolidated, and easy - to - read publication. It has been prepared by putting togeth er the officially published certification specifications (CSs) with the related acceptable means of compliance (AMC) adopted so far , including their amendments . However, this is not an official publication and EASA accepts no liability for damage of any ki nd resulting from the risks inherent in the use of this document.

Powered by EASA eRules Page 3 of 1495 | Jan 2023

Next: Note from the editor →

Note from the editor

Easy Access Rules for Large Aeroplanes Note fro m the editor (CS - 25)

N OTE FROM THE EDITOR

The content of this document is arranged as follows: the certification specifications (CS) are followed by the related acceptable means of compliance ( AMC) paragraph(s) .

All elem ents (i.e. CS and AMC ) are colour - coded and can be identified according to the illustration below. The EASA Executive Director (ED) decision through which the point or paragraph was introduced or last amended is indicated below the paragraph titl e(s) in italics .

Certification specification

ED decision

Acceptable means of compliance

ED d ecision The format of this document has been adjusted to make it user - friendly and for reference purposes.

Any comments should be sent to erules@easa.europa.eu .

Powered by EASA eRules Page 4 of 1495 | Jan 2023

Next: Incorporated amendments →

Incorporated amendments

Easy Access Rules for Large Aeroplanes Incorporated amendments (CS - 25)

I NCORPORATED A MENDMENTS

CS & AMC ( ED DECISIONS )

Incorporated ED Decision CS/AMC Issue No, Amendment No Applicability date ED Decision 2003/2/RM CS - 25/ Initial i ssue 17/10/200 3 ED Decision 2005/006/R CS - 25/ Amendment 1 12/12/2005 ED Decis ion 2006/005/R CS - 25/ Amendment 2 2/10/2006 ED Decision 2007/010/R CS - 25/ Amendment 3 19/9/2007 ED Decision 2007/020/R CS - 25/ Amendment 4 27/12/2007 ED Decision 2008/006/R CS - 25/ Amendment 5 5/9/2008 ED Decision 2009/010/R CS - 25/ Amendment 6 6/7/2009 ED Decisio n 2009/013/R CS - 25/ Amendment 7 21/10/2009 ED Decision 2009/017/R CS - 25/ Amendment 8 18/12/2009 ED Decision 2010/005/R CS - 25/ Amendment 9 12/8/2010 ED Decision 2010/013/R CS - 25/ Amendment 10 23/12/2010 ED Decision 2011/004/R CS - 25/ Amendment 11 4/7/2011 ED Decisi on 2012/008/R CS - 25/ Amendment 12 13/7/2012 ED Decision 2013/010/R CS - 25/ Amendment 13 14/6/2013 ED Decision 2013/033/R CS - 25/ Amendment 14 20/12/2013 ED Decision 2014/026/R CS - 25/ Amendment 15 23/7/2014 ED Decision 2015/008/R CS - 25/ Amendment 16 13/3/2015 ED Decis ion 2015/019/R CS - 25/ Amendment 17 17/7/2015 ED Decision 2016/010/R CS - 25/ Amendment 18 24/6/2016 ED Decision 2017/015/R CS - 25/ Amendment 19 16/5/2017 ED Decision 2017/018/R CS - 25/ Amendment 20 31/8/2017 ED Decis ion 2018/005/R CS - 25/ Amendment 21 28/3/2018 ED Decision 2018/010/R CS - 25/ Amendment 22 7/11/2018 ED Decision 2019/013/R CS - 25/ Amendment 23 17/7/2019 ED Decision 2020/001/R CS - 25/ Amendment 2 4 14/1/2020 ED Decision 2020/006/R CS - 25/ Amendment 2 5 1/1/2021 ED Decisi on 2020/024/R CS - 25/ Amendment 26 22/6/2021 ED Decision 2021/015/R CS - 25/ Amendment 27 7 /12/2021 Note: To access the official versions , please click on the hyper links provided above.

Powered by EASA eRules Page 5 of 1495 | Jan 2023

Next: Table of contents →

Table of contents

Easy Access Rules for Large Aeroplanes Table of contents (CS - 25)

T ABLE OF CONTENTS

SUBPART A – GENERAL ................................ ................................ . 57

CS 25.20 Scope ................................ ................................ ................................ .. 58 Appendix 4 – Examples of Aeroplane Flight Manual Limitations and Operating Appendix 5 – Related Acceptable Means of Compliance (AMC) and FAA Advisory Appendix 6 – Acronyms and definitions ................................ ................................ ... 105 Powered by EASA eRules Page 6 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AM C 25.107(d) Take - off speeds ................................ ................................ ............. 1 20 CS 25.109 Accelerate - stop distance ................................ ................................ .. 122 AMC 25.109(d)(2) Accelerate - stop distance: anti - skid efficiency on groov ed and porous Powered by EASA eRules Page 7 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.143(a) and (b) Controllability and Manoeuvrability ................................ ... 152 AMC 25.143(h) Manoeuvre Capability ................................ ................................ ... 159 AMC 25.145(b)(2) Longitudinal control ................................ ................................ .. 162 CS 25.149 Minimum control speed ................................ ................................ .. 166 AMC 25.149 Minimum control speeds ................................ ................................ ... 168 AMC 25.149(e) Minimum control speed ................................ ................................ . 168 MCL AMC 25.149(g) Minimum Control Speed with Two Inoperative Engines during Approach MCL - 2 TRIM ................................ ................................ ................................ .. 171 CS 25.175 Demonstration of static longitudinal stability ................................ .. 173 AMC 25.201(a)(2) Stall demonstration ................................ ................................ ... 180 AMC 25.201(b)(1) Stall demonstration ................................ ................................ ... 180 Powered by EASA eRules Page 8 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.201(d)(3) Stall demonstration ................................ ................................ ... 181 MISCELLANEOUS FLIGHT REQUIREMENTS ................................ .......... 18 8 CS 25.251 Vibration and buffeting ................................ ................................ ... 188 AMC 25.255 Out - of - trim characteristics ................................ ................................ . 193 FLIGHT MANOEUVRE AND GUST CONDITIONS ................................ ... 208 A A D Powered by EASA eRules Page 9 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.333(b) Manoeuvring envelope ................................ ................................ .. 211 AMC 25.341 Gust and Continuous Turbulence Design Criteria (Acceptable Means of CS 25.343 Design fuel and oil loads ................................ ................................ .. 239 AMC 25.345(c) High lift devices (Procedure flight condition) ................................ ... 240 Powered by EASA eRules Page 10 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of co ntents (CS - 25) CS 25.479 Level landing conditions ................................ ................................ .. 264 Powered by EASA eRules Page 11 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.561(b)(3) Commercial Accommodation Equipment ................................ ... 289 AMC No 1 to CS 25.603(a) Suitability and durability of materials — Experience or t ests AMC No 2 to CS 25.603(a) Suitability and durability of materials — Large glass items AMC 25.603(b) Suitability and durability of materials — Approved material Powered by EASA eRules Page 12 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) CS 25.672 Stability augmentation and automatic and power - operated systems 396 AMC 25.685(a) Control system details ................................ ................................ ... 399 CS 25.703 Take - off warning system ................................ ................................ .. 401 Powered by EASA eRules Page 13 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) CS 25.729 Extending and retracting mechanisms ................................ .............. 4 12 PERSONNEL AND CARGO ACCOMMODATIONS ................................ ... 448 CS 25.772 Pilot compartment doors ................................ ................................ . 448 CS 25.773 Pilot compartment view ................................ ................................ .. 448 CS 25.787 Stowage compartments ................................ ................................ ... 486 AMC 25.787(b) Stowage compartments ................................ ................................ . 487 Powered by EASA eRules Page 14 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.788(a) Installation of Showers ................................ ................................ .. 489 CS 25.789 Retention of items of mass in passenger and crew compartments and EMERGENCY PROVISIONS ................................ ................................ .. 504 CS 25.811 Emergency exit marking ................................ ................................ .. 516 Powered by EASA eRules Page 15 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) CS 25.813 Emergency exit access and ease of operation ................................ ... 526 AMC 25.813 Emergency exit access ................................ ................................ ........ 52 9 AMC 25.813(c) Emergency Exit Access and Ease of Operation ................................ . 529 AMC 25.851(a) Hand fire extinguishers ................................ ................................ .. 542 Appendix 1: Analytical methods for determining Halon 1301 concentration levels 554 CS 25.853 Compartment interiors ................................ ................................ ... 560 CS 25.854 Lavatory fire protection ................................ ................................ ... 562 AMC 25.856(a) Thermal/acoustic insulation materials: Flame propagation resistance Powered by EASA eRules Page 16 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.856(b ) Thermal/acoustic insulation materials: Flame penetration CS 25.865 Fire protection of flight controls, engine mounts, and other flight CS 25.869 Fire protection: systems ................................ ................................ .. 576 AMC 25.933(a)(1) Unwanted in - flight thrust reversal of turbojet thrust reversers ... 598 Powered by EASA eRules Page 17 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) CS 25.934 Turbo - jet engine thrust reverser system tests ................................ .. 619 AMC 25.967(a)(3) Fuel tank installation ................................ ................................ . 663 CS 25.979 Pressure fuelling system ................................ ................................ .. 679 Powered by EASA eRules Page 18 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.981(b)(1) Fuel tank flammability design precautions ................................ . 723 CS 25.994 Fuel system components ................................ ................................ . 725 CS 25.1001 Fuel jettisoning system ................................ ................................ .. 727 CS 25.1045 Cooling test procedures ................................ ................................ . 733 Powered by EASA eRules Page 19 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) CS 25.1103 Air intake system ducts and air duct systems ................................ . 747 CS 25.1155 Reverse thrust and propeller pitch settings below the flight regime 752 AMC 25.1155 Reverse thrust and propeller pitch settings below the flight regime .. 752 CS 25.1163 Powerplant accessories ................................ ................................ . 759 CS 25.1165 Engine ignition systems ................................ ................................ . 759 CS 25.1182 Nacelle areas behind firewalls, and engine pod attaching structures AMC 25.1189 Flammable fluid shut - off means ................................ ....................... 7 64 AMC 25.1193(e) Engine cowling and nacelle skin, APU compartment external skin . 768 Powered by EASA eRules Page 20 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.1197 Fire - Extinguishing Agents ................................ ................................ . 776 AMC 25.1303(a)(3) Direction indicators ................................ ................................ . 824 Powered by EASA eRules Page 21 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC to CS 25.1319 Equipment, systems and network information security protection Appendix 1 – Examples for Including Visual System Elements in an Alerting System ................................ ................................ ................................ ................................ ... 894 Appendix 2 – Examples for Including Aural System Elements in an Alerting System 898 CS 25.1325 Static pressure systems ................................ ................................ .. 917 CS 25.1329 Flight Guidance System ................................ ................................ .. 921 AMC 25.1333(b) Instruments systems ................................ ................................ .. 1003 CS 25.1355 Distribution system ................................ ................................ ..... 10 11 Powered by EASA eRules Page 22 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.1362 Electrical supplies for emergency conditio ns ................................ ... 1014 CS 25.1363 Electrical system tests ................................ ................................ .. 1014 AMC 25.1363 Electrical systems tests ................................ ................................ .. 1015 CS 25.1391 Minimum intensities in the horizontal plane of forward and rear CS 25.1393 Minimum intensities in any vertical plane of forward and rear position CS 25.1395 Maximum intensities in over - lapping beams of forward and rear Powered by EASA eRules Page 23 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) CS 25.1423 Public address system ................................ ................................ .. 1061 CS 25.1431 Electronic equipment ................................ ................................ ... 1062 AMC 25.1441(b) Risk assessment related to oxygen fire hazards in gas eous oxygen AMC 25.1441(c) Oxygen chemical generators and small sealed, one - time use gaseous CS 25.1455 Draining of fluids subject to freezing ................................ ............ 10 84 AMC 25.1457 Cockpit voice record ers ................................ ................................ .. 1088 Powered by EASA eRules Page 24 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) RA AMC 25.1521 Power - plant limitations ................................ ................................ . 1106 CS 25.1523 Minimum flight crew ................................ ................................ ... 1107 AMC 25.1533(a)(3) Take - off distances on runways with a grooved o r porous friction AMC 25.1549 Powerplant instruments ................................ ................................ . 1112 Powered by EASA eRules Page 25 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of cont ents (CS - 25) CS 25.1551 Oil quantity indicator ................................ ................................ ... 1112 CS 25.1553 Fuel quantity indicator ................................ ................................ . 1112 AMC 25.1581 Aeroplane flight manual ................................ ................................ . 1115 CS 25.1583 Operating limitat ions ................................ ................................ ... 1141 AMC 25.1583(k) Maximum Depth of Runway Contaminants for Take - off Operations CS 25.1585 Operating procedures ................................ ................................ .. 1143 CS 25.1591 Take - off performance information for operations on slippery wet and AMC 25.1591 The derivati on and methodology of performance information for use CS 25.1592 Performance information for assessing the landing distance ........ 11 61 AMC 25.1592 The derivati on and methodology of performance information for use when landing on slippery wet and contaminated runways to support the dispatch of a flight, and landing assessment performance at the time of arrival in all runway surface

SUBPART H – ELECTRICAL WIRING INTERCONNECTION SYSTEMS

AMC 25 Subpart H Correlation with previous amendment of CS - 25 .. 1174 Powered by EASA eRules Page 26 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) AMC 25.1709 System safety; EWIS ................................ ................................ . 1193 CS 25.1715 Electrical bonding and protection against static electricity; EWIS ................................ ................................ ................................ . 1209 AMC 25.1715 Electrical bonding and protection against static electricity: EWIS AMC 25.1721 Protection of EWIS ................................ ................................ ... 1211 CS 25.1723 Flammable fluid protection; EWIS ................................ .. 1212 Powered by EASA eRules Page 27 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) COOLING ................................ ................................ .......................... 12 24 AMC 25J1093(b) Essential APU air intake system de - icing and anti - icing provisions 1227 Powered by EASA eRules Page 28 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) CS 25J1106 Bleed air duct systems ................................ ................................ . 1228 CS 25J1165 APU ignition systems ................................ ................................ ... 1231 CS 25J1181 Designated fire zones ................................ ................................ .. 1232 CS 25J1203 Fire - detector system ................................ ................................ ... 1236 Powered by EASA eRules Page 29 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) CS 25J1551 Oil quantity indicator ................................ ................................ .. 1240 CS 25J1583 Operating limitations ................................ ................................ .. 1241 Part I – Test Criteria and Procedures for Showing Compliance with CS 25.853, Part III – Test Method to Determine Flame Penetration Resistance of Cargo Part IV – Test Method to Determine the Heat Release Rate from Cabin Materials AMC to Appendix F, Part IV – Test Method to Determine the Heat Release Rate from Part V – Test Method to Determine the Smoke Emission Characteristics of Cabin Part VI – Test Method to Determine the Flammability and Flame Propagation Part VII – Test Method to Determine the Burnthrough Resistance of Appendix H – Instructions for Continued Airworthiness ................................ . 1313 H25.3 Content ................................ ................................ ............................... 13 13 AMC to Appendix H, H25.4(a)(3) Mandatory replacement time of EWIS components as Powered by EASA eRules Page 30 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) H25.5 Electrical Wiring Interconnection System Instructions for Continued AMC to Appendix H, H25.5 Instructions for Continued Airworthiness applicable to EWIS H25.6 Information system security Instructions for Continued Airworthiness . 1318 I 25.3 Performance requirements ................................ ................................ .. 1320 M25.1 Fuel tank flammability exposure requirements ................................ ... 1331 M25.3 Reliability indications and maintenance access ................................ ... 1332 Appendix O – Supercooled Large Drop icing conditions ................................ .. 1341 Powered by EASA eRules Page 31 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) Appendix P – Mixed phase and ice crystal icing envelope (Deep Appendix Q – Additional airworthiness requirements for approval of a Steep Approach Landing (SAL) capability ................................ ................................ . 1354 Appendix S – Airworthiness requirements for non - commercially AMC to Appendix S, S25.1 P assenger seating configuration ................................ .. 1363 AMC to Appendix S, S25.10(a) Interior Doors on Non - Commercially Operated AMC to Appendix S, S25.10(b) Interior Doors on Commercially Operated Aeroplanes AMC to Appendix S, S25.10(d) and (e) Deactivation of existing Emergency Exits ... 1371 AMC to Appendix S, S25.20(b)(1) Ensuring removal of in - flight obstructions before take - AMC to Appendix S, S25.20(b)(2) Comparative assessment of evacuation capability AMC to Appendix S, S25.50(b) Cabin Attendant Direct View ................................ . 13 84 Powered by EASA eRules Page 32 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Table of contents (CS - 25) Appendix 2 – Powerplant Displays ................................ ................................ . 1439 AMC 25 - 13 Reduced and derated take - off thrust (power) procedures Powered by EASA eRules Page 33 of 1495 | Jan 2023

Next: Preamble →

Preamble

Easy Access Rules for Large Aeroplanes Preamb le (CS - 25)

P REAMBLE

ED Decision 2021/015/R CS - 25 Amendment 27 The following is a list of paragraphs affected by this amendment: Subpart D CS 25.603 Amended ( NPA 2020 - 11 ) AMC 25.603 Created ( NPA 2020 - 11 ) AMC No 1 to CS 25.603(a) Created ( NPA 20 20 - 11 ) A MC No 2 to CS 25.603(a) Created ( NPA 2020 - 11 ) AMC 25.603(a) Deleted ( NPA 2020 - 11 ) AMC 25.603( b) Amended ( NPA 2020 - 11 ) CS 25.605 Amended ( NPA 2020 - 11 ) AMC 25. 605(a) Created ( NPA 2020 - 11 ) AMC 25.605( b ) Created ( NPA 2020 - 11 ) AMC 25.613 Amended ( NPA 2020 - 11 ) AMC 25 .671 Amended (Editorial correction) AMC 25.775(d) Amended ( NPA 2020 - 11 ) AMC 25.801 Created ( NPA 2020 - 11 ) Subpart E AMC 25.907 Created ( NPA 2020 - 11 ) Subpart F CS 25.1305 Amended ( NPA 2020 - 11 ) AMC 25.1309 Amended (Editorial correction) Subpart G AMC 25.1541 Amended ( NPA 2020 - 11 ) AMC 25.1581 Amended ( NPA 2016 - 11 ) CS 25 .1591 Amended ( NPA 2016 - 11 ) AMC 25.1591 Amended ( NP A 2016 - 11 ) CS 25.1592 Created ( NPA 2016 - 11 ) AMC 25.1592 Created ( NPA 2016 - 11 ) Subpart H AMC 25 Subpart H Corrected ( NPA 2020 - 11 ) General AMC AMC 25 - 13 Amended ( NPA 2016 - 11 ) ED Decision 2020/024/R CS - 25 Amendment 26 The following is a list of paragraphs affected by this amendment: Subpart B CS 25.143 Amended ( NPA 2020 - 01 ) AMC 25.101(g) Amended ( NPA 20 20 - 01 ) AMC 25.119 Amended ( NPA 2020 - 01 ) AMC 25.143(b)(4) Amended ( NPA 2020 - 01 ) Powered by EASA eRules Page 34 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) AMC 25.149(f) Amended ( NPA 2020 - 01 ) AMC 25.149(g) Amended ( NPA 2020 - 01 ) Subpart C AMC 25.562 Amended ( NPA 2020 - 01 ) AMC 25.581 Amended ( NPA 2020 - 01 ) Subpart D CS 25.733 Amended ( NPA 2020 - 05 ) CS 25.807 Amended (Editorial correction) AMC 25.733(f) Created ( NPA 2020 - 05 ) AMC 25.785 Amended ( NPA 2020 - 01 ) AMC 25.791 Amended ( NPA 2020 - 01 ) AMC to CS 25.793 and CS 25.810(c) Amended ( NPA 2020 - 01 ) AMC 25.803 Amended ( NPA 2020 - 01 ) AMC 25.807 Amended ( NPA 2020 - 01 ) AMC 25 .809 Amended ( NPA 2020 - 01 ) AMC 25.809(c) and (e) Created ( NPA 2020 - 01 ) AMC 25.810 Amended ( NPA 2020 - 01 ) AMC 25.810(a)(1)(v) Created ( NPA 2020 - 01 ) AMC 25.810(c)(2) Amended ( NPA 2020 - 01 ) AMC 25.811 Amended ( NPA 2020 - 01 ) AMC 25.811(d) Amended ( NPA 2020 - 01 ) AMC 25.812 Amended ( NPA 2020 - 01 ) AMC 25 .813 Amended ( NPA 2020 - 01 ) AMC 25.815 Amended ( NPA 2020 - 01 ) AMC 25.819 Amended ( NPA 2020 - 01 ) AMC 25 .831(a) Amended ( NPA 2020 - 01 ) AMC 25.853 Amended ( N PA 2020 - 01 ) AMC to CS 25.855 and 25.857 Amended ( NPA 2020 - 01 ) AMC 25.899 Amended ( NPA 2020 - 01 ) Subpart E CS 25.954 Amended ( NPA 2020 - 01 ) CS 25.981 Amended ( NPA 2020 - 01 ) AMC 25. 954 Amended ( NPA 2020 - 01 ) AMC 25.981(a) Amended ( NP A 2020 - 01 ) Subpart F CS 25.1457 Amended ( NPA 2019 - 12 ) CS 25.1459 Amended ( NPA 2019 - 12 ) CS 25.1460 Created ( NPA 2019 - 12 ) AMC No°1 to CS 25.1329 Amended ( NPA 2020 - 01 ) AMC 25.1351(d) Amended ( NPA 2020 - 01 ) AM C 25.1411(f) Created ( NPA 2020 - 01 ) AMC 25.1457 Amended ( NPA 2019 - 12 ) AMC 25.1459 Amended ( NPA 2019 - 12 ) AMC 25.1460 Created ( NPA 2019 - 12 ) Subpart G Powered by EASA eRules Page 35 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) AMC 25.1581 Amended ( NPA 2020 - 01 ) Appendix H Appendix H25.4 Amended ( NPA 2020 - 01 ) Appendix J Appendix J Amended ( NPA 2020 - 01 ) Appendix S AMC to Appendix S, S25.20(b)(2) Amended ( NPA 2020 - 01 ) General AMCs AMC 25 - 1 Created ( NPA 2020 - 01 ) AMC 25 - 11 Amended ( NPA 2020 - 01 ) ED Decision 2020/006/R CS - 25 Amendment 25 The following is a list of paragraphs affected by this amendment: Subpart F CS 25.1319 Created ( NPA 2019 - 01 ) Appendix H25.6 Created ( NPA 2019 - 01 ) AMC 25.1319 Created ( NPA 2019 - 01 ) ED Decision 2020/001/R CS - 25 Amendment 24 The following is a list of paragraphs affected by this amendment: Subpart D CS 25.629(d) Amended ( NPA 2014 - 02 ) CS 25.671 Amended ( NPA 2014 - 02 ) CS 25.672 Amended ( NPA 2014 - 02 ) CS 25 .705 Created ( NPA 2018 - 12 ) AMC 25.629 Amended ( NPA 2014 - 02 ) AMC 25.671(a) Deleted ( NPA 2014 - 02 ) AMC 25.671(b) Deleted ( NPA 2014 - 02 ) A MC 25.671(c)(1) Deleted ( NPA 2014 - 02 ) AMC 25.671 Created ( NPA 2014 - 02 ) AMC 25.672(c)(1) Deleted ( NPA 2014 - 02 ) AMC 25.705 Created ( NPA 2018 - 12 ) Subpart E CS 25.933 Amended ( NPA 2014 - 02 ) AMC 25.933(a)(1) Amended ( NPA 2014 - 02 ) Subpart F CS 25.1309 Amended ( NPA 2014 - 02 ) AMC 25.1309 Amended ( NPA 2014 - 02 ) ED Decision 2019/013 /R CS - 25 Amendment 23 The following is a list of paragraphs affected by this amendment: Powered by EASA eRules Page 36 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) Subpart C AMC 25.341 Amended (Editorial correction) Subpart D AMC 25.701(d) Amended ( NPA 2018 - 05 ) AMC 25.777(c) Created ( NPA 2018 - 05 ) CS 25.791(d) Amended ( NPA 2018 - 05 ) CS 25.831(a) Amended ( NPA 2018 - 05 ) AMC 25.831(a) Amended ( NPA 2018 - 05 ) CS 25.853(g ) Amended ( NPA 2018 - 05 ) Subpart F CS 25.1441(c ) Amended ( NPA 2018 - 05 ) AMC 25.1441 (c) Creat ed ( NPA 2018 - 05 ) CS 25.1457 Amended ( NPA 2018 - 03 ) AMC 25 .14 57 Amended ( NPA 2018 - 03 ) CS 25.14 5 9 Amended ( NPA 2018 - 03 ) AMC 25.145 9(a)(4) Delet ed ( NPA 2018 - 03 ) AMC 25.145 9(b ) Deleted ( NPA 2018 - 03 ) AMC 25.1459 Crea ted ( NPA 2018 - 03 ) ED Decision 2018 /010 /R CS - 25 Amendment 22 The following is a list of paragraphs affected by this amendment: Subpart C CS 25. 353 Created ( NPA 2017 - 18 ) AM C 25.353 Creat ed ( NPA 2017 - 18 ) Subpart G AMC 25.1581 Amended ( NPA 2017 - 18 ) CS 25.1583 Amended ( NPA 2017 - 18 ) Subpart J AMC 25J1195(b) Corrected (editorial) ED Decision 2018/005/R CS - 25 Amendment 21 The following is a list of paragraphs affected by this amendment: Subpart B AMC 25.21(g) Amended ( NPA 2017 - 12 ) CS 25.143 Amended ( NPA 2017 - 06 ) AMC 25. 143(b)(4) Created ( NPA 2017 - 06 ) CS 25.145 Amended ( NPA 2017 - 06 ) AMC 25.145(a) Amended ( NPA 2017 - 06 ) AMC 25.145(f) Created ( NPA 2017 - 06 ) AMC 25.201(d) Amended ( NPA 2017 - 06 ) Subpart C CS 25.562(b) Amended ( NPA 201 7 - 12 ) Powered by EASA eRules Page 37 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) Subpart E CS 25.975 Amended ( NPA 2017 - 12 ) AMC 25.975(a)(7) Created ( NPA 2017 - 12 ) CS 25.1193 Amended ( NPA 2017 - 12 ) AMC 25 .1193(e)(4) and (f) Created ( NPA 2017 - 12 ) Subpart F CS 25.1303(a)(3) Amended ( NPA 2017 - 12 ) AMC 25.1303(a)(3) Created ( NPA 2017 - 12 ) AMC 25.1305(c)(5) Created ( NPA 2017 - 12 ) AMC 25.1324 Amended ( NPA 2017 - 12 ) AMC 2 5.1327 Amended ( NPA 2017 - 12 ) CS 25.1441(b) Amended ( NPA 2017 - 12 ) AMC 25.1441(b) Created ( NPA 2017 - 12 ) Subpart G CS 25.1535 Amended ( NPA 2017 - 12 ) AMC 25.1581 Corrected (Editorial) CS 25.1587 Amended ( NPA 2017 - 12 ) AMC 25.1587(c) Created ( NPA 2017 - 12 ) Ap pendix Q (SAL) 25.5(e) Amended ( NPA 2017 - 06 ) Appendix S S 25.60 Created ( NPA 2017 - 12 ) G eneral AMCs AMC 25 - 11 Amended ( NPA 2017 - 12 ) AMC 25 - 19 Corrected (Editorial) ED Decision 2017/018/R CS - 25 Amendment 20 The following is a list of paragraphs affected by this amendment: Subpart F CS 25.1309 Amended Appendix H Amended General A MCs AMC 25 - 19 Amended ED Decision 2017/015/R CS - 25 Amendment 19 The following is a list of paragraphs affected by this amendment: Subpart B CS 25.147 Amended (Editorial) AMC 25.201(d) Amended (Editorial) Subpart C CS 25.571 Amended ( NPA 2013 - 07 ) AMC 25.571(a), (b) and (e) Deleted ( NP A 2013 - 07 ) Powered by EASA eRules Page 38 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) AMC 25.571(b) and (e) Deleted ( NPA 2013 - 07 ) AMC 25.571 Created ( NPA 2013 - 07 ) Subpart D CS 25.603 Amended ( NPA 2015 - 19 ) AMC 25.603(a) Created ( NPA 2015 - 19 ) CS 25.785 Amended ( NPA 2015 - 19 ) AMC 25. 785 Amended ( NPA 2015 - 19 ) AMC 25.785(h)(2) Created ( NPA 2015 - 19 ) AMC 25.787(b) Amended ( NPA 2015 - 19 ) CS 25.788 Created ( NPA 2015 - 19 ) AMC 25.788(a) Created ( NPA 2015 - 19 ) AMC 25.788(b) Created ( NPA 2015 - 19 ) CS 25.807 Amended ( NPA 2015 - 19 ) AMC 25.807 Amended ( NPA 2015 - 19 ) AMC 25.807(e) Created ( NPA 2015 - 19 ) CS 25.811 Amended ( NPA 2015 - 19 ) AMC 25.811(d) Created ( NPA 2015 - 19 ) AMC 25.811(e)(4) Amended ( NPA 2015 - 19 ) CS 25.812 Amended ( NPA 2015 - 19 ) AMC 25.812(b)(1) Amended ( NPA 2015 - 19 ) AMC 25.812(b )(2) Amended ( NPA 2015 - 19 ) AMC 25.812(e)(2) Amended ( NPA 2015 - 19 ) AMC 25.812(l)(1) Created ( NPA 2015 - 19 ) CS 25.813 Amended ( NPA 2015 - 19 ) AMC 25.813(c) Amended ( NPA 2015 - 19 ) AMC 25.813(e) Created ( NPA 2015 - 19 ) CS 25.854 Amended ( NPA 2015 - 19 ) AMC 25.854 Created ( NPA 2015 - 19 ) Subpart F CS 25.1309 Amended ( NPA 2016 - 07 ) AMC 25.1309 Amended ( NPA 2016 - 07 ) CS 25 .1365 Amended ( NPA 2015 - 19 ) AMC 25.1365(b) Created ( NPA 2015 - 19 ) CS 25.1447 Amended ( NPA 2015 - 19 ) AMC 25.1447(c)(1) Amended ( NPA 2015 - 19 ) AMC 25.1447(c)(3) Amended ( NPA 2015 - 19 ) Subpart G AMC 25.1541 Amended ( NPA 2015 - 19 ) Appendix H Amended ( NPA 2013 - 07 ) Appendix S Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.1 Created ( NPA 20 15 - 19 ) AMC to Appendix S, S25.10(a) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.10(b) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.10(c) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.10(d) and (e) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.20(a)(1) Created ( NPA 2015 - 19 ) Powered by EASA eRules Page 39 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) AMC to Appendix S, S25.20(b) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.20(b)(1) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.20(b)(2) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.30(a) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.30(b) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.40(b) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.40(c) Created ( NPA 2015 - 19 ) AMC to Appendix S, S25.50(b) Created ( NPA 2015 - 19 ) ED Decision 2016/010 /R CS - 25 Amendment 18 The following is a list of paragraphs affected by this amendment: Subpart B CS 25.21(g) Amended ( NPA 2015 - 07 ) AMC 25.21(g) Amended ( NPA 2015 - 07 ) CS 25.143 Amended ( NPA 2015 - 11 ) CS 25.207 Amended ( NPA 2015 - 11 ) Subpart C CS 25.301 Amended ( NPA 2015 - 11 ) CS 25.331 Amended ( NPA 2015 - 11 ) CS 25.333 Amended ( NPA 2015 - 11 ) CS 25.335 Amended ( NPA 2015 - 11 ) CS 25.345 Amended ( NPA 2015 - 11 ) CS 25.349 Amended ( NPA 2015 - 11 ) CS 25. 365 Amended ( NPA 2015 - 11 ) CS 25.393 Amended ( NPA 2015 - 11 ) CS 25.397 Amended ( NPA 2015 - 11 ) CS 25.415 Amended ( NPA 2015 - 11 ) CS 25.491 Amended ( NPA 2015 - 11 ) CS 25. 571 Amended ( NPA 2015 - 11 ) CS 25.581 Amended ( NPA 2015 - 11 ) Subpart D CS 25.603 Amended ( NPA 2015 - 11 ) CS 25.609 Amended ( NPA 2015 - 11 ) CS 25.629 Amended ( NPA 2015 - 11 ) AMC 25.629 Amended ( NPA 2015 - 07 ) CS 25.631 Amended ( NPA 2015 - 11 ) CS 25.671 Amended ( NPA 2015 - 11 ) CS 25.672 Amended ( NPA 2015 - 11 ) CS 25.679 Amended ( NPA 2015 - 11 ) CS 25.685 Amended ( NPA 2015 - 11 ) CS 25.701 Amended ( NPA 2015 - 11 ) CS 25.729 Amended ( NPA 2015 - 11 ) AMC 25.729 Amended ( NPA 2015 - 11 ) AMC 25.735 Amended ( NPA 2015 - 11 ) Powered by EASA eRules Page 40 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) CS 25.745 Amended ( NPA 2015 - 11 ) CS 25.773 Amended ( NPA 2015 - 11 ) AMC 25.773(b)(1)(ii) Amended ( NPA 2015 - 0 7 ) AMC 25.773(b)(4) Amended ( NPA 2015 - 07 ) CS 25.775 Amended ( NPA 2015 - 11 ) CS 25.783 Amended ( NPA 2015 - 11 ) CS 25.787 Amended ( NPA 2015 - 11 ) CS 25.795 Amended ( NPA 2015 - 11 ) CS 25.807 Amended ( NPA 2015 - 11 ) CS 25.810 Amended ( NPA 2015 - 11 ) AMC 25.810(a)(1)(iv) Created ( NPA 2015 - 11 ) CS 25.813 Amended ( NPA 2015 - 11 ) CS 25.831 Amended ( NPA 2015 - 11 ) CS 25.851 Amended ( NPA 2015 - 11 ) CS 25.856 Amended ( NPA 2015 - 11 ) CS 25.863 Amended ( NPA 2015 - 11 ) CS 25.8 69 Amended ( NPA 2015 - 11 ) Subpart E CS 25.901 Amended ( NPA 2015 - 11 ) CS 25.903 Amended ( NPA 2015 - 11 ) CS 25. 905 Amended ( NPA 2015 - 11 ) CS 25.929 Amended ( NPA 2015 - 11 ) AMC 25.929(a) Amended ( NPA 2015 - 07 ) CS 25.933 Amended ( NPA 2015 - 11 ) CS 25.954 Amended ( N PA 2015 - 11 ) CS 25.955 Amended ( NPA 2015 - 11 ) CS 25.963 Amended ( NPA 2015 - 11 ) CS 25.967 Amended ( NPA 2015 - 11 ) CS 25. 979 Amended ( NPA 2015 - 11 ) CS 25.981 Amended ( NPA 2015 - 11 ) CS 25.1043 Amended ( NPA 2015 - 11 ) CS 25.1091 Amended ( NPA 2015 - 11 ) CS 25.1093 Amended ( NPA 2015 - 11 ) AMC 25.1093(b) Amended ( NPA 2015 - 07 ) CS 25.1103 Amended ( NPA 2015 - 11 ) CS 25.1121 Amended ( NPA 2015 - 11 ) CS 25.1141 Amended ( NPA 2015 - 11 ) CS 25.1155 Amended ( NPA 2015 - 11 ) CS 25 .1193 Amended ( NPA 2015 - 11 ) CS 25.1195 Amended ( N PA 2015 - 11 ) Subpart F CS 25.1303 Amended ( NPA 2015 - 11 ) CS 25.1305 Amended ( NPA 2015 - 11 ) CS 25.1310 Amended ( NPA 2015 - 11 ) CS 25.1315 Amended ( NPA 2015 - 11 ) AMC 25.132 2 Amended ( NPA 2015 - 11 ) Powered by EASA eRules Page 41 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) CS 25.1323 Amended ( NPA 2015 - 11 ) AMC 25.132 4 Amended ( NPA 2015 - 11 ) AMC No.1 to CS 25.1329 Amended ( NPA 2015 - 07 , NPA 2015 - 11 ) CS 25.1333 Amended ( NPA 2015 - 11 ) CS 25.1351 Amended ( NPA 2015 - 11 ) CS 25 .1353 Amended ( NPA 2015 - 11 ) CS 25.1355 Amended ( N PA 2015 - 11 ) CS 25.1357 Amended ( NPA 2015 - 11 ) CS 25.1360 Amended ( NPA 2015 - 11 ) AMC 25.1403 Amended ( NPA 2015 - 07 ) CS 25.1420 Amended ( NPA 2015 - 07 ) AMC 25.1420 Amended ( NPA 2015 - 07 ) AMC 25.1435 Amended ( NPA 2015 - 11 ) CS 25 .1436 Amended ( NPA 2015 - 11 ) CS 25.1438 Amended ( NP A 2015 - 11 ) CS 25.1441 Amended ( NPA 2015 - 11 ) CS 25.1447 Amended ( NPA 2015 - 11 ) CS 25.1459 Amended ( NPA 2015 - 11 ) Subpart G CS 25.1519 Amended ( NPA 2015 - 11 ) CS 25.1523 Amended ( NPA 2015 - 11 ) CS 25.1533 Amended ( NPA 2015 - 11 ) CS 25.1545 Amended ( NPA 2015 - 11 ) CS 25 .1557 Amended ( NPA 2015 - 11 ) CS 25.1583 Amended ( N PA 2015 - 11 ) AMC 25.1593 Corrected ( NPA 2015 - 11 ) Subpart J CS 25J901 Amended ( NPA 2015 - 11 ) CS 25J955 Amended ( NPA 2015 - 11 ) CS 25J1093 Amended ( NPA 2015 - 11 ) CS 25J1195 Amended ( NPA 2015 - 11 ) Appendix F Amended ( NPA 2015 - 11 ) Appendix H Amended ( NPA 2015 - 11 ) Appendix N Amended ( NPA 2015 - 11 ) Appendix Q Amended ( NPA 2015 - 11 ) AMC to Appendix Q Corrected ( NPA 2015 - 11 ) ED Decision 2015/019/R CS - 25 Amendment 17 The following is a list of paragraphs affected by this amendment: AMC 25 - 11 Amended ( NPA 2013 - 11 ) Subpart B CS 25.21(g)(3) Corrected Subpart C CS 25.562 Amended ( NPA 2013 - 11 ) Powered by EASA eRules Page 42 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) AMC 25.562 Created ( NPA 2013 - 11 ) Subpart D CS 25.785 Amended ( NPA 2013 - 11 ) AMC 25.785 Created ( NPA 2013 - 11 ) AMC 25.785(d) Deleted ( NPA 2013 - 11 ) CS 25.793 Amended ( NPA 2013 - 11 ) AMC to CS 25.793 and CS 25.810(c) Created ( NPA 2013 - 11 ) CS 25.795 Amended ( NPA 2013 - 11 ) AMC 25.795(d) Created ( NPA 2013 - 11 ) CS 25.809 Amended ( NPA 2013 - 11 ) AMC 25.809 Amended ( NPA 2013 - 11 ) AMC 25.809(a) Created ( NPA 2013 - 11 ) CS 25.810 Amended ( NPA 2013 - 11 ) AMC 25.810 Created ( NPA 2013 - 11 ) CS 25.811 Amended ( NPA 2013 - 11 ) AMC 25.811 Created ( NPA 2013 - 11 ) AMC 25.813 Amended ( NPA 2013 - 11 ) CS 25.819 Amended ( NPA 2013 - 11 ) AMC 2 5.819 Created ( NPA 2013 - 11 ) AMC 25.853 Amended ( NPA 2013 - 11 ) Subpart F AMC 25.1305(a)(2) Moved after AMC 25.1303(b)(5) and AMC 25.1303(c)(1) CS 25.1316 Amended ( NPA 2014 - 16 ) CS 25.1317 Created ( NPA 2014 - 16 ) AMC 25.1322, Appendix 1 Corrected CS 25.1450(b) Amended ( NPA 2013 - 11 ) Appendix F Amended ( NPA 2013 - 11 ) Appe ndix R Created ( NPA 2014 - 16 ) ED Decision 2015/008/R CS - 25 Amendment 16 The following is a list of paragraphs affected by this amendment: Subpart B CS 25. 21(g) Amended ( NPA 2011 - 03 ) AMC 25.21(g) Amended ( NPA 2012 - 22 ) CS 25.105(a)(2) Amended ( NPA 2011 - 03 ) CS 25.111(c)(5) Amended ( NPA 2011 - 03 ) CS 25.119(b) Amended ( NPA 2011 - 03 ) CS 25.121 Amended ( NPA 2011 - 03 ) CS 25 .123(b)(2) Amended ( NPA 2011 - 03 ) CS 25.125 Amended ( NPA 2011 - 03 ) CS 25.143 Amended ( NPA 2011 - 03 ) CS 25.207 Amended ( NPA 2011 - 03 ) CS 25.237(a)(3)(ii) Amended ( NPA 2011 - 03 ) CS 25.253(c) Amended ( NPA 2011 - 03 ) Powered by EASA eRules Page 43 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) Subpart D AMC 25.629 Amended ( NPA 2012 - 22 ) CS 25.773 Amended ( NPA 2011 - 03 & NPA 2012 - 22 ) AMC 25.773 Amended ( NPA 2012 - 22 ) AMC 25. 773(b)(1)(ii) Created ( NPA 2012 - 22 ) AMC 25.773(b)(4) Created ( NPA 2012 - 22 ) AMC 25.773(c) Created ( NPA 2012 - 22 ) S ubpart E CS 25.903(a)(3) Amended ( NPA 2011 - 03 ) CS 25.929(a) Amended ( NPA 2011 - 03 ) AMC 25.929(a) Amended ( NPA 2012 - 22 ) CS 25.1093 Amended ( NPA 2011 - 03 & NPA 2012 - 22 ) AMC 25.1093(b) Amended ( NPA 2012 - 22 ) Subpart F CS 25.1323(i) Deleted ( NPA 2011 - 03 ) AMC to 25.1323(i) and 25.1325(b) Deleted ( NPA 2012 - 22 ) CS 25.1324 Created ( NPA 2011 - 03 & NPA 2012 - 22 ) AMC 25.1324 Created ( NPA 2012 - 22 ) CS 25 .1325(b) Amended ( NPA 2011 - 03 ) CS 25.1326 Amended ( NPA 2011 - 03 & NPA 2012 - 22 ) AMC 25.1326 Created ( NPA 2012 - 22 ) AMC N°1 to CS 25.1329 Amended ( NPA 201 2 - 22 ) CS 25.1403 Amended ( NPA 2011 - 03 ) AMC 25.1403 Created ( NPA 2012 - 22 ) AMC 25.1419 Amended ( NPA 2012 - 22 ) CS 25.1420 Created ( NPA 2011 - 03 ) AMC 25.1420 Created ( NPA 2012 - 22 ) Subpart G CS 25.1521(c) Amended ( NPA 2011 - 03 ) CS 25.1533(c) Amended ( NPA 2011 - 03 ) Subpart J CS 25J1093 Amended ( NPA 201 1 - 03 ) AMC 25J1093(b) Amended ( NPA 2012 - 22 ) Appendix C Part II Amended ( NPA 2011 - 03 ) Appendix O Created ( NPA 2011 - 03 ) Appe ndix P Created ( NPA 2011 - 03 ) ED Decision 2014/026/R CS - 25 Amendment 15 The following is a list of paragraphs affected by this amendment: Subpart B CS 25.143 Corrected (Editorial) Subpart C CS 25.562(b) Corrected (Editorial) Powered by EASA eRules Page 44 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) Subpart D CS 25.801(a) Amended ( NPA 2014 - 06 ) CS 25.841 Corrected (Editorial) Subpart E AMC 25.1041 Deleted ( NPA 2014 - 06 ) AMC 25.1043 Created ( NPA 2014 - 06 ) Subpart F AMC 25.1447(c)(3) Amended ( NPA 2014 - 06 ) ED Decision 2013/033/R CS - 25 Amendment 14 The following is a list of paragraphs affected by this amendment: Subpart D CS 25.729(f) Deleted ( NPA 2013 - 02 ) AMC 25.729 Amended ( NPA 201 3 - 02 ) CS 25.734 Created ( NPA 2013 - 02 ) AMC 25.734 Created ( NPA 2013 - 02 ) CS 25.735(l) Created ( NPA 2013 - 02 ) AMC 25.735 Amended ( NPA 2013 - 02 ) CS 25.809(g) Corrected (Editorial) Subpart E CS 25.963(e) Amended ( NPA 2013 - 02 ) AMC 25.963(e) Amended ( NPA 2013 - 02 ) S ubpart F AMC 25.1309 Corrected (Editorial) ED Decision 2013/010/R CS - 25 Amendment 13 The following is a list of paragraphs affected by this amendment: Subpart A AMC 25 - 13 Amended ( NPA 2011 - 09 ) Subpart B AMC 25.21(g) Amended ( NPA 2 011 - 09 ) AMC 25.101(g) Created ( NPA 2011 - 09 ) CS 25.143(k) Created ( NPA 2011 - 09 ) CS 25.143(l) Created ( NPA 2011 - 09 ) Su bpart C CS 25.331(c) Amended ( NPA 2011 - 09 ) AMC 25.331(c)(1) Created ( NPA 2011 - 09 ) AMC 25.331(c)(2) Created ( NPA 2011 - 09 ) CS 25.333(b) Amended ( NPA 2011 - 09 ) AM C 25.333(b) Created ( NPA 2011 - 09 ) CS 25.335(b)(1) Amended ( NPA 2011 - 09 ) AMC 25.335(b)(1)(ii) Created ( NPA 2011 - 09 ) Powered by EASA eRules Page 45 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) CS 25.349(a) Amended ( NPA 2011 - 09 ) AMC 25.349(a) Created ( NPA 2011 - 09 ) CS 25.351 Amended ( NPA 2011 - 09 ) AMC 25.351 Created ( NPA 2011 - 09 ) CS 25.397(d) Created ( NPA 2011 - 09 ) CS 25.509 Amended ( NPA 2011 - 09 ) AMC 25.509 Created ( NPA 2011 - 09 ) Subpart D CS 25.745(d) Amended ( NPA 2011 - 09 ) AMC 25.745(d) Created ( NPA 2011 - 09 ) CS 25.777(i) Created ( NPA 2011 - 09 ) CS 25.785(b) Amended ( NPA 2011 - 09 ) CS 25.810(a)(1)(iv) Amended ( NPA 2011 - 09 ) CS 25.855(c) Amended ( NPA 2011 - 09 ) Subpart E CS 25.951 (c) Corrected (editorial) CS 25.1193(e)(3) Amended ( NPA 2011 - 09 ) AMC 25.1193(e) Created ( NPA 2011 - 09 ) Subpart F CS 25.1447(c)(3) Amended ( NPA 2011 - 09 ) AMC 25.1447(c)(3) Created ( NPA 2011 - 09 ) Subpart G CS 25.1501 Amended ( NPA 2011 - 17 ) CS 25.1593 Created ( NPA 2011 - 17 ) AMC 25.1593 Created ( NPA 2011 - 17 ) Subpart J CS 25J1193(e)(3) Amended ( NPA 2011 - 09 ) Appendix Q Created ( NPA 2011 - 09 ) AMC to Appendix Q Created ( NPA 2011 - 09 ) ED Decision 2012/008/R CS - 25 Amendment 12 The following is a list of paragraphs affected by this amendment: Subpart A AMC 25 - 11 Amended and corrected (editorial) Subpart C CS 25.341(a)(4) Corrected (editorial) Subpart D AMC 25.703 Amended (editorial) AMC 25.729 Amended (editorial) AMC 25.735 Amended (editorial) CS 25.785 Amended ( NPA 2010 - 11 ) AMC 25.803 Amended (editorial) CS 25.807 Amended ( NPA 2010 - 11 ) AMC to 25.807 and 25.813 Amended ( NPA 2010 - 11 ) Powered by EASA eRules Page 46 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) AMC 25.807 Deleted ( NPA 2010 - 11 ) AMC 25.807(d) Amended ( NPA 2010 - 11 ) CS 25.809 Amended ( NPA 2010 - 11 ) AMC 25.809 Created ( NPA 2010 - 11 ) AMC 25.809(a)(3) Created ( NPA 2010 - 11 ) CS 25.810 Amended ( NPA 2010 - 11 ) CS 25.812 Amended ( NPA 2010 - 11 ) CS 25.813 Amended ( NPA 2010 - 11 ) AMC 25.813 Created ( NPA 2010 - 11 ) CS 25.851 Amended ( NPA 2011 - 14 ) AMC 25.851(a) Amended ( NPA 2011 - 14 ) A MC 25.851(a)(1) Amended ( NPA 2011 - 14 ) AMC 25.851(a)(2) Amended ( NPA 2011 - 14 ) AMC 25.851(b) Amended ( NPA 2011 - 14 ) AMC 25.851(c) Created ( NPA 2011 - 14 ) CS 25.853(f) Amended ( NPA 2010 - 11 ) CS 25.855 Amended ( NPA 2010 - 11 ) AMC to CS 25.855 and 25.857 Amended ( NPA 2011 - 14 ) Subpart E CS 25.951 (c) Corrected (editorial) AMC 25.1195(b) Amended ( NPA 2011 - 14 ) CS 25.1197 Amended ( NPA 2011 - 14 ) AMC 25.1197 Created ( NPA 2011 - 14 ) Subpart F CS 25.1305(a)(2) Amended ( NPA 2011 - 13 ) AMC 25.1305(a)(2) Created ( NPA 2011 - 13 ) AMC 25.1309 Amended (editorial) AMC 25.1309, Appendix 2 Amended (editorial) AMC 25.1322 Corrected (editorial) AMC 25.1329 Amended (editorial) AMC 25.1435 Amended (editorial) CS 25.1445 Corrected (editorial) CS 25.1447(c)(4) Amended ( NPA 2010 - 11 ) Subpart G AMC 25.1581, Appendix 1 Amended (editorial) Appendix F Part II Amended ( NPA 2011 - 14 ) ED Decision 2011/004/R CS - 25 Amendment 11 The following is a list of paragraphs affected by this amendment: Subpart A CS 25.1 Amended (editorial) AMC 25 - 11 Amended ( NPA 2009 - 12 ) Subpart B Powered by EASA eRules Page 47 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) CS 25.177(c) Corrected (editorial) AMC 25.177(c) Corrected (editorial) Subpart C CS 25.333 Corrected (editorial) AMC 25.561(b)(3) Corrected (editorial) Subpart D AMC 25.783 Corrected (editorial) CS 25.785(f)(3) Corrected (editorial) AMC 25.785(d) Corrected (editorial) AMC 25.791 Amended (editorial) AMC 25.803 Amended (editorial) AMC 25.807 Amended (editorial) AMC 25.807(d) Corrected (editorial) AMC 25.812 Amended (editorial) AMC 25.815 Amended (editorial) AMC 25.853 Amended (editorial) AMC to CS 25.855 and 25.857 Amended (editorial) Subpart E AMC 25.1125(a)(3) Deleted Subpart F AMC 25.1302 Corrected (editorial) AMC 25.1309 Amended (editorial) CS 25.1322 Amended ( NPA 2009 - 12 ) AMC 25.1322 Amended ( NPA 2009 - 12 ) AMC No.1 to CS 25.1329 Amended (editorial) CS 25.1459(d)(3) Corrected (editorial) ED Decision 2010/013/R CS - 25 Amendment 10 The following is a list of paragraphs affected by this amendment: Subpart G CS 25.1 535 New ( NPA 2008 - 01 ) ED Decision 2010/005/R CS - 25 Amendment 9 The following is a list of paragraphs affected by this amendment: Subpart B CS 25.113 Corrected (editorial) Subpart D CS 25.603 Amended ( NPA 2009 - 06 ) AMC No. 1 to 25.603 Deleted ( NPA 2009 - 06 ) AMC No. 2 to 25.603 Deleted ( NPA 2009 - 06 ) CS 25.795 Amended ( NPA 2009 - 07 ) AMC 25.795(a)(1) Amended ( NPA 2009 - 07 ) Powered by EASA eRules Page 48 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) AMC 25.795(a)(2) Amended ( NPA 2009 - 07 ) AMC 25.795(b)(1) New ( NPA 2009 - 07 ) AMC 25.795(b)(2) New ( NPA 2009 - 07 ) AMC 25.795(b)(3) New ( NPA 2009 - 07 ) AMC 25.795(c)(1) New ( NPA 2009 - 07 ) AMC 25.795(c)(2) New ( NPA 2009 - 07 ) AMC 25.795(c)(3) New ( NPA 2009 - 07 ) CS 25.813 Amended ( NPA 2008 - 04 ) AMC 25.813(c) Amended ( NPA 2008 - 04 ) Subpart E CS 25.981 Amended (definition added) AMC 25.981 (a) Corrected (editorial) Subpart H AMC 25.1711 Corrected (editorial) Subpart J CS 25J951 Corrected (editorial) ED Decision 2009/017/R CS - 25 Amendment 8 The following is a list of paragraphs affected by this amendment: Subpart B AMC 25 - 24 Created ( NPA 2007 - 15 ) Subpart C CS 25.361 Amended ( NPA 2007 - 15 ) AMC 25.361 Created ( NPA 2007 - 15 ) CS 25.362 Created ( NPA 2007 - 15 ) AMC 25.362 Created ( NPA 2007 - 15 ) Subpart D AMC 25.703 Corrected (editorial) AMC 25.735 Corrected (editorial) AMC 25.783 Corrected (editorial) CS 25.851 Amended ( NPA 2008 - 10 ) CS 25.855 Amended ( NPA 2008 - 10 ) CS 25.857 Amended ( NPA 2008 - 10 ) AMC 25.857 Amended ( NPA 2008 - 10 ) Subpart E CS 25.901 Amended ( NPA 2007 - 15 ) AMC 25.981 Corrected (editorial) Subpart F AMC 25.1309 Corrected (editorial) Appendix F Part I – paragraph (a) Amended ( NPA 2008 - 10 ) Part III Corrected (editorial) Appendix H H25.5 Corrected (editorial) Powered by EASA eRules Page 49 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamb le (CS - 25) ED Decision 2009/013/R CS - 25 Amendment 7 The following is a list of paragraphs affected by this amendment: Subpart B CS 25.143 Amended ( NPA 2009 - 08 ) CS 25.207 Amended ( NPA 2009 - 08 ) Subpa rt F CS 25.1419 Amended ( NPA 2009 - 08 ) Appendix C Part II paragraph (e) Amended ( NPA 2009 - 08 ) ED Decision 2009/010/R CS - 25 Amendment 6 The following is a list of paragraphs affected by this amendment: Subpart B CS 25.21 Amended ( NPA 2008 - 05 ) AMC 25.21(g) Corrected Subpart D AMC 25.629 Corrected (editorial) AMC 25.783 Corrected (editorial) CS 25.807(h) (3) Corrected (editorial) AMC 25.807 Corrected (editorial) CS 25.856 Created ( NPA 2008 - 13 ) AMC 25.856 (a) Created ( NPA 2008 - 13 ) AMC 25.856 (b) Created ( NPA 2008 - 13 ) Subpart E CS 25.981(b) Amended ( NPA 2008 - 19 ) AMC 25.981(b) Created ( NPA 2008 - 19 ) CS 25.981(c) Deleted ( NPA 2008 - 19 ) AMC 25.981(c) Deleted ( NPA 2008 - 19 ) Subpart F CS 25.1309 Corrected (editorial) Appendix F Part I Amended ( NPA 2008 - 13 ) Part VI Created ( NPA 2008 - 13 ) Part VII Created ( NPA 2008 - 13 ) Appendix M Created ( NPA 2008 - 19 ) Appendix N Created ( NPA 2008 - 19 ) AMC to Appendix N Created ( NPA 2008 - 19 ) Powered by EASA eRules Page 50 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) ED Decision 2008/006/R CS - 25 Amendment 5 The following is a list of paragraphs affected by this amendment: Subpart D CS 25.611 Amended ( NPA 2007 - 01 ) CS 25.807 Corrected CS 25.812 Corrected CS 25.855 Amended ( NPA 2007 - 01 ) CS 25.869 Amended ( NPA 2007 - 01 ) Subpa rt E AMC 25.951 (d) Deleted (Correction) CS 25.991 Corrected CS 25.1203 Amended ( NPA 2007 - 01 ) Subpart F CS 25.1301 Amended ( NPA 2007 - 01 ) AMC 25.1301(a)(2) Created ( NPA 2007 - 01 ) AMC 25.1301(b) Replaced by AMC 25.1301(a)(2) ( NPA 2007 - 01 ) CS 25.1309 Amended ( NPA 2007 - 01 ) CS 25.1353 Amended ( NPA 2007 - 01 ) CS 25.1357 Amended ( NPA 2007 - 01 ) AMC 25.1357(f) Created ( NPA 2007 - 01 ) CS 25.1411 Corrected Subpart H AMC 25 Subpart H Created ( NPA 2007 - 01 ) CS 25.1701 Created ( NPA 2007 - 01 ) AMC 25.1701 Created ( NPA 2007 - 01 ) CS 25.1703 Created ( NPA 2007 - 01 ) AMC 25.1703 Created ( NPA 2007 - 01 ) CS 25.1705 Created ( NPA 2007 - 01 ) CS 25.1707 Created ( NPA 2007 - 01 ) AMC 25.1707 Created ( NPA 2007 - 01 ) CS 25.1709 Created ( NPA 2007 - 01 ) AMC 25.1709 Created ( NPA 2007 - 01 ) CS 25.1711 Created ( NPA 2007 - 01 ) A MC 25.1711 Created ( NPA 2007 - 01 ) CS 25.1713 Created ( NPA 2007 - 01 ) A MC 25.1713 Created ( NPA 2007 - 01 ) CS 25.1715 Created ( NPA 2007 - 01 ) A MC 25.1715 Created ( NPA 2007 - 01 ) CS 25.1717 Created ( NPA 2007 - 01 ) A MC 25.1717 Created ( NPA 2007 - 01 ) CS 25.1719 Created ( NPA 2007 - 01 ) A MC 25.1719 Created ( NPA 2007 - 01 ) CS 25.1721 Created ( NPA 2007 - 01 ) A MC 25.1721 Created ( NPA 2007 - 01 ) CS 25.1723 Created ( NPA 2007 - 01 ) Powered by EASA eRules Page 51 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) A MC 25.1723 Created ( NPA 2007 - 01 ) CS 25.1725 Created ( NPA 2007 - 01 ) CS 25.172 7 Created ( NPA 2007 - 01 ) CS 2 5.1729 Created ( NPA 2007 - 01 ) CS 25.1731 Created ( NPA 2007 - 01 ) Subpart J CS 25J991 Corrected Appendix H H25.1 Amended ( NPA 2007 - 01 ) H25.4 Amended ( NPA 2007 - 01 ) AMC to Ap pendix H, H25.4(a)(3) Created ( NPA 2007 - 01 ) H25.5 Created ( NPA 2007 - 01 ) AMC to Appendix H, H25.5 Created ( NPA 2007 - 01 ) ED Decision 2007/020/R CS - 25 Amendment 4 The following is a list of paragraphs affected by this amendment: Subpart D CS 25.729 Amended ( NPA 02/2006 ) AMC 25.729 Created ( NPA 02/2006 ) CS 25.773 Amended ( NPA 02/2006 ) AMC 25.773 Created ( NPA 02/2006 ) AMC 25.773(b)(1)(ii) Deleted ( NPA 02/2006 ) CS 25.783 Amended ( NPA 02/2006 ) AMC 25.783 Created ( NPA 02/2006 ) CS 25.807 Amended ( NPA 02/2006 ) CS 25.809 Amended ( NPA 02/2006 ) CS 25 .810 Amended ( NPA 02/2006 ) CS 25.820 Created ( NPA 02/2006 ) CS 25.851 Amended ( NPA 02/2006 ) AMC 25.851(b) Created ( NPA 02/2006 ) Subpart F AMC 25.1309 (4) Corrected CS 25.1329 Replaced entirely ( NPA 18/2006 ) AMC 25.1329 Replaced by AMC Nos 1 and 2 to CS 25.1329 AMC No. 1 to CS 25.1329 Created ( NPA 18/2006 ) AMC No. 2 to CS 25.1329 Created ( NPA 1 8/2006 ) CS 25.1335 Deleted ( NPA 18/2006 ) CS 25.1439 Amended ( NPA 02/2006 ) AMC 25.1439(b)(5) Deleted ( NPA 02/2006 ) CS 25.1453 Amended ( NPA 02/2006 ) AMC 25.1453 Deleted ( NPA 02/2006 ) Powered by EASA eRules Page 52 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) Appendix F Part II paragraph (f)4 Corrected ( NPA 18/2006 ) ED Decision 2007 /010 /R CS - 25 Amendment 3 The following is a list of paragraphs affected by this amendment: Subpart B CS 25.21 Amend ed ( NPA 16/2004 ) AMC 25.21(g) Created ( NPA 16/2004 ) CS 25.103(b)(3) Amended ( NPA 16/2004 ) CS 25.105(a) Amended ( NPA 16/2004 ) CS 25.107(c)(3) Amended ( NPA 16/2004 ) CS 25.107 Amended ( NPA 16/2004 ) CS 25 .111 Amended ( NPA 16/2004 ) CS 25.119 Amended ( NPA 16/2004 ) AMC 25.119(a) Amended and redesignated as AMC 25.119 ( NPA 16/2004 ) CS 25.121 Amended ( NPA 16/2004 ) AMC 2 5.121(b)(1) Redesignated as AMC 25.121(b)( 1) (i) ( NPA 16/2004 ) CS 25.123 Amended ( NPA 16/2004 ) AMC 25.125(a)(3) Re designated as AMC 25.125(b)(3) ( NPA 16/2004 ) AMC 25.125(b) Redesignated as AMC 25.125(c) ( NPA 16/2004 ) AMC 25.125(b)(2) Amended and redesignated as AMC 25.125(c)(2)( NPA 16/2004 ) CS 25.125 Amended ( NPA 16/2004 ) CS 25.143 Amended ( NPA 16/2004 ) AMC 25.143(c) Amended and redesignated as AMC 25.143(d) ( NPA 16/2004 ) AMC No.1 to 25.143(f) Redesignated as AMC No.1 to 25.143(g) ( NPA 16/2004 ) AMC No.2 to 25.143(f) Amended and redesignated as AMC No.2 to 25.143(g) ( NPA 16/2004 ) AMC 25.143(g) Amended and redesignated as AMC 25.143(h) ( NPA 16/2004 ) CS 25.207(b) Amended ( NPA 16/2004 ) CS 25.237(a) Amended ( NPA 16/2004 ) CS 25.253 Amended ( NPA 16/2004 ) Subpart C CS 25.405(b) Formula corrected Subpart D CS 25.721 Amended ( NPA 21/2005 ) CS 25.773(b)(1)(ii) Amended ( NPA 16/2004 ) CS 25.811(g) Amended ( NPA 04/2006 ) CS 25.812 Amended ( NPA 04/2006 ) AMC 25.812(b)(1) Created ( NPA 04/2006 ) AMC 25.812(b)(2) Created ( NPA 04/2006 ) AMC 25.812(e)(2) Created ( NPA 04/2006 ) CS 25.855(c) Amended ( NPA 04/2006 ) CS 25.857(d) Deleted ( NPA 04/2006 ) CS 25.858 Amended ( NPA 04/2006 ) Powered by EASA eRules Page 53 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) Subpart E CS 25.901(b)(1)(ii) Corrected CS 25.905 Corrected CS 25.907 Corrected CS 25.941(c) Amended ( NPA 16/2004 ) CS 25.963 Amended ( NPA 21/2005 ) AMC 2 5.963(d) Replaced ( NPA 21/2005 ) AMC 25.963(e) Created ( NPA 21/2005 ) AMC 25.963(g) Revoked ( NPA 21/2005 ) CS 25.994 Amended ( NPA 21/2005 ) Subpa rt F CS 25.1302 Created ( NPA 15/2004 ) AMC 25.1302 Created ( NPA 15/2004 ) AMC 25.1329 Cross - references amended ( NPA 16/2004 ) AMC 25.1360(a) Title corrected AMC 25.1360(b) Title corrected CS 25.1419 Amended ( NPA 16/2004 ) Subpart J CS 25J994 Amended ( NPA 21/2005 ) Appendices Appendix C Introduction of Part I Title ( NPA 16/2004 ) Part I paragraph (c) Created ( NPA 16/2004 ) Part II Created ( NPA 16/2004 ) ED Decision 2006/005/R CS - 25 Amendment 2 The following is a list of paragraphs affected by this amendment: Subpart A AMC 25 - 11 Amended AMC 25 - 13 Title corrected AMC 25 - 19 Amended Subpart B CS 25.101 Amended Subpart C AMC 25. 335 (b)(2) Amended CS 25.399 Amended A MC 25.415 Title corrected A MC 25.491 Title corrected A MC 25.571 (a),(b) and (e) Amended Subpart D AMC 25.703 Amended AMC 25.723 Title corrected CS 25.735 Amended AMC 25.735 Amended CS 25.745 Amended Powered by EASA eRules Page 54 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) A MC 25. 785 (d) Amended Subpart F CS 25.1301(c) Amended AMC 25.1309 Amended AMC 25.1322 Amended CS 25.1365(a) Amended CS 25.1423 Amended CS 25.1435(b)(2) Amended AMC 25.1435 Amended AMC 25.14 57 Amended Subpart G AMC 25.1581 Appx 1 Amended AMC 25.158 3 (k) Amended ( NPA 14/2004 ) CS 25.1591 Replace entirely ( NPA 14/20 04 ) AMC 25.1591 Created ( NPA 14/2004 ) Appendices Appendix F , Part II Amended Appendix J Amended ED Decision 20 05/ 006/R CS - 25 Amendment 1 The following is a list of paragraphs affected by this amendment: Subpart B CS 25.251 (a) and (b) Amended ( NPA 11/2004 ) Subpart C CS 25.301(b) Amended ( NPA 02/2005 ) AMC 25.301(b) Amended (s ub - paragraph (b) deleted ) and renumber ed as AMC No 1 to CS 25.301(b) ( NPA 02/2005 ) AMC No.2 to CS 25.301(b) Created ( NPA 02/2005 ) CS 25.302 Created ( NPA 11/2004 ) CS 25 .305 Amended by adding sub - paragraphs (e) and (f) (( NPA 11/2004 )) CS 25.307 Amended ( NPA 11/2004 ) AMC 25.307 Replaced ( NPA 11/2004 ) CS 25.341 Amended ( NPA 11/2004 ) AMC 25.341 Amended ( NPA 11/2004 ) CS 25.343(b)(1)(ii) Amended ( NPA 11/2004 ) CS 25.345(c)(2) Amended ( NPA 11/2004 ) CS 25.371 Amended ( NPA 11/2004 ) CS 25.373 (a) Amended ( NPA 11/2004 ) CS 25.391 Amended ( NPA 11/2004 ) CS 25.427 Amended by adding sub - paragraph (d) ( NPA 11/2004 ) Subpart D CS 25.613 Amended ( NPA 11/2004 ) AMC 25.613 Created ( NPA 11/2004 ) CS 2 5.621 Replaced ( NPA 08/2004 ) Powered by EASA eRules Page 55 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes Preamble (CS - 25) AMC 25.621 Created ( NPA 08/2004 ) AMC 25.621(c) Created ( NPA 08/2004 ) AMC 25.621(c)(1) Created ( NPA 08/2004 ) CS 25.629 Amended ( NPA 11/2004 ) AMC 25.629 Created ( NPA 11/2004 ) Subpart E CS 25.901(c) Amended ( NPA 13/2004 ) AMC 25.901(c) Created ( NPA 13/2004 ) CS 25.933 (a)(1) Amended ( NPA 13/2004 ) AMC 25.933 (a)(1) Created ( NPA 13/2004 ) CS 25.981 Replaced ( NPA 10/2004 ) AMC 25.981(a) Created ( NPA 10/2004 ) AMC 25.981(c) Created ( NPA 10/2004 ) CS 25.1141 (f) Amended ( NPA 13/2004 ) CS 25.1189 Amended ( NPA 13/2004 ) AMC 25.1189 Created ( NPA 13/2004 ) Subpart F CS 25.1436(b)(7) Amended to refer to Appendix K ( NPA 11/2004 ) Subpart G CS 25.1517 Amended ( NPA 11/ 2004 ) CS 25.1522 Deleted ( NPA 10/2004 ) CS 25.1583(b)(1) Amended by removing reference to CS 25.1522 ( NPA 10/2004 ) Subpart J Subpart J Replaced entirely ( NPA 10/2004 ) Existing AMC to subpart J Deleted entirely ( NPA 10/2004 ) AMC 25J901(c)(2) Created ( NPA 10/2004 ) AMC 25J901(c)(4) Created ( NPA 10/2004 ) AMC 25J943 Created ( NPA 10/2004 ) AMC 25J955(a)(2)(iii) Created ( NPA 10/2004 ) AMC 25J991 Created ( NPA 10/2004 ) AMC 25J1041 Created ( NPA 10/2004 ) AMC 25J1093(b) Created ( NPA 10/2004 ) CS 25J1189 Amended by adding reference to AMC 25.1189 ( NPA 13/2004 ) AMC 25J1195(b) Created ( NPA 10/2004 ) Appendices Appendix K Replaced entirely ( NPA 11/2004 ) Appendix L Old Appendix K renumbered ( NPA 11/2004 ) Powered by EASA eRules Page 56 of 1495 | Jan 2023

Next: SUBPART A – GENERAL →

SUBPART A – GENERAL

Easy Access Rules for Large Aeroplanes SUBPART A – GENERAL (CS - 25) GENERAL

SUBPART A – GENERAL

CS 25.1 Applicability

ED Decision 2011 / 004 /R (a) These Certification Specifications are applicable to turbine powered Large Aeroplanes.

[Amdt 25/11] Powered by EASA eRules Page 57 of 1495 | Jan 2023

Next: SUBPART B – FLIGHT →

SUBPART B – FLIGHT

Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

SUBPART B – FLIGHT

GENERAL

CS 25.20 Scope

ED Decision 2003/ 2/RM (a) The requirements of thi s Subpart B apply to aeroplanes powered with turbine engines – (1) Without contingency thrust ratings, and (2) For which it is assumed that thrust is not increased following engine failure during take - off except as specified in sub - paragraph (c).

(b) In the absence of an appropriate investigation of operational implications these requirements do not necessarily cover – (1) Automatic landings.

(2) Approaches and landings with decision heights of less than 60 m (200 ft).

(3) Operations on unprepared runway surfaces.

(c) If the aeroplane is equipped with an engine control system that automatically resets the power or thrust on the operating engine(s) when any engine fails during take - off, additional requirements pertaining to aeroplane performance and limitat ions and the functioning and reliability of the system, contained in Appendix I , must be complied with.

CS 25.21 Proof of compliance

ED Decision 2016 / 010 /R (a) Each requirement of this Subpart must be met at each appropriate combination of weight and centre of gravity within the range of loading conditions for which certification is requested. This must be shown – (1) By tests upon an aeroplane of the type for which certification is requested, or by calculatio ns based on, and equal in accuracy to, the results of testing; and (2) By systematic investigation of each probable combination of weight and centre of gravity, if compliance cannot be reasonably inferred from combinations investigated.

(b) Reserved (c) Th e controllability, stability, trim, and stalling characteristics of the aeroplane must be shown for each altitude up to the maximum expected in operation.

(d) Parameters critical for the test being conducted, such as weight, loading (centre of gravity and inertia), airspeed, power, and wind, must be maintained within acceptable tolerances of the critical values during flight testing. (See AMC 25.21(d) ) (e) If compliance with the flight characteristics requirements i s dependent upon a stability augmentation system or upon any other automatic or power - operated system, compliance must be shown with CS 25.671 and 25.672 .

Powered by EASA eRules Page 58 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL (f ) In meeting th e requirements of CS 25.105(d) , 25.125 , 25.233 and 25.237 , the wind velocity must be measured at a height of 10 metres above the surface, or corrected for the difference between the height at which the wind velocity is measured and the 10 - metre height.

(g) The requirements of this subpart associated with icing conditions apply only if the applicant is seeking certification for flight in icing conditions. (See AMC 25.21(g) ) (1) Each requirement of this subpart, except CS 25.121(a) , 25.123(c) , 25.143(b)(1) and (b)(2) , 25.149 , 25.201(c)(2) , and 25.251(b) t hrough (e) , must be met in the icing conditions specified in Appendix C . CS 25.207(c) and (d) must be met in the landing configuration in the icing conditions specified in Appendix C but need not b e met for other configurations.

Compliance must be shown using the ice accretions defined in part II of Appendix C , assuming normal operation of the aeroplane and its ice protection system in accordance with the operating limitations and operating procedures established by the applicant and provided in the Aeroplane Flight Manual.

(2) If the applicant does not seek certification for flight in all icing conditions defined in Appendix O , each requirement of this subpart, except CS 25.105 , 25.107 , 25.109 , 25.111 , 25.113 , 25.115 , 25.121 , 25.123 , 25.143(b)(1), (b)(2), and (c)(1) , 25.149 , 25.201(c)(2) , 25.207(c), (d) and (e)(1) , and 25.251(b) through (e) , must be met in the Appendix O icing conditions for which certification is not sought in order to allow a safe exit from those conditions. Compliance must be shown using the iceaccretions defined in part II , paragraphs (b) and (d) of Appendix O, assuming normal operation of the aeroplane and its ice protection syste m in accordance with the operating limitations and operating procedures established by the applicant and provided in the Aeroplane Flight Manual. If applicable, a comparative analysis (refer to CS 25.1420 ) may be u sed to show compliance as an alternative to using the ice accretions defined in part II , paragraphs (b) and (d) of Appendix O.

(3) If the applicant seeks certification for flight in any portion of the icing conditi ons of Appendix O, each requirement of this subpart, except paragraphs CS 25.121(a) , 25.123(c) , 25.143(b)(1) and (b)(2) , 25.149 , 25.201(c)(2) , and 25.251(b) through (e) , must be met in the Appendix O icing conditions for which certification is sought. CS 25.207(c) and (d) must be met in the landing configuration in the icing conditions specified in Appendix O for which certification is sought but need not be met for other configurations. Compliance must be shown using the ice accretions defined in part II, paragraphs (c) and (d) of Appendix O , assuming normal operation of the aeroplane and its ice protection system in accordance wi th the operating limitations and operating procedures established by the applicant and provided in the Aeroplane Flight Manual . If applicable, a comparative analysis (refer to CS 25.1420) may be used to show compliance as an alternative to using the ice ac cretions defined in part II , paragraphs (c) and (d) of Appendix O.

(4) No changes in the load distribution limits of CS 25.23 , the weight limits of CS 25.25 (except where limited by performance requirements of this subpart), and the centre of gravity limits of CS 25.27 , from those for non - icing conditions, are allowed for flight in icing cond itions or with ice accretion.

[Amdt 25/3] [Amdt 25/6] [Amdt 25/16] [Amdt 25/17] [Amdt 25/18] Powered by EASA eRules Page 59 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

A MC 25.21(d) Proof of c ompliance

ED Decision 2003/ 2/RM 1 Where variation of the parameter on which a tolerance is permitted will have an appreciable effect on the test, the result should be corrected to the specified value of the parameter; otherwise no correction is necessary.

2 In areas of critical handling or stability, notwithstanding the tolerance of CS 25.21(d) (7% total travel), aft centre of gravity tests should be flown at a centre of gravity not more forward than the certificate aft centre of gravity limit. Tests which are critical on the forward centre of gravity limit should be flown at centres of gravity at l east as forward as the certificate forward limit.

AMC 25.21(g) Performance and handling characteristics in icing

c ondit ions

ED Decision 201 8 / 005 /R Table of Contents Para. Title 1 Purpose 2 Related Requirements 3 Reserved 4 Requirements and Guidance 4.1 General 4.2 Proof of Compliance (CS 25.21(g)) 4.3 Propeller Speed and Pitch Limits (CS 25.33) 4.4 Performance - General (CS 25.101) 4.5 Stall Speed (CS 25.103) 4.6 Failure Conditions (CS 25.1309) 4.7 Flight - related Systems 4.8 Aeroplane Flight Manual (CS 25.1581) 5 Acceptable Means of Compliance - General 5.1 General 5.2 Flight Testing 5.3 Wind Tunnel Testing and Analysis 5.4 Engineering Simulator Testing and Analysis 5.5 Engineering Analysis 5.6 Ancestor Aeroplane Analysis 6 Acceptable Means of Compliance - Flight Test Programme 6.1 General 6.2 Stall Speed (CS 25.103) 6.3 Accelerate - stop Distance (CS 25.109) 6.4 Take - off Path (CS 25.111) 6.5 Landing Climb: All - engines - operating (CS 25.119) 6.6 Climb: One - engine - inoperative (CS 25.121) 6.7 En - rout e Flight Path (CS 25.123) 6.8 Landing (CS 25.125) 6.9 Controllability and Manoeuvrability - General (CS 25.143) 6.10 Longitudinal Control (CS 25.145) 6.11 Directional and Lateral Control (CS 25.147) 6.12 Trim (CS 25.161) 6.13 Stability - General (CS 25.171 ) 6.14 Demonstration of Static Longitudinal Stability (CS 25.175) 6.15 Static Directional and Lateral Stability (CS 25.177) Powered by EASA eRules Page 60 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 6.16 Dynamic Stability (CS 25.181) 6.17 Stall Demonstration (CS 25.201) 6.18 Stall Warning (CS 25.207) 6.19 Wind Velocities (CS 25.2 37) 6.20 Vibration and Buffeting (CS 25.251) 6.21 Natural Icing Conditions 6.22 Failure Conditions (CS 25.1309) A1 Appendix 1 - Airframe Ice Accretion A1.1 General A1.2 Operative Ice Protection System A1.3 Ice Protection System Failure Cases A1.4 Additional guidance for Appendix O ice accretions A2 https://dxweb.easa.europa.eu/dx4/Topics/Cloned - 908a3904 - 6301 - 4e9d - a841 - 79c1efdc07c0.docx - Artificial Ice Shapes A2.1 General A2.2 Shape and Texture of Artificial Ice A2.3 "Sandpaper Ice" A3 Appendix 3 - Design Features A3.1 Aeroplane Configuration and Ancestry A3.2 Wing A3.3 Empennage A3.4 Aerodynamic Balancing of Flight Control Surfaces A3.5 Ice Protection/Detection System A4 Appendix 4 - Examples of Aeroplane Flight Manual Limitations and Operating P rocedures for Operations in Supercooled Large Drop Icing Conditions A5 Appendix 5 - Related Acceptable Means of Compliance (AMC) and FAA Advisory Circulars (AC) A6 Appendix 6 - Acronyms and definitions 1 Purpose .

1.1 This AMC describes an acceptable me ans for showing compliance with the requirements related to performance and handling characteristics of Large Aeropla nes as affected by flight in icing conditions . The means of compliance described in this AMC is intended to provide guidance to supplement the engineering and operational judgement that should form the basis of any compliance findings relative to handling characteristics and performance in Appendix C and Appendix O icing conditions.

1.2 The guidance information is presented in sections 4 to 6 and three appendices.

1.3 Section 4 explains the various performance and handling requirements in relation to the flight condi tions that are relevant for determining the shape and texture of ice accretions for the aeroplane in the atmospheric icing conditions of CS - 25, Appendix C and Appendix O.

1.4 Section 5 describes acceptable methods and procedures that an applicant may use to show that an aerop lane meets these requirements. Depending on the design features of a specific aeroplane as discussed in Append ix 3 of this AMC, its similarity to other types or models, and the service history of those types or models, some judgement will often be necessary for determining that any particular method or procedure is adequate for showing compliance with a particular requirement. AMC 25.1420(f) provides guidance for comparative analysis as an acceptable means of compliance to meet these requirements.

1.5 Section 6 provides an acceptable flight test programme where flight testing is selected by the applicant and agreed by the Agency as being the primary means of compliance.

Powered by EASA eRules Page 61 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 1.6 The three appendices provide additional reference material associated with ice accretion, artificial ice shapes, and aeroplane design features.

2 Related Requirements . The following paragraphs of CS - 25 are related to the guidance in this AMC: — CS 25.21 (Proof of compliance) — CS 25.103 (Stall speed) — CS 25.105 (Take - off) — CS 25.107 (Take - off speeds) — CS 25.111 (Take - off path) — CS 25.119 (Landing climb) — CS 25.121 (Climb: One - engine - inoperative) — CS 25.123 (En - route flight paths) — CS 25.125 (Landing) — CS 25.143 (Controllability and Manoeuvrability - General) — CS 25.207 (Stall warning) — CS 25.237 (Wind velocities) — CS 25.253 (High - speed characteristics) — CS 25.1309 (Equipment, systems, and installations) — CS 25.1419 (Ice protection) — CS 25.1420 (Supercooled large drop icing conditions) — CS 25.1581 (Aeroplane Flight Manual) — CS - 25, Appendix C — CS 25, Appendix O 3 Reserved .

4 Requirements and Guidance .

4.1 General. This sec tion provides guidance for showing compliance with Subpart B requirements for flight in the icing conditions of Appendix C a nd Appendix O to CS - 25.

4.1.1 Operating rules fo r commercial operation of large aeroplanes (e.g. Part - CAT , CAT.OP.MPA.250 ) require that the aeroplane is free of any significant ice contamination at the beginning of the take - off roll due to application of appropriate ice removal and ice protection proce dures during flight preparation on the ground.

4.1.2 For certification for flight in the icing conditions described in Appendix C of CS - 25, CS 25.21(g)(1) requires that an aeroplane meet certain performance and handling qualities requirements while operating in the icing environment defined in Appendix C. In addition, CS 25.1420 requires applicants to consider icing conditions beyond those covered by Appendix C. The additional icing conditions that must be considered are the supercooled large drop icing conditions defined in Appendix O .

CS 25.21(g)(2) and (3) respectively provide the performance and handling qualities Powered by EASA eRules Page 62 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL requirements to be met by applicants not seeking certification in the icing conditions of Appendix O and by applican ts seeking certification in any portion of the icing conditions of Appendix O . Appendix 1 of this AMC provides detailed guidance for determining ice accretions in both Appe ndix C and Appendix O icing conditions that can be used for showing compliance.

CS 25.1420 requires applicants to choose to do one of the following: (a) Not seek approval for flight in the supercooled large drop atmospheric icing conditions defined in Appendix O .

(b) Seek approval for flight in only a portion of Appendix O icing conditions.

(c) Seek approval for flight throughout the entire Appendix O atmospheric icing envelope.

4.1.3 Because an aeroplane may encounter supercooled large drop icing conditions at any time while flying in icing conditions, certain safety requirements must be met for the supercooled large drop icing conditions of Appendix O , even if the aeroplane will not be certified for flight in the complete range of Appendix O atmospheric icing conditions. CS 25.21(g)(2) requires the stall speed ( CS 25.103 ), landing climb ( CS 25.119 ), and landing ( CS 25.125 ) requirements to be met in supercooled large drop atmospheric icing conditions beyond those the aeroplane will be certified for. Compliance with these requirements plus the requirements for flight in Appendix C icing conditions are intended to provide adequate performance capability for a safe exit from all icing conditions after an encounter with sup ercooled large drop atmospheric icing conditions beyond those the aeroplane is certified for.

4.1.4 If the aeroplane is not to be certified for flight in all of the supercooled large drop icing conditions of Append ix O , there must be a means of indicating when the aeroplane has encountered icing conditions beyond those it is certified for. See AMC 25.1420 for guidance on acceptable means of detecting and indicating when the aeroplane has encountered icing conditions beyond those it is certified for. The applicant should provide procedures in the aeroplane flight manual to enable a safe exit from all icing conditions after an encounter with icing conditions beyond those the aeroplane is certified for.

4.1.5 To certify an aeroplane for operations in Appendix O icing conditions only for certain flight phase(s), the applicant should define the flight phase(s) for which approval is sought in a way that will allow a flight crew to e asily determine whether the aeroplane is operating inside or outside its certified icing envelope. The critical ice accretion or accretions used to show compliance with the applicable requirements should cover the range of aeroplane configurations, operati ng speeds, angles - of - attack, and engine thrust or power settings that may be encountered during that phase of flight (not just at the conditions specified in the CS - 25 subpart B requirements). For the ice accretion scenarios defined in paragraph A1.4.3(c) of Appendix 1 to this AMC, the applicable flight phases are take - off (including the ground roll, take - off, and final take - off segments), en route, holding, and approach/landing (including both the approach and land ing segments).

Powered by EASA eRules Page 63 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 4.1.6 Ice accretions used to show compliance with the applicable CS - 25 subpart B regulations should be consistent with the extent of the desired certification for flight in icing conditions. Appendices C and O define the ice accretions, as a function of flight phase, that must be considered for certification for flight in those icing conditions. Any of the applicable ice accretions (or a composite accretion representing a combination of accretions) may be used to show compliance with a part icular subpart B requirement if it is either the ice accretion identified in the requirement or one shown to be more conservative than that. In addition, the ice accretion with the most adverse effect on handling characteristics may be used for compliance with the aeroplane performance requirements if each difference in performance is conservatively taken into account. Ice accretion(s) used to show compliance should take into account the speeds, configurations (including configuration changes), angles of at tack, power or thrust settings, etc. for the flight phases and icing conditions they are intended to cover. For example, if the applicant desires certification for flight in the supercooled large drop icing conditions of Appendix O in addition to those of Appendix C, compliance with the applicable subpart B requirements may be shown using the most critical of the Appendix C and Appendix O ice accretions.

4.1. 7 Certification experience has shown that it is not necessary to consider ice accumulation on the propeller, induction system or engine components of an inoperative engine for handling qualities substantiation. Similarly, the mass of the ice need not normally be considered.

4.1.8 Flight in icing conditions includes operation of the aeroplane after leaving the icing conditions, but with ice accretion remaining on the critical surfaces of the aeroplane.

4.1.9 Ice - contaminated tailplane stall (ICTS) refers to a phenomenon identified as a causal factor in several aeroplane incidents and accidents. It results from airflow separation on the lower surface of the tailplane because ice is present . ICTS can occur if the angle - of - attack of the horizontal tailplane exceeds its stall angle - of - attack. Even very small quantities of ice on the tailplane leading edge can significantly reduce the angle - of - attack at which the tailplane stalls. An increase i n tailplane angle - of - attack, which may lead to a tailplane stall, can result from changes in aeroplane configuration (for example, extending flaps, which increases the downwash angle at the tail or the pitch trim required) or flight conditions (a high appr oach speed, gusts, or manoeuvring, for example). An ICTS is characterized by reduction or loss of pitch control or pitch stability while in, or soon after leaving, icing conditions. A flight test procedure for determining susceptibility to ICTS is presente d in paragraph 6.9.4, Low g Manoeuvres and Sideslips, of this AMC.

(a) For aeroplanes with unpowered longitudinal control systems, the pressure differential between the upper and lower surfaces of the stalled tailplane may result in a high elevator hinge m oment, forcing the elevator trailing edge down. This elevator hinge moment reversal can be of sufficient magnitude to cause the longitudinal control (for example, the control column) to suddenly move forward with a force beyond the capability of the flight crew to overcome. On some aeroplanes, ICTS has been caused by a lateral flow component coming off the vertical stabilizer, as may occur in sideslip conditions or because of a wind gust with a lateral component.

Powered by EASA eRules Page 64 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL (b) Aerodynamic effects of reduced tailplane lift should be considered for all aeroplanes, including those with powered controls. Aeroplanes susceptible to this phenomenon are those having a near zero or negative tailplane stall margin with tailplane ice contamination.

4.1.10 There have been aeropl ane controllability incidents in icing conditions as a result of ice on unprotected leading edges of extended trailing edge flaps or flap vanes.

The primary safety concern illustrated by these incidents is the potential for controllability problems due to the accretion of ice on trailing edge flap or flap vane leading edges while extending flaps in icing conditions. The flight tests specified in Table 4 of this AMC, in which handling characteristics are tested at each flap position while ice is being accret ed in natural icing conditions, are intended to investigate this safety concern. Unless controllability concerns arise from these tests, it is not necessary to conduct flight tests with artificial ice shapes on the extended trailing edge flap or flap vanes or to include extended trailing edge flap or flap vane ice accretions when evaluating aeroplane performance with flaps extended.

4.1.11 Supercooled large drop icing conditions, or runback ice in any icing condition, can cause a ridge of ice to form aft of the protected area on the upper surface of the wing. This can lead to separated airflow over the aileron. Ice - induced airflow separation upstream of the aileron can have a significant effect on aileron hinge moment. Depending on the extent of the separa ted flow and the design of the flight control system, ice accretion upstream of the aileron may lead to aileron hinge moment reversal, reduced aileron effectiveness, and aileron control reversal. Although aeroplanes with de - icing boots and unpowered ailero n controls are most susceptible to this problem, all aeroplanes should be evaluated for roll control capability in icing conditions. Acceptable flight test procedures for checking roll control capability are presented in paragraphs 6.9.3, 6.15, and 6.17.2. e of this AMC and consist of bank - to - bank roll manoeuvres, steady heading sideslips, and rolling manoeuvres at stall warning speed.

4.1.12 Appendix 5 contains related Acceptable Means of Compliance and FAA Advisory Circulars. Appendix 6 contains acronyms and definitions used in this AMC.

4.2 Proof of Compliance ( CS 25.21(g) ).

4.2.1 Demonstration of compliance with certification requirements for flight in icing conditions may be accomplished by any of the means discussed in paragraph 5.1 of this AMC.

4.2.2 Certification experience has shown that aeroplanes of conventional design do not require additional detailed substantiation of compliance with the requirements of the following paragraphs of CS - 25 for flight in icing conditions or with ice accretions: 25.2 3, Load distribution limits 25.25, Weight limits 25.27, Centre of gravity limits 25.29, Empty weight and corresponding centre of gravity 25.31, Removable ballast 25.231, Longitudinal stability and control Powered by EASA eRules Page 65 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 25.233, Directional stability and control 25.235, Taxiing condition 25.253(a) and (b), High - speed characteristics, and 25.255, Out - of - trim characteristics 4.2.3 Where normal operation of the ice protection system results in changing the stall warning system and/or stall identification system activ ation settings, it is acceptable to establish a procedure to return to the non icing settings when it can be demonstrated that the critical wing surfaces are free of ice accretion.

4.3 Propeller Speed and Pitch Limits ( CS 25.33 ). Certification experience has shown that it may be necessary to impose additional propeller speed limits for operations in icing conditions.

4.4 Performance - General ( CS 25.101 ).

4.4.1 The propulsive power or thrust available for each flight condition must be appropriate to the aeroplane operating limitations and normal procedures for flight in icing condit ions. In general, it is acceptable to determine the propulsive power or thrust available by suitable analysis, substantiated when required by appropriate flight tests (e.g. when determining the power or thrust available after 8 seconds for CS 25.119 ). The following aspects should be considered: a. Operation of induction system ice protection.

b. Operation of propeller ice protection.

c. Operation of engine ice protection.

d. Operation of airframe ice protection system.

4.4.2 The following should be considered when determining the change in performance due to flight in icing conditions: a. Thrust loss due to ice accretion on propulsion system components with normal operation of the ice protection system, including engine induction system and /or engine components, and propeller spinner and blades.

b. The incremental airframe drag due to ice accretion with normal operation of the ice protection system.

c. Changes in operating speeds due to flight in icing conditions.

4.4.3 Certification experie nce has shown that any increment in drag (or decrement in thrust) due to the effects of ice accumulation on the landing gear, propeller, induction system and engine components may be determined by a suitable analysis or by flight test.

4.4.4 Apart from th e use of appropriate speed adjustments to account for operation in icing conditions, any changes in the procedures established for take - off, balked landing, and missed approaches should be agreed with the Agency .

4.4.5 Performance associated with flight i n icing conditions is applicable after exiting icing conditions until the aeroplane critical surfaces are free of ice accretion and the ice protection systems are selected “Off.” Powered by EASA eRules Page 66 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 4.4.6 Certification experience has also shown that runback ice may be criti cal for propellers, and propeller analyses do not always account for it. Therefore, runback ice on the propeller should be addressed . Research has shown that ice accretions on propellers, and resulting thrust decrement, may be larger in Appendix O (supercooled large drop) icing conditions than in Appendix C icing conditions for some designs. This may be accomplished through aeroplane performance checks in natural icing condi tions , icing tanker tests, icing wind tunnel tests, aerodynamic analysis, or the use of an assumed (conservative) loss in propeller efficiency.

Testing should include a range of outside air temperatures, including warmer (near freezing) temperatures that c ould result in runback icing. For the Appendix O icing conditions, the applicant may use a comparative analysis. AMC 25.1420(f) provides guidance for comparative analysis.

4.5 Stall speed ( CS 25.103 ). Certification experience has shown that for aeroplanes of conventional design it is not necessary to make a separate determination of the effects of Mach number on stall speeds for the aeroplane with ice accretions.

4.6 Failure Conditions ( CS 25.1309 ).

4.6.1 The failure modes of the ice protection system and the resulting effects on aeroplane handling and performance should be analysed in accordance wit h CS 25.1309 . In determining the probability of a failure condition, it should be assumed that the probability of entering icing conditions defined in CS - 25 Appendix C is one. As explained in AMC 25.1420, on an annual basis, t he average probability of encountering the icing conditions defined in Appendix O may be assumed to be 1 × 10 per flight hour. This probability should not be reduced on a - 2 phase - of - flight basis. The "Failure Ice" configuration is defined in Appendix 1 , paragraph A1.3.

4.6.2 For probable failure conditions that are not annunciated to the flight crew, the guidance in this AMC for a normal condition is applicable with the "Fai lure Ice" configuration.

4.6.3 For probable failure conditions that are annunciated to the flight crew, with an associated procedure that does not require the aeroplane to exit icing conditions, the guidance in this AMC for a normal condition is applicable with the "Failure Ice" configuration.

4.6.4 For probable failure conditions that are annunciated to the flight crew, with an associated operating procedure that requires the aeroplane to leave the icing conditions as soon as possible , it should be shown that the aeroplane’s resulting performance and handling characteristics with the failure ice accretion are commensurate with the hazard level as determined by a system safety analysis in accordance with CS 25.1309 . The operating procedures and related speeds may restrict the aeroplane’s operating envelope, but the size of the restricted envelope should be consistent with the safety analysis.

4.6.5 For failure conditions that are extremely remote but not ext remely improbable, the analysis and substantiation of continued safe flight and landing, in accordance with CS 25.1309 , should take into consideration whether annunciation of the failure is provided and the associa ted operating procedures and speeds to be used following the failure condition.

Powered by EASA eRules Page 67 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 4.7 Flight - related Systems. In general, systems aspects are covered by the applicable systems and equipment requirements in other subparts of CS - 25, and associated guidance material. However, certification experience has shown that other flight related systems aspects should be considered when determining compliance with the flight requirements of subpart B. For example, the following aspects may be relevant: a. Th e ice protection systems may not anti - ice or de - ice properly at all power or thrust settings. This may result in a minimum power or thrust setting for operation in icing conditions which affects descent and/or approach capability. The effect of power or th rust setting should also be considered in determining the applicable ice accretions. For example, a thermal bleed air system may be running wet resulting in the potential for runback ice.

b. Ice blockage of control surface gaps and/or freezing of seals cau sing increased control forces, control restrictions or blockage.

c. Airspeed, altitude and/or angle of attack sensing errors due to ice accretion forward of the sensors (e.g. radome ice). Dynamic pressure ("q") operated feel systems using separate sensors also may be affected.

d. Ice blockage of unprotected inlets and vents that may affect the propulsive thrust available, aerodynamic drag, powerplant control, or flight control.

e. Operation of stall warning and stall identification reset features for flight in icing conditions, including the effects of failure to operate.

f. Operation of icing condition sensors, ice accretion sensors, and automatic or manual activation of ice protection systems.

g. Flight guidance and a utomatic flight control systems operati on. See AMC No. 1 and 2 to 25.1329 for guidance on compliance with CS 25.1329 for flight in icing conditions, including stall and manoeuvrability evaluations with the aeroplane under flight guidance system control.

h. Installed thrust. This includes operation of ice protection systems when establishing acceptable power or thrust setting procedures, control, stability, lapse rates, rotor speed margins, temperature margins, Automatic Take - Off Thrust Control System (AT TCS) operation, and power or thrust lever angle functions.

4.8 Aeroplane Flight Manual ( CS 25.1581 ).

4.8.1 Limitations.

4.8.1.1 Where limitations are required to ensure safe operation in icing conditions, these lim itations should be stated in the AFM.

4.8.1.2 The Limitations section of the AFM should include, as applicable, a statement similar to the following: “In icing conditions the aeroplane must be operated, and its ice protection systems used, as described in the operating procedures section of this manual. Where specific operational speeds and performance information have been established for such conditions, this information must be used."

4.8.1.3 For aeroplanes without leading edge high - lift devices, unless an acceptable means exists to ensure that the protected surfaces of the wing leading edges are free of ice contamination immediately prior to take - off, the wing ice protection system should be operative and efficient before take - off (at least Powered by EASA eRules Page 68 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL during the fi nal taxi phase) whenever the outside ai r temperature is below 6° C (42 ° F) and any of the following applies: — Visible moisture is present in the air or on the wing, — The difference between the dew point temperature and the outside air temperature is less tha n 3° C (5 °F), or — Standing water, slush, ice, or snow is present on taxiways or runways.

An acceptable means to ensure that the wing leading edges are free of ice contamination immediately prior to take - off would be the application of anti - icing fluid wit h adequate hold over time and compliant with SAE AMS 1428, Types II, III, or IV.

Note: The aircraft must be de - iced in compliance with applicable operational rules.

4.8.1.4 To comply with CS 25.1583(e) , Kinds of operation, the AFM Limitations section should clearly identify the extent of each approval to operate in icing conditions, including the extent of any approval to operate in the supercooled large drop atmospheric icing conditions defined in CS - 2 5 Appendix O .

4.8.1.5 For aeroplanes not certified to operate throughout the atmospheric icing envelope of CS - 25 Appendix O for every flight phase, the Limitations section of the AFM should also identify the means for detecting when the certified icing conditions have been exceeded and state that intentional flight, including take - off and landing, into these conditions is prohibited. A requirement to exit all icing condition s must be included if icing conditions for which the aeroplane is not certified are encountered.

4.8.2 Operating Procedures.

4.8.2.1 AFM operating procedures for flight in icing conditions should include normal operation of the aeroplane including operation of the ice protection system and operation of the aeroplane following ice protection system failures. Any changes in procedures for other aeroplane system failures that affect the capability of the aeroplane to operate in icing conditions should be included.

4.8.2.2 Normal operating procedures provided in the AFM should reflect the procedures used to certify the aeroplane for flight in icing conditions. This includes configurations, speeds, ice protection system operation, power plant and systems operation, for take - off, climb, cruise, descent, holding, go - around, and landing. For aeroplanes not certified for flight in all of the supercooled large drop atmospheric icing conditions defined in Appendix O to CS - 25, procedures should be provided for s afely exiting all icing conditions if the aeroplane encounters Appendix O icing conditions that exceed the icing conditions the aeroplane is certified for. Information to be provided in the AFM may be based on the information provided in the reference fleet AFM(s), or other operating manual(s) furnished by the TC holder, when comparative analysis is used as the means of compliance.

Powered by EASA eRules Page 69 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 4.8.2.3 For aeroplanes without leading edge high - lift devices, the AFM normal operati ng procedures section should contain a statement similar to the following: “WARNING Minute amounts of ice or other contamination on the leading edges or wing upper surfaces can result in a stall without warning, leading to loss of control on take - off.” 4.8 .2. 4 Abnormal operating procedures should include the procedures to be followed in the event of annunciated ice protection system failures and suspected unannunciated failures. Any changes to other abnormal procedures contained in the AFM, due to flight in icing conditions, should also be included.

4.8.3 Performance Information. Performance information, derived in accordance with subpart B of CS - 25, must be provided in the AFM for all relevant phases of flight.

4.8.4 Examples of AFM limitations and operatin g procedures are contained in Appendix 4 of this AMC.

5 Acceptable Means of Compliance - General .

5.1 General.

5.1.1 This section describes acceptable methods and procedures that an applicant may use to show that an aeroplane meets the performance and hand ling requirements of subpart B in the atmospheric conditions of Appendix C and Appendix O to CS - 25.

5.1.2 Compliance with CS 25.21(g) should be shown by one or more of the methods listed in this section.

5.1.3 The compliance process should address all phases of flight, including take - off, climb, cruise, holding, descent, landing, and go - around as appropriate to the aeroplane type, consi dering its typical operating regime and the extent of its certification approval for operation in the atmospheric icing conditions of Appendix O to CS - 25.

5.1.4 The design features included in Appendix 3 of this AMC should be considered when determining the extent of the substantiation programme.

5.1.5 Appropriate means for showing compliance include the actions and items listed in Table 1 below . These are explained in more detail in the following sections of this AMC.

Powered by EASA eRules Page 70 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL TABLE 1: Means for Showing Compliance Flight Testing Flight testing in dry air using artificial ice shapes or with ice shapes created in natural icing conditions.

Wind Tunnel Testing and Analysis An analysis of results from wind tunnel tests with artificial or actual ice shapes.

Engineering Simulator Testing and Analysis An analysis of results from engineering simulator tests.

Engineering Analysis An analysis which may include the results from any of the other means of compliance as well as the use of engineering judgment.

Ancestor Aeroplane Analysis An analysis of results from a closely related ancestor aeroplane.

Comparative analysis for showing An analysis which substantiates that a new or derivative compliance in SLD icing conditions aeroplane model has at least the same level of safety in all supercooled liquid water icing conditions that a reference fleet has achieved.

Guidance is provided i n AMC 25.1420(f). The use of a comparative analysis is only an option for showing compliance with CS - 25 specifications relative to Appendix O icing conditions; it is not an option for showing compliance with CS - 25 specifications relative to Appendix C icin g conditions.

5.1.6 Various factors that affect ice accretion on the airframe with an operative ice protection system and with ice protection system failures are discussed in Appendix 1 of this AMC.

5.1.7 An acceptable methodology to obtain agreement on the artificial ice shapes is given in Appendix 2 of this AMC. That appendix also provides the different types of artificial ice sh apes to be considered.

5.2 Flight Testing.

5.2.1 General.

5.2.1.1 The extent of the flight test programme should consider the results obtained with the non - contaminated aeroplane and the design features of the aeroplane as discussed in Appendix 3 of this AMC.

5.2.1.2 It i s not necessary to repeat an extensive performance and flight characteristics test programme on an aeroplane with ice accretion. A suitable programme that is sufficient to demonstrate compliance with the requirements can be established from experience with aeroplanes of similar size, and from review of the ice protection system design, control system design, wing design, horizontal and vertical stabiliser design, performance characteristics, and handling characteristics of the non - cont aminated aeroplane. In particular, it is not necessary to investigate all weight and centre of gravity combinations when results from the non - contaminated aeroplane clearly indicate the most critical combination to be tested. It is not necessary to investigate the flight chara cteristics of the aeroplane at high altitude (i.e. above the highest altitudes specified in Appendix C and Appendix O to CS - 25). An acceptable flight test programme is provided in section 6 of this AMC.

Powered by EASA eRules Page 71 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 5.2.1.3 Certification experience has shown that tests are usually necessary to evaluate the consequences of ice protection system failures on handling characteristics and performance and to demonstrate cont inued safe flight and landing.

5.2.2 Flight Testing Using Approved Artificial Ice Shapes.

5.2.2.1 The performance and handling tests may be based on flight testing in dry air using artificial ice shapes that have been agreed with the Agency .

5.2.2.2 Addit ional limited flight tests are discussed in paragraph 5.2.3, below.

5.2.3 Flight Testing In Natural Icing Conditions.

5.2.3.1 Where flight testing with ice accretion obtained in natural atmospheric icing conditions is the primary means of compliance, the c onditions should be measured and recorded. The tests should ensure good coverage of CS - 25 Appendix C and Appendix O conditions (consistent with the extent of the certificat ion approval sought for operation in Appendix O icing conditions) and, in particular, the critical conditions. The conditions for accreting ice (including the icing atmosphere, configuration, speed and duration of exposure) should be agreed with the Agency .

5.2.3.2 Where flight testing with artificial ice shapes is the primary means of compliance, additional limited flight tests should be conducted with ice accretion obtained in natural icing conditions. The objective of these tests is to corroborate the ha ndling characteristics and performance results obtained in flight testing with artificial ice shapes. As such, it is not necessary to measure the atmospheric characteristics (i.e. liquid water content (LWC) and median volumetric diameter (MVD)) of the flig ht test icing conditions.

For some derivative aeroplanes with similar aerodynamic characteristics as the ancestor, it may not be necessary to carry out additional flight test in natural icing conditions if such tests have been already performed with the an cestor. Depending on the extent of the Appendix O icing conditions that certification is being sought for, and the means used for showing compliance with the performance and handling characteristics requirements, i t may also not be necessary to conduct flight tests in the natural icing conditions of Appendix O . See AMC 25.1420 for guidance on when it is necessary to conduct flight te sts in the natural atmospheric icing conditions of Appendix O .

5.3 Wind Tunnel Testing and Analysis. Analysis of the results of dry air wind tunnel testing of models with artificial ice shapes, as defined in Part II of Appendix C and Appen dix O to CS - 25, may be used to substantiate the performance and handling characteristics.

5.4 Engineering Simulator Testing and Analysis. The results of an engineering simulator analysis of an aeroplane that includes the effects of the ice accretions as de fined in Part II of Appendix C and Appendix O to CS - 25 may be used to substantiate the handling characteristics. The data used to model the effects of ice accretions for th e engineering simulator may be based on results of dry air wind tunnel tests, flight tests, computational analysis, and engineering judgement.

Powered by EASA eRules Page 72 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 5.5 Engineering Analysis. An engineering analysis that includes the effects of the ice accretions as defined in Part II of Appendix C and Appendix O to CS - 25 may be used to substantiate the performance and handling characteristics. The effects of the ice shapes used in this analysis may be determined by an analysis of the results of dry air wind tunnel tests, flight tests, computational analysis, engineering simulator analysis, and engineering judgement.

5.6 Ancestor Aeroplane Analysis.

5.6.1 To help substantiate acceptable performan ce and handling characteristics, the applicant may use an analysis of an ancestor aeroplane that includes the effect of the ice accretions as defined in Part II of Appendix C and Appendix O to CS - 25 . This analysis should consider the similarity of the configuration, operating envelope, performance and handling characteristics, and ice protection system of the ancestor aeroplane to the one being certified.

5.6.2 The analysis may include flight test data, dry air wind tunnel test data, icing tunnel test data, engineering simulator analysis, service history, and engineering judgement.

5.7 Comparative Analysis.

For showing compliance with the CS - 25 certification spec ifications relative to SLD icing conditions represented by Appendix O, the applicant may use a comparative analysis.

AMC 25.1420 (f) provides guidance for comparative analysis.

6 Acceptable Means of Compliance - Flight Test Programme .

6.1 General.

6.1.1 Th is section provides an acceptable flight test programme where flight testing is selected by the applicant and agreed by the Agency as being the primary means for showing compliance.

6.1.2 Where an alternate means of compliance is proposed for a specific pa ragraph in this section, it should enable compliance to be shown with at least the same degree of confidence as flight test would provide (see CS 25.21(a)(1) ).

6.1.3 Ice accretions for each flight phase are defined in Part II of Appendix C and Part II of Appendix O to CS - 25. Additional guidance for determining the applicable ice accretions is provided in Appendix 1 to this AMC.

6.1.4 This test programme is based on the assumption that the applicant will choose to use the holding Ice accretion for the majority of the testing assuming that it is the most conservative ice accretion. In general, the applicant may choose to use an ice accre tion that is either conservative or is the specific ice accretion that is appropriate to the particular phase of flight. In accordance with Part II of Appendix C and Part I I(e) of Appendix O to CS - 25, if the holding ice accretion is not as conservative as the ice accretion appropriate to the flight phase, then the ice accretion appropriate to the flight phase (or a more conservative ice accretion) must be used.

6.1.5 For the approach and landing configurations, in accordance with the guidance provided in paragraph 4.1.10 of this AMC, the flight tests in natural icing conditions specified in Table 4 of this AMC are usually sufficient to evaluate whether ice accretions on trail ing edge flaps adversely affect aeroplane performance or handling qualities. If these tests show that aeroplane performance or handling Powered by EASA eRules Page 73 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL qualities are adversely affected, additional tests may be necessary to show compliance with the aeroplane performance an d handling qualities requirements.

6.2 Stall Speed ( CS 25.103 ).

6.2.1 The stall speed for intermediate high lift configurations can normally be obtained by interpolation. However if a stall identification system (e .g. stick pusher) activation point is set as a function of the high lift configuration and/or the activation point is reset for icing conditions, or if significant configuration changes occur with extension of trailing edge flaps (such as wing leading edge high - lift device position movement), additional tests may be necessary.

6.2.2 Acceptable Test Programme. The following represents an acceptable test programme subject to the provisions outlined above: a. Forward centre of gravity position appropriate to t he configuration.

b. Normal stall test altitude.

c. In the configurations listed below, trim the aeroplane at an initial speed of 1.13 to 1.30 V . Decrease speed at a rate not to exceed 0.5 m/sec² (1 knot SR per second) until an acceptable stall identificati on is obtained.

i. High lift devices retracted configuration, "Final Take - off Ice."

ii. High lift devices retracted configuration, "En - route Ice."

iii. Holding configuration, "Holding Ice."

iv. Lowest lift take - off configuration, "Holding Ice."

v. Highest lift take - off configuration, "Take - off Ice."

vi. Highest lift landing configuration, "Holding Ice."

6.3 Accelerate - stop Distance ( CS 25.109 ). The effect of any increase in V1 due to take - off in icing conditions may be determined by a suitable analysis.

6.4 Take - off Path ( CS 25.111 ). If VSR in the configuration defined by CS 25.121(b) with the “Take - off Ice" accretion de fined in Appendix C and Appendix O to CS - 25 exceeds VSR for the same configuration without ice accretions by more than the greater of 5.6 km/h (3 knots) or 3%, the take - off demonstrations should be repeated to subs tantiate the speed schedule and distances for take - off in icing conditions. The effect of the take - off speed increase, thrust loss, and drag increase on the take - off path may be determined by a suitable analysis.

6.5 Landing Climb: All - engines - operating ( CS 25.119 ). Acceptable Test Programme. The following represents an acceptable test programme: a. The "Holding Ice " accretion should be used.

b. Forward centre of gravity position appropriate to the configuration.

c . Highest lift landing configuration, landing climb speed no greater than VREF.

d. Stabilise at the specified speed and conduct 2 climbs or drag polar checks as agreed with the Agency .

Powered by EASA eRules Page 74 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 6.6 Climb: One - engine - inoperative ( CS 25.121 ). Acceptable Test Programme. The following represents an acceptable test programme: a. Forward centre of gravity position appropriate to the configuration.

b. In the configurations listed below, stabilise the aeroplane at the specified s peed with one engine inoperative (or simulated inoperative if all effects can be taken into account) and conduct 2 climbs in each configuration or drag polar checks substantiated for the asymmetric drag increment as agreed with the Agency .

i. High lift dev ices retracted configuration, final take - off climb speed, "Final Take - off Ice."

ii. Lowest lift take - off configuration, landing gear retracted, V climb speed, "Take - off Ice."

iii. Approach configuration appropriate to the highest lift landing configuration, landing gear retracted, approach climb speed, "Holding Ice."

6.7 En - route Flight Path ( CS 25.123 ). Acceptable Test Programme. The following represents an acceptable test programme: a. The "En - route I ce" accretion should be used.

b. Forward centre of gravity position appropriate to the configuration.

c. En - route configuration and climb speed.

d. Stabilise at the specified speed with one engine inoperative (or simulated inoperative if all effects can be taken into account) and conduct 2 climbs or drag polar checks substantiated for the asymmetric drag increment as agreed with the Agency .

6.8 Landing ( CS 25.125 ). The effect of landing speed increase on the landin g distance may be determined by a suitable analysis.

6.9 Controllability and Manoeuvrability - General ( CS 25.143 and 25.177 ).

6.9.1 A qualitative and quantitative evaluati on is usually necessary to evaluate the aeroplane's controllability and manoeuvrability. In the case of marginal compliance, or the force limits or stick force per g limits of CS 25.143 being approached, additional substantiation may be necessary to establ ish compliance.

In general, it is not necessary to consider separately the ice accretion appropriate to take - off and en - route because the "Holding Ice" is usually the most critical.

6.9.2 General Controllability and Manoeuvrability. The following represent s an acceptable test programme for general controllability and manoeuvrability, subject to the provisions outlined above: a. The "Holding Ice" accretion should be used.

b. Medium to light weight, aft centre of gravity position, symmetric fuel loading.

Powered by EASA eRules Page 75 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL c . In the configurations listed in Table 2, trim at the specified speeds and conduct the following manoeuvres: i. 30° banked turns left and right with rapid reversals; ii. Pull up to 1.5g (except that this may be limited to 1.3g at V ), and REF pushover to 0.5g (except that the pushover is not required at V and MO V ); and FE iii. Deploy and retract deceleration devices.

TABLE 2: Trim Speeds Configuration Trim Speed High lift devices retracted configuration: 1.3 V SR , and V or 463 km/h (250 knots) IAS , whichever is less MO Lowest lift takeoff configuration: 1.3 V SR , and V or 463 km/h (250 knots) IAS, whichever is less FE Highest lift landing configuration: V REF , and V or 463 km/h (250 knots) IAS, whichever is less.

FE V Reference Stall Speed SR — V Maximum operating limit speed MO — IAS Indicated air speed — V Maximum flap extended speed FE — V Reference landing speed REF — d. Lowest lift take - off configuration: At the greater of 1.13 V or V MIN, with SR 2 the critical engine inoperative (or simulated inoperative if all effects can be taken into account), conduct 30° banked turns left and right with normal turn reversals and, in wings - level flight, a 9.3 km/h (5 knot) speed decrease and increase.

e. Conduct an approach and go - around with all engines operating using the recommended procedure.

f. Conduct an approach and go - around with the critical engine inoperative (or simulated inoperative if all effects can be taken into account) using the recommended procedure.

g. Conduct an approach and landing using the recommended procedure. In addition satisfactory controllability should be demonstrated during a landing at V minus 9.3 km/h (5 knots). These tests should be done at heavy weight REF and forward centre of gravity.

h. Conduct an approach and landing with the critical engine inoperative (or simulated inoperative if all effects can be taken into account) using the recommended procedure.

6.9.3 Evaluati on of Lateral Control Characteristics . Aileron hinge moment reversal and other lateral control anomalies have been implicated in icing accidents and incidents. The following manoeuvre, along with the evaluation of lateral controllability during a decelerat ion to the stall warning speed covered in paragraph 6.17.2(e) of this AMC and the evaluation of static lateral - directional Powered by EASA eRules Page 76 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL stability covered in paragraph 6.15 of this AMC, is intended to evaluate any adverse effects arising from both stall of the outer por tion of the wing and control force characteristics.

For each of the test conditions specified in subparagraphs (a) and (b) below, perform the manoeuvres described in subparagraphs 1 through 6 below.

(a) Holding configuration, holding ice accretion, maximum landing weight, forward centre - of - gravity position, minimum holding speed (highest expected holding angle - of - attack); and (b) Landing configuration, most critical of holding, approach, and landing ice accretions, medium to light weight, forward centre - of - gravity position, V REF (highest expected landing approach angle - of - attack).

1 Establish a 30 - degree banked level turn in one direction.

2 Using a step input of approximately 1/3 full lateral control deflection, roll the aeroplane in the other direction.

3 Maintain the control input as the aeroplane passes through a wings level attitude.

4 At approximately 20 degrees of bank in the other direction, apply a step input in the opposite direction to approximately 1/3 full lateral control deflection.

5 Release the control input as the aeroplane passes through a wings level attitude.

6 Repeat this test procedure with 2/3 and up to full lateral control deflection unless the roll rate or structural loading is judged excessive.

It should be possible to r eadily arrest and reverse the roll rate using only lateral control input, and the lateral control force should not reverse with increasing control deflection.

6.9.4 Low g Manoeuvres and Sideslips. The following represents an example of an acceptable test p rogram for showing compliance with controllability requirements in low g manoeuvres and in sideslips to evaluate susceptibility to ice - contaminated tailplane stall.

6.9.4.1 CS 25.143(i)(2) states: “It must be show n that a push force is required throughout a pushover manoeuvre down to zero g or the lowest load factor obtainable if limited by elevator power or other design characteristic of the flight control system. It must be possible to promptly recover from the m anoeuvre without exceeding a pull control force of 222 N. (50 lbf).

6.9.4.2 Any changes in force that the pilot must apply to the pitch control to maintain speed with increasing sideslip angle must be steadily increasing with no force reversals, unless th e change in control force is gradual and easily controllable by the pilot without using exceptional piloting skill, alertness, or strength. Discontinuities in the control force characteristic, unless so small as to be unnoticeable, would not be considered to meet the requirement that the force be steadily increasing. A gradual change in control force is a change that is not abrupt and does not have a steep gradient that can be easily managed by a pilot of average skill, alertness, and Powered by EASA eRules Page 77 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL strength. Control forc es in excess of those permitted by CS 25.143(c) would be considered excessive.

(See paragraph 6.15.1 of this AMC for lateral - directional aspects).

6.9.4.3 The test manoeuvres described in paragraphs 6.9.4.1 and 6.9 .4.2, above, should be conducted using the following configurations and procedures: a. The "Holding Ice " accretion should be used. For aeroplanes with unpowered elevators, these tests should also be performed with "Sandpaper Ice."

b. Medium to light weight , the most critical of aft or forward centre of gravity position, symmetric fuel loading.

c. In the configurations listed below, with the aeroplane in trim, or as nearly as possible in trim, at the specified trim speed, perform a continuous manoeuvre (with out changing trim) to reach zero g normal load factor or, if limited by elevator control authority, the lowest load factor obtainable at the target speed.

i. Highest lift landing configuration at idle power or thrust, and the more critical of: — Trim speed 1.23 V , target speed not more than 1.23 V , SR SR or — Trim speed V , target speed not less than V - 37 km/h FE FE (20 knots) ii. Highest lift landing configuration at go - around power or thrust, and the more critical of: — Trim speed 1.23 V , target speed not more than 1.23 V , SR SR or — Trim speed V , target speed not less than V - 37 km/h FE FE (20 knots) d. Conduct steady heading sideslips to full rudder authorit y, 801 N. (180 lbf) rudder force or full lateral control authority (whichever comes fir st), with highest lift landing configuration, trim speed 1.23 V , and SR power or thrust for - 3° flight path angle.

6.9.5 Controllability prior to Activation and Normal Operation of the Ice Protection System . The following represents an acceptable test progr amme for compliance with controllability requirements with the ice accretion prior to activation and normal operatio n of the ice protection system.

In the configurations , speeds, and power settings listed below, with the ice accretion specified in the requirement, trim the aeroplane at the specified speed.

Conduct pull up to 1.5g and pushover to 0.5g without longitudinal control force reversal.

i. High lift devices retracted configuration (or holding configuration if different), holding speed, power or thrust for level flight.

ii. Landing configuration, V for non - icing conditions, power or thrust for REF landing approach (limit pull up to stall warning).

Powered by EASA eRules Page 78 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 6.10 Longitudinal Control ( CS 25.145 ).

6.10.1 No specific quantitative evaluations are required for demonstrating compliance with CS 25.145(b) and (c) . Qualitative evaluations should be combined with the other testing. The results fro m the non - contaminated aeroplane tests should be reviewed to determine whether there are any cases where there was marginal compliance. If so, these cases should be repeated with ice.

6.10.2 Acceptable Test Programme . The following represents an acceptabl e test programme for compliance with CS 25.145(a) : a. The "Holding i ce " accretion should be used.

b. Medium to light weight, aft centre of gravity posit ion, symmetric fuel loading.

c. In the configurations listed below, trim the aeroplane at 1.3 V . Reduce SR speed using elevator control to stall warning plus one second and demonstrate prompt recovery to the tri m speed using elevator control.

i. High lift devices retracted configuration, maximu m continuous power or thrust.

ii. Maximum lift landing configuration, maximum continuous power or thrust.

6.11 Directional and Lateral Control ( CS 25.147 ). Qualitative evaluations should be combined with the other testing. The results from the non - contaminated aeroplane tests should be reviewed to determine whether there are any cases where there was marginal compliance. If so, these cases should be repeated with ice.

6.12 Trim ( CS 25.161 ).

6.12.1 Qualitative evaluations should be combined with the other testing. The results from the non - contaminated aeroplane tests should be reviewed to determine whether there are any cases where there was marginal compliance. If so, these cases should be repeated with ice. In addition a specific check should be made to demonstrate compliance with CS 25.161(c)(2) .

6.12.2 The following represents a representative test program for compliance with 25.161(c)(2) .

a. The "Holding ice" accretion should be used.

b. Most critical landing weight, forward centre of gravity position, symmetric fuel loading.

c. In the configurations below, trim the aircraft at the specified speed.

i. Maximum lift landing configuration, landing gear extended, and the most critical of: — Speed 1.3V with Idle power or thrust; or, SR1 — Speed V with power or thrust corresponding to a 3 deg REF glidepath' 6.13 Stability - General ( CS 25.171 ). Qualitative evaluations should be combined with the other testing. Any tendency to change speed when trimmed or requi rement for frequent trim inputs should be specifically investigated.

Powered by EASA eRules Page 79 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPA RT B – FLIGHT (CS - 25) GENERAL 6.14 Demonstration of Static Longitudinal Stability ( CS 25.175 ).

6.14.1 Each of the following cases should be tested. In general, it is not neces sary to test the cruise configuration at low speed ( CS 25.175(b)(2) ) or the cruise configuration with landing gear extended ( CS 25.175(b)(3) ); nor is it necessary to test a t high altitude. The maximum speed for substantiation of stability characteristics in icing conditions (as prescribed by CS 25.253(c) ) is the lower of 556 km/h (300 knots) CAS, V FC , or a speed at which it is demons trated that the airframe will be free of ice accretion due to the effects of increased dynamic pressure.

6.14.2 Acceptable Test Programme . The following represents an acceptable test programme for demonstration of static longitudinal stability: a. The "Hol ding ice" accretion should be used.

b. High landing weight, aft centre of gravity position, symmetric fuel loading.

c. In the configurations listed below, trim the aer oplane at the specified speed.

The power or thrust should be set and stability demonstrated over the speed ranges as stated in CS 25.175(a) through (d) , as applicable.

i. Climb: With high lift devices retracted, trim at the speed for best rate - of - climb, except that the speed need not be less than 1.3 VSR.

ii. Cruise : With high lift devices retracted, trim at V or 463 km/h MO (250 knots) CAS, whichever is lower.

iii. Approach : With the high lift devices in the approach position appropriate to the highest lift landing configuration, trim at 1.3 V .

SR iv. Landing : With the highest lift landing configuration, trim at 1.3V .

SR 6.15 Static Directional and Lateral Stability ( CS 25.177 ).

6.15.1 Compliance should b e demonstrated using steady heading sideslips to show compliance with directional and lateral stabilit y. The maximum sideslip angles obtained should be recorded and may be used to substantiate a crosswind value for landing (see paragraph 6.19 of this AMC).

6.15.2 Acceptable Test Programme . The following represents an acceptable test programme for static directional and lateral stability: a. The "Holding ice" accretion should be used.

b. Medium to light weight, aft centre of gravity position, symmetric fuel loading.

c. In the configurations listed below, trim the aeroplane at the specified speed and conduct steady heading sideslips to full rudder authority, 80 1 N.

(180 lbf) rudder pedal force, or full lateral control authority, whichever comes first.

i. High lift devices retracted configuration: Trim at best rate - of - climb speed, but need not be less than 1.3 V .

SR ii. Lowest lift take - off configuration: Trim at the all - engines - operating initial climb speed.

iii. Highest lift landing configurati on: Trim at V .

REF Powered by EASA eRules Page 80 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 6.16 Dynamic Stability ( CS 25.181 ). Provided that there are no marginal compliance aspects with the non - contaminated aeroplane, it is not necessary to demonstrate dynamic stability in specific te sts. Qualitative evaluations should be combined with the other testing. Any tendency to sustain oscillations in turbulence or difficulty in achieving precise attitude control should be investigated.

6.17 Stall Demonstration ( CS 25.201 ).

6.17.1 Sufficient stall testing should be conducted to demonstrate that the stall characteristics comply with the requirements. In general, it is not necessary to conduct a stall programme which encompasses all weights, centre of gra vity positions (including lateral asymmetry), altitudes, high lift configurations, deceleration device configurations, straight and turning flight stalls, power off and power on stalls. Based on a review of the stall characteristics of the non - contaminated aeroplane, a reduced test matrix can be established. However, additional testing may be necessary if: — the stall characteristics with ice accretion show a significant difference from the non - contaminated aeroplane, — testing indicates marginal compliance, or — a stall identification system (e.g. stick pusher) is required to be reset for icing conditions.

6.17.2 Acceptable Test Programme . Turning flight stalls at decelerations greater than 1 knot/sec are not required. Slow decelerations (much slower than 1 knot/sec) may be critical on aeroplanes with anticipation logic in their stall protection system or on aeroplanes with low directional stability, where large sideslip angles could develop. The following rep resents an acceptable test programme subject to the provisions outlined above.

a. The "Holding ice" accretion should be used.

b. Medium to light weight, aft centre of gravity position, symmetric fuel loading.

c. Normal stall test altitude.

d. In the config urations listed below, trim the aeroplane at the same initial stall speed factor used for stall speed determination. For power - on stalls, use the power setting as defined in CS 25.201 (a)(2) but with ice accretions on the aeroplane. Decrease speed at a rate not to exceed 1 knot/sec to stall identification and recover using the same test technique as for the non - contaminated aeroplane.

i. High lift devices retracted configuration: Straight/Power Off, Straight/Power O n, Turning/Power Off, Turning/Power On.

ii. Lowest lift take - off configuration: Straight/Power On, Turning/Power Off.

iii. Highest lift take - off configuration: Straight/Power Off, Turning/Power On.

iv. Highest lift landing configuration: Straight/Power Off , Straight/Power On, Turning/Power Off, Turning/Power On.

Powered by EASA eRules Page 81 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL e. For the configurations listed in paragraph 6.17.2(d) i and iv , and any other configuration if deemed more critical, in 1 knot/second deceleration rates down to stall warning with wings level and p ower off, roll the aeroplane left and right up to 10 degrees of bank using the lateral control.

6.18 Stall Warning ( CS 25.207 ).

6.18.1 Stall warning should be assessed in conjunction with stall speed testing and st all demonstration testing ( CS 25.103 , CS 25.201 and paragraphs 6.2 and 6.17 of this AMC, respectively) and in tests with faster entry rates.

6.18.2 Normal Ice Protection System Operation . The following represents an acceptable test programme for stall warning in slow down turns of at least 1.5g and at entry rates of at least 1 m/sec (2 knot/sec): a. The "Holding ice" accretion should be used.

b. Medium to light weight, aft centre of gravity position, symmetric fuel loading.

c. Normal stall test altitude.

d. In the configurations listed below, trim the aeroplane at 1.3V with the SR power or thrust necessary to maintain straight level flight. Maintain the trim powe r or thrust during the test demonstrations. Increase speed as necessary prior to establishing at least 1.5g a nd a deceleration of at least 1 m/sec (2 knot/sec). Decrease speed until 1 sec after stall warning and recover using the same test technique as f or the non - contaminated aeroplane.

i. High lift devices retracted configuration; ii. Lowest lift take - off configuration; and iii. Highest lift landing configuration.

6.18.3 Ice Accretion Prior to Activation and Normal System Operation . The following repres ent acceptable means for evaluating stall warning margin with the ice accretion prior to activation and normal operation of the ice protection system .

a. In the configurations listed below, with the ice accretion specified in the requirement, trim the aero plane at 1.3 V .

SR i. High lift devices retracted configuration: Straight/Power Off.

ii. Landing configuration: Straight/Power Off.

b. At decelerations of up to 0.5 m/sec (1 knot per second), reduce the speed to stall warning plus 1 second, and demonstrate that stalling can be prevented using the same test technique as for the non - contaminated aeroplane, without encountering any adverse characteristics (e.g., a rapid roll - off ). As required by CS 25.207(h)(3)(ii) , where stall warning is provided by a different means than for the aeroplane without ice accretion, the stall characteristics must be satisfactory and the delay must be at l east 3 seconds.

Powered by EASA eRules Page 82 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 6.19 Wind Velocities ( CS 25.237 ).

6.19.1 Crosswind landings with "Landing Ice" should be evaluated on an opportunit y basis.

6.19.2 The results of the steady heading sideslip tests with “Landing I ce” may be used to establish the safe cross wind component. If the flight test data show that the maximum sideslip angle demonstrated is similar to that demonstrated with the non - contaminated aeroplane, and the flight characteristics (e.g. control forces a nd deflections) are similar, then the non - contaminated aeroplane crosswind component is considered valid.

6.19.3 If the results of the comparison discussed in paragraph 6.19.2, above, are not clearly similar, and in the absence of a more rational analysis , a conservative analysis based on the results of the steady heading sideslip tests may be used to establish the safe crosswind component. The crosswi nd value may be estimated from: V = V sin (sideslip angle) / 1.5 CW REF * Where: V is the crosswind compo nent, CW V is the landing reference speed appropriate to a minimum landing weight, REF and sideslip angle is that demonstrated at V (see paragraph 6.15 of this REF AMC).

6.20 Vibration and Buffeting ( CS 25.251 ).

6.20.1 Qualitative evaluations should be combined with the other testing, including speeds up to the maximum speed obtained in the longitudinal stability tests (see paragraph 6.14 of this AMC).

6.20.2 It is also necessary to demonstrate that the aeroplane is free from harmful vibration due to residual ice accumulation. This may be done in conjunction with the natural icing tests.

6.20.3 An aeroplane with pneumatic de - icing boots should be evaluated to V /M with DF DF the de - icing boots operating and not operating. It is not necessary to do this demonstration with ice accretion.

6.21 Natural Icing Conditions.

6.21.1 General.

6.21.1.1 Whether the flight testing has been performed with artificial ice shapes or in natural icing conditions, additional limited flight testing described in this section should be conducted in natural icing conditions specified in Appendix C to CS - 25 and, if necessary, in the icing conditions described in Appendix O to CS - 25. (AMC 25.1 420 provides guidance on when it is necessary to perform flight testing in the atmospheric icing conditions of Appendix O.)

Where flight testing with artificial ice shapes is the primary means for showing compliance, the objective of the tests described in this section is to corroborate the handling characteristics and performance results obtained in flight testing with artificial ice shapes.

Powered by EASA eRules Page 83 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 6.21.1.2 It is acceptable for some ice to be shed during the testing due to air loads or wing flexure, etc. However , an attempt should be made to accomplish the test manoeuvres as soon as possible after exiting the icing cloud to minimise the atmospheric influences on ice shedding.

6.21.1.3 During any of the manoeuvres specified in paragraph 6.21.2, below, the behaviou r of the aeroplane should be consistent with that obtained with artificial ice shapes. There should be no unusual control responses or uncommanded aeroplane motions. Additionally, during the level turns and bank - to - bank rolls, there should be no buffeting or stall warning.

6.21.2 Ice Accretion/Manoeuvres.

6.21.2.1 Holding scenario.

a. The manoeuvres specified in Table 3, below, should be carried out with the following ice accretions representative of normal operation of the ice protection system: i. On unprotected Parts : A thickness of 75 mm (3 inches) on those parts of the aerofoil where the collection efficiency is highest should be the objective. (A thickness of 50 mm (2 inches) is normally a minimum value, unless a lesser value is agreed by the Agenc y .)

ii. On protected parts : The ice accretion thickness should be that resulting from normal operation of the ice protection system.

b. For aeroplanes with control surfaces that may be susceptible to jamming due to ice accretion (e.g. elevator horns expose d to the air flow), the holding speed that is critical with respect to this ice accretion should be used.

Table 3: Holding Scenario – Manoeuvres Centre of Configuration Gravity Trim speed Manoeuvre Position Flaps up, gear up Optional Holding, except Level, 40° banked turn, (aft range) 1.3 V for the Bank - to - bank rapid roll, 30° - 30°, SR stall manoeuvre Speedbrake extension, retraction, Full straight stall (1 knot/second deceleration rate, wings level, power off).

Flaps in Optional 1.3 V Deceleration to the speed reached 3 seconds after SR intermediate (aft range) activation of stall warning in a 1 knot/second positions, gear up deceleration.

Landing flaps, gear Optional V Level, 40° banked turn, REF down (aft range) Bank - to - bank rapid ro ll, 30° - 30°, Speedbrake extension, retraction (if approved), Full straight stall (1 knot/second deceleration rate, wings level, power off).

Powered by EASA eRules Page 84 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL 6.21.2.2 Approach/Landing Scenario. The manoeuvres specified in Table 4, below, should be carried out with successive accretions in different configurations on unprotected surfaces. Each test condition should be accomplished with the ice accretion that exists at that point. The final ice accretion (Test Condition 3) represents the sum of the amounts that would accrete during a normal descent from holding to landing in icing conditions.

TABLE 4: Approach/Landing Scenario – Manoeuvres Centre of Test Ice accretion Trim Configuration Gravity Manoeuvre Condition thickness (*) speed Position _ First 13 mm Flaps up, gear Optional Holding No specific test (0.5 in.) up (aft range) 1 Additional First Optional Holding - Level 40° banked turn, 6.3 mm (0.25 in.) intermediate (aft range) - Bank - to - bank rapid roll, 30° - 30°, (19 mm (0.75 flaps, gear up - Speed brake extension and in.) total) retraction (if approved), - Deceleration to stall warning.

2 Additional Further Optional 1.3 V SR - Bank - to - bank rapid roll, 30° - 30°, 6.3 mm (0.25 in.) intermediate (aft range) - Speed brake extension and (25 mm (1.00 flaps, gear up retraction (if approved), in.) total) (as applicable) - Deceleration to stall warning.

3 Additional Landing flaps, Optional V - Bank - to - bank rapid roll, 30° - 30°, REF 6.3 mm (0.25 in.) gear down (aft range) - Speed brake extension and (31 mm (1.25 retraction (if approved), in.) total) - Bank to 40°, - Full straight stall.

(*) The indicated thickness is that obtained on the parts of the unprotected aerofoil with the highest collection efficiency.

6.21.3 For aeroplanes with unpowered elevator controls, in the absence of an agreed substantiation of the criticality of the artificial ice shape used to demonstrate compliance with the controllability requirement, the pushover test of paragraph 6.9. 4 should be repeated with a thin accretion of natural ice on the unprotected surfaces .

6.21.4 Existing propeller speed limits or, if required, revised propeller speed limits for flight in icing, should be verified by flight tests in natural icing condition s.

6.22 Failure Conditions ( CS 25.1309 ).

6.22.1 For failure conditions which are annunciated to the flight crew, credit may be taken for the established operating procedures following the failure.

6.22.2 Acceptable Test Programme . In addition to a general qualitative evaluation, the following test programme (modified as necessary to reflect the specific operating procedures) should be carried out for the most critical probable failure condition where the associated procedure requires the aeroplane to exit the icing condition: a. The ice accretion is defined as a combination of the following: i. On the unprotected surfaces - the “Holding ice” accretion described in paragraph A1.2.1 of this AMC; ii. On the normally p rotected surfaces that are no longer protected - the “Failure ice” accretion described in paragraph A1.3.2 of this A M C; and Powered by EASA eRules Page 85 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL iii. On the normally protected surfaces that are still functioning following the segmental failure of a cyclical de - ice system – the ice accretion that will form during the rest time of the de - ice system following the critical failure condition.

b. Medium to light weight, aft centre of gravity position, symmetric fuel loading.

c. In the configurations listed below, trim the aeroplane a t the specified speed.

Conduct 30° banked turns left and right with normal reversals. Conduct pull up to 1.5g and pushover to 0.5g.

i. High lift devices retracted configuration (or holding configuration if different): Holding speed, power or thrust for lev el flight. In addition, deploy and retract deceleration devices.

ii. Approach configuration: Approach speed, power or thrust for level flight.

iii. Landing configuration: Landing speed, power or thrust for landing approach (limit pull up to 1.3g). In addi tion, conduct steady heading sideslips to angle of sideslip appropriate to type and landing procedure.

d. In the configurations listed below, trim the aeroplane at estimated 1.3 V SR Decrease speed to stall warning plus 1 second, and demonstrate prompt reco very using the same test technique as for the non - contaminated aeroplane. Natural stall warning is acceptable for the failure case.

i. High lift devices retracted configuration: Straight/Power Off.

ii. Landing configuration: Straight/Power Off.

e. Conduct an approach and go - around with all engines operating using the recommended procedure.

f. Conduct an approach and landing with all engi nes operating (unless the one - engine - inoperative condition results in a more critical probable failure condition) using the recommended procedure.

6.22.3 For improbable failure conditions, flight test may be required to demonstrate that the effect on saf ety of flight (as measured by degradation in flight characteristics) is commensurate with the failure probability or to verify the results of analyses and/or wind tunnel tests. The extent of any required flight test should be similar to that described in p aragraph 6.22.2, above, or as agreed with the Agency for the specific failure condition.

[Amdt No: 25/3] [Amdt No: 25/6] [Amdt No: 25/13] [Amdt No: 25/16] [Amdt No: 25/18] [Amdt No: 25/21] Powered by EASA eRules Page 86 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

Appendix 1 – Airframe Ice Accretion

ED Decision 20 16 / 010 /R A1.1 General.

a. In accordance with CS 25.1419, each aeroplane certified for flight in icing conditions must be capable of safely operating in the continuous maximum and intermittent maximum icing conditions of Appendix C. Therefore, at a minimum, certific ation for flight in icing conditions must include consideration of ice accretions that can occur in Appendix C icing conditions.

b. In accordance with CS 25.1420(a)(1), each aeroplane certified for flight in icing conditions must, at a minimum, be capable of safely operating: i. In the atmospheric icing conditions of Appendix C to CS - 25, and ii. After encountering the atmospheric icing conditions of Appendix O, and subsequently while exiting all icing conditions.

Therefore, at a minimum, certification for flight in icing conditions must consider ice accretions that can occur during flight in Appendix C icing conditions and during detection and exiting of Appendix O icing conditions.

c. In accordance with CS 25.1420(a)(2), an aeroplane may also be certified for operation in a portion of the atmospheric icing conditions of Appendix O to CS - 25. In that case, the aeroplane must also be capable of operating safely after encountering, and while exiting, atmospheric icing conditions in the portion of Appendix O fo r which operation is not approved. Ice accretions used for certification must consider: i. Operations in Appendix C icing conditions, ii. Operations in the Appendix O icing conditions for which approval is sought, and iii. Detection and exiting of the Appendix O icing conditions beyond those for which approval is sought.

d. In accordance with CS 25.1420(a)(3), in addition to being certifi ed for flight in Appendix C conditions, an aeroplane may be certified for operation throughout the atmospheric icing conditions of Appendix O to CS - 25. Certification for flight throughout the atmospheric icing conditions of Appendix O must consider ice acc retions resulting from: i. Operations in Appendix C icing conditions, and ii. Operations in Appendix O icing conditions.

e. The CS - 25 subpart B aeroplane performance and handling characteristics requirements identify the specific ice accretions that ap ply in showing compliance. In accordance with Appendix C, part II(b) and Appendix O, part II(e), to reduce the number of ice accretions used for demonstrating compliance, the applicant may use any of the applicable ice accretions (or a composite accretion representing a combination of accretions) to show compliance with a particular subpart B requirement if that accretion is either the ice accretion identified in the requirement or is shown to be more conservative than the ice accretion identified in the re quirement. In addition, the ice accretion with the most adverse effect on handling characteristics may be used for compliance with the aeroplane performance requirements if any difference in performance is conservatively taken into account. Ice accretion(s ) used to show compliance should take into account the speeds, configurations (including configuration changes), angles of attack, power or thrust settings, etc. for the flight phases and icing conditions they are intended to cover.

Powered by EASA eRules Page 87 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL f. The applicant should determine the most critical ice accretion in terms of handling characteristics and performance for each flight phase. Parameters to be considered include: — flight conditions (for example, aeroplane configuration, speed, angle - of - attack, altitude) and — atm ospheric icing conditions for which certification is desired (for example, temperature, liquid water content (LWC), mean effective drop diameter (MED), drop median volume diameter (MVD)).

If a comparative analysis (refer to AMC 25.1420(f)) is used as th e means of compliance with the CS - 25 certification specifications relative to the Appendix O icing conditions, the most critical ice accretions determined for Appendix C icing conditions are acceptable.

g. For each phase of flight, the shape, chordwise and spanwise, and the roughness of the shapes, considered in selection of a critical ice shape should accurately reflect the full range of atmospheric icing conditions for which certification is desired in terms of MED, LWC, MVD, and temperature during the re spective phase of flight. Justification and selection of the most critical ice shape for each phase of flight should be agreed to by the Agency.

h. See Appendix R of FAA Advisory Circular AC 20 - 73A, Aircraft Ice Protection, for additional detailed informa tion about determining the applicable critical ice accretion (shape and roughness).

A1.2 Operative Ice Protection System.

A1.2.1 All flight phases except take - off .

A1.2.1.1 For unprotected parts, the ice accretion to be considered should be determined in a ccordance with Appendices C and O to CS - 25 .

A1.2.1.2 Unprotected parts consist of the unprotected aerofoil leading edges and all unprotected airframe parts on which ice may accrete. The effect of ice accretion on protuberances such as antennae or flap hing e fairings need not normally be investigated. However aeroplanes that are characterised by unusual unprotected airframe protuberances, e.g. fixed landing gear, large engine pylons, or exposed control surface horns or winglets, etc., may experience signific ant additional effects, which should therefore be taken into consideration.

A1.2.1.3 For holding ice, the applicant should determine the effect of a 45 - minute hold in continuous maximum icing conditions. The analysis should assume that the aeroplane remain s in a rectangular “race track” pattern, with all turns being made within the icing cloud. Therefore, no horizontal extent correction should be used for this analysis. For some previous aeroplane certification programs, the maximum pinnacle height was limi ted to 75 mm (3 inches). This method of compliance may continue to be accepted for follow - on products if service experience has been satisfactory, and the designs are similar enough to conclude that the previous experience is applicable. The applicant shou ld substantiate the critical mean effective drop diameter, liquid water content, and temperature that result in the formation of an ice accretion that is critical to the aeroplane’s performance and handling qualities. The shape and texture of the ice are i mportant and should be agreed with the Agency .

Powered by EASA eRules Page 88 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL A1.2.1.4 For protected parts, the ice protection systems are normally assumed to be operative. However, the applicant should consider the effect of ice accretion on the protected surfaces that result from: a. The rest time of a de - icing cycle. Performance may be established on the basis of a representative intercycle ice accretion for normal operation of the de - icing system (consideration should also be given to the effects of any residual ice accretion that is not shed.) The average drag increment determined over the de - icing cycle may be used for performance calculations.

b. Runback ice which occurs on or downstream of the protected surface.

c. Ice accretion prior to activation and normal operation of the ice protection system (see paragraph A1.2.3, below).

A1.2.2 Take - off phase .

A1.2.2.1 For both unprotected and protected parts, the ice accretion identified in Appendix C and Appendix O to CS - 25 for the take - off phase may be determined by calculation, assuming the following : — aerofoils, control surfaces and, if applicable, propellers are free from frost, snow, or ice at the start of the take - off; — the ice accretion starts at the end of the take - off distance — the critical ratio of thrust/power - to - weight; — failure of the critical engine occurs at VEF; and — flight crew activation of the ice protection system in accordance wit h an AFM procedure, except that after commencement of the take - off roll no flight crew action to activate the ice protection system should be assumed to occur until the aeroplane is 122 m (400 ft) above the take - off surface.

A1.2.2.2 The ice accretions id entified in Appendix C and Appendix O to CS - 25 for the take - off phase are: — "Take - off ice": The most critical ice accretion between the end of the take - off distance and 122 m (400 ft) above the takeoff surface, assuming accretion starts at the end of the t ake - off distance in the icing environment.

— "Final Take - off ice": The most critical ice accretion between 122 m (400 ft) ) and the height at which the transition to the en route configura tion and speed is completed, or 457 m (1500 ft) above the take - off su rface, whichever is higher, assum ing accretion starts at the end of the take - off distance in the icing environment.

A1.2.3 Ice accretion prior to activation and normal system operation .

A1.2.3.1 When considering ice accretion before the ice protection sys tem has been activated and is performing its intended function, the means of activating the ice protection system and the system response time should be taken into account.

System response time is defined as the time interval between activation of the syst em and its effective operation (for example, for a thermal ice protection system used for de - icing, the time to heat the surface and perform its de - icing function).

Powered by EASA eRules Page 89 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGH T (CS - 25) GENERAL If activation of the ice protection system depends on flight crew recognition of icing con ditions or response to a cockpit annunciation, appropriate delays in identifying the icing conditions and activating the ice protection system should be taken into account. For the icing conditions of Appendix C, the aeroplane should be assumed to be in co ntinuous maximum icing conditions during the time between entering the icing conditions and effective operation of the ice protection system.

A1.2.3.2 For an aeroplane certified in accordance with CS 25.1420 (a)(2) or (a)(3), the requirements of CS 25.1419 (e), (f), (g), and (h) must be met for the icing conditions defined in Appendix O in which the aeroplane is certified to operate.

CS 25.1419(e) requires one of the following three methods for detecting icing and activating the airframe ice protection sys tem: (a) A primary ice detection system that automatically activates or that alerts the flight crew to activate the airframe ice protection system; or (b) A definition of visual cues for recognition of the first sign of ice accretion on a specified surface combined with an advisory ice detection system that alerts the flight crew to activate the airframe ice protection system; or (c) Identification of conditions conducive to airframe icing as defined by an appropriate static or total air temperature and vis ible moisture for use by the flight crew to activate the airframe ice protection system.

A1.2.3. 3 The following guidance should be used to determine the ice accretion on the unprotected and protected aerodynamic surfaces before activation and normal system operation of the ice protection system .

a. If the ice protection system activates automatically after annunciation from a primary ice detection system, the assumed ice accretion should take into account the time it takes for automatic activation of the ic e protection system and the time it takes for the system to perform its intended function. The assumed ice accretion can be determined as follows: i. The ice accretion on the protected surfaces corresponding to the time between entry into the icing condit ions and activation of the system, plus ii. The ice accretion during the system response time.

b. If ice protection system activation depends on pilot action following annunciation from a primary ice detection system, the assumed ice accretion should take into account flight crew delays in activating the ice protection system and the time it takes for the system to perform its intended function. The assumed ice accretion can be determined as follows: i. The ice accretion corresponding to the time between entry into the icing conditions and annunciation from the primary ice detection system, plus ii. The ice accretion corresponding to 10 additional seconds of operation in icing conditions, plus iii. The ice accretion during the system response time.

Powered by EASA eRules Page 90 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL c. If ice protection system activation depends on the flight crew visually recognizing the first indication of ice accretion on a reference surface (for example, an ice accretion probe) combined with an advisory ice detection system, the assumed ice accretion sh ould take into account flight crew delays in detecting the accreted ice and in activating the ice protection system, and the time it takes for the system to perform its intended function. This may be determined as follows: i. The ice accretion that would be easily recognizable by the flight crew under all foreseeable conditions (for example, at night in clouds) as it corresponds to the first indication of ice accretion on the reference surface, plus ii. the ice accretion equivalent to 30 seconds of operation in icing conditions, plus iii. the ice accreted during the system response time.

d. If ice protection system activation depends on pilot identification of icing conditions (as defined by an appropriate static or total air temperature in combination with visible moisture conditions) with or without an advisory ice detector, the assumed ice accretion should take into account flight crew delays in recognizing the presence of icing conditions and flight crew delays in activating the ice protection system, and the time it takes for the system to perform its intended function. This may be determ ined as follows: i. the ice accretion equivalent to 30 seconds of operation in icing conditions, plus ii. the ice accretion during the system response time.

A1.3 Ice Protection System Failure Cases.

A1.3.1 Unprotected parts. The same accretion as in parag raph A1.2.1 is applicable.

A1.3.2 Protected parts following system failure. "Failure Ice" is defined as follows: A1.3.2.1 In the case where the failure condition is not annunciated, the ice accretion on normally protected parts where the ice protection sys tem has failed should be the same as the accretion specified for unprotected parts.

A1.3.2.2 In the case where the failure condition is annunciated and the associated procedure does not require the aeroplane to exit icing conditions, the ice accretion on n ormally protected parts where the ice protection system has failed should be the same as the accretion specified for unprotected parts.

A1.3.2.3 In the case where the failure condition is annunciated and the associated procedure requires the aeroplane to e xit icing conditions as soon as possible, the ice accretion on normally protected parts where the ice protection has failed, should be taken as one - half of the accretion specified for unprotected parts unless another value is agreed by the Agency .

Powered by EASA eRules Page 91 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL A1.4 A dditional guidance for Appendix O ice accretions.

A1.4.1 Ice Accretion in Appendix O Conditions Before those Conditions Have Been Detected by the Flight crew.

This ice accretion, defined as pre - detection ice in Appendix O, part II(b)(5), refers to the ice accretion existing at the time the flight crew become aware that they are in Appendix O icing conditions and have taken action to begin exiting from all icing conditions.

a. Both direct entry into Appendix O icing conditions and entry into Appendix O ici ng conditions from flight in Appendix C icing conditions should be considered.

b. The time that the applicant should assume it will take to detect Appendix O icing conditions exceeding those for which the aeroplane is certified should be based on the mean s of detection. AMC 25.1419 and AMC 25.1420 provide guidance for certifying the detection means. In general, the Agency expects that the time to detect exceedance icing conditions may be significantly longer for a detection means relying on the flight crew seeing and recognizing a visual icing cue than it is for an ice detection system that provides an attention - getting alert to the flight crew.

c. Visual detection requires time for accumulation on the reference surface(s) of enough ice to be reliably ident ified by either pilot in all atmospheric and lighting conditions. Time between pilot scans of reference surface(s) should be considered.

i. The amount of ice needed for reliable identification is a function of the distinguishing characteristics of the ice (for example, size, shape, contrast compared to the surface feature that it is adhered to), the distance from the pilots (for example, windshield vs. engine vs. wingtip), and the relative viewing angle (location with respect to the pilots’ primary fields o f view).

ii. Pilot scan time of the reference surface(s) will be influenced by many factors.

Such factors include phase of flight, workload, frequency of occurrence of Appendix O conditions, pilot awareness of the possibility of supercooled large drop cond itions, and ease of seeing the reference surface(s). The infrequency of Appendix O conditions (approximately 1 in 100 to 1 in 1 000, on average in all worldwide icing encounters) and the high workload associated with some phases of flight in instrument con ditions (for example, approach and landing) justify using a conservative estimate for the time between pilot scans.

iii. In the absence of specific studies or tests validating visual detection times, the following times should be used for visual detection of exceedance icing conditions following accumulation of enough ice to be reliably identified by either pilot in all atmospheric and lighting conditions: 1. For a visual reference located on or immediately outside a cockpit window (for example, ice accret ions on side windows, windshield wipers, or icing probe near the windows) – 3 minutes.

2. For a visual reference located on a wing, wing mounted engine, or wing tip – 5 minutes.

Powered by EASA eRules Page 92 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL A1.4.2 Ice Accretions for Encounters with Appendix O Conditions Beyond those in Which the Aeroplane is Certified to Operate.

a. Use the ice accretions in Table 1, below, to evaluate compliance with the applicable CS - 25 subpart B requirements for operating safely after encountering Appendix O atmospheric icing conditio ns for which the aeroplane is not approved, and then safely exiting all icing conditions.

b. The ice accretions of Table 1 apply when the aeroplane is not certified for flight in any portion of Appendix O atmospheric icing conditions, when the aeroplane is certified for flight in only a portion of Appendix O conditions, and for any flight phase for which the aeroplane is not certified for flight throughout the Appendix O icing envelope.

c. Table 1 shows the scenarios to be used for determining ice accre tions for certification testing of encounters with Appendix O conditions beyond those in which the aeroplane is certified to operate (for detecting and exiting those conditions): Table 1 Flight Phase/Condition - Appendix O Detect - and - Exit Ice Accretion Ground Roll No accretion Take - off No accretion Final Take - off No accretion En Route En Route Detect - and - Exit Ice Combination of: (1) either Appendix C en route ice or Appendix O en route ice for which approval is sought, whichever is applicable, (2) pre - detection ice, (3) accretion from one standard cloud horizontal extent (32.2 km (17.4 nautical miles)) in Appendix O conditions f or which the aeroplane is not approved, and (4) accretion from one standard cloud horizontal extent (32.2 km (17.4 nautical miles)) in Appendix C continuous maximum icing conditions.

Holding Holding Detect - and - Exit Ice Combination of: (1) either Appendi x C holding ice or Appendix O holding ice for which approval is sought, whichever is applicable, (2) pre - detection ice, (3) accretion from one standard cloud horizontal extent (32.2 km (17.4 nautical miles)) in Appendix O conditions for which the aeropla ne is not approved, and (4) accretion from one standard cloud horizontal extent (32.2 km (17.4 nautical miles)) in Appendix C continuous maximum icing conditions.

The total time in icing conditions need not exceed 45 minutes.

Approach Approach Detect - and - Exit Ice The more critical of holding detect - and - exit ice or the combination of: (1) ice accreted during a descent in the cruise configuration from the maximum vertical extent of the Appendix C continuous maximum icing conditions or the Appendi x O icing environment for which approval is sought, whichever is applicable, to 610 m (2 000 feet) above the landing surface, where transition to the approach configuration is made, (2) pre - detection ice, and Powered by EASA eRules Page 93 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL Flight Phase/Condition - Appendix O Detect - and - Exit Ice Accretion (3) ice accreted at 610 m (2 000 feet) above the landing surface while transiting one standard cloud horizontal extent (32.2 km (17.4 nautical miles)) in Appendix O conditions for which the aeroplane is not approved and one standard cloud horizontal extent (32.2 km (17.4 nautical miles)) in Appendix C continuous maximum icing conditions.

Landing Landing Detect - and - Exit Ice The more critical of holding detect - and - exit ice or the combination of: (1) either Appendix C or Appendix O approach and landing ice for which approval is sought, whichever is app licable, (2) pre - detection ice, and (3) ice accreted during an exit maneuver beginning with the minimum climb gradient specified in CS 25.119 from a height of 61 m (200 feet) above the landing surface and transiting through one standard cloud horizontal extent (32.2 km (17.4 nautical miles)) in Appendix O conditions for which the aeroplane is not approved, and one standard cloud horizontal extent (32.2 km (17.4 nautical miles)) in Appendix C continuous maximum icing conditions.

For the purposes of defining the landing detect - and - exit ice shape, the Appendix C approach and landing ice is defined as the ice accreted during: — a descent in the cruise configuration from the maximum vertical extent of the Appendix C continuous maximum icing environment to 610 m (2 000 feet) above the landing surface, — a transition to the approach configuration and manoeuvring for 15 minutes at 610 m (2 000 feet) above the landing surface, and — a descent from 610 m (2 000 feet) to 61 m (200 feet) above the landing surface with a transition to the landing configuration.

Ice Accretion Before the Ice Ice accreted on protected and unprotected surfaces during the time it takes Protection System Has for icing conditions (ei ther Appendix C or Appendix O) to be detected, the ice Been Activated and is protection system to be activated, and the ice protection system to become Performing its Intended fully effective in performing its intended function.

Function Ice Accretion in Appendix O Ice accreted on protected and unprotected surfaces during: Conditions Before Those — the time it takes to detect an d identify Appendix O conditions (based on Conditions Have Been the method of detection) beyond those in which the aeroplane is Detected by the Flight crew certified to operate, and and Actions Taken, in — the time it takes the flight crew to refer to and act on procedures, Accordance With the AFM, including coordinating with Air Traffic Control, to e xit all icing conditions.

to Either Exit All Icing Conditions or Continue — a minimum time period of two minutes should be used as the time Flight in Appendix O Icing needed for the flight crew to refer to and act on the procedures to exit Conditions all icing conditions after the Appendix O icing conditions are recognised.

Failures of the I ce No accretion Protection System Notes: Intentional flight, including Take - off, is not permitted into Appendix O conditions beyond those in which the aeroplane is certified to operate.

It is not necessary to consider an unintentional encounter wit h Appendix O icing conditions beyond those in which the aeroplane is certified to operate while operating with a failed ice protection system.

Powered by EASA eRules Page 94 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENER AL A1.4.3 Ice Accretions for Encounters with Appendix O Atmospheric Icing Conditions in Which the Aeroplane is Certi fied to Operate.

a. The applicant should use the ice accretions in Table 2 to evaluate compliance with the applicable CS - 25 subpart B requirements for operating safely in the Appendix O atmospheric icing conditions for which approval is sought.

b. The de cision about which ice accretions to use should include consideration of combinations of Appendix C and Appendix O icing conditions within the scenarios defined in paragraph A1.4.3(c) of this appendix. For example, flight in Appendix O conditions may resul t in ice accumulating, and potentially forming a ridge, behind a protected surface. Once this accretion site has been established, flight in Appendix C icing conditions for the remaining portion of the applicable flight phase scenario may result in a more critical additional accretion than would occur for continued flight in Appendix O icing conditions.

c. Table 2 shows the scenarios the applicant should use for determining ice accretions for certification for flight in the icing conditions of Appendix O t o CS - 25.

Table 2 Flight Phase/Condition Appendix O Ice Accretion Ground Roll No accretion Take - off Take - off Ice Ice accretion occurring between the end of the take - off distance and 122 m (400 feet) above the take - off surface assuming ice accretion starts at the end of the take - off distance.

Final Take - off Final Take - off Ice Ice accretion occurring between a height of 122 m (400 ft) above the take - off surface and the height at which the transition to the en - route configuration and speed is completed, or 457 m (1 500 feet) above the take - off surface, whichever is higher, assuming ice accretion starts at the end of the take - off distance.

En Route En Route Ice Ice accreted during the en route phase of flight.

Holding Holding Ice Ice accreted during a 45 - minute hold with no reduction for horizontal cloud extent (that is, the hold is conducted entirely within the 32.2 km (17.4 nautical mile) standard cloud extent).

Approach Approach Ice More critical ice accretion of: (1) Ice accr eted during a descent in the cruise configuration from the maximum vertical extent of the Appendix O icing environment to 610 m (2 000 feet) above the landing surface, followed by: — transition to the approach configuration and — manoeuvring for 15 minutes at 610 m (2 000 feet) above the landing surface; or (2) Holding ice (if the aeroplane is certified for holding in Appendix O conditions).

Landing Landing Ice More critical ice accretion of: (1) Approach ice plus ice accreted during descent from 610 m (2 000 feet) above the landing surface to 61 m (200 feet) above the landing surface with: Powered by EASA eRules Page 95 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL Flight Phase/Condition Appendix O Ice Accretion — a transition to the landing configuration, followed by — a go - around manoeuvre beginning with the minimum climb gradient specified in CS 25.119 from 61 m (200 feet) to 61 0 m (2 000 feet) above the landing surface, and — holding for 15 minutes at 610 m (2 000 feet) above the landing surface in the approach configuration, and — a descent to the landing surface in the landing configuration, or (2) Holding ice (if the aeroplane is certified for holding in Appendix O conditio ns).

Ice Accretion Before the Ice Ice accreted during the time it takes for the flight crew to recognise icing Protection System has been conditions and activate the ice protection system, plus the time fo r the ice Activated and is Performing protection system to perform its intended function.

its Intended Function Ice Accretion in Appendix O Ice accreted during the time it takes for the flight crew to detect Appendix O Conditions Before those conditions and refer to and initiate associated procedures, and any time it Conditions have been takes for systems to perform their intended functions (if ap plicable). Pre - Detected by the Flight crew detection ice need not be considered if there are no specific crew actions or and Actions Taken, in systems changes associated with flight in Appendix O conditions.

Accordance With the AFM, to Either Exit All Icing Conditions or Contin ue Flight in Appendix O Icing Conditions Failures of the Ice Protection Same criteria as for Appendix C (see paragraph A1.3 of this appendix), but in System Appendix O conditions.

[Amdt 25/3] [Amdt 25/16] [Amdt 25/18] Powered by EASA eRules Page 96 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

Appendix 2 – Artificial Ice Shapes

ED Decision 20 15 / 008 /R A2.1 General.

A2.1.1 The artificial ice shapes used for flight testing should be those which have the most adverse effects on handling characteristics. If analytical data show that other reasonably expected ice shapes could be generated which could produce higher performance d ecrements, then the ice shape having the most adverse effect on handling characteristics may be used for performance tests provided that any difference in performance can be conservatively taken into account.

A2.1.2 The artificial shapes should be represe ntative of natural icing conditions in terms of location, general shape, thickness and texture. Following determination of the form and surface texture of the ice shape under paragraph A2.2, a surface roughness for the shape should be agreed with the Agenc y as being representative of natural ice accretion.

A2.1.3 "Sandpaper Ice" is addressed in paragraph A2.3.

A2.2 Shape and Texture of Artificial Ice.

A2.2.1 The shape and texture of the artificial ice should be established and substantiated by agreed method s. Common practices include: — use of computer codes, — flight in measured natural icing conditions, — icing wind tunnel tests, and — flight in a controlled simulated icing cloud (e.g. from an icing tanker).

A2.2.2 In absence of another agreed definition of textu re the following may be used: — roughness height: 3 mm — particle density: 8 to 10/cm² A2.3 "Sandpaper Ice."

A2.3.1 "Sandpaper Ice" is the most critical thin, rough layer of ice. Any representation of "Sandpaper Ice" (e.g. carborundum paper no. 40) should be agreed by the Agency .

A2.3.2 Because sandpaper ice must be considered in the basic icing certification within the Appendix C environmental icing envelope, it does not need to be considered for certification of flight in Appendix O icing conditions.

A2.3. 3 The spanwise and chordwise coverage should be consistent with the areas of ice accretion determined for the conditions of CS - 25, Appendix C except that, for the zero g pusho ver manoeuvre of paragraph 6.9.4 of thi s AMC, the "Sandpaper Ice" may be restricted to the horizontal stabiliser if this can be shown to be conservative.

[Amdt 25/3] [Amdt 25/16] Powered by EASA eRules Page 97 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

Appendix 3 – Design Features

ED Decision 20 15 / 008 /R A3.1 Aeroplane Configuration and Ancestry. An important design feature of an overall aeroplane configuration that can affect performance, controllability and manoeuvrability is its size. In addition, the safety record of the aeroplane's closely - related ancestors may be taken into consideration.

A3.1.1 Size. The size of an aeroplane determines the sensitivity of its flight characteristics to ice thickness and roughness. The relative effect of a given ice height (or ice roughness height) decreases as aeroplane size increases.

A3.1.2 Ancestors. If a close ly related ancestor aeroplane was certified for flight in icing conditions, its safety record may be used to evaluate its general arrangement and systems integration.

A3.2 Wing. Design features of a wing that can affect performance, controllability, and ma noeuvrability include aerofoil type, leading edge devices and stall protection devices.

A3.2.1 Aerofoil. Aerodynamic effects of ice accretions result mainly from the effects of the ice accretion on the behaviour of the aerofoil’s boundary layer. The bounda ry layer is the layer of air close to the surface of the aerofoil that is moving across the aerofoil at a velocity lower than the freestream velocity, that is, the velocity of the aerofoil. Ice accretions that occur in areas favourable to keeping the bound ary layer attached to the aircraft surface will result in effects that are less aerodynamically adverse than ice accretions that occur in areas less favourable to attached boundary layer conditions. Ice shapes that build up in areas of local airflow decele ration (positively increasing surface pressure), or result in conditions unfavourable to keeping attached flow conditions, as the airflow negotiates the ice surface, will result in the most adverse effects.

A3.2.2 Leading Edge Device. The presence of a lea ding edge device (such as a slat) reduces the percentage decrease in C due to ice by increasing the overall level of C . Gapping the LMAX L slat may improve the situation further. Leading edge devices can also reduce the loss in angle of attack at stall due t o ice.

A3.2.3 Stall Protection Device. An aeroplane with an automatic slat - gapping device may generate a greater C with ice than the certified C with the slat sealed and a non - LMAX LMAX contaminated leading edge. This may provide effective protection against degradation in stall performance or characteristics.

A3.2.4 Lateral Control. The effectiveness of the lateral control system in icing conditions can be evaluated by comparison with closely related ancestor aeroplanes.

A3.3 Empennage. The effects of size a nd aerofoil type also apply to the horizontal and vertical tails.

Other design features include tailplane sizing philosophy, aerofoil design, trimmable stabiliser, and control surface actuation. Since tails are usually not equipped with leading edge device s, the effects of ice on tail aerodynamics are similar to those on a wing with no leading edge devices. However, these effects usually result in changes to aeroplane handling and/or control characteristics rather than degraded performance.

A3.3.1 Tail Sizi ng. The effect on aeroplane handling characteristics depends on the tailplane design philosophy. The tailplane may be designed and sized to provide full functionality in icing conditions without ice protection, or it may be designed with a de - icing or anti - icing system.

Powered by EASA eRules Page 98 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL A3.3.2 Horizontal Stabiliser Design. Cambered aerofoils and trimmable stabilisers may reduce the susceptibility and consequences of elevator hinge moment reversal due to ice - induced tailplane stall.

A3.3.3 Control Surface Actuation. Hydrauli cally powered irreversible elevator controls are not affected by ice - induced aerodynamic hinge moment reversal.

A3.3.4 Control Surface Size. For mechanical elevator controls, the size of the surface significantly affects the control force due to an ice - ind uced aerodynamic hinge moment reversal.

Small surfaces are less susceptible to control difficulties for given hinge moment coefficients.

A3.3.5 Vertical Stabiliser Design. The effectiveness of the vertical stabiliser in icing conditions can be evaluated by comparison with closely - related ancestor aeroplanes.

A3.4 Aerodynamic Balancing of Flight Control Surfaces. The aerodynamic balance of unpowered or boosted reversible flight control surfaces is an important design feature to consider. The design should be carefully evaluated to account for the effects of ice accretion on flight control system hinge moment characteristics. Closely balanced controls may be vulnerable to overbalance in icing. The effect of ice in front of the control surface, or on the surfac e, may upset the balance of hinge moments leading to either increased positive force gradients or negative force gradients.

A3.4.1 This feature is particularly important with respect to lateral flight control systems when large aileron hinge moments are ba lanced by equally large hinge moments on the opposite aileron. Any asymmetric disturbance in flow which affects this critical balance can lead to a sudden uncommanded deflection of the control. This auto deflection, in extreme cases, may be to the control stops.

A3.5 Ice Protection/Detection System. The ice protection/detection system design philosophy may include design features that reduce the ice accretion on the wing and/or tailplane.

A3.5.1 Wing Ice Protection/Detection. A primary ice detection system that automatically activates a wing de - icing or anti - icing system may ensure that there is no significant ice accretion on wings that are susceptible to performance losses with small amounts of ice.

A3.5.1.1 If the wing leading edge is not entirely protect ed, the part that is protected may be selected to provide good handling characteristics at stall, with an acceptable performance degradation.

A3.5.2 Tail Ice Protection/Detection. A primary ice detection system may automatically activate a tailplane de - icing or anti - icing system on aeroplanes that do not have visible cues for system operation.

A3.5.2.1 An ice protection system on the unshielded aerodynamic balances of aeroplanes with unpowered reversible controls can reduce the ri sk of ice - induced aerodynamic hinge moment reversal.

[Amdt 25/3] [Amdt 25/16] Powered by EASA eRules Page 99 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

Appendix 4 – Examples of Aeroplane Flight Manual Limitations and

Operating Procedures for Operations in Supercooled Large Drop

Icing Conditions

ED Decision 2015/008/R A4.1 Aeroplane approved for flight in Appendix C icing conditions but not approved for flight in Appendix O icing conditions.

a. AFM Limitations.

Intentional flight, incl uding take - off and landing, into supercooled large drop (SLD) icing conditions, which includes freezing drizzle or freezing rain, is prohibited. If freezing drizzle or freezing rain conditions are encountered, or if [insert cue description here], immediate ly request priority handling from air traffic control to facilitate a route or altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including landing, unless it can be determined that ice accreti ons no longer remain on the airframe.

b. AFM Operating Procedures (Normal Procedures Section).

Freezing drizzle and freezing rain conditions are severe icing conditions for this aeroplane.

Intentional flight, including take - off and landing, into freezing drizzle or freezing rain conditions is prohibited. A flight delay or diversion to an alternate airport is required if these conditions exist at the departure or destination airports.

[insert cue description here] is one indication of severe icing for this aeroplane. If severe icing is encountered, immediately request priority handling from air traffic control to facilitate a route or altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including l anding, unless it can be determined that ice accretions no longer remain on the airframe.

c. Flight Crew Operating Manual Operating Procedures.

Warning: Hazardous icing effects may result from environmental conditions outside of those for which this aerop lane is certified. Flight into unapproved icing conditions may result in ice build - up on protected surfaces exceeding the capability of the ice protection system, or in ice forming aft of the protected surfaces. This ice might not be shed when using the ic e protection systems, and may seriously degrade performance and controllability of the aeroplane.

Operations in icing conditions were evaluated as part of the certification process for this aeroplane. Freezing drizzle and freezing rain conditions were not evaluated and are considered severe icing conditions for this aeroplane.

Intentional flight, including take - off and landing, into freezing drizzle or freezing rain conditions is prohibited. A flight delay or diversion to an alternate airport is required if these conditions exist at the departure or destination airports. [insert cue description here] is an indication of severe icing conditions that exceed those for which this aeroplane is certified. If severe icing is encountered, immediately requ est priority handling from air traffic control to facilitate a route or altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including landing, unless it can be determined that ice accretions no longer remain on the airframe.

Powered by EASA eRules Page 100 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL A4.2. Aeroplane approved for flight in Appendix C icing conditions and freezing drizzle conditions of Appendix O but not approved for flig ht in freezing rain conditions of Appendix O .

a. AFM Limitations.

Intentional flight, including take - off and landing, into freezing rain conditions is prohibited. If freezing rain conditions are encountered, or if [insert cue description here], immediately request priority handling from air traffic control to facilitate a route or altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including landing, unl ess it can be determined that ice accretions no longer remain on the airframe.

b. AFM Operating Procedures (Normal Procedures Section).

Freezing rain conditions are severe icing conditions for this aeroplane. Intentional flight, including take - off and lan ding, into freezing rain conditions is prohibited. A flight delay or diversion to an alternate airport is required if these conditions exist at the departure or destination airports.

[insert cue description here] is one indication of severe icing for this aeroplane. If severe icing is encountered, immediately request priority handling from air traffic control to facilitate a route or altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including l anding, unless it can be determined that ice accretions no longer remain on the airframe.

c. Flight Crew Operating Manual Operating Procedures.

Warning: Hazardous icing effects may result from environmental conditions outside of those for which this aerop lane is certified. Flight into unapproved icing conditions may result in ice build - up on protected surfaces exceeding the capability of the ice protection system, or may result in ice forming aft of the protected surfaces. This ice might not be shed when u sing the ice protection systems, and may seriously degrade the performance and controllability of the aeroplane.

Operations in icing conditions, including freezing drizzle, were evaluated as part of the certification process for this aeroplane. Freezing ra in conditions were not evaluated and are considered severe icing conditions for this aeroplane.

Intentional flight, including take - off and landing, into freezing rain conditions is prohibited. A flight delay or diversion to an alternate airport is required if these conditions exist at the departure or destination airports. [insert cue description here] is an indication of severe icing conditions that exceed those for which this aeroplane is certified. If severe icing is encountered, immediately request prio rity handling from air traffic control to facilitate a route or altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including landing, unless it can be determined that ice accretions no longer r emain on the airframe.

A4.3 Aeroplane approved for flight in Appendix C and Appendix O icing conditions except for en route and holding flight phases in Appendix O icing conditions.

a. AFM Limitations.

Intentional holding or en route flight into freezing drizzle or freezing rain conditions is prohibited. If freezing drizzle or freezing rain conditions are encountered during a hold (in any aeroplane configuration) or in the en route phase of flight (climb, cruise, or descent with high lift devices and gear retracted), or if [insert cue description here], immediately request priority handling from air traffic control to facilitate a r oute or Powered by EASA eRules Page 101 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including landing, unless it can be determined that ice accretions no longer remain on the airframe.

b. AFM Operating Procedures (Normal Procedures Section).

Freezing drizzle and freezing rain conditions encountered during a hold (in any aeroplane configuration) or in the en route phase of flight (climb, cruise, or descent with high lift devices and gear retracted) are se vere icing conditions for this aeroplane. Intentional holding or en route flight into freezing drizzle or freezing rain conditions is prohibited.

[insert cue description here] is one indication of severe icing for this aeroplane. If severe icing is encount ered, immediately request priority handling from air traffic control to facilitate a route or altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including landing, unless it can be determined t hat ice accretions no longer remain on the airframe.

c. Flight Crew Operating Manual Operating Procedures.

Warning: Hazardous icing effects may result from environmental conditions outside of those for which this aeroplane is certified. Flight into unapproved icing conditions may result in ice build - up on protected surfaces exceeding the capability of the ice protection system, or in ice forming aft of the protected surfaces. This ice might not be shed when using the ice protection systems, and may s eriously degrade the performance and controllability of the aeroplane.

Operations in icing conditions were evaluated as part of the certification process for this aeroplane. En route (climb, cruise, and descent with high lift devices and gear retracted) an d holding flight (in any aeroplane configuration) in freezing drizzle and freezing rain conditions were not evaluated and are considered severe icing conditions for this aeroplane.

Intentional holding or en route flight into freezing drizzle or freezing ra in conditions is prohibited. [insert cue description here] is an indication of severe icing conditions that exceed those for which the aeroplane is certified. If severe icing is encountered, immediately request priority handling from air traffic control to facilitate a route or altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including landing, unless it can be determined that ice accretions no longer remain on the airframe.

A4.4 Aeroplane ap proved for flight in Appendix C icing conditions and a portion of Appendix O icing conditions.

a. AFM Limitations.

Intentional flight, including take - off and landing, into [insert pilot usable description here] co nditions is prohibited. If [insert pilot usable description here] conditions are encountered, or if [insert cue description here], immediately request priority handling from air traffic control to facilitate a route or altitude change to exit all icing con ditions.

Stay clear of all icing conditions for the remainder of the flight, including landing, unless it can be determined that ice accretions no longer remain on the airframe.

Powered by EASA eRules Page 102 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL b. AFM Operating Procedures (Normal Procedures Section).

[insert pilot usab le description here] are severe icing conditions for this aeroplane.

Intentional flight, including take - off and landing, into [insert pilot usable description here] conditions is prohibited. A flight delay or diversion to an alternate airport is required i f these conditions exist at the departure or destination airports.

[insert cue description here] is one indication of severe icing for this aeroplane. If severe icing is encountered, immediately request priority handling from air traffic control to facilit ate a route or altitude change to exit all icing conditions. Stay clear of all icing conditions for the remainder of the flight, including landing, unless it can be determined that ice accretions no longer remain on the airframe.

c. Flight Crew Operating Manual Operating Procedures.

Warning: Hazardous icing effects may result from environmental conditions outside of those for which this aeroplane is certified. Flight into unapproved icing conditions may result in ice build - up on protected surfaces exceedin g the capability of the ice protection system, or may result in ice forming aft of the protected surfaces. This ice may not be shed when using the ice protection systems, and may seriously degrade the performance and controllability of the aeroplane.

Opera tions in icing conditions were evaluated as part of the certification process for this aeroplane. [insert pilot usable description here] were not evaluated and are considered severe icing conditions for this aeroplane.

Intentional flight, including take - o ff and landing, into [insert pilot usable description here] is prohibited. A flight delay or diversion to an alternate airport is required if these conditions exist at the departure or destination airports. [insert cue description here] is an indication of severe icing conditions that exceed those for which this aeroplane is certified. If severe icing is encountered, immediately request priority handling from air traffic control to facilitate a route or altitude change to exit all icing conditions. Remain c lear of all icing conditions for the remainder of the flight, including landing, unless it can be determined that ice accretions no longer remain on the airframe.

[Amdt 25/16] Powered by EASA eRules Page 103 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

Appendix 5 – Related Acceptable Means of Compliance (AMC) and

FAA Advisory Cir culars (AC)

ED Decision 2015/008/R Acceptable Means of Compliance The following AMCs are related to the guidance contained in this AMC: AMC 25.1309, System Design and Analysis AMC N°. 1 to CS 25.1329, Flight Guidance System AMC N°. 2 to CS 25.1329, Flight testing of Flight Guidance Systems AMC 25.1419, Ice Protection AMC 25.1420, Supercooled large drop icing conditions Advisory Circulars The following FAA ACs are related to the guidance contained in this AMC.

AC 20 - 73A, Aircraft Ice Prot ection [Amdt 25/16] Powered by EASA eRules Page 104 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

Appendix 6 – Acronyms and definitions

ED Decision 2015/008/R AC Advisory Circular AFM Aeroplane Flight Manual ATTCS Automatic Takeoff Thrust Control System FAA Federal Aviation Administration ICTS Ice - Contaminated Tailplane Stall.

LWC Liquid Water Content MED Mean Effective Diameter MVD Median Volume Diameter CL Lift Coefficient C Maximum Lift Coefficient LMAX Trim A flight condition in which the aerodynamic moment acting about the axis of interest is zero. In the absence of an external disturbance no control input is needed to maintain the flight condition.

[Amdt 25/16] Powered by EASA eRules Page 105 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

CS 25.23 Load distribution limits

ED Decis ion 2003/ 2/RM (a) Ranges of weights and centres of gravity within which the aeroplane may be safely operated must be established. If a weight and centre of gravity combination is allowable only within certain load distribution limits (such as spanwise) tha t could be inadvertently exceeded, these limits and the corresponding weight and centre of gravity combinations must be established.

(b) The load distribution limits may not exceed – (1) The selected limits; (2) The limits at which the structure is proven ; or (3) The limits at which compliance with each applicable flight requirement of this Subpart is shown.

CS 25.25 Weight Limits

ED Decision 2003/ 2/RM (a) Maximum weights. Maximum weights corresponding to the aeroplane operating conditions (such as ramp, g round taxi, take - off, en - route and landing) environmental conditions (such as altitude and temperature), and loading conditions (such as zero fuel weight, centre of gravity position and weight distribution) must be established so that they are not more tha n – (1) The highest weight selected by the applicant for the particular conditions; or (2) The highest weight at which compliance with each applicable structural loading and flight requirement is shown.

(3) The highest weight at which compliance is shown with the n oise certification requirements .

(b) Minimum weight. The minimum weight (the lowest weight at which compliance with each ap plicable requirement of this CS - 25 is shown) must be established so that it is not less than – (1) The lowest weight selected by the applicant; (2) The design minimum weight (the lowest weight at which compliance with each structur al loading condition of this CS - 25 is shown); or (3) The lowest weight at which compliance with each applicable flight requirement is shown.

CS 25.27 Centre of gravity limits

ED Decision 2003/2/RM The extreme forward and the extreme aft centre of gravity limitations must be established for each practicably sep arable operating condition. No such limit may lie beyond – (a) The extremes selected by the applicant; (b) The extremes within which the structure is proven; or (c) The extremes within which compliance with each applicable flight requirement is shown.

Powered by EASA eRules Page 106 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GENERAL

C S 25.29 Empty weight and corres ponding centre of gravity

ED Decision 2003/ 2/RM (a) The empty weight and corresponding centre of gravity must be determined by weighing the aeroplane with – (1) Fixed ballast; (2) Unusable fuel determined under CS 25.959 ; and (3) Full operating fluids, including – (i) Oil; (ii) Hydraulic fluid; and (iii) Other fluids required for normal operation of aeroplane systems, except potable water, lavatory pre - charge water, and fluids intende d for injection in the engine.

(b) The condition of the aeroplane at the time of determining empty weight must be one that is well defined and can be easily repeated.

CS 25.31 Removable ballast

ED Decision 2003/2/RM Removable ballast may be used in showin g compliance with the flight requirements of this Subpart.

CS 25.33 Propeller speed and pitch limits

ED Decision 2003/ 2/RM (a) The propeller speed and pitch must be limited to values that will ensure – (1) Safe operation under normal operating conditions; and (2)Compliance with the performance requirements in CS 25.101 to 25.125 .

(b) There must be a propeller speed limiting means at the governor. It must limit th e maximum possible governed engine speed to a value not exceeding the maximum allowable rpm.

(c) The means used to limit the low pitch position of the propeller blades must be set so that the engine does not exceed 103% of the maximum allowable engine rpm or 99% of an approved maximum overspeed, whichever is greater, with – (1) The propeller blades at the low pitch limit and governor inoperative; (2) The aeroplane stationary under standard atmospheric conditions with no wind; and (3) The engin es operating at the maximum take - off torque limit for turbopropeller engine - powered aeroplanes.

Powered by EASA eRules Page 107 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE

PERFORMANCE

CS 25.101 General

ED Decision 2016 / 010 /R (See AMC 25.101 ) (a) Unless otherwise prescribed, aeroplanes mus t meet the applicable performance requirements of this Subpart for ambient atmospheric conditions and still air.

(b) The performance, as affected by engine power or thrust, must be based on the following relative humidities: (1) 80%, at and below standard temperatures; and (2) 34%, at and abov e standard temperatures plus 28 ° C (50 ° F).

Between these two temperatures, the relative humidity must vary linearly.

(c) The performance must correspond to the propulsive thrust available under the particular ambient atmospheric conditions, the particular flight condition, and the relative humidity specified in sub - paragraph (b) of this paragraph. The available propulsive thrust must correspond to engine power or thrust, not exceeding the approved power or thrust, less – (1) Installation losses; and (2) The power or equivalent thrust absorbed by the accessories and services appropriate to the particular ambient atmospheric conditions and the particular flight condition. (See AMCs No 1 and No 2 to CS 25.101(c) .)

(d) Unless otherwise prescribed, the applicant must select the take - off, en - route, approach, and landing configuration for the aeroplane.

(e) The aeroplane configurations may va ry with weight, altitude, and temperature, to the extent they are compatible with the operating procedures required by sub - paragraph (f) of this paragraph.

(f) Unless otherwise prescribed, in determining the accelerate - stop distances, take - off flight paths , take - off distances, and landing distances, changes in the aeroplane’s configuration, speed, power, and thrust, must be made in accordance with procedures established by the applicant for operation in service.

(g) Procedures for the execution of balked la ndings and missed approaches associated with the conditions prescribed in CS 25.119 and 25.121(d) must be established. (See AMC 25.101(g)) (h) The procedures established un der sub - paragraphs (f) and (g) of this paragraph must – (1) Be able to be consistently executed in service by crews of average skill, (2) Use methods or devices that are safe and reliable, and (3) Include allowance for any time delays in t he execution of t he procedures, that may reasonably be expected in service. (See AMC 25.101(h)(3) .)

(i) The accelerate - stop and landing distances prescribed in CS 25.109 and 25.125 , respectively, must be determined with all the aeroplane wheel brake assemblies at the fully worn limit of their allowable wear range. (See AMC 25.101(i) .)

[Amdt 25/2] [Amdt 25/18] Powered by EASA eRules Page 108 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE

AMC 25.101 General

ED Decision 2003/2/RM The test aeroplane used in the determination of the scheduled performance should be in a condition which, as far as is reasonably possible, is representative of the average new production aeroplane.

Where the test aeroplane differs from this standard (e.g. with regard to engine idle thrust settings, flap rigging, etc.) it will be necessary to correct the measured performance for any significant performance effects of such differences.

AMC No. 1 to CS 25.101(c) Extrapolation of Performance with

Weight

ED De cision 2003/ 2/RM The variation of take - off, climb and landing performance with weight may be extrapolated without conservatism to a weight greater, by up to 10%, than the maximum weight tested and to a weight lower, by up to 10%, than the lowest weight tes ted. These ranges may not be applicable if there are significant discontinuities, or unusual variations, in the scheduling of the relevant speeds with weight, in the weight ranges covered by extrapolation.

AMC No. 2 to CS 25.101(c) General

ED Decision 200 3/ 2/RM 1 GENERAL - CS 25.101 1.1 Explanation - Propulsion System Behaviour. CS 25.101(c) requires that aeroplane “performance must correspond to the propulsive thrust available under the particular ambient atmosph eric conditions, the particular flight condition, . . .” The propulsion system’s (i.e., turbine engines and propellers, where appropriate) installed performance characteristics are primarily a function of engine power setting, airspeed, propeller efficienc y (where applicable), altitude, and ambient temperature. The effects of each of these variables must be determined in order to establish the thrust available for aeroplane performance calculations.

1.2 Procedures.

1.2.1 The intent is to develop a model o f propulsion system performance that covers the approved flight envelope. Furthermore, it should be shown that the combination of the propulsion system performance model and the aeroplane performance model are validated by the takeoff performance test data , climb performance tests, and tests used to determine aeroplane drag. Installed propulsion system performance characteristics may be established via the following tests and analyses: a. Steady - state engine power setting vs. thrust (or power) testing. Eng ines should be equipped with adequate instrumentation to allow the determination of thrust (or power). Data should be acquired in order to validate the model, including propeller installed thrust, if applicable, over the range of power settings, altitudes, temperatures, and airspeeds for which approval is sought. Although it is not possible to definitively list or foresee all of the types of instrumentation that might be considered adequate for determining thrust (or power) output, two examples used in past certification programmes are: (1) engine pressure rakes, with engines calibrated in a ground test cell, and (2) fan speed, with engines calibrated in Powered by EASA eRules Page 109 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PER FORMANCE a ground test cell and the calibration data validated by the use of a flying test bed. In any case, the a pplicant should substantiate the adequacy of the instrumentation to be used for determining the thrust (or power) output.

b. Lapse rate takeoff testing to characterise the behaviour of power setting, rotor speeds, propeller effects (i.e., torque, RPM, and blade angle), or gas temperature as a function of time, thermal state, or airspeed, as appropriate. These tests should include the operation of an Automatic Takeoff Thrust Control System (ATTCS), if applicable, and should cover the range of power settings for which approval is sought.

i. Data for higher altitude power settings may be acquired via overboost (i.e., operating at a higher than normal power setting for the conditions) with the consent of the engine and propeller (when applicable) manufacturer( s). When considering the use of overboost on turbopropeller propulsion system installations to simulate higher altitude and ambient temperature range conditions, the capability to achieve an appropriate simulation should be evaluated based on the engine an d propeller control system(s) and aircraft performance and structural considerations. Engine (gearbox) torque, rotor speed, or gas temperature limits, including protection devices to prohibit or limit exceedences, may prevent the required amount of overboo st needed for performance at the maximum airport altitude sought for approval.

Overboost may be considered as increased torque, reduced propeller speed, or a combination of both in order to achieve the appropriate blade angle for the higher altitude and am bient temperature range simulation. Consideration for extrapolations will depend on the applicant’s substantiation of the proper turbopropeller propulsion system simulated test conditions.

ii. Lapse rate characteristics should be validated by takeoff demo nstrations at the maximum airport altitude for which takeoff approval is being sought. Alternatively, if overboost (see paragraph (i) above) is used to simulate the thrust setting parameters of the maximum airport altitude for which takeoff approval is sou ght, the takeoff demonstrations of lapse rate characteristics can be performed at an airport altitude up to 915 m (3,000 feet) lower than the maximum airport altitude.

c. Thrust calculation substantiation. Installed thrust should be calculated via a mathe matical model of the propulsion system, or other appropriate means, adjusted as necessary to match the measured inflight performance characteristics of the installed propulsion system. The propulsion system mathematical model should define the relationship of thrust to the power setting parameter over the range of power setting, airspeed, altitude, and temperature for which approval is sought. For turbojet aeroplanes, the propulsion system mathematical model should be substantiated by ground tests in which thrust is directly measured via a calibrated load cell or equivalent means. For turbopropeller aeroplanes, the engine power measurements should be substantiated by a calibrated dynamometer or equivalent means, the engine jet thrust should be established by an Powered by EASA eRules Page 110 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE acceptable engine model, and the propeller thrust and power characteristics should be substantiated by wind tunnel testing or equivalent means.

d. Effects of ambient temperature. The flight tests of paragraph 1.2.1.a. above will typically provide data over a broad range of ambient temperatures.

Additional data may also be obtained from other flight or ground tests of the same type or series of engine. The objective is to confirm that the propulsion system model accurately reflects the effects of temper ature over the range of ambient temperatures for which approval is being sought (operating envelope). Because thrust (or power) data can usually be normalised versus temperature using either dimensionless variables (e.g., theta exponents) or a thermodynami c cycle model, it is usually unnecessary to obtain data over the entire ambient temperature range. There is no need to conduct additional testing if: i. The data show that the behaviour of thrust and limiting parameters versus ambient temperature can be p redicted accurately; and ii. Analysis based upon the test data shows that the propulsion system will operate at rated thrust without exceeding propulsion system limits.

1.2.2 Extrapolation of propulsion system performance data to 915 m (3,000 feet) above the highest airport altitude tested (up to the maximum takeoff airport altitude to be approved) is acceptable, provided the supporting data, including flight test and propulsion system operations data (e.g., engine and propeller control, limits exceedence , and surge protection devices scheduling), substantiates the proposed extrapolation procedures. Considerations for extrapolation depend upon an applicant's determination, understanding, and substantiation of the critical operating modes of the propulsion system. This understanding includes a determination and quantification of the effects that propulsion system installation and variations in ambient conditions have on these modes.

2 Expansion of Takeoff and Landing Data for a Range of Airport Elevations.

2.1 These guidelines are applicable to expanding aeroplane Flight Manual takeoff and landing data above and below the altitude at which the aeroplane takeoff and landing performance tests are conducted.

2.2 With installed propulsion system performance characteristics that have been adequately defined and verified, aeroplane takeoff and landing performance data obtained at one field elevation may be extrapolated to higher and lower altitudes within the limits of the operating envelope without applying additional performance conservatisms. It should be noted, however, that extrapolation of the propulsion system data used in the determination and validation of propulsion system performance characteristics is typi cally limited to 915 m (3,000 feet) above the highest altitude at which propulsion system parameters were evaluated for the pertinent power/thrust setting. (See paragraph 1 of this AMC for more information on an acceptable means of establishing and verifyi ng installed propulsion system performance characteristics.)

2.3 Note that certification testing for operation at airports that are above 2438 m (8,000 feet) should also include functional tests of the cabin pressurisation system. Consideration should be given to any other systems whose operation may be sensitive to, or dependent upon airport altitude, such as: engine and APU starting, passenger oxygen, autopilot, autoland, autothrottle system thrust set/operation."

Powered by EASA eRules Page 111 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE

AMC 25.101(g) Go - around

ED Decision 202 0/024/R 1. General CS 25.101(g) requires that procedures must be established for the execution of go - arounds from landing configurations (identified as ‘balked landings’ in this AMC) and from approach configurati ons (identified as ‘missed approaches’ in this AMC) associated with the conditions prescribed in CS 25.119 and CS 25.121(d) . Also, as required by CS 25.1587(b)(4) , each AFM must contain the procedures established under CS 25.101(g) , including any relevant limitations or information. The landing climb gradient determined under the CS 25.119 conditions, the approach climb gradient determined under the CS 25.121(d) conditions, and the additional operating limitations regarding the maximum landing weight establishe d in accordance with CS 25.1533(a)(2) must be consistent with the established balked landing and missed approach procedures ( CS 25.101(g) ) provided in the aeroplane flight manual (AFM). In order to demonstrate the acceptability of the recommended missed approach and balked landing procedures, the applicant should conduct demonstrations (by flight test or pilot - in - the - loop simulator tests) to include a one engine inoperative go - around at a weight, altitude, temperature (WAT) - limited or simulated WAT - limited thrust or power condition.

The applicant should conduct the demonstrations at WAT - limited conditions that result in the greatest height loss and/or longest horizontal distance to accelerate to the scheduled approach climb speed. Alternatively, the applicant may conduct testing at si mulated WAT - limited conditions (with reduced thrust or power on the operating engine) and use the resulting time delays for each crew action in a subsequent off - line simulation/analysis in accordance with the procedures below. Although compliance with CS 25.101(g) and (h) and CS 25.121(d) is not directly linked with the criteria for the approval of weather minima for approach, the minimum decision height for initiating a go - around is dependent upon the weather minima to be approved. In addition, a steeper climb gradient and the associated lower WAT - limited landing weight may be associated with CAT II operations. As such, if CAT II weather minima approval is expected, the appl icant should conduct the go - around demonstration and/or analysis consistent with both CAT I and II operations for the associated decision height and WAT - limited thrust or power condition (or a critical combination thereof).

2 . Procedures The go - around demo nstration specified in Chapter 1 of this AMC can be conducted at an altitude above the normal decision height/altitude (for test safety), with the height loss in the manoeuvre used to show that ground contact prior to the runway threshold would not occur i f the manoeuvre was initiated at the decision height/altitude. Flight testing, simulation and/or analysis at a range of (WAT limit or simulated WAT limit) conditions throughout the approved envelope should be conducted to assess the height loss relative to the decision height/altitude consistent with the criteria for the weather minima to be approved (or higher as constrained by AFM limitations). At least one flight test or pilot - in - the - loop simulator test should be conducted at a WAT - limited condition to a ssess the OEI go - around procedure and establish the time delays used for any subsequent analysis/simulation.

In addition, the assessment of the go - around procedure should include consideration of the horizontal distance (based upon the minimum go - around tr ajectory) needed to establish the minimum engine - out climb gradient required by CS 25.121(d) or a steeper gradient as required by specific weather minima operational criteria. It should be shown by flight test, sim ulation and/or analysis that the aeroplane would remain above the profile illustrated in Figure 1 below when the go - around is evaluated at the critical WAT limit condition (up to the structural Powered by EASA eRules Page 112 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE maximal landing weight) and flown in accordance with the one - e ngine - inoperative (OEI) go - around procedure.

This provides a minimum design standard trajectory for a missed approach with one engine inoperative and does not constitute a means to ensure obstacle clearance. It does not preclude additional missed approach procedures that may be developed to satisfy operational requirements, including special or complex missed approach path requirements. The operator should seek approval from their national aviation authority to use the additional procedures and data.

(a) In accordance with CS 25.101(h) , the established procedures for executing balked landings and missed approaches must: (i) be able to be consistently executed in service by crews of average skill, (ii) use methods or devices that are safe and reliable, and (iii) include allowance for any time delays in the execution of the procedures that may reasonably be expected in service (including the recovery of full go - around thrust or power if equipped with a reduced go - around (RGA) thrust or power function that requires a manual override), but should not be less than one second between successive flight crew actions, except for movements of the primary flying controls.

(b) The flight test demonstration(s), simulation and/or an alysis should be made with: (i) all engines operating (AEO) and the thrust or power initially set for a 3 - degree approach, and the configuration and final approach airspeed consistent with the AEO landing procedure (not more than V + 5 kt) in zero wind conditions, REF (ii) application of the available go - around thrust or power at the selected go - around height (initially the RGA thrust or power level, if so equipped, followed by either automatic or manual selection of full go - around thrust or power in accorda nce with the established missed approach and engine failure AFM procedures) with simultaneous failure of the critical engine (or with a simulated engine failure, including the effects on dependent systems), and (iii) the high - lift system, pitch attitude, engine/propeller controls and airspeed adjusted to achieve the conditions consistent with CS 25.121(d) , in accordance with the established missed approach and engine failure AF M procedures. The landing gear should be selected to the ‘up’ position only after a positive rate of climb is achieved. If the use of automatic features (autopilot, auto - throttle, flight director, etc.) is included in the procedure, these features should b e considered during the demonstration.

Powered by EASA eRules Page 113 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE Figure 1. Trajectory Assessment for OEI Go - around Segment A : From the initiation of go - around at the decision height/altitude to the runway threshold – remain above a 1:50 (2.0 %) plane extended to the runway threshold for clearance of airport obstacles.

Segment B : From the runway threshold plus a distance defined by 40 seconds * V , not more T_appr than the distance indicated in the table below – remain above ground height.

Field Elevation (ft) Distance ( ft) 0 - 3 048 m (0 - 10 000 ft) 3 048 m (10 000 ft) >3 048 m (> 10 000 ft) = Field Elevation Segment C : A straight line from the end of Segment B at ground height with a gradient defined by CS 25.121(d)(1) or a ste eper gradient as required by specific weather minima operational criteria, up to a height, H1 – remain above the line.

Where: V is the true airspeed for the normal recommended AEO approach speed in zero T_appr wind at the flight condition being assessed (no t more than V + 9.3 km/h (5 kt) CAS).

REF H is the height above the runway elevation where the aeroplane has achieved the approach climb configuration and stabilised on the approach climb speed out of ground effect (1x the wingspan), not less than the heig ht at which the go - around was initiated.

[Amdt 25/13] [Amdt 25/ 26 ]

AMC 25.101(h)(3) General

ED Decision 2003/ 2/RM CS 25.109(a) and (b) require the accelerate - stop distance to include a distance equivalent to 2 seconds at V in addition to the demonstrated distance to accelerate to V and then bring the aeroplane to a 1 1 full stop. This additional distance is not intended to allow extra time for making a decision to stop as the aeroplane passes through V , but is to account for operational variability in the time it takes pilots to accomplish the actions necessary to bring the aeroplane to a stop. It allows for the typical requirement for up to three pilot actions (i.e. brakes – throttles – spoilers) without introducing additional time delays to those demonstrated. If the procedures require more than three pilot actions, an allowance for time delays must be made in the scheduled accelerate - sto p distance. These delays, which are applied in addition to the demonstrated delays, are to be 1 second (or 2 seconds if a command to another crew member to take the action is required) for each action beyond the third action. This is illustrated in Figure 1.

Powered by EASA eRules Page 114 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE * 2 sec. where a command to another crew member is required.

FIGURE 1. ACCELERATE - STOP TIME DELAYS where: – V is the calibrated airspeed selected by the applicant at which the critical engine is assumed to fail.

EF The relationship between V and V is defined in CS 25.107 .

EF 1 ∆t = the demonstrated time interval between engine failure and activation of the first deceleration act 1 device. This time interval is defined as beginning at the instant the critical engine is failed and ending when the pilot recognises and reacts to the engine failure, as indicated by the pilot’s application of the first retarding means during accelerate - stop tests. A sufficient number of demonstrations should be conducted using both applicant and Agency test pilots to assure that the time increment is represent ative and repeatable. The pilot’s feet should be on the rudder pedals, not the brakes, during the tests. For AFM data expansion purposes, in order to provide a recognition time increment that can be executed consistently in service, this time increment sho uld be equal to the demonstrated time or 1 second, whichever is greater. If the aeroplane incorporates an engine failure warning light, the recognition time includes the time increment necessary for the engine to spool down to the point of warning light ac tivation, plus the time increment from light ‘on’ to pilot action indicating recognition of the engine failure.

∆t = the demonstrated time interval between activation of the first and second deceleration act 2 devices.

∆t = the demonstrated time inte rval between activation of the second and third deceleration act 3 devices.

∆t = the demonstrated time interval between activation of the third and fourth (and any act 4→n subsequent) deceleration devices. For AFM expansion, a 1 - second reaction time delay to acc ount for in - service variations should be added to the demonstrated activation time interval between the third and fourth (and any subsequent) deceleration devices. If a command is required for another crew member to actuate a deceleration device, a 2 - secon d delay, in lieu of the 1 - second delay, should be applied for each action. For automatic deceleration devices that are approved for performance credit for AFM data expansion, established systems actuation times determined during certification testing may b e used without the application of the additional time delays required by this paragraph.

Powered by EASA eRules Page 115 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE

AMC 25.101(i) Performance determination with worn brakes

ED Decision 2003/2/RM It is not necessary for all the performance testing on the aircraft to be conducted with fully worn brakes. Sufficient data should be available from aircraft or dynamometer rig tests covering the range of wear and energy levels to enable correction of the flight test results to the 100% worn level. The only aircraft test that should be carried out at a specific brake wear state is the maximum kinetic energy rejected take - off test of CS 25.109(i) , for which all brake s should have not more than 10% of the allowable brake wear remaining.

CS 25.103 Stall speed

ED Decision 20 16 / 010 /R (See AMC 25.103) (a) The reference stall speed V is a calibrated airspeed defined by the applicant. V may not be SR SR less than a 1 - g stall speed. V is expressed as: SR 𝑉 𝐶𝐿𝑀𝐴𝑋 𝑉𝑆𝑅 ≥ 𝑛 √ 𝑧𝑤 where – 𝑛 𝑊 𝑧𝑤 V = Calibrated airspeed obtained when the loadfactor - corrected lift coefficient ( ) is CLMAX 𝑞𝑆 first a maximum during the manoeuvre prescribed in sub - paragraph (c) of this paragraph.

In addition, when the manoeuvre is limited by a device that abruptly pushes the nose down at a selected angle of attack (e.g. a stick pusher), V may not be les s than the CLMAX speed existing at the instant the device operates; n = Load factor normal to the flight path at V ; zw CLMAX W = Aeroplane gross weight; S= Aerodynamic reference wing area; and q= Dynamic pressure.

(b) V is determined with: CLMAX (1) Engines i dling, or, if that resultant thrust causes an appreciable decrease in stall speed, not more than zero thrust at the stall speed; (2) Propeller pitch controls (if applicable) in the take - off position; (3) The aeroplane in other respects (such as flaps , land ing gear , and ice accretions ) in the condition existing in the test or performance standard in which V is being used; SR (4) The weight used when V is being used as a factor to determine compliance with a SR required performance standard; (5) The centre of g ravity position that results in the highest value of reference stall speed; and (6) The aeroplane trimmed for straight flight at a speed selected by the applicant, but not less than 1.13 V and not greater than 1.3 V . (See AMC 25.103(b)) SR SR (c) Starting fr om the stabilised trim condition, apply the longitudinal control to decelerate the aeroplane so that the speed reduction does not exceed 0.5 m/s (one knot per second). (See AMC 25.103(b) and (c) ).

Powered by EASA eRules Page 116 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (d) In addition to the requirements of sub - paragraph (a) of this paragraph, when a device that abruptly pushes the nose down at a selected angle of attack (e.g. a stick pusher) is installed, the reference s tall speed, V , may not be less than 3,7 km/h (2 kt) or 2%, whichever is greater, SR above the speed at which the device operates. (See AMC 25.103(d)) [Amdt 25/3] [Amdt 25/18]

AMC 25.103(b) Stalling s peed

ED Decision 2003/ 2/RM The airplane should be trimmed for hands - off flight at a speed 13 percent to 30 percent above the anticipated V SR with the engines at idle and the airplane in the configuration for which the stall speed is being determined. Then, using only the primary longitudinal control for s peed reduction, a constant deceleration (entry rate) is maintained until the airplane is stalled, as defined in CS 25.201(d) .

Following the stall, engine thrust may be used as desired to expedite the recovery.

The analysis to determine V should disregard any transient or dynamic increases in recorded load CLMAX factor, such as might be generated by abrupt control inputs, which do not reflect the lift capability of the aeroplane. The load factor normal to the flight path should be nominally 1.0 until V is reached.

CLMAX

AMC 25.103(c) Stall s peed

ED Decision 2003/ 2/RM The stall entry rate is defined as the mean rate of speed reduction (in m/s (knots CAS/second)) in the deceleration to the stall in the particular stall demonstration, from a speed 10% above that stall speed, i.e.

1 ∙ 1 𝑉 − 1 ∙ 0 𝑉 𝐶𝐿𝑀𝐴𝑋 𝐶𝐿𝑀𝐴𝑋 𝐸𝑛𝑡𝑟𝑦 𝑅𝑎𝑡𝑒 = ( 𝑚 / 𝑠 ( 𝑘𝑛𝑜𝑡𝑠 𝐶𝐴𝑆 / 𝑠𝑒𝑐 ) ) 𝑇𝑖𝑚𝑒 𝑡𝑜 𝑑𝑒𝑐𝑒𝑙𝑒𝑟𝑎𝑡𝑒 𝑓𝑟𝑜𝑚 1 ∙ 1 𝑉 𝑡𝑜 𝑉 𝐶𝐿𝑀𝐴𝑋 𝐶𝐿𝑀𝐴𝑋

AMC 25.103(d) Stall s peed

ED Decision 2003/ 2/RM In the case where a device that abruptly pushes the nose down at a selected angle of attack (e.g. a stick pusher) operates after C , the speed at which the device operates, stated in CS 25.103(d) , need LMAX not be corrected to 1g.

Test procedures should be in accordance with AMC 25.103(b) to ensure that no abnormal or unusual pilot control input is used to obtain an artificially low device activation speed.

CS 25.105 Take - off

ED Decision 2015 / 008 /R ( a ) The take - off speeds pr escribed by CS 25.107 , the accelerate - stop distance pr escribed by CS 25.109 , the take - off path pr escribed by CS 25.111 , the take - off distance and take - off run pr escribed by CS 25.113 , and the net take - off flight path prescribed by CS 25.115 , must be determined in the selected configuration for take - off at each weight, altitude, and ambient temperature within the operational limits selected by the applicant - Powered by EASA eRules Page 117 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (1) In non - icing conditions; and (2) In icing conditions, if in the configurati on used to show compliance with CS 25.121(b) , and with the most critical of the “Take - off Ice” accretion(s) defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) : (i) The stall speed at maximum take - off weight exceeds that in non - icing conditions by more than the greater of 5. 6 km/h (3 knots) CAS or 3% of VSR; or (ii) The degradation of the gradient of climb determined in accordance with CS 25.121(b) is greater than one - half of the applicable actual - to - net take - off flight path gradient reduction defined in CS 25.115(b) .

( b ) No take - off made to determine the data required by this paragraph may require exceptional piloting skill or alertness.

(c) The take - off data must be based on: (1) Smooth, dry and wet, hard - surfaced runways; and (2) At the option of the applicant, grooved or p orous friction course wet, hardsurfaced runways.

(d) The take - off data must include, within the established operational limits of the aeroplane, the following operational correction factors: (1) Not more than 50% of nominal wind components along the take - o ff path opposite to the direction of take - off, and not less than 150% of nominal wind components along the take - off path in the direction of take - off.

(2) Effective runway gradients.

[Amdt 25/3] [Amdt 25/16]

CS 25.107 Take - off speeds

ED Decision 2016 / 010 /R (a) V 1 must be established in relation to V EF as follows: (1) V is the calibrated airspeed at which the critical engine is assumed to fail. V must be EF EF selected by the applicant, but may not be less than V determined under CS 25.149(e) .

MCG (2) V , in terms of calibrated airspeed, is selected by the applicant; however, V may not be 1 1 less than V plus the speed gained with the critical engine inoperative during the time EF interval between the instant at which the critical engine is failed, and the instant at which the pilot recognises and reacts to the engine failure, as indicated by the pilot’s initiation of the first action (e.g. applying brakes, reducing thrust, deploying speed brakes) to stop the aeroplane during accelerate - stop tests.

(b) V , in terms of calibrated airspeed, may not be less than – 2MIN (1) 1·13 V for – SR (i) Two - engined and three - engined turbo - propeller powered aeroplanes; and (ii) Turbojet powered aeroplanes without provisions for obtaining a significant reduction in the one - engineinoperative power - on stall speed; Powered by EASA eRules Page 118 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (2) 1·08 V for – SR (i) Turbo - propeller powered aeroplanes with more than three engines; and (ii) Turbojet powered aeroplanes with provisions for obtaining a significant reduction in the one - engine - inoperative power - on stall speed: and (3) 1·10 times V established under CS 25.149 .

MC ( c ) V , in terms of calibrated airspeed, must be selected by the applicant to provide at least the gradient of climb required by CS 25.121(b) but may not be less than – (1) V ; 2MIN (2) V plus the speed increment attained (in accordance with CS 25.111(c)(2) ) before R reaching a height of 11 m (35 ft) above the takeoff surface; and (3) A speed that provides the manoeuvring capability specified in CS 25.143(h) .

( d ) V is the calibrated airspeed at and above which the aeroplane can safely lift off the ground, MU and continue the take - off. V speeds must be selected by the applicant throughout the range MU of thrust - to - weight ratios to be certificated . These speeds may be established from free air data if these data are verified by ground take - off tests. (See AMC 25.107(d) .)

( e ) V , in terms of calibrated air speed, must be selected in accordance with the conditions of sub - R paragraphs (1) to (4) of this paragraph: (1) V may not be less than – R (i) V ; (ii) 105% of V ; MC (iii) The speed (determined in accordance with CS 25.111(c)(2) ) that allows reaching V before reaching a height of 11 m (35 ft) above the take - off surface; or (iv) A speed that, if the aeroplane is rotated at its maximum practicable rate, will result in a V of not less than - LOF (A) 110% of V in the allengines - operating condition, and 105 % of V MU MU determined at the thrust - to - weight ratio corresponding to the one - engine - inoperative condition; or (B) If the V attitude is limited by the geometry of the aeroplane (i.e., tail MU contact with the runway), 108% of V in the all - engines - operating c ondition MU and 104% of V determined at the thrust - to - weight ratio corresponding to MU the one - engine - inoperative condition. (See AMC 25.107(e)(1)(iv) .)

(2) For any given set of conditions (such as weight, configuration, and temperature), a single value of V , obtained in accordance with this paragraph, must be used to show R compliance with both the one - engine - inoperative and the all - engines - operating take - off provisions.

(3) It must be shown that the one - eng ine - inoperative take - off distance, using a rotation speed of 9.3 km/h (5 knots) less than V established in accordance with sub - paragraphs R (e)(1) and (2) of this paragraph, does not exceed the corresponding one - engine - inoperative take - off distance using th e established V . The take - off distances must be R determined in accordance with CS 25.113(a)(1) . (See AMC 25.107(e)(3) .)

Powered by EASA eRules Page 119 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (4) Reasonably expected variations in service from the established take - off procedures for the operation of the aeroplane (such as over - rotation of the aeroplane and out - of - trim conditions) may not result in unsafe flight characteristics or in marked increases in the scheduled take - off distances establish ed in accordance with CS 25.113(a) . (See AMC No.

1 to CS 25.107(e)(4) and AMC No. 2 to CS 25.107(e)(4) .)

(f) V is the calibrated airspeed at which the aeroplane first be comes airborne.

LOF (g) V FTO , in terms of calibrated airspeed, must be selected by the applicant to provide at least the gradient of climb required by CS 25.121(c) , but may not be less than – (1) 1.18 V ; and SR (2) A speed that provides the manoeuvring capability specified in CS 25.143(h) .

(h) In determining the take - off speeds V , V , and V for flight in icing conditions, the values of V , 1 R 2 MCG V , and V determined for non - icing conditions may be used.

MC MU [Amdt 25/3] [Amdt 25/18]

AMC 25.107(d) Take - off s peeds

ED Decision 2003/ 2/RM 1 If cases are encountered where it is not possible to obtain the actual V at forward centre of MU gravity with aeroplanes having limited elevator power (including those aeroplanes which have limited elevator power only over a portion of the take - off weight range), it will be permissible to test with a more aft centre of gravity and/or more than normal nose - up trim to obtain V .

MU 1.1 When V is obtained in this manner, the values should be c orrected to those which MU would have been attained at forward centre of gravity if sufficient elevator power had been available. The variation of V with centre of gravity may be assumed to be the MU same as the variation of stalling speed in free air with cen tre of gravity for this correction.

1.2 In such cases where V has been measured with a more aft centre of gravity and/or with MU more than normal nose - up trim, the V R selected should (in addition to complying with the requirements of CS 25.107(e) ) be greater by an adequate margin than the lowest speed at which the nose wheel can be raised from the runway with centre of gravity at its most critical position and with the trim set to the normal take - off setting for the weight and centre of gravity.

NOTE: A margin of 9,3 km/h (5 kt) between the lowest nose - wheel raising speed and V R would normally be considered to be adequate.

2 Take - offs made to demonstrate V should be continued until the aeropla ne is out of ground MU effect. The aeroplane pitch attitude should not be decreased after lift - off.

AMC 25.107(e)(1)(iv) Take - off s peeds

ED Decision 2003/ 2/RM V Testing for Geometry Limited Aeroplanes.

MU 1 For aeroplanes that are geometry limited (i.e., the minimum possible V speeds are limited by MU tail contact with the runway), CS 25.107(e)(1)(iv)(B) allows the V to V speed margins to be MU LOF reduced to 108% and 104% for the all - engines - operating and one - engineinoperative conditions, respectively. The V demonstrated must be sound and repeatable.

MU Powered by EASA eRules Page 120 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE 2 One acceptable means for demonstrating compliance with CS 25.107(d) and 25 .107(e)(1)(iv) with respect to the capability for a safe lift - off and fly - away from the geometry limited condition is to show that at the lowest thrust - to - weight ratio for the all - engines - operating condition: 2.1 During the speed range from 96 to 100% of the actual lift - off speed, the aft under - surface of the aeroplane should be in contact with the runway. Because of the dynamic nature of the test, it is recognised that contact will probably not be maintained during this entire speed range, and some judge ment is necessary. It has been found acceptable for contact to exist approximately 50% of the time that the aeroplane is in this speed range.

2.2 Beyond the point of lift - off to a height of 11m (35 ft), the aeroplane’s pitch attitude should not decrease below that at the point of lift - off, nor should the speed increase more than 10%.

2.3 The horizontal distance from the start of the take - off to a height of 11 m (35 ft) should not be greater than 105% of the distance determined in accordance with CS 25.113(a)(2) without the 115% factor.

AMC 25.107( e)(3) Take - off s peeds

ED Decision 2003/ 2/RM In showing compliance with CS 25.107(e)(3) – a. Rotation at a speed of V - 9,3 km/h (5 kt) should be carried out using, up to the point of lift - off, R the same rotation te chnique, in terms of control input, as that used in establishing the one - engine - inoperative distance of CS 25.113(a)(1) ; b. The engine failure speed used in the V - 9,3 km/h (5 kt) demonstration should be the same as R that used in the comparative take - off rotating at V ; R c. The tests should be carried out both at the lowest practical weight (such that V - 9,3 km/h (5 kt) R is not less than V ) and at a weight approaching take - off climb limiting conditions; MCG d. The ta il or tail skid should not contact the runway.

AMC No. 1 to CS 25.107(e)(4) Take - off s peeds

ED Decision 2003/2/RM Reasonably expected variations in service from established take - off procedures should be evaluated in respect of out - of - trim conditions duri ng certification flight test programmes. For example, normal take - off should be made with the longitudinal control trimmed to its most adverse position within th e allowable take - off trim band.

AMC No. 2 to CS 25.107(e)(4) Take - off s peeds

ED Decision 2003/ 2 /RM 1 CS 25.107(e)(4) states that there must be no marked increase in the scheduled take - off distance when reasonably expected service variations, such as over - rotation, are encountered. This can be interpreted as requiring take - off tests with all engines operating with an abu se on rotation speed.

2 The expression ‘marked increase’ in the take - off distance is defined as any amount in excess of 1% of the scheduled take - off distance. Thus the abuse test should not result in a field length more than 101% of the scheduled field le ngth.

Powered by EASA eRules Page 121 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE 3 For the early rotation abuse condition with all engines operating and at a weight as near as practicable to the maximum sea - level take - off weight, it should be shown by test that when the aeroplane is rotated rapidly at a speed which is 7% or 19 k m/h (10 kt), whichever is lesser, below the scheduled V speed, no ‘marked increase’ in the scheduled field length would result.

R

CS 25.109 Accelerate - stop distance

ED Decision 2016 / 010/R (See AMC 25.109) (a) (See AMC 25.109(a) and (b) .) The accelerate - stop distance on a dry runway is the greater of the following distances: (1) The sum of the distances necessary to – (i) Accelerate the aeroplane from a standing start with all engines operating to V EF for take - off from a dry runway; (ii) Allow the aeroplane to accelerate from V to the highest speed reached during the EF rejected take - off, assuming the critical engine fails at V and the pilot takes the EF first action to reject t he take - off at the V for take - off from a dry runway; and (iii) Come to a full stop on a dry runway from the speed reached as prescribed in sub - paragraph (a)(1)(ii) of this paragraph; plus (iv) A distance equivalent to 2 seconds at the V for take - off from a dry runway.

(2) The sum of the distances necessary to – (i) Accelerate the aeroplane from a standing start with all engines operating to the highest speed reached during the rejected take - off, assuming the pilot takes the first action to reject the tak e - off at the V for take - off from a dry runway; and (ii) With all engines still operating, come to a full stop on a dry runway from the speed reached as prescribed in sub - paragraph (a)(2)(i) of this paragraph; plus (iii) A distance equivalent to 2 seconds at the V for take - off from a dry runway.

(b) (See AMC 25.109(a) and (b) .) The accelerate - stop distance on a wet runway is the greater of the following distances: (1) The accelerate - stop distance on a dry r unway determined in accordance with sub - paragraph (a) of this paragraph; or (2) The accelerate - stop distance determined in accordance with sub - paragraph (a) of this paragraph, except that the runway is wet and the corresponding wet runway values of V an d V are used. In determining the wet runway accelerate - stop distance, the stopping EF 1 force from the wheel brakes may never exceed: (i) The wheel brakes stopping force determined in meeting the requirements of CS 25. 101(i) and sub - paragraph (a) of this paragraph; and (ii) The force resulting from the wet runway braking coefficient of friction determined in accordance with subparagraphs (c) or (d) of this paragraph, as applicable, taking into account the distribution o f the normal load between braked and unbraked wheels at the most adverse centre of gravity position approved for take - off.

Powered by EASA eRules Page 122 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (c) The wet runway braking coefficient of friction for a smooth wet runway is defined as a curve of friction coefficient versus gro und speed and must be computed as follows: (1) The maximum tyre - to - ground wet runway braking coefficient of friction is defined as (see Figure 1): Tyre Pressure Maximum Braking Coefficient (tyre - to - ground) (psi) 3 2 𝑉 𝑉 𝑉 μ t/gMAX = −0 ⋅ 0350 ( ) + 0 ⋅ 306 ( ) − 0 ⋅ 851 ( ) + 0 ⋅ 883 100 100 100 3 2 𝑉 𝑉 𝑉 μ = −0 ⋅ 0437 ( ) + 0 ⋅ 320 ( ) − 0 ⋅ 805 ( ) + 0 ⋅ 804 t/gMAX 100 100 100 3 2 𝑉 𝑉 𝑉 μ = −0 ⋅ 0331 ( ) + 0 ⋅ 252 ( ) − 0 ⋅ 658 ( ) + 0 ⋅ 692 t/gMAX 100 100 100 3 2 𝑉 𝑉 𝑉 μ t/gMAX = −0 ⋅ 0401 ( ) + 0 ⋅ 263 ( ) − 0 ⋅ 611 ( ) + 0 ⋅ 614 100 100 100 Figure 1 where: Tyre Pressure = maximum aeroplane operating tyre pressure (psi) μ = maximum tyre - to - ground braking coefficient t/gMAX V = aeroplane true ground speed (knots); and Linear interpolation may be used for tyre pre ssures other than those listed.

(2) (See AMC 25.109(c)(2) The maximum tyre - to - ground wet runway braking coefficient of friction must be adjusted to take into account the efficiency of the anti - skid system on a wet runway. Anti - skid system operation must be demonstrated by flight testing on a smooth wet runway and its efficiency must be determined. Unless a specific anti - skid system efficiency is determined from a quantitative analysis of the flight testing on a smooth wet runway, the maximum tyre - to - ground w et runway braking coefficient of friction determined in sub - paragraph (c)(1) of this paragraph must be multiplied by the efficiency value associated with the type of anti - skid system installed on the aeroplane: Type of anti - skid system Efficiency value On - off 0 ⋅ 30 Quasi - modulating 0 ⋅ 50 Fully modulating 0 ⋅ 80 (d) At the option of the applicant, a higher wet runway braking coefficient of friction may be used for runway surfaces that have been grooved or treated with a porous friction course material.

F or grooved and porous friction course runways, (1) 70% of the dry runway braking coefficient of friction used to determine the dry runway accelerate - stop distance; or (2) (See AMC 25.109(d)(2) .) The wet runway braking coefficient of friction defined in sub - paragraph (c) of this paragraph, except that a specific anti - skid efficiency, if determined, is appropriate for a grooved or porous friction course wet runway and the maximum tyre - to - ground wet runway b raking coefficient of friction is defined as (see Figure 2): Powered by EASA eRules Page 123 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE Tyre Pressure Maximum Braking Coefficient (tyre - to - ground) (psi) 5 4 3 2 𝑉 𝑉 𝑉 𝑉 𝑉 μ = 0 ⋅ 147 ( ) − 1 ⋅ 05 ( ) + 2 ⋅ 673 ( ) − 2 ⋅ 683 ( ) + 0 ⋅ 403 ( ) + 0 ⋅ 859 t/gMAX 100 100 100 100 100 5 4 3 2 𝑉 𝑉 𝑉 𝑉 𝑉 μ = 0 ⋅ 1106 ( ) − 0 ⋅ 813 ( ) + 2 ⋅ 13 ( ) − 2 ⋅ 20 ( ) + 0 ⋅ 317 ( ) + 0 ⋅ 807 t/gMAX 100 100 100 100 100 5 4 3 2 𝑉 𝑉 𝑉 𝑉 𝑉 μ = 0 ⋅ 0498 ( ) − 0 ⋅ 398 ( ) +1 ⋅ 14 ( ) −1 ⋅ 285 ( ) + 0 ⋅ 140 ( ) + 0 . 701 t/gMAX 100 100 100 100 100 5 4 3 2 𝑉 𝑉 𝑉 𝑉 𝑉 μ = 0 ⋅ 0314 ( ) − 0 ⋅ 247 ( ) + 0 ⋅ 703 ( ) − 0 ⋅ 779 ( ) − 0 ⋅ 00954 ( ) + 0 ⋅ 614 t/gMAX 100 100 100 100 100 Figure 2 where: Tyre Pressure = maximum aeroplane operating tyre pressure (psi) μ = maximum tyre - to - ground braking coefficient t /gMAX V = aeroplane true ground speed (knots); and Linear interpolation may be used for tyre pre ssures other than those listed.

(e) Except as provided in sub - paragraph (f)(1) of this paragraph, means other than wheel brakes may be used to determine the accelerate - stop distance if that means – (1) Is safe and reliable; (2) Is used so that consistent results can be expected under normal operating conditions; and (3) Is such that exceptional skill is not required to control the aeroplane.

(f) The effects of available reverse thrust – (1) Must not be included as an additional means of deceleration when determining the accelerate - stop distan ce on a dry runway; and (2) May be included as an additional means of deceleration using recommended reverse thrust procedures when determining the accelerate - stop distance on a wet runway, provided the requirements of sub - paragraph (e) of this paragraph a re met. (See AMC 25.109(f) .)

(g) The landing gear must remain extended throughout the accelerate - stop distance.

(h) If the accelerate - stop distance includes a stopway with surface characteristics substantially diff erent from those of the runway, the take - off data must include operational correction factors for the accelerate - stop distance. The correction factors must account for the particular surface characteristics of the stopway and the variations in these charac teristics with seasonal weather conditions (such as temperature, rain, snow and ice) within the established operational limits.

(i) A flight test demonstration of the maximum brake kinetic energy accelerate - stop distance must be conducted with not more tha n 10% of the allowable brake wear range remaining on each of the aeroplane wheel brakes.

[Amdt 25/18] Powered by EASA eRules Page 124 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE

AMC 25. 109(a) and (b) Accelerate - stop d istance

ED Decision 2003/2/RM Propeller pitch position . For the one - engine - inoperative accelerate - stop distance, the critical engine’s propeller should be in the position it would normally assume when an engine fails and the power levers are closed. For dry runway one - engine - inoperative accelerate - stop distan ces, the high drag ground idle position of the operating engines’ propellers (defined by a pitch setting that results in not less than zero total thrust, i.e. propeller plus jet thrust, at zero airspeed) may be used provided adequate directional control is available on a wet runway and the related operational procedures comply with CS 25.109(f) and (h) . Wet runway controllability may either be demonstrated by using the guidance available in AMC 25.109(f) at the appropriate power level, or adequate control can be assumed to be available at ground idle power if reverse thrust credit is approved for determining the wet runway accelerate - stop distances. For the all - engines - operat ing accelerate - stop distances on a dry runway, the high drag ground idle propeller position may be used for all engines (subject to CS 25.109(f) and (h) ). For criteria relating to reverse thrust credit for wet runway accelerate - stop distances, see AMC 25.1 09(f) .

AMC 25.109(c)(2) Accelerate - stop distance: anti - skid system

efficiency

ED Decision 2003/ 2/RM CS 25.109(c)(2) identifies 3 categories of anti - skid system and provides for either the use of a default efficie ncy value appropriate to the type of system or the determination of a specific efficiency value.

Paragraph 1 of this AMC gives a description of the operating characteristics of each category to enable the classification of a particular system to be determi ned. Paragraph 2 gives an acceptable means of compliance with the requirement for flight testing and use of default efficiency values in accordance with CS 25.109(c)(2) . These values are appropriate where the tunin g of the anti - skid system is largely qualitative and without detailed quantitative analysis of system performance. Where detailed data recording and analysis is used to optimise system tuning, an efficiency value somewhat higher than the default value migh t be obtained and determined. Typically, a value of 40% might be achieved with an On/Off system. The quasi - modulating category covers a broad range of systems with varying performance levels. The best quasi - modulating systems might achieve an efficiency up to approximately 80%. Fully modulating systems have been tuned to efficiencies greater than 80% and up to a maximum of approximately 92%, which is considered to be the maximum efficiency on a wet runway normally achievable with fully modulating digital an ti - skid systems. Paragraph 3 gives an acceptable means of compliance with CS 25.109(c)(2) where the applicant elects to determine a specific efficiency value.

In Paragraph 4 of this AMC, guidance is given on the use of 2 alternative methods for calculating antiskid system efficiency from the recorded data. One method is based on the variation of brake torque throughout the stop, while the other is based on wheel speed slip ratio. Finally, Paragraph 5 gives guidance on accounting for the distribution of the normal load between braked and unbraked wheels.

1 Classification of anti - skid system types 1.1 For the purposes of determining the default anti - skid efficien cy value under CS 25.109(c)(2) , anti - skid systems have been grouped into three broad classifications; on/off, quasi - modulating and fully modulating. These classifications represent evolving levels of technology and performance capabilities on both dry and wet runways.

Powered by EASA eRules Page 125 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE 1.2 On/off systems are the simplest of the three types of anti - skid systems. For these systems, fully metered brake pressure (as commanded by the pilot) is applied until wheel locking is sensed. Brake pressure is then released to allow the wheel to spin back up.

When the system senses that the wheel is accelerating back to synchronous speed (i.e.

ground speed), full metered pressure is again applied. The cycle of full pressure application/complete pres sure release is repeated throughout the stop (or until the wheel ceases to skid with brake pressure applied).

1.3 Quasi - modulating systems attempt to continuously regulate brake pressure as a function of wheel speed. Typically, brake pressure is released when the wheel deceleration rate exceeds a preselected value. Brake pressure is re - applied at a lower level after a length of time appropriate to the depth of skid. Brake pressure is then gradually increased until another incipient skid condition is sensed . In general, the corrective actions taken by these systems to exit the skid condition are based on a pre - programmed sequence rather than the wheel speed time history.

1.4 Fully modulating systems are a further refinement of the quasi - modulating systems. The major difference between these two types of anti - skid systems is in the implementation of the skid control logic. During a skid, corrective action is based on the sensed wheel speed signal, rather than a preprogrammed response. Specifically, the amount of pressure reduction or reapplication is based on the rate at which the wheel is going into or recovering from a skid. Also, higher fidelity transducers and upgraded control systems are used, which respond more quickly.

1.5 In addition to examining the control system differences noted above, a time history of the response characteristics of the anti - skid system during a wet runway stop should be used to help identify the type of anti - skid system. Comparing the response characteristics from wet and dry ru nway stops can also be helpful.

Figure 1 shows an example of the response characteristics of a typical on - off system on both wet and dry runways. In general, the on - off system exhibits a cyclic behaviour of brake pressure application until a skid is sense d, followed by the complete release of brake pressure to allow the wheel to spin back up. Full metered pressure (as commanded by the pilot) is then re - applied, starting the cycle over again. The wheel speed trace exhibits deep and frequent skids (the troug hs in the wheel speed trace), and the average wheel speed is significantly less than the synchronous speed (which is represented by the flat topped portions of the wheel speed trace).

Note that the skids are deeper and more frequent on a wet runway than on a dry runway. For the particular example shown in Figure 1, the brake becomes torque - limited toward the end of the dry runway stop and is unable to generate enough torque to cause further skidding.

Powered by EASA eRules Page 126 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE FIGURE 1. ANTI - SKID SYSTEM RESPONS E CHARACTERISTICS On - Off System The effectiveness of quasi - modulating systems can vary significantly depending on the slipperiness of the runway and the design of the particular control system. On dry runways, these systems typically perform very well; however, on wet runway s their performance is highly dependent on the design and tuning of the particular system. An example of the response characteristics of one such system is shown in Figure 2. On both dry and wet runways, brake pressure is released to the extent necessary t o control skidding. As the wheel returns to the synchronous speed, brake pressure is quickly increased to a pre - determined level and then gradually ramped up to the full metered brake pressure. On a dry runway, this type of response reduces the depth and f requency of skidding compared to an on - off system. However, on a wet runway, skidding occurs at a pressure below that at which the gradual ramping of brake pressure occurs. As a result, on wet runways the particular system shown in Figure 2 operates very s imilarly to an on - off system.

Powered by EASA eRules Page 127 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes S UBPART B – FLIGHT (CS - 25) PERFORMANCE FIGURE 2. ANTI - SKID SYSTEM RESPONSE CHARACTE RISTICS Quasi - Modulating System Powered by EASA eRules Page 128 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE Powered by EASA eRules Page 129 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE FIGURE 3. ANTI - SKID SYSTEM RESPONSE CHARACTE RISTICS Fully Modulating System When properly tuned, fully modulating systems are characterised by much smaller variations in brake pressure around a fairly high average value. These systems can respond quickly to developing skids and are capable of modulating brake pressure to reduce th e frequency and depth of skidding. As a result, the average wheel speed remains much closer to the synchronous wheel speed. Figure 3 illustrates an example of the response characteristics of a fully modulating system on dry and wet runways.

2 Demonstration of anti - skid system operation when using the anti - skid efficiency values specified in CS 25.109(c)(2) 2.1 If the applicant elects to use one of the anti - skid efficiency values specified in CS 25.109(c )(2) , a limited amount of flight testing must still be conducted to verify that the anti - skid system operates in a manner consistent with the type of anti - skid system declared by the applicant. This testing should also demonstrate that the anti - skid system has been properly tuned for operation on wet runways.

2.2 A minimum of one complete stop, or equivalent segmented stops, should be conducted on a smooth (i.e. not grooved or porous friction course) wet runway at an appropriate speed and energy to cover t he critical operating mode of the anti - skid system. Since the objective of the test is to observe the operation (i.e. cycling) of the anti - skid system, this test will normally be conducted at an energy well below the maximum brake energy condition.

2.3 Th e section of the runway used for braking should be well soaked (i.e. not just damp), but not flooded. The runway test section should be wet enough to result in a number of cycles of anti - skid activity, but should not cause hydroplaning.

2.4 Before taxy an d with cold tyres, the tyre pressure should be set to the highest value appropriate to the take - off weight for which approval is being sought.

2.5 The tyres and brakes should not be new, but need not be in the fully worn condition. They should be in a con dition considered representative of typical in - service operations.

2.6 Sufficient data should be obtained to determine whether the system operates in a manner consistent with the type of anti - skid system declared by the applicant, provide evidence that fu ll brake pressure is being applied upstream of the anti - skid valve during the flight test demonstration, determine whether the anti - skid valve is performing as intended and show that the anti - skid system has been properly tuned for a wet runway.

Typically , the following parameters should be plotted versus time: (i) The speed of a representative number of wheels.

(ii) The hydraulic pressure at each brake (i.e. the hydraulic pressure downstream of the anti - skid valve, or the electrical input to each anti - sk id valve).

(iii) The hydraulic pressure at each brake metering valve (i.e. upstream of the anti - skid valve).

2.7 A qualitative assessment of the anti - skid system response and aeroplane controllability should be made by the test pilot(s). In particular, pi lot observations should confirm that: (i) Anti - skid releases are neither excessively deep nor prolonged; (ii) The gear is free of unusual dynamics; and Powered by EASA eRules Page 130 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (iii) The aeroplane tracks essentially straight, even though runway seams, water puddles and wetter pat ches may not be uniformly distributed in location or extent.

3 Determination of a specific wet runway anti - skid system efficiency 3.1 If the applicant elects to derive the anti - skid system efficiency from flight test demonstrations, sufficient flight test ing, with adequate instrumentation, must be conducted to ensure confidence in the value obtained. An anti - skid efficiency of 92% (i.e.

a factor of 0·92) is considered to be the maximum efficiency on a wet runway normally achievable with fully modulating di gital anti - skid systems.

3.2 A minimum of three complete stops, or equivalent segmented stops, should be conducted on a wet runway at appropriate speeds and energies to cover the critical operating modes of the anti - skid system. Since the objective of the test is to determine the effi ciency of the anti - skid system, these tests will normally be conducted at energies well below the maximum brake energy condition. A sufficient range of speeds should be covered to investigate any variation of the anti - skid efficiency with speed.

3.3 The t esting should be conducted on a smooth (i.e. not grooved or porous friction course) runway.

3.4 The section of the runway used for braking should be well soaked (i.e. not just damp), but not flooded. The runway test section should be wet enough to result in a number of cycles of anti - skid activity, but should not cause hydroplaning.

3.5 Before taxy and with cold tyres, the tyre pressure should be set to the highest value appropriate to the take - off weight for which approval is being sought.

3.6 The tyres and brake should not be new, but need not be in the fully worn condition. They should be in a condition considered representative of typical in - service operations.

3.7 A qualitative assessment of anti - skid system response and aeroplane controllability sh ould be made by the test pilot(s). In particular, pilot observations should confirm that: (i) The landing gear is free of unusual dynamics; and (ii) The aeroplane tracks essentially straight, even though runway seams, water puddles and wetter patches may not be uniformly distributed in location or extent.

3.8 The wet runway anti - skid efficiency value should be determined as described in Paragraph 4 of this AMC. The test instrumentation and data collection should be consistent with the method u sed.

4 Calculation of anti - skid system efficiency 4.1 Paragraph 3 above provides guidance on the flight testing required to support the determination of a specific anti - skid system efficiency value. The following paragraphs describe 2 methods of calculati ng an efficiency value from the data recorded. These two methods, which yield equivalent results, are referred to as the torque method and the wheel slip method. Other methods may also be acceptable if they can be shown to give equivalent results.

4.2 Tor que Method Under the torque method, the anti - skid system efficiency is determined by comparing the energy absorbed by the brake during an actual wet runway stop to the energy that is determined by integrating, over the stopping distance, a curve defined by connecting the peaks of the instantaneous brake force curve (see figure 4). The energy absorbed by the Powered by EASA eRules Page 131 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORM ANCE brake during the actual wet runway stop is determined by integrating the curve of instantaneous brake fo rce over the stopping distance.

FIGURE 4. INST ANTANEOUS BRAKE FORCE AND PEAK BRAKE FORCE Using data obtained from the wet runway stopping tests of paragraph 3, instantaneous brake force can be calculated f rom the following relationship: ( 𝑇 + 𝛼𝐼 ) 𝑏 𝐹 = 𝑏 R 𝑡𝑦𝑟𝑒 where: F = brake force b T = brake torque b α = wheel acceleration I = wheel moment of inertia; and R = tyre radius tyre For brake installations where measuring brake torque directly is impractical, torque may be determined from other parameters (e.g. brake pressure) if a suitabl e correlation is available. Wheel acceleration is obtained from the first derivative of wheel speed.

Instrumentation recording rates and data analysis techniques for wheel speed and torque data should be well matched to the anti - skid response characteristi cs to avoid introducing noise and other artifacts of the instrumentation system into the data.

Since the derivative of wheel speed is used in calculating brake force, smoothing of the wheel speed data is usually necessary to give good results. The smoothi ng algorithm should be carefully designed as it can affect the resulting efficiency calculation. Filtering or smoothing of the brake torque or brake force data should not normally be done. If conditioning is applied, it should be done in a conservative man ner (i.e. result in a lower efficiency value) and should not misrepresent actual aeroplane/system dynamics.

Both the instantaneous brake force and the peak brake force should be integrated over the stopping distance. The anti - skid efficiency value for det ermining the wet runway accelerate - stop distance is the ratio of the instantaneous brake force integral to the peak brake force integral: ∫ 𝑖𝑛𝑠𝑡𝑎𝑛𝑡𝑎𝑛𝑒𝑜𝑢𝑠 𝑏𝑟𝑎𝑘𝑒 𝑓𝑜𝑟𝑐𝑒 . 𝑑𝑠 𝜂 = ∫ 𝑝𝑒𝑎𝑘 𝑏𝑟𝑎𝑘𝑒 𝑓𝑜𝑟𝑐𝑒 . 𝑑𝑠 Powered by EASA eRules Page 132 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE where: η = anti - skid efficiency; and s = stopping distance The stopping distance is defined as the distance travelled during the specific wet runway stopping demonstration, beginning when the full braking configuration is obtained and ending at the lowest speed at which anti - skid cycling occurs (i.e. the brakes are not torque limited), except that this speed need not be less than 19 km/h (10 kt). Any variation in the anti - skid efficiency with speed should also be investigated, which can be accomplished by determi ning the efficiency over segments of the total stopping distance.

If significant variations are noted, this variation should be reflected in the braking force used to determine the accelerate - stop distances (either by using a variable efficiency or by usin g a conservative single value).

4.3 Wheel Slip Method At brake application, the tyre begins to slip with respect to the runway surface, i.e. the wheel speed slows down with respect to the aeroplane’s ground speed. As the amount of tyre slip increases, th e brake force also increases until an optimal slip is reached. If the amount of slip continues to increase past the optimal slip, the braking force will decrease.

Using the wheel slip method, the anti - skid efficiency is determined by comparing the actual wheel slip measured during a wet runway stop to the optimal slip. Since the wheel slip varies significantly during the stop, sufficient wheel and ground speed data must be obtained to determine the variation of both the actual wheel slip and the optimal wh eel slip over the length of the stop. A sampling rate of at least 16 samples per second for both wheel speed and ground speed has been found to yield acceptable fidelity.

For each wheel and ground speed data point, the instantaneous anti - skid efficiency v alue should be determined from the relationship shown in Figure 5: FIGURE 5. ANTI - SKID EFFIC IENCY – WHEEL SLIP RELATIONSHIP wheel speed WSR = wheel slip ratio = 1 − ( ) ground speed OPS = optimal slip ratio; and η = instantaneous anti - skid efficiency i Powered by EASA eRules Page 133 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE To determine the overall anti - skid efficiency value for use in calculating the wet runway accelerate - stop distance, the instantaneous anti - skid efficiencies should be integrated with respect to distance and divided by the total stopping distance: 𝜂 . 𝑑𝑠 ∫ 𝑖 𝜂 = 𝑠 where: η = anti - skid efficiency; and s = stopping distance The stopping distance is defined as the distance travelled during the specific wet runway stopping demonstration, beginning when the full braki ng configuration is obtained and ending at the lowest speed at which anti - skid cycling occurs (i.e. the brakes are not torque limited), except that this speed need not be less than 19 km/h (10 kt). Any variation in the anti - skid efficiency with speed shoul d also be investigated, which can be accomplished by determining the efficiency over segments of the total stopping distance.

If significant variations are noted, this variation should be reflected in the braking force used to determine the accelerate - stop distances (either by using a variable efficiency or by using a conservative single value).

The applicant should provide substantiation of the optimal wheel slip value(s) used to determine the anti - skid efficiency value. An acceptable method for determini ng the optimal slip value(s) is to compare time history plots of the brake force and wheel slip data obtained during the wet runway stopping tests. For brake installations where measuring brake force directly is impractical, brake force may be determined f rom other parameters (e.g. brake pressure) if a suitable correlation is available. For those skids where wheel slip continues to increase after a reduction in the brake force, the optimal slip is the value corresponding to the brake force peak. See Figure 6 for an example and note how both the actual wheel slip and the optimal wheel slip can vary during the stop.

FIGURE 6. SUBSTANTI ATION OF THE OPTIMAL SLIP VALUE Powered by EASA eRules Page 134 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE 4.4 For dispatch with an inoperative anti - skid system (if approved), the wet runway acceleratestop distances should be based on an efficiency no higher than that allowed by CS 25.109(c)(2) for an on - off type of anti - sk id system. The safety of this type of operation should be demonstrated by flight tests conducted in accordanc e with Paragraph 2 of this AMC.

5 Distribution of normal load between braked and unbraked wheels In addition to taking into account the efficienc y of the anti - skid system, CS 25.109(b)(2)(ii) also requires adjusting the braking force for the effect of the distribution of the normal load between braked and unbraked wheels at the most adverse centre of gravit y position approved for take - off. The stopping force due to braking is equal to the braking coefficient multiplied by the normal load (i.e. weight) on each braked wheel. The portion of the aeroplane’s weight being supported by the unbraked wheels (e.g. unb raked nose wheels) does not contribute to the stopping force generated by the brakes. This effect must be taken into account for the most adverse centre of gravity position approved for take - off, considering any centre of gravity shifts that occur due to t he dynamics of the stop. The most adverse centre of gravity position is the position that results in the l east load on the braked wheels.

AMC 25.109(d)(2) Accelerate - stop distance: anti - skid effi ciency on

grooved and porous friction course (PFC) runways.

E D Decision 2003/ 2/RM Properly designed, constructed and maintained grooved and PFC runways can offer significant improvements in wet runway braking capability. A conservative level of performance credit is provided by 25.109(d) to reflect this performance improvement and to provide an incentive for installing and maintaining such surfaces.

In accordance with CS 25.105(c) and 25.109(d) , applicants may optionally determine t he acceleratestop distance applicable to wet grooved and PFC runways. These data would be included in the AFM in addition to the smooth runway accelerate - stop distance data. The braking coefficient for determining the accelerate - stop distance on grooved an d PFC runways is defined in CS 25.109(d) as either 70% of the braking coefficient used to determine the dry runway accelerate - stop distances, or a curve based on ESDU 71026 data and derived in a manner consistent with that used for smooth runways. In eithe r case, the brake torque limitations determined on a dry runway may not be exceeded.

Using a simple factor applied to the dry runway braking coefficient is acceptable for grooved and PFC runways because the braking coefficient’s variation with speed is much lower on these types of runways. On smooth wet runways, the braking coefficient var ies significantly with speed, which makes it inappropriate to apply a simple factor to the dry runway braking coefficient. For applicants who choose to determine the grooved/PFC wet runway accelerate - stop distances in a manner consistent with that used for smooth runways, CS 25.109(d)(2) provides the maximum tyre - to - ground braking coefficient applicable to grooved and PFC runways. This maximum tyre - to - ground braking coefficient must be adjusted for the anti - skid sys tem efficiency, either by using the value specified in CS 25.109(c)(2) appropriate to the type of anti - skid system installed, or by using a specific efficiency established by the applicant. As anti - skid system performance depends on the characteristics of the runway surface, a system that has been tuned for optimum performance on a smooth surface may not achieve the same level of efficiency on a grooved or porous friction course runway, and vice versa.

Consequently, if the applicant elects to establish a sp ecific efficiency for use with grooved or PFC surfaces, anti - skid efficiency testing should be conducted on a wet runway with such a surface, in addition to testing on a smooth runway. Means other than flight testing may be acceptable, such as Powered by EASA eRules Page 135 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE using the ef ficiency previously determined for smooth wet runways, if that efficiency is shown to be representative of, or conservative for, grooved and PFC runways. The resulting braking force for grooved/PFC wet runways must be adjusted for the effect of the distrib ution of the normal load between braked and unbraked wheels. This adjustment will be similar to that used for determining the braking force for smooth runways, except that the braking dynamics should be appropriate to the braking force achieved on grooved and PFC wet runways. Due to the increased braking force on grooved and PFC wet runways, an increased download on the nose wheel and corresponding reduction in the downloa d on the main gear is expected.

AMC 25.109(f) Accelerate - stop distance: credit for rev erse thrust.

ED Decision 2003/ 2/RM In accordance with CS 25.109(f) , reverse thrust may not be used to determine the accelerate - stop distances for a dry runway. For wet runway accelerate - stop distances, however, CS 25.109(f) allows credit for the stopping force provided by reverse thrust, if the requirements of CS 25.109(e) are met.

In addition, the procedures associated with the use of reverse thrust, which CS 25.101(f) requ ires the applicant to provide, must meet the requirements of CS 25.101(h) . The following criteria provide acceptable means of demonstrating compliance with these requirements: 1 Procedures for using reverse thrust during a rejected take - off must be developed and demonstrated. These procedures should include all of the pilot actions necessary to obtain the recommended level of reverse thrust, maintain directional control and safe engine operating characteristics, an d return the reverser(s), as applicable, to either the idle or the stowed position. These procedures need not be the same as those recommended for use during a landing stop, but must not result in additional hazards, (e.g., cause a flame out or any adverse engine operating characteristics), nor may they significantly increase flightcrew workload or training needs.

2 It should be demonstrated that using reverse thrust during a rejected take - off complies with the engine operating characteristics requirements of CS 25.939(a) . No adverse engine operating characteristics should be exhibited. The reverse thrust procedures may specify a speed at which the reverse thrust is to be reduced to idle in order to maintain safe en gine operating characteristics.

3 The time sequence for the actions necessary to obtain the recommended level of reverse thrust should be demonstrated by flight test. The time sequence used to determine the accelerate - stop distances should reflect the mos t critical case relative to the time needed to deploy the thrust reversers. For example, on some aeroplanes the outboard thrust reversers are locked out if an outboard engine fails. This safety feature prevents the pilot from applying asymmetric reverse th rust on the outboard engines, but it may also delay the pilot’s selection of reverse thrust on the operable reversers. In addition, if the selection of reverse thrust is the fourth or subsequent pilot action to stop the aeroplane (e.g., after manual brake application, thrust/power reduction, and spoiler deployment), a one second delay should be added to the demonstrated time to select reverse thrust. (See figure 1 of AMC 25.101(h)(3) .)

4 The response times of the a ffected aeroplane systems to pilot inputs should be taken into account. For example, delays in system operation, such as thrust reverser interlocks that prevent the pilot from applying reverse thrust until the reverser is deployed, should be taken into acc ount. The effects of transient response characteristics, such as reverse thrust engine spin - up, should also be included.

Powered by EASA eRules Page 136 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE 5 To enable a pilot of average skill to consistently obtain the recommended level of reverse thrust under typical in - service conditions, a lever position that incorporates tactile feedback (e.g., a detent or stop) should be provided. If tactile feedback is n ot provided, a conservative level of reverse thrust should be assumed.

6 The applicant should demonstrate that exceptional skill is not required to maintain directional control on a wet runway with a 19 km/h (ten knot) crosswind from the most adverse dire ction.

For demonstration purposes, a wet runway may be simulated by using a castering nosewheel on a dry runway. Symmetric braking should be used during the demonstration, and both all - engines - operating and critical - engine - inoperative reverse thrust should be considered. The brakes and thrust reversers may not be modulated to maintain directional control. The reverse thrust procedures may specify a speed at which the reverse thrust is reduced to idle in order to maintain directional controllability.

7 To m eet the requirements of CS 25.101(h)(2) and 25.109(e)(1) the probability of failure to provide the recommended level of reverse thrust should be no greater than 1 per 1000 selections. The effects of any system or component malfunction or failure should not create an additional hazard.

8 The number of thrust reversers used to determine the wet runway accelerate - stop distance data provided in the AFM should reflect the number of engines assumed to be operating during the rejected take - off along with any applicable system design features. The all - engines - operating accelerate - stop distances should be based on all thrust reversers operating. The one - engine - inoperative accelerate - stop distances should be based on failure of the critical engine.

For example, if the outboard thrust reversers are locked out when an outboard engine fails, the one - engine - inoperative accelerate stop distances can only include reverse thrust from the inbo ard engine thrust reversers.

9 For the engine failure case, it should be assumed that the thrust reverser does not deploy (i.e., no reverse thrust or drag credit for deployed thrust reverser buckets on the failed engine).

10 For approval of dispatch with one or more inoperative thrust reverser(s), the associated performance information should be provided either in the Aeroplane Flight Manual or the Master Minimum Equipment List.

11 The effective stopping force provided by rev erse thrust in each, or at the option of the applicant, the most critical take - off configuration, should be demonstrated by flight test. Flight test demonstrations should be conducted to substantiate the accelerate - stop distances, and should include the co mbined use of all the approved means for stopping the aeroplane. These demonstrations may be conducted on a dry runway.

12 For turbo - propeller powered aeroplanes, the criteria of paragraphs 1 to 11 above remain generally applicable. Additionally, the prop eller of the inoperative engine should be in the position it would normally assume when an engine fails and the power lever is closed. Reverse thrust may be selected on the remaining engine(s). Unless this is achieved by a single action to retard the power lever(s) from the take - off setting without encountering a stop or lockout, it must be regarded as an additional pilot action for the purposes of assessing delay times. If this is the fourth or subsequent pilot action to stop the aeroplane, a one second de lay should be added to the demonstrated time to select reverse thrust.

Powered by EASA eRules Page 137 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE

CS 25.111 Take - off path

ED Decision 2015 / 0 0 8 /R (See AMC 25.111 ) (a) The take - off path extends from a standing start to a point in the take - of f at which the aeroplane is 457 m (1500 ft) above the take - off surface, or at which the transition from the take - off to the en - route configuration is completed and V is reached, whichever point is higher. In addit ion – FTO (1) The take - off path must be based on the procedures prescribed in CS 25.101(f) ; (2) The aeroplane must be accelerated on the ground to V , at which point the critical engine EF must be made inoperative and remain inope rative for the rest of the take - off; and (3) After reaching V , the aeroplane must be accelerated to V .

EF 2 (b) During the acceleration to speed V , the nose gear may be raised off the ground at a speed not less than V . However, landing gear retraction may not be begun until the aeroplane is airborne.

R (See AMC 25.111(b) .)

(c) During the take - off path determination in accordance with sub - paragraphs (a) and (b) of this paragraph – (1) The slope of the airborne part of the take - off path must be positive at each point; (2) The aeroplane must reach V before it is 11 m (35 ft) above the take - off surface and must continue at a speed as close as practical to, but not less than V until it is 122 m (400 ft) above the take - of f surface; (3) At each point along the take - off path, starting at the point at which the aeroplane reaches 122 m (400 ft) above the take - off surface, the available gradient of climb may not be less than – (i) 1·2% for two - engined aeroplanes; (ii) 1·5% for three - engined aeroplanes; and (iii) 1·7% for four - engined aeroplanes, (4) The aeroplane configuration may not be changed, except for gear retraction and automatic propeller feathering, and no change in power or thrust that requires action by the pilot may be made, until the aeroplane is 122 m (400 ft) above the take - off surface , and (5) If CS 25.105(a)(2) requires the take - off path to be determined for flight in icing conditions, the airborne part of the take - off must be based on the aeroplane drag: (i) With the most critical of the “Take - off Ice” accretion(s) defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) , from a height of 11 m (35 ft) above the take - off surface up to the point where the aeroplane is 122 m (400 ft) above the take - off surface; and (ii) With the most critical of the “Fi nal Take - off Ice” accretion(s) defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) , from the point where the aeroplane is 122 m (400 ft) above the take - off surface to the end of the take - off path.

Powered by EASA eRules Page 138 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (d) The take - off path must be determined by a continuous demonstrated take - off or by synthesis from segments. If the take - off path is determined by the segmental method – (1) The segments must be clearly defined and must relate to the distinct changes in the configuration, power or thr ust, and speed; (2) The weight of the aeroplane, the configuration, and the power or thrust must be constant throughout each segment and must correspond to the most critical condition prevailing in the segment; (3) The flight path must be based on the aero plane’s performance without ground effect; and (4) The take - off path data must be checked by continuous demonstrated take - offs up to the point at which the aeroplane is out of ground effect and its speed is stabilised, to ensure that the path is conservati ve to the continuous path.

The aeroplane is considered to be out of the ground effect when it reaches a height equal to its wing span.

(e) Not required for CS - 25.

[Amdt 25/3] [Amdt 25/16]

AMC 25.111 Take - off p ath

ED Decision 2003/2/RM The height references in CS 25.111 should be interpreted as geometrical heights.

AMC 25.111(b) Take - off p ath

ED Decision 2003/ 2/RM 1 Rotation speed, V , is intended to be the speed at which the pilot initiates action to raise the R nose gear off the ground, during the acceleration to V ; consequently, the take - off path determination, in accordance with CS 25.111(a) and (b) , should assume that pilot action to raise the nose gear off the ground will not be initiated until the speed V has been reached.

R 2 The time between lift - off and the initiation of gear retraction during take - off distance demonstrations should not be less than that necessary to establish an indicated positive rate of climb p lus one second. For the purposes of flight manual expansion, the average demonstrated time delay between lift - off and initiation of gear retraction may be assumed; however, this value should not be less than 3 seconds.

Powered by EASA eRules Page 139 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE

CS 25.113 Take - off distance and tak e - off run

ED Decision 2016 / 010 /R (See AMC 25.113) (a) Take - off distance on a dry runway is the greater of – (1) The horizontal distance along the take - off path from the start of the take - off to the point at which the aeroplane is 11 m (35 ft) above the tak e - off surface, determined under CS 25.111 for a dry runway; or (2) 115% of the horizontal distance along the take - off path, with all engines operating, from the start of the take - off to the point at which the aerop lane is 11 m (35 ft) above the take - off surface, as determined by a procedure consistent with CS 25.111 . (See AMC 25.113(a)(2), (b)(2) and (c)(2) .)

(b) Take - off distance on a wet runway is the greater of – (1) The take - off distance on a dry runway determined in accordance with sub - paragraph (a) of this paragraph; or (2) The horizontal distance along the take - off path from the start of the take - off to the point at which the aeroplane is 4,6 m (15 ft) above the ta ke - off surface, achieved in a manner consistent with the achievement of V before reaching 11 m (35 ft) above the take - off surface, determined under CS 25.111 for a wet runway. (See AMC 25.113(a)(2), (b)(2) and (c)(2) .)

(c) If the take - off distance does not include a clearway, the take - off run is equal to the take - off distance. If the take - off distance includes a clearway – (1) The take - off run on a dry runway is the greater of – (i) The horizontal distance along the take - off path from the start of t he takeoff to a point equidistant between the point at which V is reached and the point at which LOF the aeroplane is 11 m (35 ft) above the take - off surface, as determined under CS 25.111 for a dry runway; or (ii) 115% of the horizontal distance along the take - off path, with all engines operating, from the start of the take - off to a point equidistant between the point at which VLOF is reached and the point at which the aeroplane is 11 m (35 ft) above the take - off surface, determined by a procedure consisten t with CS 25.111 . (See AMC 25.113(a)(2), (b)(2) and (c)(2) .)

(2) The take - off run on a wet runway is the greater of – (i) The horizontal distance along the take - off path from the start of the takeoff to the point at which the aeroplane is 4,6 m (15 ft) ab ove the take - off surface, achieved in a manner consistent with the achievement of V before reaching 11 m (35 ft) above the take - off surface, determined under CS 25.111 for a wet runway; or (ii) 115% of the horizontal distance along the take - off path, with all engines operating, from the start of the take - off to a point equidistant between the point at which V LOF is reached and the point at which the aeroplane is 11 m (35 ft) above the take - off surface, determined by a procedure consistent with C S 25.111 . ( See AMC 25.113(a)(2) , (b)(2) and (c)(2) ) [Amdt 25/9] [Amdt 25/18] Powered by EASA eRules Page 140 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLI GHT (CS - 25) PERFORMANCE

AMC 25.113(a)( 2), (b)(2) and (c)(2) Take - off distance and take - off

r un

ED Decision 2003/ 2/RM In establishment of the take - off distance and take - off run, with all engines operating, in accord ance with CS 25.113(a), (b) and (c) , the flight technique should be such that – a. A speed of not less than V is achieved before reaching a height of 11 m (35 ft) above the take - off surface, b. It is consistent with the achievement of a smooth transition to a steady initial climb speed of not less than V + 19 km/h (10 kt) at a height of 122 m (400 ft) above the take - off surface.

CS 25.115 Take - off flight path

ED Decision 2003/ 2/RM (a) The take - off flight path must be considered to begin 11 m (35 ft) above the take - off surface at the end of the take - off distance determined in accordance with CS 25.113(a) or (b) as appropriate for the runway surface condition.

(b) The net take - off flight path data must be determined so that they represent the actual take - off flight paths (determined in accordance with CS 25.111 and with sub - paragraph (a) of this paragraph) reduced at each point by a gradient of climb equal to – (1) 0·8% for two - engined aeroplanes; (2) 0·9% for three - engined aeroplanes; and (3) 1·0% for four - engined aeroplanes.

(c) T he prescribed reduction in climb gradient may be applied as an equivalent reduction in acceleration along that part of the take - off flight path at which the aeroplane is accelerated in level flight.

CS 25.117 Climb: general

ED Decision 2003/2/RM Compliance with the requirements of CS 25.119 and 25.121 must be shown at each weight, altitude, and ambient temperature within the operational limits established for the a eroplane and with the most unfavourable centre of gravity for each configuration.

CS 25.119 Landing climb: all engines operating

ED Decision 2016 / 010 /R (See AMC 25.119 ) In the landing configuration, the steady gradient of climb may not be less than 3·2%, with t he engines at the power or thrust that is available 8 seconds after initiation of movement of the power or thrust controls from the minimum flight idle to the go - around power or thrust setting; and (a) In non - icing conditions, with a climb speed of VREF determined in accordance with CS 25.125(b)(2)(i) ; and Powered by EASA eRules Page 141 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (b) In icing conditions with the most critical of the “Landing Ice” accretion (s) defined in Appendice s C and O , as applicable, in accordance with CS 25.21(g) , and with a climb speed of V REF determined in accordance with CS 25.125(b)(2)(i) .

[Amdt 25/3] [Amdt 25/16] [Amdt 25/18]

AMC 25.119 Landing climb: a ll - engines - operating

ED Decision 2020/024/R In establishing the thrust specified in CS 25.119 , either – a. Engine acceleration tests should be conducted using the most critical combination of th e following parameters: i. Altitude; ii. Airspeed; iii. Engine bleed; iv. Engine power off - take; likely to be encountered during an approach to a landing airfield within the altitude range for which landing certification is sought; or b. The thrust specif ied in CS 25.119 should be established as a function of these parameters.

For aeroplanes equipped with a reduced go - around (RGA) thrust or power function, the climb requirements specified in CS 25.119 are applicable with the RGA function active. During the determination of the maximum thrust or power specified in AMC 25.119 a. and b. the thrust or power controls should be moved to the RGA thrust or power setting. This is consistent with an AFM all - engi nes - operating go - around procedure which recommends the use of an RGA function (see AMC 25.143(b)(4) ). In exceptional circumstances such as in the presence of wind shear or of unplanned obstacles, the flight crew ma y elect to use go - around thrust or power that exceeds the RGA setting. However, the applicant is not required to provide AFM climb gradient performance for this situation.

If an AFM go - around procedure is approved to use thrust or power above the RGA setti ng, then the climb requirements of CS 25.119 will apply at the higher thrust or power setting.

[Amdt 25/3] [Amdt 25/ 26 ]

CS 25.121 Climb: one - engine - inoperative

ED Decision 2015 / 008 /R (See AMC 25.121 ) (a) Take - off; landing gear extended. (See AMC 25.121(a) .) In the critical take - off configuration existing along the flight path (between the points at which the aeroplane reaches V a nd at LOF which the landing gear is fully retracted) and in the configuration used in CS 25.111 but without ground effect, the steady gradient of climb must be positive for two - engined aeroplanes, and not less than 0·3 % for three - engined aeroplanes or 0·5% for fourengined aeroplanes, at V and LOF with – Powered by EASA eRules Page 142 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (1) The critical engine inoperative and the remaining engines at the power or thrust available when retraction of the landing gear is begun in accordance with CS 25.111 u nless there is a more critical power operating condition existing later along the flight path but before the point at which the landing gear is fully retracted (see AMC 25.121(a)(1) ); and (2) The weight equal to th e weight existing when retraction of the landing gear is begun determined under CS 25.111 .

(b) Take - off; landing gear retracted. In the take - off configuration existing at the point of the flight path at which the landing gear is fully retracted, and in the configuration used in CS 25.111 but without ground effect, (1) the steady gradient of climb may not be less than 2·4% for two - e ngined aeroplanes, 2·7% for three - engined aeroplanes and 3·0% for four - engined aeroplanes, at V with – ( i ) The critical engine inoperative, the remaining engines at the take - off power or thrust available at the time the landing gear is fully retracted, d etermined under CS 25.111 , unless there is a more critical power operating condition existing later along the flight path but before the point where the aeroplane reaches a height of 122 m (400 ft) above the take - off surface (see AMC 25.121(b)(1)(i) ) ; and ( ii ) The weight equal to the weight existing when the aeroplane’s landing gear is fully retracted, determined under CS 25.111 .

(2) The requirements of sub - paragraph (b)(1) of this paragraph must be met: (i) In non - icing conditions; and (ii) In icing conditions with the most critical of the “Take - off Ice” accretion (s) defined in Appendices C and O , as applicable, in accordance with CS 25.21(g) , if in the configuration used to show compliance with CS 25.121(b) with this “Take - off Ice” accretion: (A) The stall speed at maximum take - off weight exceeds that in non - icing conditions by more than the greater of 5.6 km/h ( 3 knots) CAS or 3% of VSR; or (B) The degradation of the gradient of climb determined in accordance with CS 25.121(b) is greater than one - half of the applicable actual - to - net take - off flight path gradient reduction defined in CS 25.115(b) .

(c) Final take - off. In the en - route configuration at the end of the take - off path determined in accordance with CS 25.111 : (1) the steady gradient of climb may not be less than 1·2% for two - engined aeroplanes, 1·5% for three - engin ed aeroplanes, and 1·7% for four - engined aeroplanes, at V and with – FTO (i ) The critical engine inoperative and the remaining engines at the available maximum continuous power or thrust; and ( ii ) The weight equal to the weight existing at the end of the take - off path, determined under CS 25.111 .

(2) The requirements of sub - paragraph (c)(1) of this paragraph must be met: (i) In non - icing conditions; and Powered by EASA eRules Page 143 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (ii) In icing conditions with the most critical of the “Final Take - off Ice” accretion (s) defined in Appendices C and O , as applicable, in accordance with CS 25.21(g) , if in the configuration used to show compliance with CS 25.121(b) with this “Take - off Ice” accretion: (A) The stall speed at maximum take - off weight exceeds that in non - icing conditions by more than the greater of 5.6 km/h (3 knots) CAS or 3% of VSR; or (B) The degradation of the gradient of climb determined in accordance with CS 25.121(b) is greater than one - half of the appl icable actual - to - net take - off flight path gradient reduction defined in CS 25.115(b) .

(d) Approach. In a configuration corresponding to the normal all - engines - operating procedure in which V for this configuration does not exceed 110% of the V for the related all - engines - SR SR operating landing configuration: (1) steady gradient of climb may not be less than 2·1% for two - engined aeroplanes, 2·4% for three - engined aeroplanes and 2·7% for four - engined aeroplanes, with – (i ) The critical engine inopera tive, the remaining engines at the go - around power or thrust setting; ( ii ) The maximum landing weight; (iii ) A climb speed established in connection with normal landing procedures, but not more than 1·4 V ; and SR ( iv ) Landing gear retracted.

(2) The require ments of sub - paragraph (d)(1) of this paragraph must be met: (i) In non - icing conditions; and (ii) In icing conditions with the most critical of the Approach Ice accretion (s) defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) . The climb speed selected for non - icing conditions may be used if the climb speed for icing conditions, computed in accordance with sub - paragraph (d)(1)(iii) of this paragraph, does not exceed that for non - icing conditions by more than the greater of 5.6 km/h (3 knots) CAS or 3%.

[Amdt 25/3] [Amdt 25/16]

AMC 25.121 Climb: One - engine - inoperative

ED Decision 2003/ 2/RM 1 In showing compliance with CS 25.121 it is accepted that bank angles of up to 2° to 3° toward the operating engine(s) may be used.

2 The height references in CS 25.121 should be interpreted as geometrical heights.

AMC 25.121(a) Climb: One - engine - inoperative

ED Decision 2003/2/RM The confi guration of the landing gear used in showing compliance with the climb requirements of CS 25.121(a) may be that finally achieved following ‘gear down’ selection.

Powered by EASA eRules Page 144 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE

AMC 25.121(a)(1) Climb: One - engine - inoperative

ED Decision 2003/2/RM A ‘power operating condition’ more critical than that existing at the time when retraction of the landing gear is begun would occur, for example, if water injection were discontinued prior to reaching the point at which the landing g ear is fully retracted.

AMC 25.121(b)(1) (i) Climb: One - engine - inoperative

ED Decision 2007/010/R A ‘power operating condition’ more critical than that existing at the time the landing gear is fully retracted would occur, for example, if water injection w ere discontinued prior to reaching a gross height of 122 m (400 ft).

[Amdt 25/3]

CS 25.123 En - route flight paths

ED Decision 2015 / 008 /R (See AMC 25.123 ) (a) For the en - route configuration, the flight paths prescr ibed in sub - paragraphs (b) and (c) of this paragraph must be determined at each weight, altitude, and ambient temperature, within the operating limits established for the aeroplane. The variation of weight along the flight path, accounting for the progress ive consumption of fuel and oil by the operating engines, may be included in the computation. The flight paths must be determi ned at a selected speed not less than V , with – FTO (1) The most unfavourable centre of gravity; (2) The critical engines inoperative; (3) The remaining engines at the available maximum continuous power or thrust; and (4) The means for controlling the engine - cooling air supply in the position that provides adequate cooling in the hot - day condition.

(b) The one - engine - inoperat ive net flight path data must represent the actual climb performance diminished by a gradient of climb of 1·1% for two - engined aeroplanes, 1·4% for three - engined aeroplanes, and 1·6% for four - engined aeroplanes.

(1) In non - icing conditions; and (2) In icin g conditions with the “En - route Ic e” accretion defined in Appendices C and O , as applicable, in accordance with CS 25.21(g) , if: (i) A speed of 1.18V with the most critical of the “En - route Ice ” accretion (s) exc eeds SR the en - route speed selected in non - icing conditions by more than the greater of 5.6 km/h (3 knots) CAS or 3% of V , or SR (ii) The degradation of the gradient of climb is greater than one - half of the applicable actual - to - net flight path reduction define d in sub - paragraph (b) of this paragraph.

Powered by EASA eRules Page 145 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (c) For three - or four - engined aeroplanes, the two - engine - inoperative net flight path data must represent the actual climb performance diminished by a gradient climb of 0·3% for three - engined aeroplanes and 0·5% for four - engined aeroplanes.

[Amdt 25/3] [Amdt 25/16]

AMC 25.123 En - route flight p aths

ED Decision 2003/2/RM If, in showing compliance with CS 25.123 , any credit is to be taken for the progressive use of fuel by the operating engines, the fuel flow rate should be assumed to be 80% of the engine specification flow rate at maximum continuous power, unless a more appropriate figure has been substantiated by flight tests.

CS 25.125 Landing

ED Decision 2016 / 010 / R (a) The horizontal distance necessary to land and to come to a complete stop from a point 15 m (50 ft) above the landing surface must be determined (for standard temperatures, at each weight, altit ude and wind within the operational limits established by t he applicant for the aeroplane): (1) In non - icing conditions; and (2) In icing conditions with the most critical of the “Landing Ice” accretion (s) defined in App endices C and O, as applicable, in accordance with CS 25.21(g) , if V for icing REF conditions exceeds V for non - icing conditions by more than 9.3 km/h (5 knots) CAS at REF the maximum landing weight (b) In determining the distance in (a): (1) The aer oplane must be in the landing configuration.

(2) A stabilised approach, with a calibrated airspeed of not less than V , must be maintained REF down to the 15 m (50 ft) height.

(i) In non - icing conditions, V may not be less than: REF (A ) 1.23 V ; SR0 (B ) V established under CS25.149(f) ; and MCL (C ) A speed that provides the manoeuvring capability specified in CS 25.143(h) .

(ii) In icing conditions, V may not be less than: REF ( A) The speed determined in sub - paragraph (b)(2)(i) of this paragraph; (B) 1.23 V with the most critical of the "Landing Ice" accretion (s) defined in SR0 Appendices C and O, as applicable, in accordance with CS 25.21(g) , if that speed exceeds V for non - icing conditions by more than 9.3 km/h (5 knots) REF CAS; and (C) A speed that provides the manoeuvring capability specified in CS 25.143(h) with the most critical of the “ Landing i ce accretion (s) defined in appendices C and O, as applicable, in accordance with CS 25.21(g) .

Powered by EASA eRules Page 146 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE (3) Changes in configuration, power or thrust, and speed, must be made in accordance with the established procedures for service operation. (See AMC 25.125( b )(3) .)

(4) The landing must be made without excessive vertical acceleration, tendency to bounce, nose over or ground loop.

(5) The landings may not require exceptional piloting skill or alertness.

( c ) The landing distance must be determined on a level, smooth, dry, hard - surfaced runway. (See AMC 25.125( c ) .) In addition – (1) The pressures on the wheel braking systems may not exceed those specified by the brake m anufacturer; (2) The brakes may not be used so as to cause excessive wear of brakes or tyres (see AMC 25.125(c )(2) ); and (3) Means other than wheel brakes may be used if that means – (i) Is safe and reliable; (ii) Is used so that consistent results can be expected in service; and (iii) Is such that exceptional skill is not required to control the aeroplane.

( d ) Reserved.

(e ) Reserved.

(f ) The landing distance data must include correction factors for not more than 50% of the nominal wind components along the landing path opposite to the direction of landing, and not less than 150% of the nominal wind components along the landin g path in the direction of landing.

(g ) If any device is used that depends on the operation of any engine, and if the landing distance would be noticeably increased when a landing is made with that engine inoperative, the landing distance must be determine d with that engine inoperative unless the use of compensating means will result in a landing distance not more than that with each engine operating.

[Amdt 25/3] [Amdt 25/16] [Amdt 25/18]

AMC 25.125(b )(3) Change of Configuration

ED Decision 2007/010/R No changes in configuration, addition of thrust, or nose depression should be made after reaching 15 m (50 ft) height.

[Amdt 25/3] Powered by EASA eRules Page 147 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) PERFORMANCE

AMC 25.125(c ) Landing

ED Decision 2007 / 010/R 1 During measured landings, if the brakes can be consistently app lied in a manner permitting the nose gear to touch down safely, the brakes may be applied with only the main wheels firmly on the ground. Otherwise, the brakes should not be applied until all wheels are firmly on the ground.

2 This is not intended to preve nt operation in the normal way of automatic braking systems which, for instance, permit brakes to be selected on before touchdown.

[Amdt 25/3]

AMC 25.125(c )(2) Landing

ED Decision 2007/010/R To ensure compliance with CS 25.125(c)(2) , a series of six measured landings should be conducted on the same set of wheel brakes and tyres.

[Amdt 25/3] Powered by EASA eRules Page 148 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND M ANOEUVRABILITY

CONTROLLABILITY AND MANOEUVRABILITY

CS 25.143 General

ED Decision 2020/024/R (a) (See AMC 25.143(a) and (b) ) The aeroplane must be safely contro llable and manoeuvrable during: (1) t ake - off; (2) c limb; (3) l evel flight; (4) descent; (5) approach and go - around; and (6) approach and landing.

(b) (See AMC 25.143(a) and (b) ) It must be possible to make a smooth transition from one flight condition to any other flight condition without exceptional piloting skill, alertness, or strength, and w ithout danger of exceeding the aeroplane limit - load factor under any probable operating conditions, includin g: (1) The sudden failure of the critical engine; (See AMC 25.143(b)(1) .)

(2) For aeroplanes with three or more engines, the sudden failure of the second critical engine when the aeroplane is in the en - route, approach, or landing configuration and is trimmed with the critical engine inoperative; and (3) Configuration changes, including deployment or re traction of deceleration devices; and (4) Go - around manoeuvres with all engines operating. The assessment must include, in addition to controllability and manoeuvrability aspects, the flight crew workload and the risk of a somatogravic illusion. (See AMC 25.143(b)(4) ) (c) The aeroplane must be shown to be safely control lable and manoeuvrable with the most critical ice accretion (s) appropriate to the phase of flight as defined in appendices C and O , as applicable, in accordance with CS 25.21(g) , and with the critical engine inoperative and its propeller (if applicable) in the minimum drag position: (1) At the minimum V for take - off; (2) During an approach and go - around; and (3) During an approach and landing.

( d ) The following table prescribes, for conventional wheel type controls, the maximum control forces permitted during the testing required by sub - paragraphs (a) through ( c ) of this paragraph. (See AMC 25.14 3(d ) ): Powered by EASA eRules Page 149 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY Force, in newton (pounds), applied to the Pitch Roll Yaw control wheel or rudder pedals For short term application for pitch and roll 334 (75) 222 (50) – control – two hands available for control For short term application for pitch and roll 222 (50) 111 (25) – control – one hand available for control For short term application for yaw control – – 667 (150) For long term application 44,5 (10) 22 (5) 89 (20) ( e ) Approved operating procedures or conventional operating practices must be followed when demonstrating compliance with the control force limitations for short term application that are prescribed in sub - paragraph ( d ) of this paragraph. The aeroplane must be in trim, or as nea r to being in trim as practical, in the immediately preceding steady flight condition. For the take - off condition, the aeroplane must be trimmed according to the approved operating procedures.

( f ) When demonstrating compliance with the control force limita tions for long term application that are prescribed in sub - paragrap h (d ) of this paragraph, the aeroplane must be in trim, or as near to being in trim as practical.

(g ) When manoeuvring at a constant airspeed or Mach number (up to V /M ), the stick force s and FC FC the gradient of the stick force versus manoeuvring load factor must lie within satisfactory limits.

The stick forces must not be so great as to make excessive demands on the pilot’s strength when manoeuvring the aeroplane (see AMC No. 1 to CS 25.143(g ) ), and must not be so low that the aeroplane can easily be overstressed inadvertently. Changes of gradient that occur with changes of load factor must not cause undue difficulty in maintaining control of the aero plane, and local gradients must not be so low as to result in a danger of over - controlling. (See AMC No.

2 to CS 25.143(g ) ).

( h ) (See AMC 25.143( h ) ). The manoeuvring capabilities in a constant speed coordinated turn at forward centre of gravity, as specified in the following table, must be free of stall warning or other characteristics that might interfere with normal manoeuvring.

CONFIGURATION SPEED MANOE UVRING BANK ANGLE THRUST/POWER SETTING IN A COORDINATED TURN (1) TAKE - OFF V 2 30° ASYMMETRIC WAT - LIMITED (2) (3) TAKE - OFF V + xx 40° ALL ENGINES OPERATING CLIMB (1) EN - ROUTE V FTO 40° ASYMMETRIC WAT - LIMITED LANDING V 40° SYMMETRIC FOR – 3° FLIGHT PATH REF ANGLE (1) A combination of weight, altitude and temperature (WAT) such that the thrust or power setting produces the minimum climb gradient specified in CS 25.121 for the flight condition.

(2) Airspeed approved for all - engines - operating initial climb.

(3) That thrust or power setting which, in the event of failure of the critical engine and without any crew action to adjust the thrust or power of the remaining engines, would result in the thrust or power specified for the take - off condition at V , or any lesser thrust or power setting that is used for all - engines - operating initial climb procedures.

(i) When demonstrating compliance with CS 25.143 in ic ing conditions - Powered by EASA eRules Page 150 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY (1) Controllability must be demonstrated with the most critical of the ice accretion(s) for the particular phase of flight as defined in Appendices C and O , as applicable, in accordance with CS 25. 21(g) .

(2) It must be shown that a push force is required throughout a pushover manoeuvre down to a zero g load factor, or the lowest load factor obtainable if limited by elevator power or other design characteristic of the flight control system. It must b e possible to promptly recover from the manoeuvre without exceeding a pull control force of 222 N. (50 lbf); and (3) Any changes in force that the pilot must apply to the pitch control to maintain speed with increasing sideslip angle must be steadily incre asing with no force reversals, unless the change in control force is gradual and easily controllable by the pilot without using exceptional piloting skill, alertness, or strength.

(j) For flight in icing conditions before the ice protection system has been activated and is performing its intended function, it must be demonstrated in flight with the most critical of the ice accretion (s) defined in appendix C, part II(e) , and Appendix O, part II(d), as applicable, in accordance with CS 25.21(g) , that : (1) The aeroplane is controllable in a pull - up manoeuvre up to 1.5 g load factor; and (2) There is no pitch control force reversal during a pushover manoeuvre down to 0.5 g load factor.

(k) Side stick controllers In lieu of the maximum control forces provided in CS 25.143(d) for pitch and roll, and in lieu of specific pitch force requirements of CS 25.145(b) and CS 25.175(d) , it must be shown that the temporary and maximum prolonged force levels for side stick controllers are suitable for all expected operating conditions and configurations, whether normal or non - normal.

It must be shown by fli ght tests that turbulence does not produce unsuitable pilot - in - the - loop control problems when considering precision path control/tasks.

(l) Electronic flight control systems For electronic flight control systems (EFCS) which embody a normal load factor lim iting system and in the absence of aerodynamic limitation (lift capability at maximum angle of attack), (1) The positive limiting load factor must not be less than: (i) 2.5 g with the EFCS functioning in its normal mode and with the high - lift devices retra cted up to V /M . The positive limiting load factor may be gradually MO MO reduced down to 2.25 g above V /M .; MO MO (ii) 2.0 g with the EFCS functioning in its normal mode and with the high - lift devices extended.

(2) The negative limiting load factor must be equ al to or more negative than: (i) - 1.0 g with the EFCS functioning in its normal mode and with the high - lift devices retracted; (ii) 0 g with the EFCS functioning in its normal mode and with the high - lift devices extended.

Powered by EASA eRules Page 151 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY (3) The maximum reachable positive load factor wings level may be limited by flight control system characteristics or flight envelope protections (other than load factor limitation), provided that: (i) the required values are readily achievable in turn, and (ii) wings level pitch up respo nsiveness is satisfactory.

(4) The maximum reachable negative load factor may be limited by flight control system characteristics or flight envelope protections (other than load factor limitation), provided that: (i) pitch down responsiveness is satisfactory, and (ii) from level flight, 0 g is readily achievable, or, at least, a trajectory change of 5 degrees per second is readily achievable at operational speeds (from V to Max LS speed – 10 kt. V is the lowest speed that the crew may fly with au to thrust or auto LS pilot engaged. Max speed – 10 kt ) is intended to cover typical margin from V /M to cruise speeds and typical margin from V to standard speed in high - MO MO FE lift configurations.

(5) Compliance demonstrations with the above requirements may be performed without ice accretion on the airframe.

[Amdt 25/3] [Amdt 25/7] [Amdt 25/13] [Amdt 25/15] [Amdt 25/16] [Amdt 25/18] [Amdt 25/21] [Amdt 25/26]

AMC 25.143(a) and (b) Controllability and Manoeuvrability

ED Decision 2003/2/RM In s howing compliance with the requirements of CS 25.143(a) and (b) account should be taken of aeroelastic effects and structural dynamics (including aeroplane response to rough runways and water waves) which may influ ence the aeroplane handling qualities in flight and on the surface. The oscillation characteristics of the flightdeck, in likely atmospheric conditions, should be such that there is no reduction in ability to control and manoeuvre the aer oplane safely.

AMC 25.143(b)(1) Control Following Engine Failure

ED Decision 2003/ 2/RM 1 An acceptable means of showing compliance with CS 25.143(b)(1) is to demonstrate that it is possible to regain full control of the aeroplane without attaining a dangerous flight condition in the event of a sudden and complete failure of the critical engine in the following conditions: a. At each take - off flap setting at the lowest speed recommended for initial steady climb with all engines op erating after take - off, with – i. All engines, prior to the critical engine becoming inoperative, at maximum take - off power or thrust; ii. All propeller controls in the take - off position; Powered by EASA eRules Page 152 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY iii. The landing gear retracted; iv. The aeroplane in trim in th e prescribed initial conditions; and b. With wing - flaps retracted at a speed of 1.23 V with – SR1 i. All engines, prior to the critical engine becoming inoperative, at maximum continuous power or thrust; ii. All propeller controls in the en - route position; iii. The landing gear retracted; iv. The aeroplane in trim in the prescribed initial conditions.

2 The demonstrations should be made with simulated engine failure occurring during straight flight with wings level. In order to allow for likely delay in the initiation of recovery action, no action to recover the aeroplane should be taken for 2 seconds following engine failure. The recovery action should not necessitate movement of the engine, propeller or trimming controls, nor require excessive control forces. The aeroplane will be considered to have reached an unacceptable attitude if a bank angle of 45° is exceeded during recovery.

AMC 25.143(b)(4) Go - around Manoeuvres

ED Decision 2020/024/R 1. Background When full thrust or power is applied during a go - around, an excessive level of performance (rate of climb, accelerations) may be reached very qu ickly, and make it difficult for the flight crew to undertake all the actions required during a go - around, especially in an environment that is constrained (due to Air Traffic Control instructions, operational procedures, etc) and rapidly changing.

This le vel of performance can also generate acceleration levels (in particular, forward linear accelerations) that could lead to spatial disorientation of the flight crew (e.g. a somatogravic illusion), in particular when combined with reduced visibility conditio ns and a lack of monitoring of primary flight parameters, such as pitch attitude.

Accidents and incidents have occurred during or after go - arounds where somatogravic illusions have led flight crews to make inappropriate nose - down inputs, leading to an airc raft upset, a loss of control or a deviation from the normal go - around flight path, and in some cases, controlled flight into terrain with catastrophic consequences.

Other accidents resulting in loss of control were due to excessive pitch attitudes combined with the flight crew’s inadequate awareness of the situation.

The risk is higher on aeroplanes that have a large operational range of thrust to weight ratios, in particular for twin - engine aeroplanes and those with long - range capabilitie s.

2. Criteria for assessing the go - around manoeuvre risk with respect to somatogravic illusions and the flight crew workload 2.1 Somatogravic illusions It is considered that the risk of a somatogravic illusion is high when encountering high longitudinal a cceleration or combined high values of pitch attitude (nose - up), pitch rate and longitudinal acceleration, associated with a loss of outside visual references.

Powered by EASA eRules Page 153 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CON TROLLABILITY AND MANOEUVRABILITY 2.2 Workload In order to provide sufficient time to the flight crew to manage its tasks, and t herefore keep their workload at a reasonable level, longitudinal acceleration and vertical speed may need to be constrained. The assessment of the workload should be performed considering the basic workload functions described in Appendix D of CS - 25.

2.3 Risk assessment and mitigation means There are no scientifically demonstrated aeroplane performance limits to ensure that the risks of somatogravic illusions and excessive workloads remain at acceptable levels.

Howe ver, the following criteria should not be exceeded during a recommended go - around manoeuvre: — a pitch rate value of 4 degrees per second, — a pitch attitude of 20 degrees nose - up, — an energy level corresponding to either: — a vertical speed of 3 000 ft/min at constant calibrated airspeed, — a climb gradient of 22 % at constant calibrated airspeed, or — a level flight longitudinal acceleration capability of 7.8 km/h (4.2 kt) per second.

Note 1: these boundaries should not affect operational performance, as they are considered to be beyond the operational needs for a go - around.

Note 2: the numbers above should not be considered as hard limits, but as a reference only.

Design mitigation means should be put in place in order to avoid exceeding these criteria and reduce the risk at an acceptable level. These means should: — provide a robust method to reduce the risk identified, and — be used during recommended go - around procedures.

A reduced go - around (RGA) thrust or power function is considered to be an acceptable means of m itigation (refer to Chapter 4 below).

Alternatively, exceeding any one of the above criteria should be duly justified by the applicant and accepted by EASA.

3. Go - around evaluation Go - around manoeuvres should be performed during flight testing in order to verify, in addition to the controllability and manoeuvrability aspects, that the flight crew workload and the risk of a somatogravic illusion are maintained at an acceptable level (for an acceptable level of risk of a somatogravic illusion, refer to Chapte r 2.3 of this AMC). The go - around manoeuvres should be performed with all engines operating (AEO) and for each approved landing configuration as per the recommended AFM go - around procedure: — with the most unfavourable, and practicable, combination of centre of gravity position and weight approved for landing, — with any practicable combination of flight guidance/autothrust - throttle/autopilot to be approved, including manual, — with a level - off altitude 1 000 ft above the go - around initiation altitude.

Powered by EASA eRules Page 154 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY 4. Impleme ntation of a reduced go - around (RGA) thrust or power function The applicant may provide an RGA thrust or power function for use when the flight crew initiates a go - around. The function should operate with any practicable combination of the flight guidance/ autothrust - throttle/autopilot modes to be approved for operation, including manual modes.

This function should limit the engine thrust or power applied and maintain the performance of the aeroplane (in particular, its rate of climb) at a level that: — is not less than the minimum required performance compatible with the operational needs and the flight crew workload during this phase; and — reduces the flight crew’s risk of suffering a somatogravic illusion.

This thrust or power reduction function may be availa ble either through aircraft system automation or manually.

In any case, acceptable procedure(s) should be available in the aeroplane flight manual (AFM), and the recommended go - around procedure should be based on the RGA thrust or power function.

Note: When a reduced go - around thrust or power function is provided, the applicant should still use the most critical thrust or power within the range of available go - around thrust or power when showing compliance with the CS - 25 specifications.

4.1 Design target RGA functions with a design target of a 2 000 ft/min rate of climb capability have been accepted by EASA.

4.2 Cockpit indications and information to the flight crew In automatic mode, information that thrust or power is reduced in the RGA mode shoul d be indicated to the flight crew.

In manual mode, the thrust level tables should be made available to the flight crew.

4.3 Evaluation An evaluation of the go - around manoeuvre with the RGA thrust or power function should be conducted following the recommen dations of Chapter 3 above.

4.4 Thrust or power mode command It should be possible for the flight crew, at any time and without any delay, to select and apply the full go - around thrust or power.

The applicant should provide specific procedures for which fu ll thrust or power may be required, such as wind shear alert procedures, TCAS alert procedures, etc.

4.5 Engine failure during go - around with RGA thrust or power When an engine failure occurs during a go - around performed with active RGA thrust or power, if the required thrust or power from the remaining engine(s) to achieve an adequate performance level cannot be applied automatically, a warning alert to the flight crew is required to prompt them to take the necessary thrust or power recovery action.

For no n - moving autothrust - throttle lever designs or designs relying on manual thrust or power setting procedures, compelling flight deck alerts may be acceptable in lieu of Powered by EASA eRules Page 155 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY automatic thrust or power recovery of the operating engine(s) to permit the use of maximu m go - around thrust or power for compliance with CS 25.121 (d) .

The procedure for the recovery of the engine thrust or power setting must be demonstrated to be acceptable in terms of the detection of the situation b y the pilot and the required actions in a high - workload environment.

The following items should be evaluated: — the timeliness of achieving the minimum required performance; — flight crew awareness (indications, alerting…); — flight crew actions (commands); — the flight crew workload in general.

4.6 Performance published in the AFM for RGA thrust or power The climb performance required by CS 25.119 (in a landing climb, i.e. with all engines operating) should be based on the actual RGA thrust or power available (applied by following the recommended AFM procedure). The climb performance required by CS 25.121 (in an approach climb, i.e. with one engine inoperative) should be based on: — e ither the RGA thrust or power available, if no thrust or power recovery is implemented, — or the go - around thrust or power available after the application of the thrust or power recovery action (either automatically, or manuall y after an alert is triggered). For non - moving autothrust - throttle lever designs or manual thrust or power setting procedures, compelling flight deck alerts may be acceptable in lieu of automatic thrust or power recovery of the operating engine to permit the use of maximum go - around thr ust or power for compliance with CS 25.121(d) .

[Amdt 25/21] [Amdt 25/26]

AMC 25.143 (d ) Controllability and Manoeuvrability

ED Decision 2007 / 010/R 1 The maximum forces given in the table in CS 25.143(c) for pitch and roll control for short term application are applicable to manoeuvres in which the control force is only needed for a short period. Where the manoe uvre is such that the pilot will need to use one hand to operate other controls (such as the landing flare or go - around, or during changes of configuration or power resulting in a change of control force that must be trimmed out) the single - handed maximum control forces will be applicable. In other cases (such as take - off rotation, or manoeuvring during en - route flight) the two handed maximum forces will apply.

2 Short term and long term forces should be interpreted as follows: – Short term forces are the initial stabilised control forces that result from maintaining the intended flight path during configuration changes and normal transitions from one flight condition to another, or from regaining control following a failure. It is assumed that the pilot wi ll take immediate action to reduce or eliminate such forces by re - trimming or changing configuration or flight conditions, and consequently short term forces are not considered to exist for any significant duration. They do not include transient force peak s that may occur Powered by EASA eRules Page 156 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY during the configuration change, change of flight condition or recovery of control following a failure.

Long term forces are those control forces that result from normal or failure conditions that cannot readil y be trimmed out or eliminate d.

[Amdt 25/3]

AMC No. 1 to CS 25.143(g ) Controllability and Manoeuvrability

ED Decision 2007 / 0 10/R An acceptable means of compliance with the requirement that stick forces may not be excessive when manoeuvring the aeroplane, is to demonstrate that, in a turn for 0·5g incremental normal acceleration (0·3g above 6096 m (20 000 ft)) at speeds up to V /M , the average stick force gradient does not FC FC exceed 534 N (120 lbf)/g.

[Amdt 25/3]

AMC No. 2 to CS 25.143(g ) Controllability and Manoeuvrability

ED Decisio n 2007 / 010/R 1 The objective of CS 25.143(g) is to ensure that the limit strength of any critical component on the aeroplane would not be exceeded in manoeuvring flight. In much of the structure the load sustained in manoeuvring flight can be assumed to be directly proportional to the load factor applied. However, this may not be the case for some parts of the structure, e.g., the tail and rear fuselage. Nevertheless, it is accepted that the aeroplane load factor wi ll be a sufficient guide to the possibility of exceeding limit strength on any critical component if a structural investigation is undertaken whenever the design positive limit manoeuvring load factor is closely approached. If flight testing indicates that the design positive limit manoeuvring load factor could be exceeded in steady manoeuvring flight with a 222 N (50 lbf) stick force, the aeroplane structure should be evaluated for the anticipated load at a 222 N (50 lbf) stick force.

The aeroplane will be considered to have been overstressed if limit strength has been exceeded in any critical component. For the purposes of this evaluation, limit strength is defined as the larger of either the limit design loads envelope increased by the available margins o f safety, or the ultimate static test strength divided by 1·5.

2 Minimum Stick Force to Reach Limit Strength 2.1 A stick force of at least 222 N (50 lbf) to reach limit strength in steady manoeuvres or wind up turns is considered acceptable to demonstrat e adequate minimum force at limit strength in the absence of deterrent buffeting. If heavy buffeting occurs before the limit strength condition is reached, a somewhat lower stick force at limit strength may be acceptable. The acceptability of a stick force of less than 222 N (50 lbf) at the limit strength condition will depend upon the intensity of the buffet, the adequacy of the warning margin (i.e., the load factor increment between the heavy buffet and the limit strength condition) and the stick force ch aracteristics. In determining the limit strength condition for each critical component, the contribution of buffet loads to the overall manoeuvring loads should be taken into account.

2.2 This minimum stick force applies in the en - route configuration with the aeroplane trimmed for straight flight, at all speeds above the minimum speed at which the limit strength condition can be achieved without stalling. No minimum stick force is specified for other configurations, but the requirements of CS 25.143(g) are applicable in these conditions.

Powered by EASA eRules Page 157 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY 3 Stick Force Characteristics 3.1 At all points within the buffet onset boundary determined in accordance with CS 25.251(e) , but not including speeds above V /M , the stick force should increase FC FC progressively with increasing load factor. Any reduction in stick force gradient with change of load factor should not be so large or abrupt as to impair significantly the ability of the pilot to maintain control over the load factor and pitch attitude of the aeroplane.

3.2 Beyond the buffet onset boundary, hazardous stick force characteristics should not be encountered within the p ermitted manoeuvring envelope as limited by paragraph 3.3. It should be possible, by use of the primary longitudinal control alone, to pitch the aeroplane rapidly nose down so as to regain the initial trimmed conditions. The stick force characteristics dem onstrated should comply with the following: a. For normal acceleration increments of up to 0·3 g beyond buffet onset, where these can be achieved, local reversal of the stick force gradient may be acceptable provided that any tendency to pitch up is mild and easily controllable.

b. For normal acceleration increments of more than 0·3 g beyond buffet onset, where these can be achieved, more marked reversals of the stick force gradient may be acceptable. It should be possible for any tendency to pitch up to be contained within the allowable manoeuvring limits without applying push forces to the control column and without making a large and rapid forward movement of the control column.

3.3 In flight tests to satisfy paragraph 3.1 and 3.2 the load factor sho uld be increased until either – a. The level of buffet becomes sufficient to provide a strong and effective deterrent to further increase of load factor; or b. Further increase of load factor requires a stick force in excess of 667 N (150 lbf) ( or in excess of 445 N (100 lbf) when beyond the buffet onset boundary) or is impossible because of the limitations of the control system; or c. The positive limit manoeuvring load factor established in compliance with CS 25.337(b) is achieved.

4 Negative Load Factors It is not intended that a detailed flight test assessment of the manoeuvring characteristics under negative load factors should necessarily be made throughout the specified range of conditions.

An as sessment of the characteristics in the normal flight envelope involving normal accelerations from 1 g to 0 g will normally be sufficient. Stick forces should also be assessed during other required flight testing involving negative load factors. Where these assessments reveal stick force gradients that are unusually low, or that are subject to significant variation, a more detailed assessment, in the most critical of the specified conditions, will be required. This may be based on calculations provided these are supported by adequate flight test or wind tunnel data.

[Amdt 25/3] Powered by EASA eRules Page 158 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUB PART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY

AMC 25.143(h ) Manoeuvre Capability

ED Decision 2007 / 010/R 1 As an alternative to a detailed quantitative demonstration and analysis of coordinated turn capabilities, the levels of manoeuvrability free of stall warning required by CS 25.143(h) can normally be assumed where t he scheduled operating speeds are not less than – 1.08 V for V SW 2 1.16 V for V + xx, V and V SW 2 FTO REF where V is the stall warning speed determined at idle power and at 1g in the same conditions SW of configuration, weight and centre of gravity, all expr essed in CAS. Neverthless, a limited number of turning flight manoeuvres should be conducted to confirm qualitatively that the aeroplane does meet the manoeuvre bank angle objectives (e.g. for an aeroplane with a significant Mach effect on the C /α relatio nship) and does not exhibit other characteristics which L might interfere with normal manoeuvring.

2 The effect of thrust or power is normally a function of thrust to weight ratio alone and, therefore, it is acceptable for flight test purposes to use the th rust or power setting that is consistent with a WAT - limited climb gradient at the test conditions of weight, altitude and temperature. However, if the manoeuvre margin to stall warning (or other relevant characteristic that might interfere with normal mano euvring) is reduced with increasing thrust or power, the critical conditions of both thrust or power and thrust - to - weight ratio must be taken into account when demonstrating the required manoeuvring capabilities.

[Amdt 25/3]

CS 25.145 Longitudinal control

ED Decision 201 8 / 005 /R (a) (See AMC 25.145(a) .) It must be possible at any point between the trim speed prescribed in CS 25.103(b)(6) and stall identification (as defined in CS 25.201(d) ), to pitch the nose downward so that the acceleration to this selec ted trim speed is prompt with: (1) t he aeroplane trimmed at the trim speed prescribed in CS 25.103(b)(6) ; (2) t he most critical landing gear configuration ; (3) t he wing - flaps (i) retracted and (ii) extended; and (4) engine trust or p ower (i) off and (ii) at go - around setting.

(b) With the landing gear extended, no change in trim control, or exertion of more than 222 N (50 pounds) control force (representative of the maximum short term force that can be applied readily by one hand) may be required for the following manoeuvres: (1) W ith power off, wing - flaps retracted, and the aeroplane trimmed at 1·3 V , extend the SR1 wing - flaps as rapidly as possible while maintaining the airspeed at approximately 30% above the reference stall speed existing at each instant throughout the manoeuvre. (See AMC 25.145(b)(1), (b)(2) and (b)(3) .)

(2) Repeat sub - paragraph (b)(1) of this paragraph except initially extend the wing - flaps and then retract them as rapidly as possible. (See AMC 25.145(b)(2) and AMC 25.145(b)(1), (b)(2) and (b)(3) .)

(3) Repeat sub - paragraph (b)(2) of this paragraph except at the go - around power or thrust setting. (See AMC 25.145(b)(1), (b)(2) and (b)(3) .)

Powered by EASA eRules Page 159 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY (4) With power off, wing - flaps retracted and the aeroplane trimmed at 1·3 V , rapidly set SR1 go - around power or thrust while maintaining the same airspeed.

(5) Repeat sub - paragraph (b)(4) of this paragraph except with wing - flaps extended.

(6) With power off, wing - flaps extended and the aeroplane trimmed at 1·3 V obtain and SR1 maintain airspeeds between V and either 1·6 V , or V , whichever is the lower.

SW SR1 FE (c) It must be possible, without exceptional pilot ing skill, to prevent loss of altitude when complete retraction of the high lift devices from any position is begun during steady, straight, level flight at 1·08 V , for propeller powered aeroplanes or 1·13 V , for turbo - jet powered aeroplanes, SR1 SR1 with – (1) Simultaneous movement of the power or thrust controls to the go - around power or thrust setting; (2) The landing gear extended; and (3) The critical combinations of landing weights and altitudes.

(d) Revoked (e) (See AMC 25.145(e) .) If gated high - lift device control positions are provided, sub - paragraph (c) of this paragraph applies to retractions of the high - lift devices from any position from the maximum landing position to the first gated position, between gat ed positions, and from the last gated position to the fully retracted position. The requirements of sub - paragraph (c) of this paragraph also apply to retractions from each approved landing position to the control position(s) associated with the high - lift d evice configuration(s) used to establish the go - around procedure(s) from that landing position. In addition, the first gated control position from the maximum landing position must correspond with a configuration of the high - lift devices used to establish a go - around procedure from a landing configuration. Each gated control position must require a separate and distinct motion of the control to pass through the gated position and must have features to prevent inadvertent movement of the control through the gated position. It must only be possible to make this separate and distinct motion once the control has reached the gated position.

(f) It must be possible to maintain adequate longitudinal and speed control under the following conditions without exceptio nal piloting skill, alertness, or strength, without danger of exceeding the aeroplane limit - load factor and while maintaining an adequate stall margin throughout the manoeuvre: (1) Starting with the aeroplane in each approved approach and landing configur ation, trimmed longitudinally and with the thrust or power setting per CS 25.161(c)(2) , perform a go - around, transition to the next flight phase and level off at the desired altitude: (i) with all engines operati ng and the thrust or power controls moved to the go - around power or thrust setting; (ii) with the configuration changes, as per the approved operating procedures or conventional operating practices; and (iii) with any practicable combination of Flight G uidance/Autothrust - throttle/Autopilot to be approved, including manual.

Powered by EASA eRules Page 160 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRA BILITY (2) Reasonably expected variations in service from the established approach, landing and go - around procedures for the operation of the aeroplane must not result in unsafe flight characteristics during the go - around.

[Amdt 25/18] [Amdt 25/21]

AMC 25.145(a) Longitudinal control - Control near the s tall

ED Decision 2018 / 005/R 1 CS 25.145(a) requires that there be adequate longitudinal control to promptly pitch the aeroplane nose down from at or near the stall to return to the original trim speed. The intent is to ensure sufficient pitch control for a prompt recovery if the aeroplane is inadve rtently slowed to the point of the stall. Although this requirement must be met with engine thrust or power off and at go - around setting , there is no intention to require stall demonstrations at engine thrusts or powers above that specified in CS 25.201(a)(2) . Instead of performing a full stall at go - around thrust or power setting , compliance may be assessed by demonstrating sufficient static longitudinal stability and nose down control margin when the deceleration is ended at least one second past stall warning during a 0.5 m/s (one knot per second) deceleration. The static longitudinal stability during the manoeuvre and the nose down control power remaining at the end of the manoeuvre must be sufficient to assure c ompliance with the requirement.

2 The aeroplane should be trimmed at the speed for each configuration as prescribed in CS 25.103(b)(6) . The aeroplane should then be decelerated at 0.5 m/s (1 knot per second) with wings level. For tests at idle thrust or power, it should be demonstrated that the nose can be pitched down from any speed between the trim speed and the stall. Typically, the most critical point is at the stall when in stall buff et. The rate of speed increase during the recovery should be adequate to promptly return to the trim point. Data from the stall characteristics test can be used to evaluate this capability at the stall. For tests at go - around thrust or power setting , the m anoeuvre need not be continued for more than one second beyond the onset of stall warning.

However, the static longitudinal stability characteristics during the manoeuvre and the nose down control power remaining at the end of the manoeuvre must be suffici ent to assure that a prompt recovery to the trim speed could be attained if the aeroplane i s slowed to the point of stall.

3 For aeroplanes with an automatic pitch trim function (either in manual control or automatic mode), the nose - up pitch trim travel s hould be limited before or at stall warning activation (or stall buffet onset, or before reaching the angle - of - attack (AOA) limit if a high AOA limiting function is installed), in order to prevent an excessive nose - up pitch trim position and ensure that it is possible to command a prompt pitch down of the aeroplane to recover control.

The applicant should demonstrate this feature during flight testing or by using a validated simulator.

Note 1: the behaviour of the automatic pitch trim function in degraded flight control laws should be evaluated under CS 25.1309 and CS 25.671 .

Note 2: the applicant may account for certain flight phases where this limit is not appropriate, an d provide a rationale that supports these exceptions to EASA for consideration.

[Amdt No: 25/21] Powered by EASA eRules Page 161 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY

AMC 25.145(b)(2) Longitudinal c ontrol

ED Decision 2003/2/RM Where high lift devices are being retracted and where large and rapid changes in maximum lift occur as a result of movement of high - lift devices, some reduction in the margin a bove the stall may be accepted.

AMC 25.145(b)(1), (b)(2) and (b)(3) Longitudinal c ontrol

ED Decision 2003/2/RM The presence of gated positions on the flap control does not a ffect the requirement to demonstrate full flap extensions and retractions wit hout changing the trim control.

AMC 25.145(e) Longitudinal c ontrol

ED Decision 2003/ 2/RM If gates are provided, CS 25.145(e) requires th e first gate from the maximum landing position to be located at a position corresponding to a go - around configuration. If there are multiple go - around configurations, the following criteria should be considered when selecting the location of the gate: a. The expected relative frequency of use of the available go - around configurations.

b. The effects of selecting the incorrect high - lift device control position.

c. The potential for the pilot to select the incorrect control position, considering the likely situations for use of the different go - around positions.

d. The extent to which the gate(s) aid the pilot in quickly and accurately selecting the correct position of the high - lift devices.

AMC 25.145(f) Longitudinal control – go - around

ED Decision 2018/ 005/R 1. CS 25.145(f)(1) requires there to be adequate longitudinal control to promptly pitch the aeroplane (nose down and up) and adequate speed control in order to follow or maintain the targeted trajectory during the complete manoeuvre from any approved approach and landing co nfiguration to a go - around, transition to the next flight phase and level off at the desired altitude.

The objective is to assess, in particular, the combined effects of a thrust or power application and a nose - up trim pitching moment.

The applicant should perform the evaluation throughout the range of thrust - to - weight ratios to be certified. This range sh ould include, in particular, the highest thrust - to - weight ratio for the all - engines - operating condition, with the aeroplane at its minimum landing weight, all engines operating and the thrust or power at the go - around setting.

The evaluation should show a dequate: — pitch control (i.e. no risk of excessive pitch rate or attitude, maintaining an adequate stall margin throughout the manoeuvre, no excessive overshoot of the level - off altitude), and — speed control (i.e. no risk of speed instability or exceedance of VFE with the wing - flaps extended and VLE with the landing gear extended).

Powered by EASA eRules Page 162 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY Refer also to AMC No. 1 to CS 25.1329 , Section 14.1.3.3, which provides guidance related to the demonstration of the flight guidance sy stem go - around mode.

2. The applicant shall evaluate reasonably expected variations in service from the established approach, landing and go - around procedures and ensure that they do not result in unsafe flight characteristics during a go - around.

It is expected that these variations may include: a) non - stabilised speed conditions prior to the initiation of a go - around (e.g. approach speed - 5 kt), and b) adverse pitch trim positions: i) In manual mode with a manual pitch trim, a pitch trim position ed for the approach or landing configuration, and kept at this position during the go - around phase; and ii) in autopilot or manual mode with an automatic pitch trim function: the most adverse position that can be sustained by the autopilot or automatic p itch trim function, limited to the available protecting/limiting features or alert (if credit can be taken for it).

The applicant should perform these demonstrations by conducting go - around manoeuvres in flight or during simulator test programmes.

[Amdt 2 5/21]

CS 25.147 Directional and lateral control

ED Decision 2017 / 015 /R (See AMC 25.147) (a) Directional control; general. (See AMC 25.147(a) .) It must be possible, with the wings level, to yaw into the operative engine and to safely make a reasonably sudde n change in heading of up to 15 ° in the direction of the critical inoperative engine. This must be shown at 1·3 V , for SR1 heading changes up to 15 ° (except that the heading change at which the rudder pe dal force is 667 N (150 lbf) need not be exceeded), and with – (1) The critical engine inoperative and its propeller (if applicable) in the minimum drag position; (2) The power required for level flight at 1.3 V , but not more than maximum continuous SR1 po wer; (3) The most unfavourable centre of gravity; (4) Landing gear retracted; (5) Wing - flaps in the approach position; and (6) Maximum landing weight.

(b) Directional control; aeroplanes with four or more engines. Aeroplanes with four or more engines must meet the requirements of sub - paragraph (a) of this paragraph except that – (1) The two critical engines must be inoperative with their propellers (if appl icable) in the minimum drag position; (2) Reserved; and (3) The wing - flaps must be in the most favourable climb position.

Powered by EASA eRules Page 163 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY (c) Lateral control; general. It must be possible to make 20 ° banked turns, with and against the inoperative engine, from steady fligh t at a speed equal to 1·3 V , with – SR1 (1) The critical engine inoperative and its propeller (if applicable) in the minimum drag position; (2) The remaining engines at maximum continuous power; (3) The most unfavourable centre of gravity; (4) Landing gear both retracted and extended; (5) Wing - flaps in the most favourable climb position; and (6) Maximum take - off weight; (d) Lateral control; roll capability. With the critical engine inoperative, roll response must allow normal manoeuvres. Lateral control mus t be sufficient, at the speeds likely to be used with one engine inoperative, to provide a roll rate necessary for safety without excessive control forces or travel. (See AMC 25.147(d) .)

(e) Lateral control; aeropl anes with four or more engines. Aeroplanes with four or more engines must be able to make 20 ° banked turns, with and against the inoperative engines, from steady flight at a speed equal to 1·3 V , with maximum continuous power, and with the aeroplane in SR1 the configuration prescribed by sub - paragraph (b) of this paragraph.

(f) Lateral control; all engines operating. With the engines operating, roll response must allow normal manoeuvres (such as recovery from upsets produced by gusts and the initiation of evasive manoeuvres). There must be enough excess lateral control in sideslips (up to sideslip angles that might be required in normal operation), to allow a limited amount of manoeuvring and to correct for gusts. Lateral control must be enoug h at any speed up to V /M to provide FC FC a peak roll rate necessary for safety, without excessive control forces or travel. (See AMC 25.147(f) .)

[Amdt 25/18] [Amdt 25/19]

AMC 25.147(a) Directional c ontrol; general

ED Decision 2003/2/RM The intention of the requirement is that the aircraft can be yawed as prescribed without the need for application of bank angle. Small variations of bank angle that are inevitable in a realistic flight tes t demonstration are acceptabl e.

AMC 25.147(d) Lateral control: Roll c apability

ED Decision 2003/ 2/RM An acceptable method of demonstrating compliance with CS 25.147(d) is as follows: With the aeroplane in trim, all as nearly as possible,in tr im, for straight flight at V , establish a steady 30° banked turn. It should be demonstrated that the aeroplane can be rolled to a 30° bank angle in the other direction in not more than 11 seconds. In this demonstration, the rudder may be used to the exten t necessary to minimise sideslip. The demonstration should be made in the most adverse direction. The manoeuvre may be unchecked. Care should be taken to prevent excessive sideslip and bank angle during the recovery.

Powered by EASA eRules Page 164 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY Conditions: Maximum take - off weight.

Most aft c.g. position.

Wing - flaps in the most critical take - off position.

Landing Gear retracted.

Yaw SAS on, and off, if applicable.

Operating engine(s) at maximum take - off power.

The inoperative engine that would be most critical for controllability, with the propeller (if applicable) feathered.

Note: Normal operation of a yaw stability augmentation system (SAS) should be considered in accordance with normal operating procedures.

AMC 25.147(f) Lateral control: All engines o perating

ED Decision 2003/ 2/RM An acceptable method of demonstrating that roll response and peak roll rates are adequate for compliance with CS 25.147(f) is as follows: It should be possible in the conditions specified below to roll the aeropla ne from a steady 30° banked turn through an angle of 60° so as to reverse the direction of the turn in not more than 7 seconds. In these demonstrations the rudder may be used to the extent necessary to minimise sideslip. The demonstrations should be made r olling the aeroplane in either direction, and the manoeuvres may be unchecked.

Conditions: (a) En - route: Airspeed. All speeds between the minimum value of the scheduled all - engines - operating climb speed and V /M .

MO MO Wing - flaps. En - route position(s).

Ai r Brakes. All permitted settings from Retracted to Extended.

Landing Gear. Retracted.

Power. All engines operating at all powers from flight idle up to maximum continuous power.

Trim. The aeroplane should be in trim from straight flight in these conditi ons, and the trimming controls should not be moved during the manoeuvre.

(b) Approach: Airspeed. Either the speed maintained down to the 15 m (50 ft) height in compliance with CS 25.125(a)(2) , or the target thres hold speed determined in accordance with CS 25.125(c)(2)(i) as appropriate to the method of landing distance determination used.

Wing - flaps. In each landing position.

Air Brakes. In the maximum permitted extended setting.

Landing Gear. Extended.

Powered by EASA eRules Page 165 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABI LITY AND MANOEUVRABILITY Power. All engines operating at the power required to give a gradient of descent of 5·0%.

Trim. The aeroplane should be in trim for straight flight in these conditions, and the trimming controls should not be moved duri ng the manoeuvre.

CS 25.149 Minimum control speed

ED Decision 2003/ 2/RM (See AMC 25.149 ) (a) In establishing the minimum control speeds required by this paragraph, the method used to simulate critical engine failure must represent the most critical mode of powerplant failure with respect to controllability expected in service.

(b) V is the calibrated airspeed, at which, when the critical engine is suddenly made inoperative, MC it is possible to maintain control of the aeroplane with that engine still inoperative, and maintain straight flight with an a ngle of bank of not more than 5 ° .

(c) V may not exceed 1·13 V with – MC SR (1) Maximum available take - off power or thrust on the engines; (2) The most unfavourable ce ntre of gravity; (3) The aeroplane trimmed for take - off; (4) The maximum sea - level take - off weight (or any lesser weight necessary to show V ); MC (5) The aeroplane in the most critical take - off configuration existing along the flight path after the aeropla ne becomes airborne, except with the landing gear retracted; (6) The aeroplane airborne and the ground effect negligible; and (7) If applicable, the propeller of the inoperative engine – (i) Windmilling; (ii) In the most probable position for the specific design of the propeller control; or (iii) Feathered, if the aeroplane has an automatic feathering device acceptable for showing compliance with the climb requirements of CS 25.121 .

(d) The rudder forces required t o maintain control at V may not exceed 667 N (150 lbf) nor may MC it be necessary to reduce power or thrust of the operative engines. During recovery, the aeroplane may not assume any dangerous attitude or require exceptional piloting skill, alertness, or s trength to prevent a heading change of more than 20 ° .

(e) V MCG , the minimum control speed on the ground, is the calibrated airspeed during the take - off run at which, when the critical engine is suddenly made inoperative, it is possible to maintain control of the aeroplane using the rudder control alone (without the use of nose - wheel steering), as limited by 667 N of force (150 lbf), and the lateral control to the extent of keeping the wings level to enable the take - off to be safely continued using normal pi loting skill. In the determination of V , assuming that the path of the aeroplane accelerating with all engines MCG operating is along the centreline of the runway, its path from the point at which the critical engine is made inoperative to the point at which recovery to a direction parallel to the centreline is completed, may not deviate more than 9.1 m (30 ft) laterally from the centreline at any point. V must be established, with – MCG Powered by EASA eRules Page 166 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY (1) The aeroplane in each take - off configuration or, at the option o f the applicant, in the most critical take - off configuration; (2) Maximum available take - off power or thrust on the operating engines; (3) The most unfavourable centre of gravity; (4) The aeroplane trimmed for take - off; and (5) The most unfavourable weig ht in the range of take - off weights. (See AMC 25.149(e) .)

(f) (See AMC 25.149(f) ) V , the minimum control speed during approach and landing with all MCL engines operating, is the calibrated airspeed at which, when the critical engine is suddenly made inoperative, it is possible to maintain control of the aeroplane with that engine still inoperative, MCL and maintain straight flight with an a ngle of bank of not more than 5 ° . V m ust be established with – (1) The aeroplane in the most critical configuration (or, at the option of the applicant, each configuration) for approach and landing with all engines operating; (2) The most unfavourable centre of gravity; (3) The aeroplane trimmed for approach with all engines operating; (4) The most unfavourable weight, or, at the option of the applicant, as a function of weight; (5) For propeller aeroplanes, the propeller of the inoperative engine in the position it achieves with out pilot action, assuming the engine fails while at the power or thrust necessary to maintain a 3 degree approach path angle; and (6) Go - around power or thrust setting on the operating engine(s).

(g) (See AMC 25.149(g) ) For aeroplanes with three or more engines, V , the minimum control MCL - 2 speed during approach and landing with one critical engine inoperative, is the calibrated airspeed at which, when a second critical engine is suddenly made inoperative, it is possible to maintain control of the aeroplane with both engines still inoperative, and maintain straight flight with an a ngle of bank of not more than 5 ° . V must be established with – MCL - 2 (1) The aeroplane in the most critical configuration (or, at the o ption of the applicant, each configuration) for approach and landing with one critical engine inoperative; (2) The most unfavourable centre of gravity; (3) The aeroplane trimmed for approach with one critical engine inoperative; (4) The most unfavourable weight, or, at the option of the applicant, as a function of weight; (5) For propeller aeroplanes, the propeller of the more critical engine in the position it achieves without pilot action, assuming the engine fails while at the power or thrust necessary to maintain a 3 degree approach path angle, and the propeller of the other inoperative engine feathered; (6) The power or thrust on the operating engine(s) necessary to maint ain an approach path o angle of 3 when one critical engine is inoperative; and (7 ) The power or thrust on the operating engine(s) rapidly changed, immediately after the second critical engine is made inoperative, from the power or thrust prescribed in sub - paragraph (g)(6) of this paragraph to – (i) Minimum power or thrust; and (ii) Go - around power or thrust setting.

Powered by EASA eRules Page 167 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY (h) In demonstrations of V and V – MCL MCL - 2 (1) The rudder force may not exceed 667 N (150 lbf); (2) The aeroplane may not exhibit hazardous flight characteristics or require exceptional piloting skill, alertness or strength; (3) Lateral control must be sufficient to roll the aeroplane, from an initial condition of steady straight flight, through an angle of 20 ° in the direction necessary to initiate a turn away from the inoperative engine(s), in not more than 5 seconds (see AMC 25.149(h)(3) ); and (4) For propeller aeroplanes, hazardous flight characteristics must not be exhibited due to any propeller position achieved when the engine fails or during any likely subsequent movements of the engine or propeller controls (see AMC 25.149(h)(4) ).

AMC 25.149 Minimum control speeds

ED Decision 2003/ 2/RM 1 The determination of the minimum control speed, V , and the variation of V with available MC MC thrust, may be made primarily by means of ‘static’ testing, in which the sp eed of the aeroplane is slowly reduced, with the thrust asymmetry already established, until the speed is reached at which straight flight can no longer be maintained. A small number of ‘dynamic’ tests, in which sudden failure of the critical engine is sim ulated, should be made in order to check that the V s MC determined by the static method are valid.

2 When minimum control speed data are expanded for the determination of minimum control speeds (including V , V and V ) for all ambient conditions, the se speeds should be based MC MCG MCL on the maximum values of thrust which can reasonably be expected from a production engine in service.

The minimum control speeds should not be based on specification thrust, since this thrust represents the minimum thrust as guar anteed by the manufacturer, and the resulting speeds would be unconservative for most cases.

AMC 25.149(e) Minimum control speed

ED Decision 2003/ 2/RM During determination of V , engine failure recognition should be provided by: MCG a. The pilot feeling a distinct change in the directional tracking characteristics of the aeroplane, or b. The pilot seeing a directional divergence of the aeroplane with respect to the view outside the aeroplane.

AMC 25.149(f) Minimum Control Speed during Approach and

Landing (V )

MCL ED Decision 2020/024/R (a) CS 25.149(f) is intended to ensure that the aeroplane is safely controllable following an engine failure during an all - engines - operating approach and landing. From a controllability standpoint, the most critical case usually consists of an engine failing after the pow er or thrust has been increased to perform a go - around from an all - engines - operating approach.

Powered by EASA eRules Page 168 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY (b) To determine V , the flap and trim settings should be appropriate to the approach and landing MCL configurations, the power or thrust on the operating engine (s) should be set to the go - around power or thrust setting, and compliance with all the V requirements of CS 25.149(f) and (h) MCL must be demonstrated.

(c) At the option of the applicant, a one - engine - inoperative l anding minimum control speed, V , may be determined in the conditions appropriate to an approach and landing with MCL (1 out) one engine having failed before the start of the approach. In this case, only those configurations recommended for use during an app roach and landing with one engine inoperative need be considered. The propeller of the inoperative engine, if applicable, may be feathered throughout.

The resulting value of V may be used in determining the recommended procedures and MCL (1 out) speeds for a one - engine - inoperative approach and landing.

[Amdt 25/26]

AMC 25.149(g) Minimum Control Speed with Two Inoperative

Engines during Approach and Landing (V )

MCL - 2 ED Decision 2020/024/R (a) For aeroplanes with three or more engines, V is the minimum speed for maintaining safe MCL - 2 control during the power or thrust changes that are likely to be made following the failure of a second critical engine during an approach initiated with one engine inoperative.

(b) In accordance with CS 25.149(g)(5) for propeller - driven aeroplanes, the propeller of the engine that is inoperative at the beginning of the approach may be in the feathered position. The propeller of the more critical engine must be in the position it automatically assumes following an engine failure.

(c) Tests should be conducted using either the most critical approved one - engine - inoperative approach or landing configuration (usually the minimum flap deflection), or at the option of th e applicant, each of the approved one - engine - inoperative approach and landing configurations.

The following demonstrations should be conducted to determine V : MCL - 2 (1) With the power or thrust on the operating engines set to maintain a - 3 ° glideslope with one critical engine inoperative, the second critical engine is made inoperative and the remaining operating engine(s) are advanced to the go - around power or thrust setting.

The V speed is established with the flap and trim settings appropriate to the approach MCL - 2 and landing configurations, the power or thrust on the operating engine(s) set to the go - around power or thrust setting, and compliance with all the V requirements of MCL - 2 CS 25.149(g) and (h) must be dem onstrated.

(2) With the power or thrust on the operating engines set to maintain a - 3 ° glideslope, with one critical engine inoperative: (i) Set the airspeed at the value determined in paragraph (c)(1) above and, with a zero bank angle, maintain a constan t heading using trim to reduce the control force to zero. If full trim is insufficient to reduce the control force to zero, full trim should be used, plus control deflection as required; and (ii) Make the second critical engine inoperative and retard the r emaining operating engine(s) to minimum available power or thrust without changing the directional trim. The V determined in paragraph (c)(1) is acceptable if a constant heading MCL - 2 can be maintained without exceeding a 5 ° bank angle and the limiting con ditions of CS 25.149(h) .

Powered by EASA eRules Page 169 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) CONTROLLABILITY AND MANOEUVRABILITY (iii) Starting from a steady straight flight condition, demonstrate that sufficient lateral control is available at V to roll the aeroplane through an angle of 20 ° in the MCL - 2 direction ne cessary to initiate a turn away from the inoperative engines in not more than five seconds. This manoeuvre may be flown in a bank - to - bank roll through a wings - level attitude.

(d) At the option of the applicant, a two - engine - inoperative landing minimum cont rol speed, V may be determined in the conditions appropriate to an approach and landing with MCL - 2 (2 out) two engines having failed before the start of the approach. In this case, only those configurations recommended for use during an approach and landing with two engines inoperative need be considered. The propellers of the inoperative engines, if applicable, may be feathered throughout.

The values of V or V should be used as guidance in determining the recommended MCL - 2 MCL - 2 (2 out) procedures and speeds for a two - engine inoperative approach and landing.

[Amdt 25/26]

AMC 25.149(h)(3) Minimum control speeds

ED Decision 2003/2/RM The 20° lateral control demonstration manoeuvre may be flown as a bank - to - bank roll through wings level.

AMC 25.149(h)(4) Minimum control speeds

ED Decision 2003/2/RM Where an autofeather or other drag limiting system is installed and will be operative a t approach power settings, its operation may be assumed in determining the propeller position achieved when the engine fails. Where automatic feathering is not available the effects of subsequent movements of the engine and propeller controls should be con sidered, including fully closing the power lever of the failed engine in conjunction with maintaining the go - around power sett ing on the operating engine(s).

Powered by EASA eRules Page 170 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) TRIM

TRIM

CS 25.161 Trim

ED Decision 2003/ 2/RM (a) General . Each aeroplane must meet the trim requirements of this paragraph after being trimmed, and without further pressure upon, or movement of, either the primary controls or their corresponding trim controls by the pilot or the automatic pilot.

(b) Lateral and directional trim. The aeropl ane must maintain lateral and directional trim with the most adverse lateral displacement of the centre of gravity within the relevant operating limitations, during normally expected conditions of operation (including operation at any speed from 1·3 V , to V /M ).

SR1 MO MO (c) Longitudinal trim. The aeroplane must maintain longitudinal trim during – (1) A climb with maximum continuous power at a speed not more than 1·3 V , with the SR1 landing gear retracted, and the wing - flaps (i) retracted and (ii) in the take - off position; (2) Either a glide with power off at a speed not more than 1·3 V , or an approach within the SR1 normal range of approach speeds appropriate to the weight and configuration with power settings corresponding to a 3 ° glidepath, whichever is the most severe, with the landing gear extended, the wing - flaps retracted and extended, and with the most unfavourable combination of centre of gravity position and weight approved for landing; and (3) Level flight at any speed from 1·3 V , to V /M , with the landing gear and wing - flaps SR1 MO MO retracted, and from 1·3 V to V with the landing gear extended.

SR1 LE (d) Longitudinal, directional, and lateral trim. The aeroplane must maintain longitudinal, directional, and lateral trim (and for lateral trim, the angle o f bank may not exceed 5 ° ) at 1·3 V , during the climbing flight with – SR1 (1) The critical engine inoperative; (2) The remaining engines at maximum continuous power; and (3) The landing gear and wing - flaps retracted.

(e) Aeroplanes with four or more engines. Each aeroplane with four or more engines must also maintain trim in rectilinear flight with the most unfavourable centre of gravity and at the climb speed, configuration, and power required by CS 25.123(a) for the purpose of establishing the en - route flight pat h with two engines inoperative.

Powered by EASA eRules Page 171 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STABILITY

STABILITY

CS 25.171 General

ED Decision 2003/2/RM The aeroplane must be longitudinally, directionally and laterally stable in accordance with the provision s of CS 25.173 to 25.177 . In addition, suitable stability and control feel (static stability) is required in any condition normally encountered in service, if flight tests show it is necessary for safe operation.

CS 25.173 Static longitudinal stability

ED Decision 2016/010/R (See AMC 25.173) Under the conditions specified in CS 25.175 , the characteristics of the elevator control forces (including friction) must be as follows: (a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the spe cified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or V /M , whichever is appropriate, or lower than the minimum FC FC speed for steady unstalled flight.

(b) Th e airspeed must return to within 10% of the original trim speed for the climb, approach and landing conditions specified in CS 25.175(a), (c) and (d) , and must return to within 7·5% of the original trim speed for the cruising condition specified in CS 25.175(b) , when the control force is slowly released from any speed within the range specified in sub - paragraph (a) of this paragraph.

(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 4 N (1 pound) for each 11,2 km/h (6 kt). (See AMC 25.173(c) .)

(d) Within the free ret urn speed range specified in sub - paragraph (b) of this paragraph, it is permissible for the aeroplane, without control forces, to stabilise on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required t o return to and maintain the desired trim speed and altitude.

[Amdt 25/18]

AMC 25.173(c) Static longitudinal s tability

ED Decision 2003/ 2/RM The average gradient is taken over each half of the speed range between 0·85 and 1·15 V .

trim Powered by EASA eRules Page 172 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STABILITY

CS 25.175 Demonstrat ion of static longitudinal stability

ED Decision 2003/ 2/RM Static longitudinal stability must be shown as follows: (a) Climb . The stick force curve must have a stable slope at speeds between 85% and 115% of the speed at which the aeroplane – (1) Is trimm ed with – (i) Wing - flaps retracted; (ii) Landing gear retracted; (iii) Maximum take - off weight; and (iv) The maximum power or thrust selected by the applicant as an operating limitation for use during climb; and (2) Is trimmed at the speed for best rate - of - climb except that the speed need not be less than 1·3 V .

SR1 (b) Cruise . Static longitudinal stability must be shown in the cruise condition as follows: (1) With the landing gear retracted at high speed, the stick force curve must have a stable slope at all speeds within a range which is the greater of 15% of the trim speed plus the resulting free return speed range, or 93 km/h (50 kt) plus the resulting free return speed range, above and below the trim speed (except that the speed range need not include speeds less than 1·3 V nor speeds greater than V /M , nor speeds that require a stick SR1 FC FC force of more than 222 N (50 lbf)), with – (i) The wing - flaps retracted; (ii) The centre of gravity in the most adverse position (see CS 25.27 ); (iii) The most critical weight between the maximum take - off and maximum landing weights; (iv) The maximum cruising power selected by the applicant as an operating limitation (see CS 25.1521 ), except that the power need not exceed that required at V /M ; and MO MO (v) The aeroplane trimmed for level flight with the power required in sub - paragraph (iv) above.

(2) With the landing gear retracted at low speed, the stick force curve must have a stable slope at all speeds within a range which is the greater of 15% of the trim speed plus the resulting free return speed range, or 93 km/h (50 kt) plus the resulting free r eturn speed range, above and below the trim speed (except that the speed range need not include speeds less than 1·3 V nor speeds greater than the minimum speed of the applicable SR1 speed range prescribed in subparagraph (b)(1) of this paragraph, nor speed s that require a stick force of more than 222 N (50 lbf)), with – (i) Wing - flaps, centre of gravity position, and weight as specified in sub - paragraph (1) of this paragraph; 𝑉 + 1 ∙ 3 𝑉 𝑀𝑂 𝑆𝑅 1 (ii) Power required for level flight at a speed equal to ; and (iii) The aeroplane trimmed for level flight with the power required in sub - paragraph (ii) above.

Powered by EASA eRules Page 173 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STABILITY (3) With the landing gear extended, the stick force curve must have a stable slope at all speeds within a range which is the greater of 15% of the trim speed plus the resulting free return speed range or 93 km/h (50 kt) plus the resulting free return speed range, above and below the trim speed (except that the speed range need not include speeds less than 1·3 V , nor speeds greater than V , nor speeds that r equire a stick force of SR1 LE more than 222 N (50 lbf)), with – (i) Wing - flap, centre of gravity position, and weight as specified in sub - paragraph (b)(1) of this paragraph; (ii) The maximum cruising power selected by the applicant as an operating limitation, except that the power need not exceed that required for level flight at V ; and LE (iii) The aeroplane trimmed for level flight with the power required in sub - paragraph (ii) above.

(c) Approach. The stick force curve must have a stable slope at s peeds between V , and 1·7 V SW SR1 with – (1) Wing - flaps in the approach position; (2) Landing gear retracted; (3) Maximum landing weight; and (4) The aeroplane trimmed at 1·3 V , with enough power to maintain level flight at this SR1 speed.

(d) Landing . The s tick force curve must have a stable slope and the stick force may not exceed 356 N (80 lbf) at speeds between V , and 1·7 V with – SW SR0 (1) Wing - flaps in the landing position; (2) Landing gear extended; (3) Maximum landing weight; (4) The aeroplane trimmed at 1·3 V with – SR0 (i) Power or thrust off, and (ii) Power or thrust for level flight.

CS 25.177 Static directional and lateral stability

ED Decision 20 16 / 010 /R (See AMC 25.177) (a) The static directional stability (as shown by the tendency to recover from a skid with the rudder free) must be positive for any landing gear and flap position and symmetrical power condition, at speeds from 1·13 V , up to V , V , or V /M (as appropriate).

SR1 FE LE FC FC (b) The static lateral stability (as shown by the tendency to raise the low wing in a sideslip with the aileron controls free) for any landing gear and wingflap position and symmetric power condition, may not be negative at any airspeed (except that speeds higher than V need not be FE considered for wingfl aps extended configurations nor speeds higher than V for landing gear LE extended configurations) in the following ai rspeed ranges : Powered by EASA eRules Page 174 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STABILITY (1) From 1·13 V to V /M ..

SR1 MO MO (2) From V /M to V /M , unless the divergence is – MO MO FC FC (i) Gradual; (ii) Easily recognisa ble by the pilot; and (iii) Easily controllable by the pilot (c) In straight, steady, sideslips over the range of sideslip angles appropriate to the operation of the aeroplane , the aileron and rudder control movements and forces must be substantially propo rtional to the angle of sideslip in a stable sense. The factor of proportionality must lie between limits found necessary for safe operation .

The range of sideslip angles evaluated must include those sideslip angles resulting from the lesser of: (1) on e - half of the available rudder control input; and (2) a rudder control force of 180 pounds.

This requirement must be met for the configurations and speeds specified in sub - paragraph (a) of this paragraph. (See AM C 25.177(c) .)

(d) For sideslip angles greater than those prescribed by sub - paragraph (c) of this paragraph, up to the angle at which full rudder control is used or a rudder control force of 801 N (180 lbf) is obtained, the rudder control forces may not rev erse, and increased rudder deflection must be needed for increased angles of sideslip. Compliance with this requirement must be shown using straight, steady sideslips, unless full lateral control input is achieved before reaching either full rudder control input or a rudder control force of 801 N (180 lbf) ; a straight, steady sideslip need not be maintained after achieving full lateral control input. This requirement must be met at all approved landing gear and wingflap positions for the range of operating speeds and power conditions appropriate to each landing gear and wing - flap position with all engines operating.

(See AMC 25.177(d) .)

[Amdt 25/11] [Amdt 25/18]

AMC 25.177(c) Steady, Straight Sideslips

ED Decision 20 11 / 004 /R 1 CS 25.177(c) requires, in steady, straight sideslips throughout the range of sideslip angles appropriate to the operation of the aeroplane, that the aileron and rudder control movements and fo rces be proportional to the angle of sideslip. T he factor of proportionality must lie between limits found necessary for safe operation. The range of sideslip angles evaluated must include those sideslip angles resulting from the lesser of: (1) one - half of the available rudder control input; and (2) a rudder control force of 180 pounds . CS 25.177(c) states, by cross - reference to CS 25.177(a) , that these steady, straight sideslip criteria must be met for all landing gear and flap positions and symmetrical power conditions at speeds from 1.13 V to V , V , SR1 FE LE or V /M , as appropriate for the configuration.

FC FC Powered by EASA eRules Page 175 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STABILITY 2 Sideslip Angles Appropriate to the Operation of the Aeroplane 2.1 Experience has shown that an acceptable method for determining the appropriate sideslip angle for the operation of a transport category aeroplane is provided by the following equation: ß = arc sin (30/V) where ß = Sideslip angle, and V = Airspeed (KCAS) Recognising that smaller sideslip angles are appropriate as speed is increased, this equation provides sideslip angle as a function of airspeed. The equation is based on the theoretical sideslip value for a 56 km/h (30 - knot) crosswind, but has been shown t o conservatively represent (i.e., exceed) the sideslip angles achieved in maximum crosswind take - offs and landings and minimum static and dynamic control speed testing for a variety of transport category aeroplanes. Experience has also shown that a maximum sideslip angle of 15 degrees is generally appropriate for most transport category aeroplanes even though the equation may provide a higher sideslip angle.

However, limiting the maximum sideslip angle to 15 degrees may not be appropriate for aeroplanes wit h low approach speeds or high crosswind capability.

2.2 A lower sideslip angle than that provided in paragraph 2.1 may be used if it is substantiated that the lower value conservatively covers all crosswind conditions, engine failure scenarios, and other conditions where sideslip may be experienced within the approved operating envelope. Conversely, a higher value should be used for aeroplanes where test evidence indicates that a higher value would be appropriate to the operation of the aeroplane.

3 For t he purposes of showing compliance with the requirement out to sideslip angles associated with one - half of the available rudder control input, there is no need to consider a rudder control input beyond that corresponding to full available rudder surface tra vel or a rudder control force of 8 01 N (180 lbf) . Some rudder control system designs may limit the available rudder surface deflection such that full deflection for the particular flight condition is reached before the rudder control reaches onehalf of its available travel. In such cases, further rudder control input would not result in additional rudder surface deflection.

4 Steady, straight sideslips 4.1 Steady, straight sideslips should be conducted in each direction to show that the aileron and rudder control movements and forces are substantially proportional to the angle of sideslip in a stable sense, and that the factor of proportionality is within th e limits found necessary for safe operation. These tests should be conducted at progressively greater sideslip angles up to the sideslip angle appropriate to the operation of the aeroplane (see paragraph 2.1) or the sideslip angle associated with one - half of the available rudder control input, whichever is greater.

4.2 When determining the rudder and aileron control forces, the controls should be relaxed at each point to find the minimum force needed to maintain the control surface deflection. If excessive friction is present, the resulting low forces will indicate the aeroplane does not have acceptable stability characteristics.

Powered by EASA eRules Page 176 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STABILITY 4.3 In lieu of conducting each of the separate qualitative tests required by CS 25.17 7(a) and (b), the applicant may use recorded quantitative data showing aileron and rudder control force and position versus sideslip (left and right) to the appropriate limits in the steady heading sideslips conducted to show compliance with CS 25.177(c) . If the control force and position versus sideslip indicates positive dihedral effect and positive directional stability, compliance with CS 25.177(a) and (b) will have been successfully demonstrated."

[Amdt 25/11]

AMC 25.177(d) Full Rudder Sideslips

ED Decision 2003/ 2/RM 1.1 At sideslip angles greater than those appropriate for normal operation of the aeroplane, up to the sideslip angle at which full rudder control is used o r a rudder control force of 801 N (180 lbf) is obtained, CS 25.177(d) requires that the rudder control forces may not reverse and increased rudder deflection must be needed for increased angles of sideslip.

The goa ls of this higher - than - normal sideslip angle test are to show that at full rudder, or at maximum expected pilot effort: (1) the rudder control force does not reverse, and (2) increased rudder deflection must be needed for increased angles of sideslip, thus demonstrating freedom from rudder lock or fin stall, and adequate directional stability for manoeuvres involving large rudder inputs.

1.2 Compliance with this requirement should be shown using straight, steady sideslips.

However, if full lateral control input is reached before full rudder control travel or a rudder control force of 801 N (180 lbf) is reached, the manoeuvre may be continued in a non - steady heading (i.e., rolling and yawing) manoeuvre. Care should be taken to prevent excessive bank angles t hat may occur during this manoeuvre.

1.3 CS 25.177(d) states that the criteria listed in paragraph 1.1 must be met at all approved landing gear and flap positions for the range of operating speeds and power conditions appropriate to each landing gear and flap position with all engines operating. The range of operating speeds and power conditions appropriate to each landing gear and flap position with all engines operating should be consistent with the following: a. For take - off configurations, speeds from V +xx (airspeed approved for all - engines - operating initial climb) to V or V , as appropriate, and ta ke - off power/thrust; FE LE b. For flaps up configurations, speeds from 1.23 V to V or V /M , as appropriate, SR LE MO MO and power from idle to maximum continuous power/thrust; c. For approach configurations, speeds from 1.23 V to V or V , as appropriate, and SR FE LE p ower from idle to go - around power/thrust; and d. For landing configurations, speeds from V - 9.3 km/h (5 knots) to V or V , as REF FE LE appropriate, with power from idle to go - around power/thrust at speeds from V REF to V /V , and idle power at V - 9.3 km/h (5 knots) (to cover the landing flare).

FE LE REF 2 Full Rudder Sideslips 2.1 Rudder lock is that condition where the rudder over - balances aerodynamically and either deflects fully with no additional pilot input or does not tend to return to neutral when the pilot input is released. It is indicated by a reversal in the rudder control force as sideslip angle is increased. Full rudder sideslips are conducted to determine the rudder control forces and deflections out to sideslip angles associated with full rudder contr ol Powered by EASA eRules Page 177 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STABILITY input (or as limited by a rudder control force of 801 N (180 lbf)) to investigate the potential for rudder lock and lack of directional stability.

2.2 To check for positive directional stability and for the absence of rudder lock, conduct steady heading sideslips at increasing sideslip angles until obtaining full rudder control input or a rudder control force of 801 N (180 lbf). If full lateral control i s reached before reaching the rudder control limit or 801 (180 lbf) of rudder control force, continue the test to the rudder limiting condition in a non - steady heading sideslip manoeuvre.

3 The control limits approved for the aeroplane should not be excee ded when conducting the flight tests required by CS 25.177 .

4 Flight Test Safety Concerns. In planning for and conducting the full rudder sideslips, items relevant to flight test safety should be considered, including: a. Inadvertent stalls, b. Effects of sideslip on stall protection systems, c. Actuation of stick pusher, including the effects of sideslip on an gle - of - attack sensor vanes, d. Heavy buffet, e. Exceeding flap loads or other structural limits, f. Extreme bank angles, g. Propulsion system behaviour (e.g., propeller stress, fuel and oil supply, and inlet stability), h. Minimum altitude for recover y, i. Resulting roll rates when aileron limit is exceeded, and j. Position errors and effects on electronic or augmented flight control systems, especially when using the aeroplane’s production airspeed system.

CS 25.181 Dynamic stability

ED Decision 20 03/ 2/RM (See AMC 25.181 ) (a) Any short period oscillation, not including combined lateral - directional oscillations, occurring between 1·13 V and maximum allowable speed appropriate to the configuration of the SR aer oplane must be heavily damped with the primary controls – (1) Free; and (2) In a fixed position.

(b) Any combined lateral - directional oscillations (‘Dutch roll’) occurring between 1·13 V and SR maximum allowable speed appropriate to the configuration of the aeroplane must be positively damped with controls free, and must be controllable with normal use of the primary controls without requiring exceptional pilot skill.

AMC 25.181 Dynamic s tability

ED Decision 2003/ 2/RM The requirements of CS 25.181 are applicable at all speeds between the stalling speed and V , V or FE LE V /M , as appropriate.

FC FC Powered by EASA eRules Page 178 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STALLS

STALLS

CS 25.201 Stall demonstration

ED Decision 2016 / 010/R (a) Stalls must be sho wn in straight flight and in 30 ° banked turns with – (1) Power off; and (2) The power necessary to maintain level flight at 1·5 V (where VS corresponds to the SR1 R1 reference stall speed at maximum landing weight with flaps in the approach position and the landing gear retracted. (Se e AMC 25.201(a)(2) .)

(b) In each condition required by sub - paragraph (a) of this paragraph, it must be possible to meet the applicable requirements of CS 25.203 with – (1) Flaps, landing gear and deceleration devices in any likely combination of positions approved for operation; (See AMC 25.201(b)(1) .)

(2) Representative weights within the range for which certification is requested; (3) The most adverse centre of gravity for recovery; and (4) The aeroplane trimmed for straight flight at the speed prescribed in CS 25.103(b)(6) .

(c) The following procedures must be used to show compliance with CS 25.203 : (1) Starting at a speed sufficiently above the stalling speed to ensure that a steady rate of speed reduction can be established, apply the longitudinal control so that the speed reduction does not exceed 0.5 m/s (one knot per second) until the aeroplane is stalled.

(See AMC 25.103(c) .)

(2) In addition, for turning flight stalls, apply the longitudinal control to achieve airspeed deceleration rates up to 5, 6 km/h (3 kt) per second. (See AMC 25.201(c)(2) .)

(3) As soon as the aeroplane is stalled, recover by normal recovery techniques.

(d) The aeroplane is considered stalled when the behaviour of the aeroplane gives th e pilot a clear and distinctive indication of an acceptable nature that the aeroplane is stalled. (See AMC 25.201(d) .) Acceptable indications of a stall, occurring either indi vidually or in combination, are – (1) A nose - down pitch that cannot be readily arrested; (2) Buffeting, of a magnitude and severity that is a strong and effective deterrent to further speed reduction; or (3) The pitch control reaches the aft stop and no further increase in pitch attitude occur s when the control is held full aft for a short time before recovery is initiated. (See AMC 25.201(d)(3) .)

[Amdt 25/18] Powered by EASA eRules Page 179 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STALLS

AMC 25.201(a)(2) Stall demonstration

ED Decision 2003/ 2/RM The power for all power - on stall demonstrations is that power necessary to maintain level flight at a speed of 1·5 V at maximum landing weight, with flaps in the approach position and landing gear SR1 retracted, where V is the reference stall speed in the same conditions (except power). The flap SR1 position to be used to determine this power setting is that position in which the reference stall speed does not exceed 110% of the reference stall speed with the flaps in the most extended landing position.

AMC 25.201(b)(1) Stall d emonstration

ED Decision 2003/2/RM Stall demonstrations for compliance with CS 25.201 should include demonstrations with deceleration devices deployed for all flap positions unless limitations against use of the devices with pa rticular flap positions are imposed. ‘Deceleration devices’ include spoilers when used as air brakes, and thrust reversers when use in flight is permitted. Stall demonstrations with deceleration devices deployed should normally be carried out with power of f, except where deployment of the deceleration devices while power is applied is likely to occur in normal operations (e.g. use of extended air brakes during landing approach).

AMC 25.201(c)(2) Turning Flight Stalls At Higher Deceleration Rates

ED Decision 2003/2/RM The intent of evaluating higher deceleration rates is to demonstrate safe characteristics at higher rates of increase of angle of attack than are obtained from the 0.5 m/s (1 knot per second) stalls. The specified airspeed deceleration rate, and associated angle of attack rate, should be maintained up to the point at which the aeroplane stalls.

AMC 25.201(d) Stall d emonstration

ED Decision 2018 / 00 5/R 1 The behaviour of the aeroplane includes the behaviour as affected by the normal funct ioning of any systems with which the aeroplane is equipped, including devices intended to alter the stalling characteristics of the aeroplane.

2 Unless the design of the automatic flight control system of the aeroplane protects against such an event, the stalling characteristics and adequacy of stall warning, when the aeroplane is stalled under the control of the automatic flight control system, should be investigated. (See also CS 25.1329(h) .)

[Amdt 25/19] [Amdt 25/21] Powered by EASA eRules Page 180 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STALLS

AMC 25.201(d)(3) Stall d emonstration

ED Decision 2003/ 2/RM An acceptable interpretation of holding the pitch control on the aft stop for a short time is: a. The pitch control reaches the aft stop and is held full aft for 2 seconds or until the pit ch attitude stops increasing, whichever occurs later.

b. In the case of turning flight stalls, recovery may be initiated once the pitch control reaches the aft stop when accompanied by a rolling motion that is not immediately controllable (provided the rol ling motion complies with CS 25.203(c) ).

c. For those aeroplanes where stall is defined by full nose up longitudinal control for both forward and aft C.G., the time at full aft stick should be not less than was used for stall speed determination, except as permitted by paragraph (b) above.

CS 25.203 Stall characteristics

ED Decision 2003/ 2/RM (See AMC 25.203 .)

(a) It must be possible to produce and to correct roll and yaw by unreversed use of aileron and rudder controls, up to the time the aeroplane is stalled. No abnormal nose - up pitching may occur. The longitudinal control force must be positive up to and throughout the stall. In addition, it must be possible to promptly prevent stalling and to recover from a stall by normal use of the controls.

(b) For level wing stalls, the roll occurring between the stall and the completion of the recovery may not exceed approxi mately 20 ° .

(c) For turning flight stalls, the action of t he aeroplane after the stall may not be so violent or extreme as to make it difficult, with normal piloting skill, to effect a prompt recovery and to regain control of the aeroplane. The maximum bank angle that occurs during the recovery may not exceed – ( 1) Approximately 60 ° in the origin al direction of the turn, or 30 ° in the opposite direction, for deceleration rates up to 0.5 m/s (1 knot per second); and (2) Approximately 90 ° in the original dir ection of the turn, or 60 ° in the opposite direction, for deceleration rates in excess of 0.5 m/s (1 knot per second).

AMC 25.203 Stall c haracteristics

ED Decision 2003/ 2/RM 1 Static Longitudinal Stability during the Approach to the Stall. During the approach to the stall the longitudinal control pull force should increase continuously as speed is reduced from the trimmed speed to the onset of stall warning. At lower speeds some reduction in longitudinal control pull force will be acceptabl e provided that it is not sudden or excessive.

2 Rolling Motions at the Stall 2.1 Where the stall is indicated by a nose - down pitch, this may be accompanied by a rolling motion that is not immediately controllable, provided that the rolling motion complies with CS 25.203(b) or (c) as appropriate.

2.2 In level wing stalls the bank angle may exceed 20° occasionally, provided that lateral control is effective during recovery.

Powered by EASA eRules Page 181 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STALLS 3 Deep Stall Penetration . Where the results of wind tunnel tests reveal a risk of a catastrophic phenomenon (e.g. superstall, a condition at angles beyond the stalling incidence from which it proves difficult or impossible to recover the aeroplane), studies should be made to show that adequa te recovery control is available at and sufficiently beyond the stalling incide nce to avoid such a phenomenon.

CS 25.207 Stall warning

ED Decision 2016 / 010 /R (a) Stall warning with sufficient margin to prevent inadvertent stalling with the flaps and landin g gear in any normal position must be clear and distinctive to the pilot in straight and turning flight.

(b) The warning must be furnished either through the inherent aerodynamic qualities of the aeroplane or by a device that will give clearly distinguisha ble indications under expected conditions of flight. However, a visual stall warning device that requires the attention of the crew within the cockpit is not acceptable by itself. If a warning device is used, it must provide a warning in each of the aeropl ane configurations prescribed in sub - paragraph (a) of this paragraph at the speed prescribed in sub - paragraphs (c) and (d) of this paragraph. Except for the stall warning prescribed in subparagraph (h)(3)(ii) of this paragraph , the stall warning for flight in icing conditions must be provided by the same means as the stall warning for flight in non - icing conditions. (See AMC 25.207(b) .)

(c) When the speed is reduced at rates not exceeding 0.5 m/s (one knot per seco nd), stall warning must begin, in each normal configuration, at a speed, V , exceeding the speed at which the SW stall is identified in accordance with CS 25.201(d) by not less than 9.3 km/h (five knots) or five perc ent CAS, whichever is greater. Once initiated, stall warning must continue until the angle of attack is reduced to approximately that at which stall warning began. (See AMC 25.207(c) and (d) ).

(d) In addition to th e requirement of subparagraph(c) of this paragraph, when the speed is reduced at rates not exceeding 0.5 m/s (one knot per second), in straight flight with engines idling and at the centre - of - gravity position specified in CS 25.103(b)(5) , V , in each normal configuration, SW must exceed V by not less than 5.6 km/h (three knots) or three percent CAS, whichever is SR greater. (See AMC 25.207(c) and (d) ).

(e) In icing conditions, the stall warning margin in straight and turning flight must be sufficient to allow the pilot to prevent stalling (as defined in CS 25.201(d) ) when the pilot starts a recovery manoeuvre not les s than three seconds after the onset of stall warning. When demonstrating compliance with this paragraph, the pilot must perform the recovery manoeuvre in the same way as for the air plane in non - icing conditions. Compliance with this requirement must be de monstrated in flight with the speed reduced at rates not exceeding 0.5 m/sec (one knot per second), with – (1) The most critical of the take - off ice and final take - off ice accretions defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) , for each configuration used in the take - off phase of flight; (2) The most critical of the en route ice accretion(s) defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) , for the en route configuration; (3) The most critical of the holding ice accretion(s) defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) , for the holding confi guration(s); Powered by EASA eRules Page 182 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STALLS (4) The most critical of the approach ice accretion(s) defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) , for the approach configuration(s); and (5) The most critical of the landing ice accretion(s) defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) , for the landing and go - around configuration(s).

( f ) The stall warning margin must be sufficient in both non - i cing and icing conditions to allow the pilot to prevent stalling when the pilot starts a recovery manoeuvre not less than one second after the onset of stall warning in slowdown turns with at least 1.5g load factor normal to the flight path and airspeed deceleration rates of at least 1 m/s ec (2 knots per second), When demonstrating compliance with this paragraph for icing conditions, the pilot must perform the recovery manoeuvre in the same way as for the air plane in non - icing conditions. Compli ance with this requirement must be demonstrated in flight with – (1) The flaps and landing gear in any normal position; (2) The aeroplane trimmed for straight flight at a speed of 1.3 V SR ; and (3) The power or thrust necessary to maintain level flight at 1 .3 V .

SR (g ) Stall warning must also be provided in each abnormal configuration of the high lift devices that is likely to be used in flight following system failures (including all configurations covered by Aeroplane Flight Manual procedures).

(h) The following stall warning margin is required for flight in icing conditions before the ice protection system has been activated and is performing its intended function. Compliance must be shown using the most critical of the ice accretion(s) defined in Appendix C, part II(e) , and Appendix O, part II(d) , as applicable, in accordance with CS 25.21(g) . The stall warning margin in straight and turning flight must be sufficient to allow the pilot to prevent stalling without encountering any adverse flight characteristics when: (1) The speed is reduced at rates not exceeding 0.5 m/sec² (one knot per second); (2) The pilot performs the recovery manoeuvre in the same way as for flight in non - icing conditions; and (3) The recovery manoeuvre is started no earlier than: (i) One second after the onset of stall warning if stall warning is provided by the same means as for flight in non - icing conditions; or (ii) Three seconds after the onset of stall warning if stall warning is provided by a different means than for flight in non - icing conditions.

(i) In showing compliance with subparagraph (h) of this paragraph, if stall warning is provided by a different means in icing conditions than for non - icing conditions, compliance with CS 25. 203 must be shown using the accretion defined in appendix C, part II(e) . Compliance with this requirement must be shown using the demonstration prescribed by CS 25.201 , exc ept that the deceleration rates of CS 25.201(c)(2) need not be demonstrated.

[Amdt 25/3] [Amdt 25/7] [Amdt 25/16] [Amdt 25/18] Powered by EASA eRules Page 183 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STALLS

AMC 25.207(b) Stall w arning

ED Decision 2003/ 2/RM 1 A warning which is clear and distinctive to the pilot is one which cannot be misinterpreted or mistaken for any other warning, and which, without being unduly alarming, impresses itself upon the pilot and captures his attention regardless of what other tasks and activities are occupying his attention and commanding his concentratio n. Where stall warning is to be provided by artificial means, a stick shaker device producing both a tactile and an audible warning is an Acceptable Means of Compliance.

2 Where stall warning is provided by means of a device, compliance with the requireme nt of CS 25.21(e) should be established by ensuring that the device has a high degree of reliability.

One means of complying with this criterion is to provide dual independent systems.

AMC 25.207(c) and (d) Stall w arning

ED Decision 2003/ 2/RM 1 An acceptable method of demonstrating compliance with CS 25.207(c) is to consider stall warning speed margins obtained during stall speed demonstration ( CS 25.103 ) and stall demonstration ( CS 25.201(a) ) (i.e. bank angle, power and centre of gravity conditions).

In addition, if the stall warning margin is managed by a system (thrust law, bank ang le law, …), stall warning speed margin required by CS 25.207(c) should be demonstrated, when the speed is reduced at rates not exceeding 0.5 m/s (one knot per second), for the most critical conditions in terms of stall warning margin, without exceeding 40° bank angle or maximum continuous power or thrust during the demonstrations. In the case where the management system increases, by design, the stall warning speed margin from the nominal setting (flight idle, wing level), no additional demonstration needs to be done.

2 The stall warning speed margins required by CS 25.207(c) and (d) must be determined at a constant load factor (i.e. 1g for 207(d)). An acceptable data reduc tion method is to calculate k = √(C /C ) where C and C are the C values respectively at the stall identification and LID LSW LID LSW L at the stall warning activation.

3 If the stall warning required by CS 25.207 is provided by a device (e.g. a stick shaker), the effect of production tolerances on the stall warning system should be considered when evaluating the stall warning margin required by CS 25.207(c) and (d) and the manoeuvre capabilities required by CS 25.143(g) .

a. The stall warning margin required by CS 25.207(c) and (d) should be available with the stall warning system set to the most critical setting expected in production. Unless another setting would be provide a lesser margin, the stall warning margin required by CS 25.207(c) should be evaluated assuming the stall warning system is operating at its high angle of attack limit. For aeroplanes equipped with a device that abruptly pushes the nose down at a selected angle - of - attack (e.g. a stick pusher), the stall warning margin required by CS 25.207(c) may be evaluated with both the stall warning and stall identification (e.g. stick pusher) systems at their nominal angle of attack settings unless a lesser margin can result from the various system tolerances.

b. The manoeuvre capabilities required by CS 25.143(g) should be available assuming the stall warning system is operating on its nominal setting. In addition, when the stall warning system is operating at its low angle of attack limit, the manoeuvre capabilities should not be reduced by mo re than 2 degrees of bank angle from those specified in CS 25.143(g) .

Powered by EASA eRules Page 184 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) STALLS c. The stall warning margins and manoeuvre capabilities may be demonstrated by flight testing at the settings specified above for the stall warning and, if applicable, stall identification systems. Alternatively, compliance may be shown by applying adjustments to flight test data obtained at a different system setting.

Powered by EASA eRules Page 185 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GROUND HANDLING CHARACTERISTICS

GROUND HANDLING CHARACTERISTICS

CS 25.231 Longitudinal stability and control

ED Decision 2003/ 2/RM (a) Aeroplanes may have no uncontrollable tendency to nose over in any reasonably expected operating condition or when rebound occurs during landing or take - off. In addition – (1) Wheel brakes must operate smoothly and may not cause any undue tendency to nose over; and (2) If a tail - wheel landing gear is used, it must be possible, during the take - off ground run on concrete, to maintain any attitude up to thrust line level, at 75% of V .

SR1

CS 25.233 Directional stability and control

ED Dec ision 2003/ 2/RM (a) There may be no uncontrollab le ground - looping tendency in 90 ° cross winds, up to a wind velocity of 37 km/h (20 kt) or 0·2 V , whichever is greater, except that the wind velocity need SR0 not exceed 46 km/h (25 kt) at any speed at which t he aeroplane may be expected to be operated on the ground. This may be shown while establishing the 90 ° cross component of wind velocity required by CS 25.237 .

(b) Aeroplanes must be satisfactorily controllable, w ithout exceptional piloting skill or alertness, in power - off landings at normal landing speed, without using brakes or engine power to maintain a straight path. This may be shown during power - off landings made in conjunction with other tests.

(c) The aerop lane must have adequate directional control during taxying. This may be shown during taxying prior to take - offs made in conjunction with other tests.

CS 25.235 Taxying condition

ED Decision 2003/2/RM The shock absorbing mechanism may not damage the structu re of the aeroplane when the aeroplane is taxied on the roughest ground that may reasonably be expected in normal operation.

Powered by EASA eRules Page 186 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) GROUND HANDLING CHARACTERISTICS

CS 25.237 Wind velocities

ED Decision 2015 / 008 /R (a) The following applies: (1) A 90 ° cross component of wind velocity, demonstrated to be safe for take - off and landing, must be established for dry runways and must be at least 37 km/h (20 kt) or 0·2 V , SR0 whichever is greater, except that it need not exceed 46 km/h (25 kt).

(2) The crosswi nd component for takeoff established without ice accretions is valid in icing conditions.

(3) The landing crosswind component must be established for: (i) Non - icing conditions, and (ii) Icing conditions with the most critical of the landing ice accretion (s ) defined in appendix C and O , as applicable, in accordance with CS 25.21(g) .

[Amdt 25/3] [Amdt 25/16] Powered by EASA eRules Page 187 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) MISCELLANEOUS FLIGHT REQUIREMENTS

MISCELLANEOUS FLIGHT REQUIREMENTS

CS 25.251 Vibration and buffeting

ED Decision 2016/010 /R (See AMC 25.251) (a) The aeroplane must be demonstrated in flight to be free from any vibration and buffeting that would prevent continued safe flight in any likely operating condition.

(b) Each part of the aeroplane must be demonstrated in flight to b e free from excessive vibration under any appropriate speed and power conditions up to V /M . The maximum speeds shown DF DF must be used in establishing the operatin g limitations of the aeroplane in accordance with CS 25.1505 .

(c) Except as provided in sub - paragraph (d) of this paragraph, there may be no buffeting condition, in normal flight, including configuration changes du ring cruise, severe enough to interfere with the control of the aeroplane, to cause excessive fatigue to the crew, or to cause structural damage. Stall warning buffeting within these limits is allowable.

(d) There may be no perceptible buffeting condition in the cruise configuration in straight flight at any speed up to V /M , except that the stall warning buffeting is allowable.

MO MO (e) For an aeroplane with M greater than 0·6 or with a maximum operating altitude greater than D 7620 m (25,000 ft), the positiv e manoeuvring load factors at which the onset of perceptible buffeting occurs must be determined with the aeroplane in the cruise configuration for the ranges of airspeed or Mach number, weight, and altitude for which the aeroplane is to be certificated. T he envelopes of load factor, speed, altitude, and weight must provide a sufficient range of speeds and load factors for normal operations. Probable inadvertent excursions beyond the boundaries of the buffet onset envelopes may not result in unsafe conditio ns. (See AMC 25.251(e) .)

[Amdt 25/1] [Amdt 25/18]

AMC 25.251(e) Vibration and Buffeting in Cruising Flight

ED Decision 2003/ 2/RM 1 Probable Inadvertent Excursions beyond the Buffet Boundary 1.1 CS 25.251(e) states that probable inadvertent excursions beyond the buffet onset boundary may not result in unsafe conditions.

1.2 An acceptable means of compliance with this requirement is to demonstrate by means of flight tests be yond the buffet onset boundary that hazardous conditions will not be encountered within the permitted manoeuvring envelope (as defined by CS 25.337 ) without adequate prior warning being given by severe buffeting or high stick forces.

1.3 Buffet onset is the lowest level of buffet intensity consistently apparent to the flight crew during normal acceleration demonstrations in smooth air conditions.

Powered by EASA eRules Page 188 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) MISCELLANEOUS FLIGHT REQUIREMENTS 1.4 In flight tests beyond the buffet onset boundary to satisfy paragraph 1.2, the load factor should be increased until either – a. The level of buffet becomes sufficient to provide an obvious warning to the pilot which is a strong deterrent to further appli cation of load factor; or b. Further increase of load factor requires a stick force in excess of 445 N (100 lbf), or is impossible because of the limitations of the control system; or c. The positive limit manoeuvring load factor established in complianc e with CS 25.337(b) is achieved.

1.5 Within the range of load factors defined in paragraph 1.4 no hazardous conditions (such as hazardous involuntary changes of pitch or roll attitude, engine or systems malfuncti oning which require urgent corrective action by the flight crew, or difficulty in reading the instruments or controlling the aeroplane) should be encountered.

2 Range of Load Factor for Normal Operations 2.1 CS 25.251(e) requires that the envelopes of load factor, speed, altitude and weight must provide a sufficient range of speeds and load factors for normal operations.

2.2 An acceptable means of compliance with the re quirement is to establish the maximum altitude at which it is possible to achieve a positive norma l acceleration increment of 0·3 g without exceeding the buffet onset boundary.

CS 2 5.253 High - speed characteristics

ED Decision 20 16 / 0 10 /R (a) Speed increase and recovery characteristics. The following speed increase and recovery characteristics must be met: (1) Operating conditions and characteristics likely to cause inadvertent speed increases (including upsets in pitch and roll) must be simul ated with the aeroplane trimmed at any likely cruise speed up to V /M . These conditions and characteristics include gust MO MO upsets, inadvertent control movements, low stick force gradient in relation to control friction, passenger movement, levelling off f rom climb, and descent from Mach to air speed limit altitudes.

(2) Allowing for pilot reaction time after effective inherent or artificial speed warning occurs, it must be shown that the aeroplane can be recovered to a normal attitude and its speed reduced to V MO /M MO , without – (i) Exceptional piloting strength or skill; (ii) Exceeding V /M , V /M , or the structural limitations; and D D DF DF (iii) Buffeting that would impair the pilot’s ability to read the instruments or control the aeroplane for recovery.

(3) Wi th the aeroplane trimmed at any speed up to V /M , there must be no reversal of MO MO the response to control input about any axis at any speed up to V /M . Any tendency to DF DF pitch, roll, or yaw must be mild and readily controllable, using normal piloting tech niques.

When the aeroplane is trimmed at V /M , the slope of the elevator control force MO MO versus speed curve need not be stable at speeds greater than V /M , but there must be FC FC a push force at all speeds up to V /M and there must be no sudden or excess ive DF DF reduction of elevator control force as V /M is reached.

DF DF Powered by EASA eRules Page 189 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) MISCELLANEOUS FLIGHT REQUIREMENTS (4) Adequate roll capability to assure a prompt recovery from a lateral upset condition must be available at any speed up to V /M . (See AMC 25.253(a)(4) .)

DF DF (5) Extension of speedbrakes. With the aeroplane trimmed at V /M , extension of the MO MO speedbrakes over the available range of movements of the pilots control, at all speeds above V /M , but not s o high that V /M would be exceeded during the manoeuvre, MO MO DF DF must not result in: (i) An excessive positive load factor when the pilot does not take action to counteract the effects of extension; (ii) Buffeting that would impair the pilot’s ability to read the instruments or control the aeroplane for recovery; or (iii) A nose - down pitching moment, unless it is small. (See AMC 25.253(a)(5) .)

(6) Reserved (b) Maximum speed for stability characteristics, V /M . V /M is the maximum speed at which FC FC FC FC the requirements of CS 25.143(g ) , 25.147( f ) , 25.175(b)(1) , 25.177(a) through (c ), and 25.181 must be met with wing - flaps and landing gear retracted. Except as noted in CS 25.253(c) , V /M FC FC may not be less than a speed midway between V /M and V /M , except that, for altitudes MO MO DF DF where Mach Number is the limiting factor, M need not exceed the Mach Number at which FC effective speed warning occurs.

(c) Maximum speed for stability characteristics in icing conditions . The maximum speed for stability characteristics with the most critical of the ic e accretions defined in Appendices C and O, as applicable, in accordance with CS 25.21(g) , at which the requirements of CS 25.143(g) , 25.147( f ) , 25.175(b)(1) , 25.177(a) through (c) and 25.181 must be met, is the lower of: (1) 556 km/h (300 knots) CAS, (2) V , or FC (3) A speed at which it is demonstrated that the airframe will be free of ice accretion due to the effects of increased dynamic pressure ."

[Amdt. 25/3] [Amdt 25/11] [Amdt 25/16] [Amdt 25/18]

AMC 25.253(a)(4) Lateral Control: Roll Capability

ED Decision 2003/ 2/RM An acceptable method of demonstrating compliance with CS 25.253(a)(4) is as follows: 1 Establish a steady 20° banked turn at a speed close to V /M limited to the extent necessary DF DF to accomplish the following manoeuvre and recovery without exceeding V /M . Using lateral DF DF control alone, it should be demonstrated that the aeroplane can be rolled to 20° bank angle in the other direction in not more than 8 seconds. The demonstration should be made in the most adverse direction. The manoeuvre may be unchecked.

2 For aeroplanes that exhibit an adverse effect on roll rate when rudder is used, it should also be demonstrated that use of rudder in a conventional manner will not result in a roll capability significantly below that specified above.

Powered by EASA eRules Page 190 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) MISCELLANEOUS F LIGHT REQUIREMENTS 3 Conditions for 1 and 2: Wing - flaps retracted.

Speedbrakes retracted and extended.

Landing gear retracted.

Trim. The aeroplane trimmed for straight flight at V /M . The trimming controls should not MO MO be moved during the manoeuvre.

Power: (i) All engines operating at the power required to maintain level flight at V /M , except MO MO that maximum continuous power need not be exceeded; and (ii) if the effect of power is signific ant, with the throttles closed.

AMC 25.253(a)(5) High Speed Characteristics

ED Decision 2003/2/RM Ex tension of Speedbrakes. The following guidance is provided to clarify the meaning of the words “the available range of movements of the pilot’s control” in CS 25.253(a)(5) and to provide guidance for demonstrating compliance with this requirement. Normally, the available range of movements of the pilot’s control includes the full physical range of movements of the speedbrake control (i.e., from stop to stop). Under some circumstances, however, the available range of the pilot’s control may be restricted to a lesser range associated with in - flight use of the speedbrakes. A means to limit the available range of movement to an in - flight range may be acceptable if it provides an unmistakable tactile cue to the pilot when the control reaches the maximum allowable in - flight position, and compliance with CS 25.697(b) is shown for positions beyond the in - flight range. Additionally, the applicant's recommended procedures and training must be consistent with the intent to limit the in - flight range of movements of the speedbrake control.

CS 25.697(b) requires that lift and drag devices intended for ground operation only must have means to prevent the inadvertent operation of their contro ls in flight if that operation could be hazardous. If speedbrake operation is limited to an in - flight range, operation beyond the in - flight range of available movement of the speedbrake control must be shown to be not hazardous. Two examples of acceptable unmistakable tactile cues for limiting the in - flight range are designs incorporating either a gate, or incorporating both a detent and a substantial increase in force to move the control beyond the detent. It is not an acceptable means of compliance to res trict the use of, or available range of, the pilot’s control solely by means of an aeroplane Flight Manual limitation or procedural means.

The effect of extension of speedbrakes may be evaluated during other high speed testing and during the development o f emergency descent procedures. It may be possible to infer compliance with CS 25.253(a)(5) by means of this testing. To aid in determining compliance with the qualitative requirements of this rule, the following q uantitative values may be used as a generally acceptable means of compliance. A load factor should be regarded as excessive if it exceeds 2.0. A nose - down pitching moment may be regarded as small if it necessitates an incremental control force of less than 89 N (20 lbf) to maintain 1g flight. These values may not be appropriate for all aeroplanes, and depend on the characteristics of the particular aeroplane design in high speed flight. Other means of compliance may be acceptable, provided that the Agency f inds that compliance has been shown to the qualitative requirements specified in CS 25.253(a)(5) .

Powered by EASA eRules Page 191 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) MISCELLANEOUS FLIGHT REQUIREMENTS

CS 25 .255 Out - of - trim characteristics

ED Decision 2003/ 2/RM (See AMC 25.255 ) (a) From an initial condition with the aeroplane trimmed at cruise speeds up to V /M , the MO MO aeroplane must have satisfactory manoeuvring stability and controllability with the degree of out - of - trim in both the aeroplane nose - up and nose - down directions, which results from the greater of – (1) A three - second movement of the longitudinal trim system at its normal rate for the particular flight condition with no aerodynamic load (or an equivalent degree of trim for aeroplanes that do not have a power - operated trim system), except as limited by stops in the trim system, including those required by CS 25.655(b) for adjustable stabilisers; or (2) The maximum mistrim that can be sustained by the autopilot while maintaining level flight in the high speed cru ising condition.

(b) In the out - of - trim condition specified in sub - paragraph (a) of this paragraph, when the normal acceleration is varied from + 1 g to the positive and negative values specified in sub - paragraph (c) of this paragraph – (1) The stick force vs. g curve must have a positive slope at any speed up to and including V /M ; and FC FC (2) At speeds between V /M and V /M , the direction of the primary longitudinal control FC FC DF DF force may not reverse.

(c) Except as provided in sub - paragraphs (d) and (e) of this paragraph compliance with the provisions of sub - paragraph (a) of this paragraph must be demonstrated in flight over the acceleration range – (1) – 1g to 2·5 g; or (2) 0 g to 2·0 g, and extrapolating by an acceptable method to – 1 g and 2·5 g.

(d) I f the procedure set forth in sub - paragraph (c)(2) of this paragraph is used to demonstrate compliance and marginal conditions exist during flight test with regard to reversal of primary longitudinal control force, flight tests must be accomplished from the normal acceleration at which a marginal condition is found to exist to the applicable limit specified in sub - paragraph (c)(1) of this paragraph.

(e) During flight tests required by subparagraph (a) of this paragraph the limit manoeuvring load factors pres cribed in CS 25.333(b) and 25.337 , and the manoeuvring load factors associated with probable inadvertent excursions beyond the boundaries of the buffet onset envelopes determined under CS 25.251(e) , need not be exceeded. In addition, the entry spe eds for flight test demonstrations at normal acceleration values less than 1 g must be limited to the extent necessary to accomplish a recovery without exceeding V /M .

DF DF (f) In the out - of - trim condition specified in sub - paragraph (a) of this paragraph, it must be possible from an overspeed condition at V /M , to produce at least 1·5 g for recovery by applying not DF DF more than 556 N (125 lbf) of longitudinal control force using either the primary longitudinal control alone or the primary longitudinal control and the longitudinal trim system. If the longitudinal trim is used to assist in producing the required load factor, it must be shown at V /M that the longitudinal trim can be actuated in the aeroplane nose - up direction with the DF DF primary surface loaded t o correspond to the least of the following aeroplane nose - up control forces: Powered by EASA eRules Page 192 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) MISCELLANEOUS FLIGHT REQUIREMENTS (1) The maximum control forces expected in service as specified in CS 25.301 and 25.397 .

(2) Th e control force required to produce 1·5 g.

(3) The control force corresponding to buffeting or other phenomena of such intensity that it is a strong deterrent to further application of primary longitudinal control force.

AMC 25.255 Out - of - trim c haracterist ics

ED Decision 2003/ 2/RM 1 Amount of Out - of - trim Required 1.1 The equivalent degree of trim, specified in CS 25.255(a)(1) for aeroplanes which do not have a power - operated longitudinal trim system, has not been s pecified in quantitative terms, and the particular characteristics of each type of aeroplane must be considered.

The intent of the requirement is that a reasonable amount of out - of - trim should be investigated, such as might occasionally be applied by a pil ot.

1.2 In establishing the maximum mistrim that can be sustained by the autopilot the normal operation of the autopilot and associated systems should be taken into consideration.

Where the autopilot is equipped with an auto - trim function the amount of mi strim which can be sustained will generally be small or zero. If there is no auto - trim function, consideration should be given to the maximum amount of out - of - trim which can be sustained by the elevator servo without causing autopilot disconnect.

2 Datum Trim Setting 2.1 For showing compliance with CS 25.255(b)(1) for speeds up to V /M , the datum trim MO MO setting should be the trim setting required for trimmed flight at the particular speed at which the demonstration is to be made.

2.2 For showing compliance with CS 25.255(b)(1) for speeds from V /M to V /M , and MO MO FC FC for showing compliance with CS 25.255(b)(2) and (f), the datum trim setting should be the trim setting required for trimmed flight at V /M .

MO MO 3 Reversal of Primary Longitudinal Control Force at Speeds greater than V /M FC FC 3.1 CS 25.255(b)(2) requires that the direction of the primary longitudinal control force may not reverse when the normal acceleration is varied, for +1 g to the positive and negativ e values specified, at speeds above V /M . The intent of the requirement is that it is FC FC permissible that there is a value of g for which the stick force is zero, provided that the stick force versus g curve has a positive slope at that point (see Figure 1 ).

Powered by EASA eRules Page 193 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) MISCELLANEOUS FLIGHT REQUIREMENTS FIGURE 1 3.2 If stick force characteristics are marginally acceptable, it is desirable that there should be no reversal of normal control sensing, i.e. an aft movement of the control column should produce an aircraft motion in the nose - up direction and a change in airc raft load factor in the positive direction, and a forward movement of the control column should change the aircraft load factor in the negative direction.

3.3 It is further intended that reversals of direction of stick force with negative stick - force gra dients should not be permitted in any mistrim condition within the specified range of mistrim. If test results indicate that the curves of stick force versus normal acceleration with the maximum required mistrim have a negative gradient of speeds above V /M FC FC then additional tests may be necessary. The additional tests should verify that the curves of stick force versus load factor with mistrim less than the maximum required do not unacceptably reverse, as illustrated in the upper curve of Figure 2. Contro l force characteristics as shown in Figure 3, may be considered acceptable, provided that the control sensing does not reverse (see paragraph 3.2) FIGURE 2 FIGURE 3 Powered by EASA eRules Page 194 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART B – FLIGHT (CS - 25) MISCELLANEOUS FLIGHT REQUIREMENTS 4 Probable Inadvertent Excursions beyond the Boundaries of the Buffet Onset Envelo pes.

CS 25.255(e) states that manoeuvring load factors associated with probable inadvertent excursions beyond the boundaries of the buffet onset envelopes determined under CS 25.251(e) need not be exceeded. It is intended that test flights need not be continued beyond a level of buffet which is sufficiently severe that a pilot would be reluctant to apply any further increase in load factor.

5 Use of the Longitudinal Trim Sy stem to Assist Recovery 5.1 CS 25.255(f) requires the ability to produce at least 1·5 g for recovery from an overspeed condition of V /M , using either the primary longitudinal control alone or the primary DF DF longitudinal control and the longitudinal trim system. Although the longitudinal trim system may be used to assist in producing the required normal acceleration, it is not acceptable for recovery to be completely dependent upon the use of this system. It should be possible to produce 1·2 g by applying not more than 556 N (125 lbf) of longitudinal control force using the primary longitudinal control alone.

5.2 Recovery capabi lity is generally critical at altitudes where airspeed (V ) is limiting. If at DF higher altitudes (on the M boundary) the manoeuvre capability is limited by buffeting DF of such an intensity that it is a strong deterrent to further increase in normal acceler ation, some reduction of manoeuvre capability will be acceptable, provided that it does not reduce to below 1·3 g. The entry speed for flight test demonstrations of compliance with this requirement should be limited to the extent necessary to accomplish a recovery without exceeding V /M , and the normal acceleration should be measured as near to DF DF V /M as is practical.

DF DF Powered by EASA eRules Page 195 of 1495 | Jan 2023

Next: SUBPART C – STRUCTURE →

SUBPART C – STRUCTURE

Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL

SUBPART C – STRUCTURE

GENERAL

CS 25.301 Loads

ED Decision 2016/010 /R (See AMC 25.301) (a) Strength requirements are specified in terms of limit loads (the maximum loads to be expected in service) and ultimate loads (limit loads multiplied by prescribed factors of safety). Unless otherwise provided, prescribed loads are limit loads.

(b) Unless otherwise provided the specified air, ground, an d water loads must be placed in equilibrium with inertia forces, considering each item of mass in the aeroplane. These loads must be distributed to conservatively approximate or closely represent actual conditions. (See AMC No. 1 to CS 25.301(b) .) Methods used to determine load intensities and distribution must be validated by flight load measurement unless the methods used for determining those loading conditions are shown to be reliable. (See AMC No. 2 to CS 25.301(b) .)

(c) If deflections under load would significantly change the distribution of external or internal loads, this redistribution must be taken into account.

[Amdt 25/1] [Amdt 25/18]

AMC No. 1 to 25.301(b) Loads

ED Decision 2005/006/R The engine and its mounting structure are to be stressed to the loading cases for the aeroplane as a whole.

[ Amdt 25/1]

AMC No. 2 to 25.301(b) Flight Load Validation

ED Decision 2005/006/R 1. PURPOSE This AMC sets fo rth an acceptable means, but not the only means, of demonstrating compliance with the provisions of CS - 25 related to the validation, by flight load measurements, of the methods used for determination of flight load intensities and distributions, for large aeroplanes.

2. RELATED CERTIFICATIONS SPECIFICATIONS CS 25.301(b) “Loads” CS 25.459 “Special Devices” 3. BACKGROUND (a) CS - 25 stipulates a number of load conditions, such as flight loads, ground loads, pressurisation loads, inertia loads and engine/APU loads. CS 25.301 requires methods used to determine load intensities and distributions to be validated by flight load measurements unless the methods used for determining those loading conditions are Powered by EASA eRules Page 196 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SU BPART C – STRUCTURE (CS - 25) GENERAL shown to be reliable. Although this applies to all load conditions of CS - 25, the scope of this AMC is limited to flight loads.

(b) The sizing of the structure of the aircraft generally in volves a number of steps and requires detailed knowledge of air loads, mass, stiffness, damping, flight control system characteristics, etc. Each of these steps and items may involve its own validation. The scope of this AMC however is limited to validatio n of methods used for determination of loads intensities and distributions by flight load measurements.

(c) By reference to validation of “methods”, CS 25.301(b) and this AMC are intended to convey a validation of the complete package of elements involved in the accurate representation of loads, including input data and analytical process. The aim is to demonstrate that the complete package delivers reliable or co nservative calculated loads for scenarios relevant to CS - 25 flight loads requirements.

(d) Some measurements may complement (or sometimes even replace) the results from theoretical methods and models. Some flight loads development methods such as those use d to develop buffeting loads have very little theoretical foundation, or are methods based directly on flight loads measurements extrapolated to represent limit conditions.

4. NEED FOR AND EXTENT OF FLIGHT LOAD MEASUREMENTS 4.1. General (a) The need for an d extent of the flight load measurements has to be discussed and agreed between the Agency and Applicant on a case by case basis. Such an assessment should be based on: (i) a comparison of the design features of the aeroplane under investigation with previ ously developed (by the Applicant) and approved aeroplanes. New or significantly different design features sho uld be identified and assessed.

(ii) the Applicant’s previous experience in validating load intensities and distributions derived from analytical methods and/or wind tunnel tests. This experience should have been accumulated on previously developed (by the Applicant) and approved types and mo dels of aeroplanes. The validation should have been by a flight load measurement program that was conducted by the Applicant and found acceptable to the Agency for showing compliance.

(iii) the sensitivity to parametric variation and continued applicabilit y of the analytical method s and/or wind tunnel test data.

(b) Products requiring a new type certificate will in general require flight - test validation of flight loads methods unless the Applicant can demonstrate to the A gency that this is unnecessary.

If t he configuration under investigation is a similar configuration and size as a previously developed and approved design, the use of analytical methods, such as computational fluid dynamics validated on wind tunnel test results and supported by previous load validation flight test experience, may be sufficient to determine flight loads without further flight test validation.

(c) Applicants who are making a change to a Type Certificated airplane, but who do not have access to the Type certification flight load s substantiation for that airplane, will be required to develop flight loads analyses, as necessary, to substantiate the change.

Powered by EASA eRules Page 197 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL In general, the loads analyses will require validation and may require flight test loads measurements, as specified in this AMC .

(d) The Applicant is encouraged to submit supporting data or test plans for demonstrating the reliability of the flight loads methods early in the certification planning process.

4.2. New or significa ntly different design features.

Examples of new or sig nificantly different design features i nclude, but are not limited to: — Wing mounted versus fuselage mounted engines; — Two versus three or more engines; — Low versus high wing; — Conventional versus T - tail empennage; — First use of significant sweep; — Significant expansion of flight envelope; — Addition of winglets; — Significant modification of control surface configuration; — Significant differences in airfoil shape, size (span, area); — Significant changes in high lift configurations; — Significant changes in power plant installation/configuration; — Large change in the size of the aeroplane.

4.3. Other considerations (a) Notwithstanding the similarity of the aeroplane or previous load validation flight test experience of the Applicant, the local loads on the following ele ments are typically unreliably predicted and may require a measurement during flight tes ts: — Loads on high lift devices; — Hinge moments on control surfaces; — Loads on the empennage due to buffeting; — Loads on any unusual device.

(b) For non - deterministic loading conditions, such as stall buffet, the applicant should compile a sufficient number of applicable flight loads measurements to develop a reliable method to predi ct the appropriate design load.

5. FLIGHT LOAD MEASUREMENTS 5.1. Measu rements.

Flight load measurements (for example, through application of strain gauges, pressure belt s, accelerometers) may include: — Pressures / air loads /net shear, bending and torque on primary aerodynamic surfaces; — Flight mechanics parameters necessary to correlate the analytical model with flight test results; Powered by EASA eRules Page 198 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL — High lift devices loads and positions; — Primary control surface hinge moments and positions; — Unsymmetric loads on the empennage (due to roll/yaw manoeuvres and buffeting); — Local strains or response measurements in cases where load calculations or measurements are indeterminate or unreliable.

5.2. Variation of parameters.

The test points for the flight loads measurements should consider the variation of the main parameters affecting the loads under validation. Examples of these parameters include: load factor, speeds, altitude, aircraft c.g., weight and inertia, power settings (thrust, for wing mounted engines), fuel loading, speed brake settings, flap settings and gear conditions (up/down) within th e design limits of the aeroplane. The range of variation of these parameters must be sufficient to allow the extrapolation to the design loads conditions. In general, the flight test conditions need not exceed approximately 80% of limit load.

5.3. Conditio ns.

In the conduct of flight load measurements, conditions used to ob tain flight loads may include: — Pitch manoeuvres including wind - up turns, pull - ups and push - downs (e.g. for wing and horizontal stabiliser manoeuvring loads); — Stall entry or buffet onset boundary conditions (e.g. for horizontal stabiliser buffet loads); — Yaw manoeuvres including rudder inputs and steady sideslips; — Roll manoeuvres.

Some flight load conditions are difficult to validate by flight load measurements, simply because the require d input (e.g. gust velocity) cannot be accurately controlled or generated. Therefore, these type of conditions need not be flight tested. Also, in general, failures, malfunctions or adverse conditions are not subject to flight tests for the purpose of flig ht loads validation.

5.4. Load alleviation.

When credit has been taken for an active load alleviation function by a particular control system, the effectiveness of this function should be demonstrated as far as practicable by an appropriate flight test pr ogram.

6. RESULTS OF FLIGHT LOAD MEASUREMENTS 6.1. Comparison / Correlation.

Flight loads are not directly measured, but are determined through correlation with measured strains, pressures or accelerations. The load intensities and distributions derived from flight testing should be compared with those obtained from analytical meth ods. The uncertainties in both the flight testing measurements and subsequent correlation should be carefully considered and compared with the inherent assumptions and capabilities of the process used in analytic derivation of flight loads. Since in most c ases the flight test points are not the limit design load conditions, new analytical load cases need to be generated to match the actual flight test data points.

Powered by EASA eRules Page 199 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL 6.2. Quality of measurements.

Factors which can affect the uncertainty of flight loads resulting from calibrated strain gauges include the effects of temperature, structural non - linearities, establishment of flight/ground zero reference, and large local loads, such as those resulting from the propulsion system installation, landing gear, fla p tracks or actuators. The static or dynamic nature of the loading can also affect both strain g auge and pressure measurements.

6.3. Quality of correlation.

A given correlation can provide a more or less reliable estimate of the actual loading condition d epending on the "static" or "flexible dynamic" character of the loading action, or on the presence and level of large local loads. The quality of the achieved correlation depends also on the skills and experience of the Applicant in the choice of strain ga uge locations and conduct of t he calibration test programme.

Useful guidance on the calibration and selection of strain gauge installations in aircraft structures for flight loads measurements can be found, but not exclusively, in the following references : 1. Skopinski, T.H., William S. Aiken, Jr., and Wilbur B. Huston, “Calibration of Strain - Gage Installations in Aircraft Structures for Measurement of Flight Loads”, NACA Report 1178, 1954.

2. Sigurd A. Nelson II, “Strain Gage Selection in Loads Equation s Using a Genetic Algorithm”, NASA Contractor Report 4 597 (NASA - 13445), October 1994.

6.4. Outcome of comparison / correlation.

Whatever the degree of correlation obtained, the Applicant is expected to be able to justify the elements of the correlation pr ocess, including the effects of extrapolation of the actual test conditions to the design load conditions.

If the correlation is poor, and especially if the analysis underpredicts the loads, then the Applicant should review and assess all of the components of the analysis, rather than applying blanket correction factors.

For example: (a) If the level of discrepancy varies with the Mach number of the condition, then the Mach corrections ne ed to be evaluated and amended.

(b) If conditions with speed brakes ex tended show poorer correlation than clean wing, then the speed brake aerodynamic derivatives and/or spanwise distribution ne ed to be evaluated and amended.

[ Amdt 25/1]

CS 25.302 Interaction of systems and structures

ED Decision 2005/006/R For aeroplanes eq uipped with systems that affect structural performance, either directly or as a result of a failure or malfunction, the influence of these systems and their failure conditions must be taken into account when showing compliance with the requirements of Subp arts C and D. Appendix K of CS - 25 must be used to evaluate the structural performance of aeroplanes equipped with these systems.

[ Amdt 25/1] Powered by EASA eRules Page 200 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL

CS 25.303 Factor of safety

ED Decision 2003/2/RM Unless otherwise specified, a factor of safety of 1·5 must be applied to the prescribed limit load which are considered external loads on the structure. When loading condition is prescribed in terms of ultimate loads, a factor of safety need not be applied unless otherwise specified.

CS 25.305 Strength and deformation

ED Decision 2005 / 006/R (a) The structure must be able to support limit loads without detrimental permanent deformation.

At any load up to limit loads, the deformation may not interfere with s afe operation.

(b) The structure must be able to support ultimate loads without failure for at least 3 seconds.

However, when proof of strength is shown by dynamic tests simulating actual load conditions, the 3 - second limit does not apply. Static tests con ducted to ultimate load must include the ultimate deflections and ultimate deformation induced by the loading. When analytical methods are used to show compliance with the ultimate load strength requirements, it must be shown that – (1) The effects of def ormation are not significant; ( 2) The deformations involved are fully accounted for in the analysis; or (3) The methods and assumptions used are sufficient to cover the effects of these deformations.

(c) Where structural flexibility is such that any rat e of load application likely to occur in the operating conditions might produce transient stresses appreciably higher than those corresponding to static loads, the effects of this rate of application must be considered.

(d) Reserved (e) The aeroplane must be designed to withstand any vibration and buffeting that might occur in any likely operating condition up to V /M , including stall and probable inadvertent excursions D D beyond the boundaries of the buffet onset envelope. This must be shown by analysis, fli ght tests, or other tests found necessary by the Agency.

(f) Unless shown to be extremely improbable, the aeroplane must be designed to withstand any forced structural vibration resulting from any failure, malfunction or adverse condition in the flight con trol system. These loads must be treated in accordance with the requirements of CS 25.302 .

[ Amdt 25/1]

CS 25.307 Proof of structure

ED Decision 2005 / 006/R ( See AMC 25.307 ) (a) Compliance with the strength and deformation requirements of this Subpart must be shown for each critical loading condition. Structural analysis may be used only if the structure conforms to that for which experience has shown this method to be reliable. In other cases, substantiating tests must be made to load levels that are sufficient to verify structural behaviour up to loads specified in CS 25.305 .

(b) Res erved Powered by EASA eRules Page 201 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL (c) Reserved (d) When static or dynamic tests are used to show compliance with the requirements of CS 25.305(b) for flight structures, appropriate material correction factors must be applied to the test resul ts, unless the structure, or part thereof, being tested has features such that a number of elements contribute to the total strength of the structure and the failure of one element results in the redistribution of the load through alternate load paths.

[Am dt 25/1]

AMC 25.307 Proof of s tructure

ED Decision 2005 / 006/R 1. Purpose This AMC establishes methods of compliance with CS 25.307 , which specifies the requirements for Proof of Structure.

2. Related Certification Specifications CS 25.303 “Factor of safety” CS 25.305 “Strength and deformation” CS 25.651 “Proof of strength” 3. De finitions 3.1. Detail. A structural element of a more complex structural member (e.g. joints, splices, stringers, stringer run - outs, or access holes).

3.2. Sub Component. A major three - dimensional structure which can provide complete structural representa tion of a section of the full structure (e.g., stub - box, section of a spar, wing panel, wing rib, body panel, or frames).

3.3. Component. A major section of the airframe structure (e.g., wing, body, fin, horizontal stabiliser) which can be tested as a comp lete unit to qualify the structure.

3.4. Full Scale. Dimensions of test article are the same as design; fully representative test specimen (not necessarily complete airframe).

3.5. New Structure. Structure for which behaviour is not adequately predicted by analysis supported by previous test evidence. Structure that utilises significantly different structural design concepts such as details, geometry, structural arrangements, and load paths or materials from previously tested designs.

3.6. Similar New Struc ture. Structure that utilises similar or comparable structural design concepts such as details, geometry, structural arrangements, and load paths concepts and materials to an existing tested design.

3.7. Derivative/Similar Structure. Structure that uses st ructural design concepts such as details, geometry, structural arrangements, and load paths, stress levels and materials that are nearly identical to those on which the analytical methods have been validated.

3.8. Previous Test Evidence. Testing of the ori ginal structure that is sufficient to verify structural behaviour in accordance with CS 25.305 .

Powered by EASA eRules Page 202 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL 4. Introduction As required by subparagraph (a) of CS 25.307 , the structur e must be shown to comply with the strength and deformation requirements of Subpart C of CS - 25. This means that the structure must: (a) be able to support limit loads without detrimental permanent deformation, and: (b) be able to support ultimate loads wit hout failure.

This implies the need of a comprehensive assessment of the external loads (addressed by CS 25.301), the resulting internal strains and stresses, and the structural allowables.

CS 25.307 requires compl iance for each critical loading condition. Compliance can be shown by analysis supported by previous test evidence, analysis supported by new test evidence or by test only. As compliance by test only is impractical in most cases, a large portion of the sub stantiating data will be based on analysis.

There are a number of standard engineering methods and formulas which are known to produce acceptable, often conservative results especially for structures where load paths are well defined. Those standard method s and formulas, applied with a good understanding of their limitations, are considered reliable analyses when showing compliance with CS 25.307 .

Conservative assumptions may be considered in assessing whether or not an analysis may be accepted without test substantiation.

The application of methods such as Finite Element Method or engineering formulas to complex structures in modern aircraft is considered reliable only when validated by full scale tests (ground and/or flight tests). Experience relevant to the product in the utilisation of such methods should be considered.

5. Classification of structure (a) The structure of the product should be classified into one of the following three categories: — New Structure — Similar New Structure — Derivative/Similar Structure (b) Justifications should be provided for classifications other than New Structure. Element s that should be considered are : (i) The accuracy/conservatism of the analytical methods, and (ii) Comparison of the structure under investigation with previously tested structure.

Considerations should include, but are not limited to the following: — external loads (bending moment, shear, torque , etc.); — internal loads (strains, stresses, etc.); — structu ral design concepts such as details, geometry, structural arrangements, load paths; — materials ; — test experience (load levels achieved, lessons learned); — deflections ; Powered by EASA eRules Page 203 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL — deformations ; — extent of extrapolation from test stress levels.

6. Need and Extent of Testin g The following factors should be considered in deciding the need for and the extent of testing including the load levels to be achieved: (a) The classification of the structure (as above); (b) The consequence of failure of the structure in terms of the o verall integrity of the aeroplane; (c) The consequence of the failure of interior items of mass and the supporting structure to the safety of the occupants.

Relevant service experience may be included in this evaluation.

7. Certification Approaches The fo llowing certification approaches may be selected: (a) Analysis, supported by new strength testing of the structure to limit and ultimate load.

This is typically the case for New Structure.

Substantiation of the strength and deformation requirements up to l imit and ultimate loads normally requires testing of sub - components, full scale components or full scale tests of assembled components (such as a nearly complete airframe). The entire test program should be considered in detail to assure the requirements f or strength and deformation can be met up to limit load levels as well as ultimate load levels.

Sufficient limit load test conditions should be performed to verify that the structure meets the deformation requirements of CS 25.305(a) and to provide validation of internal load distribution and analysis predictions for all critical loading conditions.

Because ultimate load tests often result in significant permanent deformation, choices will have to be made with respect to the load conditions applied. This is usually based on the number of test specimens available, the analytical static strength margins of safety of the structure and the range of supporting detail or sub - component tests. An envelope approach may b e taken, where a combination of different load cases is applied, each one critical for a different section of the structure.

These limit and ultimate load tests may be supported by detail and sub - component tests that verify the design allowables (tension, shear, compression) of the structure and often provide some degree of validation for ultimate strength.

(b) Analysis valid ated by previous test evidence and supported with additional limited testing. This is typically the case for Similar New Structure.

The extent of additional limited testing (number of specimens, load levels, etc.) will depend upon the degree of change, relative to the elements of paragraphs 5(b)(i) and (ii).

For example, if the changes to an existing design and analysis nece ssitate extensive changes to an existing test - validated finite element model (e.g. different rib spacing) additional testing may be needed. Previous test evidence can be relied upon whenever practical.

Powered by EASA eRules Page 204 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL These additional limited tests may be further supporte d by detail and sub - component tests that verify the design allowables (tension, shear, compression) of the structure and often provide some degree of validation for ultimate strength.

(c) Analysis, supp orted by previous test evidence . This is typically the case for Derivative/ Similar Structure.

Justification should be provided for this approach by demonstrating how the previous static test evidence validates the analysis and supports showing compliance for the structure under investigation. Elements that n eed to be considered are those defined in paragraphs 5(b)(i) and (ii).

For example, if the changes to the existing design and test - validated analysis are evaluated to assure they are relatively minor and the effects of the changes are well understood, the original tests may provide sufficient validation of the analysis and further testing may not be necessary. For example, if a weight increase results in higher loads along with a corresponding increase in some of the element thickness and fastener sizes, an d materials and geometry (overall configuration, spacing of structural members, etc.)

remain generally the same, the revised analysis could be considered reliable based on the previous validation.

(d) Test only.

Sometimes no reliable analytical method exis ts, and testing must be used to show compliance with the strength and deformation requirements. In other cases it may be elected to show compliance solely by tests even if there are acceptable analytical methods. In either case, testing by itself can be us ed to show compliance with the strength and deformation requirements of CS - 25 Subpart C. In such cases, the test load conditions should be selected to assure all critical design loads are encompassed.

If tests only are used to show compliance with the stre ngth and deformation requirements for single load path structure which carries flight loads (including pressurisation loads), the test loads must be increased to account for variability in material properties, as required by CS 25.307(d) . In lieu of a rational analysis, for metallic materials, a factor of 1.15 applied to the limit and ultimate flight loads may be used. If the structure has multiple load paths, no material correction factor is required.

8. Interpreta tion of Data The interpretation of the substantiation analysis and test data requires an extensive review of: — the representativeness of the loading ; — the instrumentation data ; — comparisons with analytical methods ; — representativeness of the test article(s ) ; — test set - up (fixture, load introductions) ; — load levels and conditions tested ; — test results.

Powered by EASA eRules Page 205 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GENERAL Testing is used to validate analytical methods except when showing compliance by test only. If the test results do not correlate with the analysis, the reas ons should be identified and appropriate action taken. This should be accomplished whether or not a test article fails below ultimate load.

Should a failure occur below ultimate load, an investigation should be conducted for the product to reveal the cause of this failure. This investigation should include a review of the test specimen and loads, analytical loads, and the structural analysis. This may lead to adjustment in analysis/modelling techniques and/or part redesign and may result in the need for add itional testing. The need for additional testing to ensure ultimate load capability, depends on the degree to which the failure is understood and the analysi s can be validated by the test.

[Amdt 25/1] Powered by EASA eRules Page 206 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT LOADS

FLIGHT LOADS

CS 25.321 General

ED Decision 2003/ 2/RM (a) Flight load factors represent the ratio of the aerodynamic force component (acting normal to the assumed longitudinal axis of the aeroplane) to the weight of the aeroplane. A positive load factor is one in which the aerodynamic force acts upward with respect to the aeroplane.

(b) Considering compressibility effects at each speed, compliance with the flight load requirements of this Subpart must be shown – (1) At each critical altitude within the range of altitudes selected by the appl icant; (2) At each weight from the design minimum weight to the design maximum weight appropriate to each particular flight load condition; and (3) For each required altitude and weight, for any practicable distribution of disposable load within the operat ing limitations recorded in the Aeroplane Flight Manual.

(c) Enough points on and within the boundaries of the design envelope must be investigated to ensure that the maximum load for each part of the aeroplane structure is obtained.

(d) The significant forces acting on the aeroplane must be placed in equilibrium in a rational or conservative manner. The linear inertia forces must be considered in equilibrium with the thrust and all aerodynamic loads, while the angular (pitching) inertia f orces must be considered in equilibrium with thrust and all aerodynamic moments, including moments due to loads on components such as tail surfaces and nacelles. Critical thrust values in the range from zero to maximum continuous thrust must be considered.

Powered by EASA eRules Page 207 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS

FLIGHT MANOEUVRE AND GUST CONDITIONS

CS 25.331 Symmetric manoeuvring conditions

ED Decision 2016 / 010/R (See AMC 25.331) (a) Procedure . For the analysis of the manoeuvring flight conditions specified in sub - paragraphs (b) and (c) of this paragraph, the fol lowing provisions apply: (1) Where sudden displacement of a control is specified, the assumed rate of control surface displacement may not be less than the rate that could be applied by the pilot through the control system.

(2) In determining elevator ang les and chordwise load distribution in the manoeuvring conditions of sub - paragraphs (b) and (c) of this paragraph, the effect of corresponding pitching velocities must be taken into account. The in - trim and out - of - trim flight conditions specified in CS 25.255 must be considered.

(b) Manoeuvring balanced conditions. Assuming the aeroplane to be in equilibrium with zero pitching acceleration, the manoeuvring conditions A through I on the manoeuvring envelope in CS 25.333(b) must be investigated.

(c) Manoeuvring pitching conditions . The following conditions must be investigated: (1) Maximum pitch control displacement at V . The aeroplane is assumed to be flying in A steady level flight (point A1, CS 25.333(b) ) and the cockpit pitch control is suddenly moved to obtain extreme nose up pitching acceleration. In defining the tail load, the response of the aeroplane must be taken into account. Aeroplane loads which occur subsequent to the time when normal acceleration at the c.g. exceeds the positive limit manoeuvring load factor (at point A2 in CS 25.333(b) ), or the resulting tailplane normal load reaches its maximum, whichever occurs first, need not be considered (See AMC 25.331(c)(1) ) .

(2) Checked manoeuvre between V and V . Nose up checked pitching manoeuvres must be A D analysed in which the positive limit load factor prescribed in CS 25.337 is achieved. As a separate condition, nose down checked pitching manoeuvres must be analysed in which a limit load factor of 0 is achieved. In defining the aeroplane loads the cockpit pitch control motions described in sub - paragraphs (i), (ii), (iii) and (iv) of this paragraph must be used: (See AMC 25.331( c)(2) ) (i) The aeroplane is assumed to be flying in steady level flight at any speed between V and V and the cockpit pitch control is moved in accordance with the following A D formula: 𝛿 ( 𝑡 ) = 𝛿 sin ( 𝜔𝑡 ) 𝑓𝑜𝑟 0 ≤ 𝑡 ≤ 𝑡 1 𝑚𝑎𝑥 where: δ1 = the maximum available displacement of the cockpit pitch control in the initial direction, as limited by the control system stops, control surface stops, or by pilot effort in accordance with CS 25.397(b) ; δ(t) = t he displacement of the cockpit pitch control as a function of time. In the initial direction δ(t) is limited to δ . In the reverse direction, δ(t) may be Powered by EASA eRules Page 208 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes S UBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS truncated at the maximum available displacement of the cockpit pitch control as limited by the control system stops, control surface stops, or by pilot effort in accordance with CS 25.397(b) ; t = 3π/2ω; max ω = the circular frequency (radians/second) of the control deflection taken equal to the undamped natural frequency of the short period rigid mode of the aeroplane, with active control system effects included where appropriate; but not less than: 𝜋𝑉 𝜔 = 𝑟𝑎𝑑𝑖𝑎𝑛𝑠 𝑝𝑒𝑟 𝑠𝑒𝑐𝑜𝑛𝑑 ; 2 𝑉 𝐴 where: V = the speed of the aeroplane at entry to the manoeuvre.

V = the design manoeuvring speed prescribed in CS 25.335(c) A (ii) For nose - up pitching manoeuvres the complete cockpit pitch control displacement history may be scaled down in amplitude to the extent just necessary to ensure that the positive limit load factor prescribed in CS 25.337 is not exceeded. For nose - down pitching manoeuvres the complete cockpit control displa cement history may be scaled down in amplitude to the extent just necessary to ensure that the normal acceleration at the c.g. does not go below 0g.

(iii) In addition, for cases where the aeroplane response to the specified cockpit pitch control motion doe s not achieve the prescribed limit load factors then the following cockpit pitch control motion must be used: 𝛿 ( 𝑡 ) = 𝛿 sin ( 𝜔𝑡 ) 𝑓𝑜𝑟 0 ≤ 𝑡 ≤ 𝑡 1 1 ( ) 𝛿 𝑡 = 𝛿 𝑓𝑜𝑟 𝑡 ≤ 𝑡 ≤ 𝑡 1 1 2 ( ) ( [ ] ) 𝛿 𝑡 = 𝛿 sin 𝜔 𝑡 + 𝑡 − 𝑡 𝑓𝑜𝑟 𝑡 ≤ 𝑡 ≤ 𝑡 1 1 2 2 𝑚𝑎𝑥 where: t = π /2 ω t = t + ∆t 2 1 t = t + π/ω; max 2 ∆t = the minimum period of time necessary to allow the prescribed limit load factor to be achieved in the initial direction, but it need not exceed five seconds (see figure below).

Powered by EASA eRules Page 209 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS (iv) In cases where the cockpit pitch control motion may be affected by inputs from systems (for example, by a stick pusher that can operate at high load factor as well as at 1g) then the effects of those systems must be taken into account.

(v) Aeroplane loads that occur beyond the following times nee d not be considered: (A) For the nose - up pitching manoeuvre, the time at which the normal acceleration at the c.g. goes below 0g; (B) For the nose - down pitching manoeuvre, the time at which the normal acceleration at the c.g. goes above the positive limit load factor prescribed in CS 25.337 ; (C) t .

max [Amdt 25/13] [Amdt 25/18]

AMC 25.331(c)(1) Maximum pitch control displacement at V

A ED Decision 2013/010/R The physical limitations of the aircraft from the cockpit pitch control device to the control surface deflection, such as control stops position, maximum power and displacement rate of the ser vo controls, and control law limiters, may be taken into account.

[Amdt 25/13]

AMC 25.331(c)(2) Checked manoeuvre between V and V

A D ED Decision 2013/010/R The physical limitations of the aircraft from the cockpit pitch control device to the control surface deflection, such as control stops position, maximum power and displacement rate of the servo controls, and control law limit ers, may be taken into account.

For aeroplanes equipped with electronic flight controls, where the motion of the control surfaces d oes not bear a direct relationship to the motion of the cockpit control devices, the circular frequency of the movement of the cockpit control ‘ω’ shall be varied by a reasonable amount to establish the effect Powered by EASA eRules Page 210 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT M ANOEUVRE AND GUST CONDITIONS of the input period and amplitude on the resul ting aeroplane loads. This variation is intended to verify that there is no large and rapid increase in aeroplane loads.

[Amdt 25/13]

CS 25.333 Flight manoeuvring envelope

ED Decision 2016 / 010 /R (See AMC 25.333) (a) General. The strength requirements must be met at each combination of airspeed and load factor on and within the boundaries of the representative manoeuvring envelope (V - n diagram) of sub - paragraph (b) of this paragraph. This envelope must also be used in determin ing the aeroplane structural operating limitations as specified in CS 25.1501 .

(b) Manoeuvring envelope (See AMC 25.333(b) ) [Amdt 25/11] [Amdt 25/13] [Amdt 25/18]

AMC 25.333(b) Manoeuvring envelope

ED Decision 2013/010/R For the calculation of structural design speeds, the stalling speeds V and V should be taken to be s0 s1 the 1 - g stalling speeds in the appropriate flap configuration. This structural interpretation of st alling speed should be used in connection with the par agraphs CS 25.333(b) , CS 25.335 , CS 25.335(c)(d)(e), CS 25.479(a) , and CS 25.481(a)(1) .

[Amdt 25/13] Powered by EASA eRules Page 211 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS

CS 25.335 Design airspeeds

ED Decision 2016 /010/R (See AMC 25.335) The selected design airspeeds are equivalent airspeeds (EAS). Estimated values of V and V must be S0 S1 conservative.

(a) Design cruising speed , V . For V , the following apply: C C (1) The minimum value of V must be sufficiently greater than V to provide for inadvertent C B speed increases likely to occur as a result of severe atmospheric turbulence.

(2) Except as provided in sub - paragraph 25.335(d)(2), V may not be less than V + 1·32 U C B ref (with U as specified in sub - paragraph 25.341(a)(5)(i) . However, V need not exceed the ref C maximum speed in level flight at maximum continuous power fo r the corresponding altitude.

(3) At altitudes where V is limited by Mach number, V may be limited to a selected Mach D C number. (See CS 25.1505 .)

(b) Design dive speed, V . V must be selected so that V /M is not greater than 0·8 V /M , or so D D C C D D that the minimum speed margin between V /M and V /M is the greater of the following C C D D values: (1) (i) For aeroplanes not equipped with a high speed protection function: From an initial c ondition of stabilised flight at V /M , the aeroplane is upset, flown for 20 seconds C C along a flight path 7·5° below the initial path, and then pulled up at a load factor of 1·5 g (0·5 g acceleration increment). The speed increase occurring in this manoeuvr e may be calculated if reliable or conservative aerodynamic data issued.

Power as specified in CS 25.175(b)(1)(iv) is assumed until the pullup is initiated, at which time power reduction and the use of pilot contro lled drag devices may be assumed; (ii) For aeroplanes equipped with a high speed protection function: In lieu of subparagraph (b)(1)(i), the speed increase above V /M resulting from the greater C C of the following manoeuvres must be established: (A) From an initial condition of stabilised flight at V /M , the aeroplane is upset C C so as to take up a new flight path 7.5° below the initial path. Control application, up to full authority, is made to try and maintain this new flight path. Twenty seconds after achiev ing the new flight path, manual recovery is made at a load factor of 1.5 g (0.5 g acceleration increment), or such greater load factor that is automatically applied by the system with the pilot’s pitch control neutral. The speed increase occurring in this manoeuvre may be calculated if reliable or conservative aerodynamic data is used.

Power as specified in CS 25.175(b)(1)(iv) is assumed until recovery is made, at which time power reduction and the use of pilot cont rolled drag devices may be assumed.

(B) From a speed below V /M , with power to maintain stabilised level flight at C C this speed, the aeroplane is upset so as to accelerate through V /M at a C C flight path 15° below the initial path (or at the steepest nose down attitude that the system will permit with full control authority if less than 15°). Pilot controls may be in neutral position after reaching V /M and before recovery C C is initiated. Recovery may be initiated 3 seconds after operation of high Powered by EASA eRules Page 212 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS speed, attitude, or other alerting system by application of a load factor of 1.5 g (0.5 g acceleration increment), or such greater load factor that is automatically applied by the system with the pilot’s pitch control neutral.

Power may be reduced simultaneously. All other means of decelerating the aeroplane, the use of which is authorised up to the highest speed reached in the manoeuvre, may be used. The interval between successive pilot actions m ust not be less than 1 second (See AMC 25.335(b)(1)(ii) ).

(2) The minimum speed margin must be enough to provide for atmospheric variations (such as horizontal gusts, and penetration of jet streams and cold fronts) and for instrument errors and airframe production variations. These factors may be considered on a probability basis. The margin at altitude where M is limited by compressibility effects C must not be less than 0.07M unless a lower margin is determined usi ng a rational analysis that includes the effects of any automatic systems. In any case, the margin may not be reduced to less than 0.05M. (See AMC 25.335(b)(2) ) (c) Design manoeuvring speed , V . For V , the followi ng apply: A A (1) V may not be less than V √ n where – A S1 (i) n is the limit positive manoeuvring load factor at V ; and C (ii) V is the stalling speed with wing - flaps retracted.

S1 (2) V and V must be evaluated at the design weight and altitude under consideration.

A S (3) V need not be more than V or the speed at which the positive C curve intersects the A C Nmax positive manoeuvre load factor line, whichever is less.

(d) Design speed for maximum gust intensity, V .

B (1) V may not be less than B ⁄ 𝐾 𝑈 𝑉 𝑎 𝑔 𝑟𝑒𝑓 𝑐 𝑉 [ 1 + ] 𝑠 1 498 𝑤 where – V = the 1 - g stalling speed based on C with the fla ps retracted at the particular sl NAmax weight under consideration; C = the maximum aeroplane normal force coefficient; NAmax V = design cruise speed (knots equivalent airspeed); c U = the reference gust velocity (feet per second equivalent airspeed) from ref CS 25.341(a)(5)(i) ; w = average wing loading (pounds per square foot) at the particular weight under consideration.

. 88 𝜇 K = g 5 . 3 + 𝜇 2 𝑤 μ = 𝜌 𝑐𝑎𝑔 ρ = density of air (slugs/ft ); c = mean geometric chord of the wing (feet); g = acceleration due to gravity (ft/sec ); Powered by EASA eRules Page 213 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS a = slope of the aeroplane normal force coefficient curve, C per radian; NA (2) At altitudes where V is limited by Mach number – c (i) V may be chosen to provide an optim um margin between low and high speed B buffet boundaries; and, (ii) V need not be greater than V .

B C (e) Design wing - flap speeds, V . For V , the following apply: F F (1) The design wing - flap speed for each wing - flap position (established in accordance with CS 25.697(a) ) must be sufficiently greater than the operating speed recommended for the corresponding stage of flight (including balked landings) to allow for probable variations in control of airspeed and for transiti on from one wing - flap position to another.

(2) If an automatic wing - flap positioning or load limiting device is used, the speeds and corresponding wing - flap positions programmed or allowed by the device may be used.

(3) V may not be less than – F (i) 1·6 V with the wing - flaps in take - off position at maximum take - off weight; S1 (ii) 1·8 V with the wing - flaps in approach position at maximum landing weight; and S1 (iii) 1·8 V with the wing - flaps in landing position at maximum landing weight.

S0 (f) Design drag device speeds, V . The selected design speed for each drag device must be DD sufficiently greater than the speed recommended for the operation of the device to allow for prob able variations in speed control. For drag devices intended for use in high speed descents, V may not be less than V . When an automatic drag device positioning or load limiting means DD D is used, the speeds and corresponding drag device positions programmed or allowed by the automatic means must be used for design.

[Amdt 25/13] [Amdt 25/18]

AMC 25.335(b)(1)(ii) Design Dive Speed - High speed protection

function

ED Decision 2013/010/R In any failure condition affecting the high speed protection function, the conditions as defined in CS 25.335(b)(1)(ii) still remain applicable.

It implies that a specific value, which may be different from the V /M value in normal configuration, D D has to be associated with this failure co ndition for the definition of loads related to V /M as well as D D for the justification to CS 25.629 . However, the strength and speed margin required will depend on the probability of this failure condition, accordin g to the criteria of CS 25.302 .

Alternatively, the operating speed V /M may be reduced to a value that maintains a speed margin MO MO between V /M and V /M that is consistent with showing compliance with CS 25.335(b)(1)(ii) MO MO D D without the benefit of the high speed protection system, provided that: (a) Any failure of the high speed protection system that would affect the design dive speed determination is shown to be Remote; Powered by EASA eRules Page 214 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS (b) Failures of the system must be announced to the pilots, and: (c) Aeroplane flight manual instructions should be provided that reduce the maximum operating speeds, V /M .

MO MO [Amdt 25/13]

AMC 25.335(b)(2) Design Dive Speed

ED Decision 2006 / 005/R 1. PURPOSE . This AMC sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of CS - 25 related to the minimum speed margin between design cruise speed and design dive speed.

2. RELATED CERTIFICATION S PECIFICATIONS . CS 25.335 "Design airspeeds".

3. BACKGROUND . CS 25.335(b) requires the design dive speed, V , of the aeroplane to be D established so that the design cruise speed is no greater than 0.8 times the design dive speed, or that it be based on an upset criterion initiated at the design cruise speed, V . At altitudes C where the cruise speed is limited by compressibility effects, CS 25.335(b)(2) requires the mar gin to be not less than 0.05 Mach. Furthermore, at any altitude, the margin must be great enough to provide for atmospheric variations (such as horizontal gusts and the penetration of jet streams), instrument errors, and production variations. This AMC pro vides a rational method for considering the atmospheric variations.

4. DESIGN DIVE SPEED MARGIN DUE TO ATMOSPHERIC VARIATIONS .

a. In the absence of evidence supporting alternative criteria, compliance with CS 25.335(b)(2) may be shown by providing a marg in between V /M and V /M sufficient C C D D to provide for the following atmospheric conditions: (1) Encounter with a Horizontal Gust . The effect of encounters with a substantially headon gust, assumed to act at the most adverse angle between 30 degrees above and 30 degrees below the flight path, should be considered. The gust velocity should be 15.2 m/s (50 fps) in equivalent airspeed (EAS) at altit udes up to 6096 m (20,000 feet) . At altitudes above 6096 m (20,000 feet) the gust velocity may be reduced l inearly from 15.2 m/s (50 fps) in EAS at 6096 m (20,000 feet) to 7.6 m/s (25 fps) in EAS at 15240 m (50,000 feet) , above which the gust velocity is considered to be constant. The gust velocity should be assumed to build up in not more than 2 seconds and la st for 30 seconds.

(2) Entry into Jetstreams or Regions of High Windshear .

(i) Conditions of horizontal and vertical windshear should be investigated taking into account the windshear data of this paragraph which are world - wide extreme values.

(ii) Horizo ntal windshear is the rate of change of horizontal wind speed with horizontal distance. Encounters with horizontal windshear change the aeroplane apparent head wind in level flight as the aeroplane traverses into regions of changing wind speed. The horizon tal windshear region is assumed to have no significant vertical gradient of wind speed.

(iii) Vertical windshear is the rate of change of horizontal wind speed with altitude. Encounters with windshear change the aeroplane apparent head wind as the aeroplan e climbs or descends into regions of changing wind Powered by EASA eRules Page 215 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS speed. The vertical windshear region changes slowly so that temporal or spatial changes in the vertical windshear gradient are assumed to have no significant affect on an aeroplane in level flight.

(iv) Wi th the aeroplane at V /M within normal rates of climb and descent, the C C most extreme condition of windshear that it might encounter, according to available meteorological data, can be expressed as follows: (A) Horizontal Windshear . The jet stream is assumed to consist of a linear shear of 3.6 KTAS/NM over a distance of 25 NM or of 2.52 KTAS/NM over a distance of 50 NM or of 1.8 KTAS/NM over a distance of 100 NM, whichever is most severe.

(B) Vertical Windshear . The windshear region is assumed to have the most severe of the followin g characteristics and design values for windshear intensity and height band. As shown in Figure 1, the total vertical thickness of the windshear region is twice the height band so that the windshear intensity specified in Table 1 applies to a vertical dist ance equal to the height band above and below the reference altitude. The variation of horizontal wind speed with altitude in the windshear region is linear through the height band from zero at the edge of the region to a strength at the reference altitude determined by the windshear intensity multiplied by the height band. Windshear intensity varies linearly between the reference altitudes in Table 1.

Figure 1 - Windshear Region Note: The analysis should be conducted by separatel y descending from point “ A” and climbing from point “B” into initially increasing headwind.

Powered by EASA eRules Page 216 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS Table 1 - Vertical Windshear Intensity Characteristics Height Band - Ft.

1000 3000 5000 7000 Reference Vertical Windshear Altitude - Ft. Units: ft./sec. per foot of height (KTAS per 1000 feet of height) 0 0.095 (56.3) 0.05 (29.6) 0.035 (20.7) 0.03 (17.8) 40,000 0.145 (85.9) 0.075 (44.4) 0.055 (32.6) 0.04 (23.7) 45,000 0.265 (157.0) 0.135 (80.0) 0.10 (59.2) 0.075 (44.4) Above 45,000 0.265 (157.0) 0.135 (80.0) 0.10 (59.2) 0.075 (44.4) Windshear intensity varies linearly between specified altitudes.

(v) The entry of the aeroplane into horizontal and vertical windshear should be treated as separate cases. Because the penetration of these large scale phenomena is fairly slow, recovery action by the pilot is usually possible. In the case of manual flight (i.e., when flight is being controlled by inputs made by the pilot), the aeroplane is assumed to maintain constant att itude until at least 3 seconds after the operation of the overspeed warning device, at which time recovery action may be started by using the primary aerodynamic controls and thrust at a normal acceleration of 1.5g, or the maximum available, whichever is l ower.

b. At altitudes where speed is limited by Mach number, a speed margin of .07 Mach between M and M is considered sufficient without further investigation.

C D [Amdt 25/2]

CS 25.337 Limit manoeuvring load factors

ED Decision 2003/ 2/RM (See AMC 25.337 ) (a) Except where limited by maximum (static) lift coefficients, the aeroplane is assumed to be subjected to symmetrical manoeuvres resulting in the limit manoeuvring load factors prescribed in this paragr aph. Pitching velocities appropriate to the corresponding pull - up and steady turn manoeuvres must be taken into account.

(b) The positive limit manoeuvring load factor ‘n’ for any speed up to V may not be less than D 24 000 2 · 1 + ( ) except that ‘n’ may not be less than 2·5 and need not be greater than 3·8 – 𝑊 + 10 000 where ‘W’ is the design maximum take - off weight (lb).

(c) The negative limit manoeuvring load factor – (1) May not be less than – 1·0 at speeds up to V ; and C (2) Must vary linearly with speed from the value at V to zero at V .

C D (d) Manoeuvring load factors lower than those specified in this paragraph may be used if the aeroplane has design features that make it impossible to exceed these values in flight.

Powered by EASA eRules Page 217 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS

AMC 25.337 Limit manoeuvring load f actors

ED Decision 2003/ 2/RM The load factor boundary of the manoeuvring envelope is defined by CS 25.337(b) and (c) . It is recognised that constraints which may limit the aircraft’s ability to attain the manoeuvring envelo pe load factor boundary may be taken into account in the calculation of manoeuvring loads for each unique mass and flight condition, provided that those constraints are adequately substantiated. This substantiation should take account of critical combinati ons of vertical, rolling and yawing manoeuvres that may be invoked either statically or dynamically within the manoeuvring envelope.

Examples of the aforementioned constraints include aircraft C , mechanical and/or aerodynamic N - max limitations of the pitch control, and limitations defined within any flight contr ol software.]

CS 25.341 Gust and turbulence loads

ED Decision 2012 / 008 /R (See AMC 25.341 ) (a) Discrete Gust Design Criteria. The aeroplane is assumed to be s ubjected to symmetrical vertical and lateral gusts in level flight. Limit gust loads must be determined in accordance with the following provisions: (1) Loads on each part of the structure must be determined by dynamic analysis. The analysis must take int o account unsteady aerodynamic characteristics and all significant structural degrees of freedom including rigid body motions.

(2) The shape of the gust must be taken as follows: 𝑈 𝜋 𝑠 𝑑𝑠 𝑈 = [ 1 − cos ( ) ] for 0 ≤ s ≤ 2H 2 𝐻 𝑈 = 0 for s > 2H where – s = distance penetrated into the gust (metre ); U = the design gust velocity in equivalent airspeed specified in sub - paragraph (a) (4) of ds this paragraph; H = the gust gradient which is the distance (metre) parallel to the aeroplane’s flight path fo r the gust to reach its peak velocity.

(3) A sufficient number of gust gradient distances in the range 9 m (30 feet) to 107 m (350 feet) must be investigated to find the critical response for each load quantity.

(4) The design gust velocity must be: ⁄ 𝐻 𝑈 = 𝑈 𝐹 ( ) 𝑑𝑠 𝑟𝑒𝑓 𝑔 where – U = the reference gust velocity in equivalent airspeed defined in sub - paragraph (a)(5) ref of this paragraph; F = the flight profile alleviation factor defined in sub - paragraph (a)(6) of this g paragraph.

Powered by EASA eRules Page 218 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS (5) The follo wing reference gust velocities apply: (i) At aeroplane speeds between V and V : Positive and negative gusts with reference B C gust velocities of 17.07 m/s (56.0 ft/s) EAS must be considered at sea level. The reference gust velocity may be reduced linearly fr om 17.07 m/s (56.0 ft/s) EAS at sea level to 13.41 m/s (44.0 ft/s) EAS at 4572 m (15 000 ft). The reference gust velocity may be further reduced linearly from 13 .41 m/s (44.0 ft/s) EAS at 4572 m (15 000 ft) to 6.36 m/s (20.86 ft/sec) EAS at 18288 m (60 000 ft).

(ii) At the aeroplane design speed V : The reference gust velocity must be 0·5 times D the value obtained under CS 25.341(a)(5)(i) .

(6) The flight profile alleviation factor, F , must be increased linearly from the sea level value g to a value of 1.0 at the maximum operating altitude defined in CS 25.1527 . At sea level, the flight profile alleviation factor is determined by the following eq uation.

𝐹 = 0 ∙ 5 ( 𝐹 + 𝐹 ) 𝑔 𝑔𝑧 𝑔𝑚 where – 𝑍 𝑍 𝑚𝑜 𝑚𝑜 𝐹 = 1 − ; ( 𝐹 = 1 − ) ; 𝑔𝑧 𝑔𝑧 76200 250 000 𝐹 = √ 𝑅 𝑇𝑎𝑛 ( 𝜋𝑅 ) ; 𝑔𝑚 2 ⁄ 𝑀𝑎𝑥𝑖𝑚𝑢𝑚 𝐿𝑎𝑛𝑑𝑖𝑛𝑔 𝑊𝑒𝑖𝑔 ℎ 𝑡 𝑅 = ; 𝑀𝑎𝑥𝑖𝑚𝑢𝑚 𝑇𝑎𝑘𝑒 − 𝑜𝑓𝑓 𝑊𝑒𝑖𝑔 ℎ 𝑡 𝑀𝑎𝑥𝑖𝑚𝑢𝑚 𝑍𝑒𝑟𝑜 𝐹𝑢𝑒𝑙 𝑊𝑒𝑖𝑔 ℎ 𝑡 𝑅 = ; 𝑀𝑎 𝑥𝑖𝑚𝑢𝑚 𝑇𝑎𝑘𝑒 − 𝑜𝑓𝑓 𝑊𝑒𝑖𝑔 ℎ 𝑡 Z maximum operating altitude (metres (feet)) defined in CS 25.1527 .

mo (7) When a stability augmentation system is included in the analysis, the effect of any significant sys tem non - linearities should be accounted for when deriving limit loads from limit gust conditions.

(b) Continuous Turbulence Design Criteria . The dynamic response of the aeroplane to vertical and lateral continuous turbulence must be taken into account. The dynamic analysis must take into account unsteady aerodynamic characteristics and all significant structural degrees of freedom including rigid body motions. The limit loads must be determined for all critical altitudes, weights, and weight distributions a s specified in CS 25.321(b) , and all critical speeds within the ranges indicated in subparagraph (b)(3).

(1) Except as provided in subparagraphs (b)(4) and (b)(5) of this paragraph, the following equation must be u sed: ̅ 𝑃 = 𝑃 ± 𝑈 𝐴 𝐿 𝐿 − 1 𝑔 𝜎 Where: P = limit load; L P = steady 1 - g load for the condition; L - 1g A = ratio of root - mean - square incremental load for the condition to root - mean - square turbulence velocity; and Powered by EASA eRules Page 219 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS U = limit turbulence intensity in true airspeed, specified in subparagraph (b)(3) of this σ paragraph.

(2) Values of Ā must be determined according to the following formula: ∞ | ( ) | ( ) 𝐴 = √ ∫ 𝐻 𝛺 𝛷 𝛺 𝑑𝛺 𝐼 Where: H(Ω) = the frequency response function, determined by dynamic analysis, that relates the loads in the aircraft structure to the atmospheric turbulence; and Φ (Ω) = normalised power spectral density of atmospheric turbulence given by: I ( ) 1 + 1 . 339 𝛺𝐿 𝐿 𝛷 ( 𝛺 ) = 𝐼 ⁄ 𝜋 2 [ 1 + ( 1 . 339 𝛺𝐿 ) ] Where: Ω = reduced frequency, rad/ft; and L = scale of turbulence = 2,5 00 ft.

(3) The limit turbulence intensities, U , in m/s (ft/s) true airspeed required for compliance σ with this paragraph are: (i) At aeroplane speeds between V and V : B C 𝑈 = 𝑈 F 𝜎 𝜎𝑟𝑒𝑓 𝑔 Where: U is the reference turbulence intensity that varies linearly with altitude from σref 27.43 m/s (90 ft/s) (TAS) at sea level to 24.08 m/s ( 79 ft/s) (TAS) at 7315 m (24000 ft) and is then constant at 24.08 m/s (79 ft/s) (TAS) up to the altitude of 18288 m (60000 f t); and F is the flight profile alleviation factor defined in subparagraph (a)(6) of this g paragraph; (ii) At speed V : U is equal to 1/2 the values obtained under subparagraph (3)(i) of D σ this paragraph.

(iii) At speeds between V and V : Uσ is equal to a value obtained by linear C D interpolation.

(iv) At all speeds both positive and negative incremental loads due to continuous turbulence must be considered.

(4) When an automatic system affecting the dynamic response of the aeroplane is included in the analysi s, the effects of system non - linearities on loads at the limit load level must be taken into account in a realistic or conservative manner.

Powered by EASA eRules Page 220 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS (5) If necessary for the assessment of loads on aeroplanes with significant non - linearities, it must be assumed that the turbulence field has a root - mean - square velocity equal to 40 percent of the U values specified in subparagraph (3). The value of limit load is that load σ with the same probability of exceedance in the turbulence field as Ā Uσ of the same lo ad quantity in a linear approximated model.

(c) Supplementary gust conditions for wing mounted engines. For aeroplanes equipped with wing mounted engines, the engine mounts, pylons, and wing supporting structure must be designed for the maximum response at the nacelle centre of gravity derived from the following dynamic gust conditions applied to the aeroplane: (1) A discrete gust determined in accordance with CS 25.341(a) at each angle normal to the flight path, and separately, (2) A pair of discrete gusts , one vertical and one lateral. The length of each of these gusts must be independently tuned to the maximum response in accordance with CS 25.341(a) .

The penetration of the aeroplane in the combined gust field and the phasing of the vertical and lateral c omponent gusts must be established to develop the maximum response to the gust pair. In the absence of a more rational analysis, the following formula must be used for each of the maximum engine loads in all six degrees of freedom: 2 2 √ 𝑃 = 𝑃 ± 0 . 85 ( 𝐿 + 𝐿 ) 𝐿 𝐿 − 1 𝑔 𝑉 𝑖 𝐿𝑖 Where: P = limit load; L P = steady 1 - g load for the condition; L - 1g L = peak incremental response load due to a vertical gust according to CS 25.341(a) ; V and L = peak incremental response load due to a lateral gust according to CS 25.341(a) .

L [Amdt 25/1] [Amdt 25/12]

AMC 25.341 Gust and Continuous Turbulence Design Criteria

(Acceptable Means of Compliance)

ED Decision 2019/013/R 1. PURPOSE . This AMC sets forth an acceptable means of compliance with the provisions of CS - 25 dealing with discrete gust and continu ous turbulence dynamic loads.

2. RELATED CERTIFICATION SPECIFICATIONS . The contents of this AMC are considered by the Agency in determining compliance with the discrete gust and continuous turbulence criteria defined in CS 25.341 . Related paragraphs are: CS 25.343 Design fuel and oil loads CS 25.345 High lift devices CS 25.349 Rolling conditions CS 25.371 Gyroscopic loads CS 25.373 Speed control devices Powered by EASA eRules Page 221 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIO NS CS 25.391 Control surface loads CS 25.427 Unsymmetrical loads CS 25 445 Auxiliary aerodynamic surfaces CS 25.571 Damage - tolerance and fatigue evaluation of structure Reference should also be made to the following CS paragraphs: CS 25.301 , CS 25.302 , CS 25.303 , CS 25.305 , CS 25.32 1 , CS 25.335 , CS 25.1517 .

3. OVERVIEW . This AMC addresses both discrete gust and continuous turbulence (or continuous gust) requirements of CS - 25. It provides some of the a cceptable methods of modelling aeroplanes, aeroplane components, and configurations, and the validation of those modelling methods for the purpose of determining the response of the aeropl ane to encounters with gusts.

How the various aeroplane modelling parameters are treated in the dynamic analysis can have a large in fluence on design load levels. The basic elements to be modelled in the analysis are the elastic, inertial, aerodynamic and control system characteristics of the complete, coupled aeroplane (Figure 1). The degree of sophistication and detail required in the modelling depends on the complexity of the aeroplane and its systems.

Figure 1 Basic Elements of the Gust Response Analysis Design loads for encounters with gusts are a combin ation of the steady level 1 - g flight loads, and the gust incremental loads including the dynamic response of the aeroplane. The steady 1 - g flight loads can be realistically defined by the basic external parameters such as speed, altitude, weight and fuel l oad. They can be determined us ing static aeroelastic methods.

Powered by EASA eRules Page 222 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS The gust incremental loads result from the interaction of atmospheric turbulence and aeroplane rigid body and elastic motions. They may be calculated using linear analysis methods when the aerop lane and its flight control systems are reasonably or conservatively approximated by linear analysis models.

Non - linear solution methods are necessary for aeroplane and flight control systems that are not reasonably or conservatively represented by linear analysis models. Non - linear features generally raise the level of complexity, particularly for the continuous turbulence analysis, because they often require that the solutions be ca rried out in the time domain.

The modelling parameters discussed in the following paragraphs include: — Design conditions and associated steady, level 1 - g flight conditions.

— The discrete and continuous gust models of atmospheric turbulence.

— Detailed representation of the aeroplane system including structural dynamics, aerodynami cs, and control system modelling.

— Solution of the equations of motion and the extraction of response loads.

— Considerations for non - linear aeroplane systems.

— Analytical model validation techniques.

4. DESIGN CONDITIONS .

a. General. Analyses should be condu cted to determine gust response loads for the aeroplane throughout its design envelope, where the design envelope is taken to include, for example, all appropriate combinations of aeroplane configuration, weight, centre of gravity, payload, fuel load, thru st, speed, and altitude.

b. Steady Level 1 - g Flight Loads. The total design load is made up of stati c and dynamic load components. In calculating the static component, the aeroplane is assumed to be in trimmed steady level flight, either as the initial c ondition for the discrete gust evaluation or as the mean flight condition for the continuous turbulence evaluation. Static aeroelastic effects should be taken into account if significant.

To ensure that the maximum total load on each part of the aeroplane is obtained, the associated steady - state conditions should be chosen in such a way as to reasonably envelope the range of possible steady - state conditions that could be achieved in that flight condition. Typically, this would include consideratio n of effects such as speed brakes, power settings between zero thrust and the maximum for the flight condition, etc.

c. Dynamic Response Loads. The incremental loads from the dynamic gust solution are superimposed on the associated steady level flight 1 - g loads. Load responses in both positive and negative senses should be assumed in calculating total gust response loads.

Generally the effects of speed brakes, flaps, or other drag or high lift devices, while they should be included in the steady - state con dition, may be neglected in the calculation of incremental loads.

d. Damage Tolerance Conditions. Limit gust loads, treated as ultimate, need to be developed for the structural failure conditions considered under C S 25.571(b) . Generally, for redundant structures, significant changes in stiffness or geometry do not occur for the types of damage under consideration. As a result, the limit gust load values obtained for the undamaged aircraft may be used and applied to the failed structure. However, when structural failures of the types considered under CS 25.571(b) cause significant changes Powered by EASA eRules Page 223 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS in stiffness or geometry, or both, these changes should be taken into account when calculating limit gust lo ads for the damaged str ucture.

5. GUST MODEL CONSIDERATIONS.

a. General. The gust criteria presented in CS 25.341 consist of two models of atmospheric turbulence, a discrete model and a continuous turbulence model. It is beyond the scope of this AMC to review the historical development of these models and their associated parameters. This AMC focuses on the applicati on of those gust criteria to establish design limit loads. The discrete gust model is used to represent single discrete extreme turbulence events. The continuous turbulence model represents longer duration turbulence encounters which excite lightly damped modes. Dynamic loads for both atmospheric models must be considered in the struc tural design of the aeroplane.

b. Discrete Gust Model (1) Atmosphere. The atmosphere is assumed to be one dimensional with the gust velocity acting normal (either vertically or laterally) to the direction of aeroplane travel. The one - dimensional assumption constrains the instantaneous vertical or lateral gust velocities to be the same at all points in planes normal to the direction of aeroplane travel. Design level discrete gust s are assumed to have 1 - cosine velocity profiles. The maximum velocity for a discrete gust is calculated using a reference gust velocity, U , a flight profile alleviation factor, Fg, and an expression ref which modifies the maximum velocity as a function of the gust gradient distance, H. These paramete rs are discussed further below.

(A) Reference Gust Velocity, U - Derived effective gust velocities representing ref gusts occurring once in 70,000 flight hours are the basis for design gust velocities. These ref erence velocities are specified as a function of altitude in CS 25.341 (a)(5 ) and are given in terms of feet per second equivalent airspeed for a gust gradient d istance, H, of 107 m (350 ft).

(B) Flight Profile Alle viation Factor, F - The reference gust velocity, Uref , is a g measure of turbulence intensity as a function of altitude. In defining the value of Uref at each altitude, it is assumed that the aircraft is flown 100% of the time at that altitude. T he factor F is then applied to account for the g expected service experience in terms of the probability of the aeroplane flying at any given altitude within its certification altitude range. Fg is a minimum value at sea level, linearly increasing to 1.0 at the certi fied maximum altitude. The expression for Fg is given in CS 25.341 (a)(6) .

(C) Gust Gradient Distance, H - The gust gradient distance is that distance over which the gust velocity increases to a maximum value. Its value is specified as ranging fr om 9.1 to 1 07 m (30 to 350 ft). (It should be noted that if 12.5 times the mean geometric chord of the aeroplane’s wing exceeds 350 ft, consideration should be given to covering increased maximum gust gradient distances.)

Powered by EASA eRules Page 224 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS (D) Design Gust Velocity, U - Maximum vel ocities for design gusts are ds proportional to the sixth root of the gust gradient distance, H. The maximum gust velocity for a given gust is then defined as: ( ) 1 / 6 ( ) 𝑈 = 𝑈 𝐹 𝐻 / 350 𝑑𝑠 𝑟𝑒𝑓 𝑔 The maximum design gust velocity envelope, Uds, and example design gust velocity profiles are illustrated in Figure 2.

Figure - 2 Typical (1 - cosine) Design Gust Velocity Profiles (2) Discrete Gust Response. The solution for discrete gust response time histories can be achieved by a number of techniques. These inc lude the explicit integration of the aeroplane equations of motion in the time domain, and frequency domain solutions utilising Fourier transform techniques. These are discussed further in Paragraph 7.0 of this AMC.

Maximum incremental loads, P , are iden tified by the peak values selected from Ii time histories arising from a series of separate, 1 - cosine shaped gusts having gradient distances ranging from 9.1 to 107 m (30 to 350 ft). Input gust profiles should cover this gradient distance range in sufficientl y small increments to determine peak loads and responses. Historically 10 to 20 gradient distances have been found to be acceptable. Both positive and negative gust velocities should be assumed in calculating total gust response loads. It should be noted t hat in some cases, the peak incremental loads can occur well after the prescribed gust velocity has returned to zero. In such cases, the gust response calculation should be run for sufficient additional time to ensure that the critical i ncremental loads a re achieved.

Powered by EASA eRules Page 225 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS The design limit load, P , corresponding to the maximum incremental load, P for Li Ii a given load quantity is then defined as: 𝑃 = 𝑃 ± 𝑃 𝐿𝑖 ( 1 − 𝑔 ) 𝑖 𝑙𝑖 Where P is the 1 - g steady load for the load quantity under consideration. The (1 - g)i set of tim e correlated design loads, P , corresponding to the peak value of the load Lj quantity, P , are calculated for the same instant in time using the expression: Li 𝑃 = 𝑃 ± 𝑃 𝐿𝑗 ( 1 − 𝑔 ) 𝑗 𝑙𝑗 Note that in the case of a non - linear aircraft, maximum positive incremental loads may differ from maxim um negative incremental loads.

When calculating stresses which depend on a combination of external loads it may be necessary to consider time correlated load sets at time instants other than those which result in pea ks for indivi dual external load quantities.

(3) Round - The - Clock Gust. When the effect of combined vertical and lateral gusts on aeroplane components is significant, then round - the - clock analysis should be conducted on these components and supporting struct ures. The vertical and lateral components of the gust are assumed to have the same gust gradient distance, H and to start at the same time. Components that should be considered include horizontal tail surfaces having apprecia ble dihedral or anhedral (i.e., greater than 10º), or components supported by other lifting surfaces, for example T - tails, outboard fins and winglets. Whilst the round - the - clock load assessment may be limited to just the components under consideration, the loads themselves should be cal culated from a whole aeroplane dynamic analysis.

The round - the - clock gust model assumes that discrete gusts may act at any angle normal to the flight path of the aeroplane. Lateral and vertical gust components are correlated since the round - the - clock gust is a single discrete event. For a linear aeroplane system, the loads due to a gust applied from a direction intermediate to the vertical and lateral directions - the round - the - clock gust loads - can be obtained using a linear combination of the load time histories induced from pure vertical and pure lateral gusts. The resultant incremental design value for a particular load of interest is obtained by determining the round - the - clock gust angle and gust length giving the largest (tuned) response value for th at load. The design limit load is then obtain ed using the expression for P given above in paragraph 5(b)(2).

L (4) Supplementary Gust Conditions for Wing Mounted Engines.

(A) Atmosphere - For aircraft equipped with wing mounted engines, CS 25.341 (c) requires that engine mounts, pylons and wing supporting structure be designed to meet a round - the - clock discrete gust requirement and a multi - axis discrete gust requirement.

The model of the atmosphere and the method for calculating response loads for th e round - the - clock gust requirement is the same as that described in Paragraph 5(b)(3) of this AMC.

For the multi - axis gust requirement, the model of the atmosphere consists of two independent discrete gust components, one vertical and one lateral, having amplitudes such that the overall probability of the combined gust pair is the same as that of a single discrete gust as defined by CS 25.341 (a) as described in Paragraph 5(b)(1) of this AMC. To achieve this equal - p robability Powered by EASA eRules Page 226 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS condition, in addition to the reductions in gust amplitudes that would be applicable if the input were a multi - axis Gaussian process, a further factor of 0.85 is incorporated into the gust amplitudes to account for non - Gaussian properties of sev ere discrete gusts. This factor was derived from severe gust data obtained by a research aircraft specially instrumented to measure vertical and lateral gust components. This information is contained in Stirling Dynamics Laboratories Report No SDL – 571 - TR - 2 dated May 1999.

( B) Multi - Axis Gust Response - For a particular aircraft flight condition, the calculation of a specific response load requires that the amplitudes, and the time phasing, of the two gust components be chosen, subject to the condition on overall probability specified in (A) above, such that the resulting combined load is maximised. For loads calculated using a linear aircraft model, the response load may be based upon the separately tuned vertical and lateral discrete gust responses for th at load, each calculated as described in Paragraph 5(b)(2) of this AMC. In general, the vertical and lateral tuned gust lengths and the times to maximum response (measured from the onset of each gust) will n ot be the same.

Denote the independently tuned ve rtical and lateral incremental responses for a particular aircraft flight co ndition and load quantity i by L and L , Vi Li respectively. The associated multi - axis gust input is obtained by multiplying the amplitudes of the independently - tuned vertical and lat eral discrete gusts, obtained as described in the previous paragraph, by 0.85* L /√ Vi 2 2 2 2 (L +L ) and 0.85*L /√ (L +L ) respectively. The time - phasing of the two Vi Li Li Vi Li scaled gust components is such that their associated peak lo ads occur at the same instant.

The combined incremental response load is given by: 2 2 𝑃 = 0 . 85 √ ( 𝐿 + 𝐿 ) 𝑙𝑖 𝑉𝑖 𝐿𝑖 and the design limit load, P , corresponding to the maximum incremental Li load, P , for the given load quantity is then given by: Ii 𝑃 = 𝑃 ± 𝑃 𝐿𝑖 ( 1 − 𝑔 ) 𝑖 𝑙𝑖 where P is the 1 - g steady load for the load quantity under consideration.

(1 - g)i The incremental, time correlated loads corresponding to the specific flight condition under consideration are obtained from the independently - tuned vertical and lateral gust inputs for load quantity i. The vertical and lateral 2 2 2 2 gust ampli tudes are factored by 0.85*L /√ (L +L ) and 0.85*L /√ (L +L ) Vi Vi Li Li Vi Li respectively. Loads L and L resulting from these reduced vertical and Vj Lj lateral gust inputs, at the time when the amplitude of load qu antity i is at a maximum value, are added to yield the multi - axis incremental time - correlated value P for load quantity j.

Ij The set of time correlated design loads, P , corresponding to the peak value Lj of the load quantity, P , are obtained using the ex pression: Li 𝑃 = 𝑃 ± 𝑃 𝐿𝑗 ( 1 − 𝑔 ) 𝑗 𝑙𝑗 Note that with significant non - linearities, maximum positive incremental loads may differ from maximum negative incremental loads.

Powered by EASA eRules Page 227 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS c. Continuous Turbulence Model.

(1) Atmosphere. The atmosphere for the determination of cont inuous gust responses is assumed to be one dimensional with the gust velocity acting normal (either vertically or laterally) to the direction of aeroplane travel. The one - dimensional assumption constrains the instantaneous vertical or lateral gust velociti es to be the same at all points in planes normal to the direction of aeroplane travel.

The random atmosphere is assumed to have a Gaussian distribution of gust velocity intensities and a Von Kármán power spectral density with a scale of turbulence, L, equ al to 2500 feet. The expression for the Von Kármán spectrum for unit, root - mea n - square (RMS) gust intensity, Φ ( Ω ), is given below. In this expression Ω = ω /V, I where ω is the circular frequency in radians per second, and V is the aeroplane velocity in feet per second true airspeed.

1 + ( 1 . 339 𝛺𝐿 ) 𝐿 𝛷 ( 𝛺 ) = ⁄ π [ ] 1 + ( 1 . 339 𝛺𝐿 ) The Von Kármán power spectrum for unit RMS gust int ensity is illustrated in Figure 3.

Figure - 3 The Von Kármán Power Spectral Density Function, Φ (Ω) I The design gust velocity, U σ , applied in the analysis is given by the product of the reference gust velocity, U σ ref , and the profile alleviation factor, Fg, as follows: 𝑈 = 𝑈 𝐹 𝜎 𝑟𝑒𝑓 𝑔 where values for U σ ref , are specified in CS 25.341 (b)(3) in meters per second (feet per second) true airspeed and Fg is defined in CS 25.341 (a)(6) . The value of Fg is base d on aeroplane design parameters and is a minimum value at sea level, linearly Powered by EASA eRules Page 228 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIG HT MANOEUVRE AND GUST CONDITIONS increasing to 1.0 at the certified maximum design altitude. It is identical to that used in the discrete gust analysis.

As for the discrete gust analysis, the reference continuo us t urbulence gust intensity, U σ ref , defines the design value of the associate d gust field at each altitude. In defining the value of U σ ref at each altitude, it is assumed that the aeroplane is flown 100% of the time at that altitude. The factor Fg is then applied to account for the probability of the aeroplane flying at any given altitude during its service lifetime.

It should be noted that the reference gust velocity is comprised of two components, a root - mean - square (RMS) gust intensity and a peak to RMS ratio.

The separation of these components is not defined and is not required for the linear aeroplane analysis. Guidance is provided in Paragraph 8.d. of this AMC for generating a RMS gust intensity for a non - linear simulation.

(2) Continuous Turbule nce R esponse. For linear aeroplane systems, the solution for the response to continuous turbulence may be performed entirely in the frequency d omain, using the RMS response. is defined in CS 25.341 (b)(2) and is repeated here in modified notation for load quantity i, where: ⁄ ∞ ̅ | ( ) | 𝐴 = [ ∫ ℎ 𝛺 𝛷 ( 𝛺 ) 𝑑𝛺 ] 𝑖 𝑖 𝐼 or ⁄ ∞ ∗ ̅ ( ) ( ) 𝐴 = [ ∫ 𝛷 𝛺 ℎ 𝑖𝛺 ℎ ( 𝑖𝛺 ) 𝑑𝛺 ] 𝑖 𝐼 𝑖 𝑖 I n the above expression Φ (Ω) is the input Von Kármán power spectrum of the I turbulence and is defined in Paragraph 5.c.(1) of this AMC, h (i Ω ) is the transfer i function relatin g the output load quantity, i, to a unit, harmonically oscillating, one - dimensional gust field, and the asteri sk superscript denotes the complex conjugate. When evaluating Ā , the integration should be continued until a i converged value is achieved since, realistically, the integration to infinity may be impractical. The design limit load, P , is then defined as: Li 𝑃 = 𝑃 ± 𝑃 𝐿𝑖 ( 1 − 𝑔 ) 𝑖 𝑙𝑖 = 𝑃 ± 𝑈 𝐴 ( 1 − 𝑔 ) 𝑖 𝜎 𝑖 where U is defined in Paragraph 5.c.(1) of this AMC, and P is the 1 - g steady σ (1 - g)i state v alue for the load quantity, i, under consideration. As indicated by the formula, both positive and negative load response s should be considered when calculating limit loads.

Correlated (or equiprobable) loads can be developed using c ross - correlation coefficients, ρ , computed as follows: ij ∞ ∗ 𝛷 ( 𝛺 ) 𝑟𝑒𝑎𝑙 [ ℎ ( 𝑖𝛺 ) ℎ ( 𝑖𝛺 ) ] 𝑑𝛺 ∫ 𝐼 𝑖 𝑗 𝜌 = 𝑖𝑗 A A 𝑖 𝑗 where, ‘real[...]’ denotes the real part of the complex function contained within the brackets. In this equation, the lowercase subscripts, i and j, denote the Powered by EASA eRules Page 229 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS responses being correlated. A set of design loads, P , correlated to the design limit Lj load P , are then calculated as follows: Li P = 𝑃 ± 𝑈 𝜌 𝐴 𝐿𝑗 ( 1 − 𝑔 ) 𝑗 𝜎 𝑖𝑗 𝑗 The correlated load sets calculated in the foregoing manner provide balanced load distributions corresponding to the maximum value of the response for e ach external load quantity, i, calcu lated.

When calculating stresses, the foregoing load distributions may not yield critical design values because critical stress values may depend on a combination of external loads. In these cases, a more general application of the correlation coefficient method is required. For example, when the value of stress depends on two externally applied loads, such as torsion and shear, the equiprobable relationship between the two parameters forms an ell ipse as illustrated in Figure 4.

Figure - 4 Equal Probabili ty Design Ellipse In this figure, the points of tangency, T, correspond to the expressions for correlated load pairs given by the foregoing expressions. A practical additional set of equiprobable load pairs that should be considered to establish critical d esign stresses are given by the points of tangency to the ellipse by lines AB, CD, EF and GH. These additional load pairs are given by the following express ions (where i = torsion and j = shear): For tangents to lines AB and EF 1 2 ⁄ P = 𝑃 + / − 𝐴 𝑈 [ ( 1 − 𝜌 ) / 2 ] 𝐿𝑖 ( 1 − 𝑔 ) 𝑖 𝑗 𝜎 𝑖𝑗 Powered by EASA eRules Page 230 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDIT IONS and 1 2 ⁄ P = 𝑃 − / + 𝐴 𝑈 [ ( 1 − 𝜌 ) / 2 ] ( ) 𝐿𝑗 1 − 𝑔 𝑗 𝑖 𝜎 𝑖𝑗 For tangents to lines CD and GH 1 2 ⁄ P = 𝑃 ± 𝐴 𝑈 [ ( 1 + 𝜌 ) / 2 ] ( ) 𝐿𝑖 1 − 𝑔 𝑖 𝑗 𝜎 𝑖𝑗 a nd 1 2 ⁄ P = 𝑃 ± 𝐴 𝑈 [ ( 1 + 𝜌 ) / 2 ] ( ) 𝐿𝑗 1 − 𝑔 𝑗 𝑖 𝜎 𝑖𝑗 All correlated or equiprobable loads developed using correlation coefficients will provide balanced load distributions.

A more comprehensive approach for calculating critical design stresses that depend on a combination of external load quantities is to e valuate directly the transfer function for the stress quantity of interest from which can be calculated the gust response function, the value for RMS response, Ā , and the design stress values P(1 - g) ± U Ā .

σ 6. AEROPLANE MODELLING CONSIDERATIONS a. General . The procedures presented in this paragraph generally apply for aeroplanes having aerodynamic and structural properties and flight control systems that may be reasonably or conservatively approximated using linear analysis methods for calculating limit loa d. Additional guidance material is presented in Paragraph 8 of this AMC for aeroplanes having properties and/or systems not reasonably or conservatively approximated by linear analysis methods.

b. Structural Dynamic Model. The model should include both ri gid body and flexible aeroplane degrees of freedom. If a modal approach is used, the structural dynamic model should include a sufficient number of flexible aeroplane modes to ensure both convergence of the modal superposition procedure and that responses from high frequency excitations are properly represented.

Most forms of structural modelling can be classi fied into two main categories: (1) the so - called “stick model” characterised by beams with lumped masses distribute d along their lengths, and (2) finite element models in which all major structural components (frames, ribs, stringers, skins) are represented with mass properties defined at grid points.

Regardless of the approach taken for the structural modelling, a min imum acceptable level of sophistication, consistent with configuration complexity, is necessary to represent satisfactorily the critical modes of deformation of the primary structure and control surfaces. Results from the models should be compared to test data as outlined in Paragraph 9.b. of this AMC in order to validate the accuracy of the model.

c. Structural Damping. Structural dynamic models may include damping properties in addition to representations of mass and stiffness distributions. In the absen ce of better information it will normally be acceptable to assume 0.03 (i.e. 1.5% equivalent critical viscous damping) for all flexible modes. Structural damping may be increased over the 0.03 value to be consistent with the high structural response levels caused by extreme gust intensity, provi ded justification is given.

Powered by EASA eRules Page 231 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS d. Gust and Motion R esponse Aerodynamic Modelling. Aerodynamic forces included in the analysis are produced by both the gust velocity directly, and by the aeroplane response.

Aerodynamic modelling for dynamic gust response analyses requires the use of unsteady two - dimensional or three - dimensional panel theory methods for incompressible or compressible flow. The choice of the appropriate technique depends on the complexity of the aerodynam ic configuration, the dynamic motion of the surfaces under investigation and the flight speed envelope of the aeroplane. Generally, three - dimensional panel methods achieve better modelling of the aerodynamic interference between lifting surfaces. The model should have a sufficient number of aerodynamic degrees of freedom to properly represent the steady and unsteady aerodynamic distributions under consideration.

The build - up of unsteady aerodynamic forces should be represented. In two - dimensional unsteady a nalysis this may be achieved in either the frequency domain or the time domain through the application of oscillatory or indicial lift functions, respectively. Where three - dimensional panel aerodynamic theories are to be applied in the time domain (e.g.

fo r non - linear gust solutions), an approach such as the ‘rational function approximation’ method may be employed to transform frequency domain aero dynamics into the time domain.

Oscillatory lift functions due to gust velocity or aeroplane response depend on the reduced frequency parameter, k. The maximum reduced frequency used in the generation of the unsteady aerodynamics should include the highest frequency of gust excitation and the highest structural frequency under consideration. Time lags representing t he effect of the gradual penetration of the gust field by the aeroplane should also be accounted for in the build - up of lift due to gust velocity.

The aerodynamic modelling should be supported by tests or previous experience as indicated in Paragraph 9.d. of this AMC. Primary lifting and control surface distributed aerodynamic data are commonly adjusted by weighting factors in the dynamic gust response analyses. The weighting factors for steady flow (k = 0) may be obtained by comparing wind tunnel test resu lts with theoretical data. The correction of the aerodynamic forces should also ensure that the rigid body motion of the aeroplane is accurately represented in order to provide satisfactory short period and Dutch roll frequencies and damping ratios. Correc tions to primary surface aerodynamic loading due to control surface deflection should be considered. Special attention should also be given to control surface hinge moments and to fuselage and nacelle aerodynamics because viscous and other effects may req uire more extensive adjustments to the theoretical coefficients. Aerodynamic gust forces should reflect weighting factor adjustments performed on the steady or unsteady motion response aerodynamics.

e. Gyroscopic Loads. As specified in CS 25.371 , the structure supporting the engines and the auxi liary power units should be designed for the gyroscopic loads induced by both discrete gusts and continuous turbulence. The gyroscopic loads for turbopropel lers and turbofans may be calculated as an integral part of the solution process by including the gyroscopic terms in the equations of motion or the gyroscopic loads can be superimposed after the solution of the equations of motion. Propeller and fan gyros copic coupling forces (due to rotational direction) between symmetric and antisymmetric modes need not be taken into account if the coupling forces are shown to be negligible.

The gyroscopic loads used in this analysis should be determined with the engine or auxiliary power units at maximum continuous rpm. The mass polar moment of inertia Powered by EASA eRules Page 232 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS used in calculating gyroscopic inertia terms should include the mass polar moments of inertia of all significant rotating parts taking into account their respective rotati onal gearing ratios and directions of rotation.

f. Control Systems. Gust analyses of the basic configuration should include simulation of any control system for which interaction may exist with the rigid body response, structural dynamic response or extern al loads. If possible, these control systems should be uncoupled such that the systems which affect “symmetric flight” are included in the vertical gust analysis and those which affect “antisymmetric flight” are included in the lateral gust analysis.

The c ontrol systems considered should include all relevant modes of operation. Failure conditions should also be analysed for any control system which influences the design loads in accordance with CS 25.302 and Appendix K .

The control systems included in the gust analysis may be assumed to be linear if the impact of the non - linearity is negligible, or if it can be shown by analysis on a similar aeroplane/control system that a li near control law representation is conservative. If the control system is significantly non - linear, and a conservative linear approximation to the control system cannot be developed, then the effect of the control system on the aeroplane responses should b e evaluated in accordance with Paragraph 8. of this AMC.

g. Stability. Solutions of the equations of motion for either discrete gusts or continuous turbulence require the dynamic model be stable. This applies for all modes, except possibly for very low fr equency modes which do not affect load responses, such as the phugoid mode. (Note that the short period and Dutch roll modes do affect load responses). A stability check should be performed for the dynamic model using conventional stability criteria approp riate for the linear or non - linear system in question, and adjustments should be made to the dynamic model, as required, to achieve appropriate frequency and damping characteristics.

If control system models are to be included in the gust analysis it is a dvisable to check that the following characteristics are acceptable and are representative of the aeroplane: — static margin of the unaugmented aeroplane — dynamic stability of the unaugmented aeroplane — the static aeroelastic effectiveness of all control surfa ces utilised by any feed - back control system — gain and phase margins of any feedback control system coupled with the aeroplane rigid body and flexible modes — the aeroelastic flutter and divergence margins of the unaugmented aeroplane, and also for any feedba ck control system coupled with the aeroplane.

7. DYNAMIC LOADS a. General. This paragraph describes methods for formulating and solving the aeroplane equations of motion and extracting dynamic loads from the aeroplane response. The aeroplane equations of m otion are solved in either physical or modal co - ordinates and include all terms important in the loads calculation including stiffness, damping, mass, and aerodynamic forces due to both aeroplane motions and gust excitation. Generally the aircraft equation s are solved in modal co - ordinates. For the purposes of describing the solution of these equations in the remainder of this AMC, modal co - ordinates will be Powered by EASA eRules Page 233 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS assumed. A sufficient number of modal co - ordinates should be included to ensure that the loads extra cted provide converged values.

b. Soluti on of the Equations of Motion. Solution of the equations of motion can be achieved through a number of techniques. For the continuous turbulence analysis, the equations of motion are generally solved in the frequenc y domain. Transfer functions which relate the output response quantity to an input harmonically oscillating gust field are generated and these transfer functions are used (in Paragraph 5.c. of this AMC) to generate the RMS value of the output response quan tity.

There are two primary approaches used to generate the output time histories for the discrete gust analysis; (1) by explicit integration of the aeroplane equations of motion in the time domain, and (2) by frequency domain solutions which can utilise F ourier transform techniques.

c. Extraction of Loads and Responses. The output quantities that may be extracted from a gust response analysis include displacements, velocities and accelerations at structural locations; load quantities such as shears, bend ing moments and torques on structural components; and stresses and shear flows in structural components. The calculation of the physical responses is given by a modal superposition of the displacements, velocities and accelerations of the rigid and elastic modes of vibration of the aeroplane structure.

The number of modes carried in the summation should be sufficient to ensure converged results.

A variety of methods may be used to obtain physical structural loads from a solution of the modal equations of m otion governing gust response. These include the Mode Displacement method, the Mode Acceleration method, an d the Force Summation method. All three methods are capable of providing a balanced set of aeroplane loads. If an infinite number of modes can be con sidered in the analysis, the three will lead to essentially identical results.

The Mode Displacement method is the simplest. In this method, total dynamic loads are calculated from the structural deformations produced by the gust using modal superposition. Specifically, the contribution of a given mode is equal to the product of the load associated with the normalised deformed shape of that mode and the value of the displacement response given by the associated modal co - ordinate. For converged results, the Mode Displacement method may need a significantly larger number of modal co - ord inates than the other two methods.

In the Mode Acceleration method, the dynamic load response is composed of a static part and a dynamic part. The static part is determined by conventional static analysis (including rigid body “inertia relief”), with the externally applied gust loads treated as static loads. The dynamic part is computed by the superposition of appropriate modal quantities, and is a function of the number of modes carried in the solution. The quantities to be superimposed involve both moti on response forces and acceleration responses (thus giving this method its name). Since the static part is determined completely and independently of the number of normal modes carried, adequate accuracy may be achieved with fewer modes than would be neede d in the Mode Displacement method.

The Force Summation method is the most laborious and the most intuitive. In this method, physical displacements, velocities and accelerations are first computed by superposition of the modal responses. These are then used to determine the physical Powered by EASA eRules Page 234 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS inertia forces and other motion dependent forces. Finally, these forces are added to the externally applied forces to give the total dynamic loads acting on the structure.

If balanced aeroplane load distributions are needed from the discrete gust analysis, they may be determined using time correlated solution results. Similarly, as explained in Paragraph 5.c of this AMC, if balanced aeroplane load distributions are needed from the continuous turbulence analysis, they may be determined from equiprobable solution results obtained using cross - correlation coefficients.

8. NONLINEAR CONSIDERATIONS a. General. Any structural, aerodynamic or automatic control system characteristic which may cause aeroplane response to discrete gusts or continuous turbulence to become non - linear with respect to intensity or shape should be represented realistically or conservativel y in the calculation of loads. While many minor non - linearities are amenable to a conservative linear solution, the effect of major non - linearities cannot usually be quantified without explicit calculation.

The effect of non - linearities should be investigated above limit conditions to assure that the system presents no anomaly compared to behaviour below limit conditions, in accordance with Appendix K, K25.2(b)(2) .

b. Structural and Aerodynamic Non - linearity. A linear elastic structural model, and a linear (unstalled) aerodynamic model are normally recommended as conservative and acce ptable for the unaugmented aeroplane elements of a loads calculation. Aerodynamic models may be refined to take account of minor non - linear variation of aerodynamic distributions, due to local separation etc., through simple linear piecewise solution. Loca l or complete stall of a lifting surface would constitute a major non - linearity and should not be represented without account being taken of the influence of rate of change of incidence, i.e., the so - called ‘dynamic stall’ in which the range of linear incr emental aerodynamics may extend significantly beyo nd the static stall incidence.

c. Automatic Control System Non - linearity. Automatic flight control systems, autopilots, stability control systems and load alleviation systems often constitute the primary so urce of non - linear response. For example, — non - proportional feedback gains — rate and amplitude limiters — changes in the control laws, or control law switching — hysteresis — use of one - sided aerodynamic controls such as spoilers — hinge moment performance and satu ration of aerodynamic control actuators The resulting influences on response will be aeroplane design dependent, and the manner in which they are to be considered will normally have to be assessed for each design.

Minor influences such as occasional clipp ing of response due to rate or amplitude limitations, where it is symmetric about the stabilised 1 - g condition, can often be represented through quasi - linear modelling techniques such as describing functions or use of a linear equivalent gain.

Powered by EASA eRules Page 235 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS Major, and unsymmetrical influences such as application of spoilers for load alleviation, normally require explicit simulation, and therefore adoption of an appropriate solu tion based in the time domain.

The influence of non - linearities on one load quantity often ru ns contrary to the influence on other load quantities. For example, an aileron used for load alleviation may simultaneously relieve wing bending moment whilst increasing wing torsion. Since it may not be possible to represent such features conservatively w ith a single aeroplane model, it may be conservatively acceptable to consider loads computed for two (possibly linear) representations which bound the realistic condition. Another example of this approach would be separate representation of continuous turb ulence response for the two control law states to cover a situation where the aeroplane may occasionally switch from one state to another.

d. Non - linear Solution Methodology. Where explicit simulation of non - linearities is required, the loads response may be calculated through time domain integrati on of the equations of motion.

For the tuned discrete gust conditions of CS 25.341 (a) , limit loads should be identified by peak values in the non - linear time domain simu lation response of the aeroplane model excited by the discrete gust model described in Paragraph 5.b. of this AMC.

For time domain solution of the continuous turbulence conditions of CS 25.341 (b) , a variety of approaches may be taken for the specification of the turbulence input time history and the mechanism for identifying limit loads from the resulting responses.

It will normally be necessary to justify that the selected approach provides an equivalent level of safety as a conventional linear analysis and is appropriate to handle the types of non - linearity on the aircraft. This should include verification that the approach provides adequate st atistical significance in the loads resu lts.

A methodology based upon stochastic simulation has been found to be acceptable for load alleviation and flight control system non - linearities. In this simulation, the input is a long, Gaussian, pseudo - random tu rbulence stream conforming to a Von Kármán spectrum with a root - mean - square (RMS) amplitude of 0.4 times U (defined in P aragraph σ 5.c (1) of this AMC). The value of limit load is that load with the sam e probability of exceedance as Ā U of the same load qu antity in a linear model. This is illustrated σ graphically in Figure 5. When using an analysis of this type, exceedance curves should be constructed using incremental load values up to, or just beyond the limit load value.

Powered by EASA eRules Page 236 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS Figure - 5 Establishing Limit Load for a Non - linear Aeroplane The non - linear simulation may also be performed in the frequency domain if the frequency domain method is shown to produce conservative results. Frequency domain methods include, but are not limited to, M atched Filter Theory and Equivalent Linearisation.

9. ANALYTICAL MODEL VALIDATION a. General. The intent of analytical model validation is to establish that the analytical model is adequate for the prediction of gust response loads. The following paragraph s discuss acceptable but not the only methods of validating the analytical model. In general, it is not intended that specific testing be required to validate the dynamic gust loads model.

b. Struct ural Dynamic Model Validation. The methods and test data used to validate the flutter analysis models presented in AMC 25.629 should also be applied to validate the gust analysis models. These procedures are addressed in AMC 25.629.

c. Damping Model Validation. In the absence of better information it will normal ly be acceptable to assume 0.03 (i.e. 1.5% equivalent critical viscous damping) for all flexible modes. Structural damping may be increased over the 0.03 value to be consistent with the high structural response levels caused by extreme gust intensity, prov ided justification is given.

d. Aerodynamic Model Validation. Aerodynamic modelling parameters fall into two categories: (i) steady or quasi - steady aerodynamics governing static aeroelastic and flight dynamic airload distributions Powered by EASA eRules Page 237 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FL IGHT MANOEUVRE AND GUST CONDITIONS (ii) unsteady aerodynamics which interact with the fle xible modes of the aeroplane.

Flight stability aerodynamic distributions and derivatives may be validated by wind tunnel tests, detailed aerodynamic modelling methods (such as CFD) or flight test data. If detailed an alysis or testing reveals that flight dynamic characteristics of the aeroplane differ significantly from those to which the gust response model have been matched, then the implications on gust loads should be investigated.

The analytical and experimental m ethods presented in AMC 25.629 for flutter analyses provide acceptable means for establishing reliable unsteady aerodynamic characteristics both for motion response and gust excitation aerodynamic force distributions. The aeroelastic implications on aeropl ane flight dynamic stab ility should also be assessed.

e. Control System Validation. If the aeroplane mathematical model used for gust analysis contains a representation of any feedback control system, then this segment of the model should be validated. The level of validation that should be performed depends on the complexity of the system and the particular aeroplane respon se parameter being controlled. Systems which control elastic modes of the aeroplane may require more validation than those which contro l the aeroplane rigid body response. Validation of elements of the control system (sensors, actuators, anti - aliasing filters, control laws, etc.)

which have a minimal effect on the output load and response quantities under consideration can be neglected.

I t will normally be more convenient to substantiate elements of the control system independently, i.e. open loop, before undertaking the validat ion of the closed loop system.

(1) System Ri g or Aeroplane Ground Testing. Response of the system to artificial s timuli can be mea sured to verify the following: — The transfer functions of the sensors and any pre - control system anti - aliasing or other filtering.

— The sampling delays of acquiring data into the control system.

— The behaviour of the control law itself.

— Any c ontrol system output delay and filter transfer function.

— The transfer functions of the actuators, and any features of actuation system performance characteristics that may influence the actuator response to the maximum demands that might arise in turbulenc e; e.g. maximum rate of deployment, actuator hinge moment capability, etc.

If this testing is performed, it is recommended that following any adaptation of the model to reflect this information, the complete feedback path be validated (open loop) against measurements taken from the rig or ground tests.

(2) Flight Testing. The functionality and performance of any feedback control system can also be validated by direct comparison of the analytical model and measurement for input stimuli. If this test ing is performed, input stimuli should be selected such that they exercise the features of the control system and the interaction with the aeroplane that are significant in the use of the mathematical model for gust load analysis. These might include: — Aero plane response to pitching and yawing manoeuvre demands.

Powered by EASA eRules Page 238 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS — Control system and aeroplane response to sudden artificially introduced demands such as pulses and steps.

— Gain and phase margins determined using data acquired within the flutter test program. These gain and phase margins can be generated by passing known signals through the open l oop system during flight test.

[Amdt No: 25/1] [Amdt No: 25/23]

CS 25.343 Design fuel and oil loads

ED Decision 2005 / 006/R (a) The disposable load combinations must include each fuel and oil load in the range from zero fuel and oil to the selected maximum fuel and oil load. A structural reserve fuel condition, not exceeding 45 minutes of fuel under operating conditions in CS 25.1001(f ) , may be selected.

(b) If a structural reserve fuel condition is selected, it must be used as the minimum fuel weight condition for showing compliance with the flight load requirements as prescribed in this Subpart. In addition – (1) The structure must be designed for a condition of zero fuel and oil in the wing at limit loads corresponding to – (i) A manoeuvring load factor of +2·25; and (ii) The gust and turbulence conditions of CS 25.341 , but assuming 85% of the gust velocities prescribed in C S 25.341(a)(4) and 85% of the turbulence intensities prescribed in CS 25.341(b)(3) .

(2) Fatigue evaluation of the structure must account for any increase in operating stresses resulting from the design condition of sub - paragraph (b) (1) of this paragraph; and (3) The flutter, deformation, and vibration requirements must a lso be met with zero fuel.

[Amdt 25/1]

CS 25.345 High lift devices

ED Decision 2016 / 010 /R (See AMC 25.345) (a) If wing - flaps are to be used during take - off, approach, or landing, at the design flap speeds established for these stages of flight under CS 25.335(e) and with the wing - flaps in the corresponding positions, the aeroplane is assumed to be subjected to symmetrical manoeuvres and gusts. The resulting limit loads must correspond to the conditions determined as follows: (1) Manoeuvring to a positive limit load factor of 2·0; and (2) Positive and negative gusts of 7.62 m/sec (25 ft/sec) EAS acting normal to the flight path in level flight. Gust loads resulting on each part of the structure must be determined by r ational analysis. The analysis must take into account the unsteady aerodynamic characteristics and rigid body motions of the aircraft. (See AMC 25.345(a) .) The shape of the gust must be as described in CS 25.341(a)(2) except that – Powered by EASA eRules Page 239 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST COND ITIONS U = 7.62 m/sec (25 ft/sec) EAS; ds H = 12.5 c; and c = mean geometric chord of the wing (metres (feet)).

(b) The aeroplane must be designed for the conditions prescribed in sub - paragraph (a) of this paragraph except that the aeroplane load factor need not exceed 1·0, taking into account, as separate conditions, the effects of – (1) Propeller slipstream corresponding to maximum continuous power at the design flap speeds V and with take - off power at not less than 1·4 times the stalling speed for the F, particular flap position and associated maximum weight; and (2) A head - on gust of 7.62m/sec (25 fps) velocity (EAS).

(c) If flaps or other high lift devices are to be used in en - route conditions, and with flaps in the appropriate position at speeds up to the flap design speed chosen for these conditions, the aeroplane is assumed to be subjected to symmetrical manoeuvres and gusts within the range determined by – (1) Ma noeuvring to a positive limit load factor as prescribed in CS 25.337(b) ; and (2) The vertical gust and turbulence conditions prescribed in CS 25.341 . (See AMC 25.345(c) .)

(d) The aeroplane must be designed for a manoeuvring load factor of 1.5 g at the maximum take - off weight with the wing - flaps and similar high lift devices in the landing configurations.

[Amdt 25/1] [Amdt 25/18]

AMC 25.345(a) High lift devices (Gust conditions)

ED Decision 2003/ 2/RM Compliance with CS 25.345(a) may be demonstrated by an analysis in which the solution of the vertical response equations is made by assuming the aircraft to be rigid. If desired, the analysis may take account of the effects of structural flexibility on a quasi - flexible basis (i.e. us ing aerodynamic derivatives and load distributions corresponding to the distorted structure under maximum gust load).

AMC 25.345(c) High lift devices (Procedure flight c ondition)

ED Decision 2003/ 2/RM 1 En - route conditions are flight segments other than t ake - off, approach and landing. As applied to the use of high lift devices the following flight phases are to be included in en - route conditions: — holding in designated areas outside the terminal area of the airport, and — flight with flap s extended from top of descent.

The following flight phases are not to be i ncluded in en - route conditions: — portion of the flight corresponding to standard arrival routes preceding the interception of the final approach path, and — holding at relatively low altitude close to the airport.

Powered by EASA eRules Page 240 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS 2 To apply CS 25.341(a) gust con ditions to CS 25.345(c) , the speeds V and V should be FC FD determined for the flap positions selected in en - route conditions.

These procedures should ensure proper speed margins for flap retraction in the case of s evere turbulence when the aeroplane is in a low speed en - route holding configuration.

3 The manoeuvre of CS 25.345(c)(1) is to be considered as a balanced condition. (See CS 25.331(b) for definition.)

CS 25.349 Rolling conditions

ED Decision 2016 / 010/R (See AMC 25.349) The aeroplane must be designed for loads resulting from the rolling conditions specified in sub - paragraphs (a) and (b) of this paragraph. Unbalanced aerodynamic moments about the centre of gravity must be reacted in a rational or conservative manner, considering the principal masses furnishing the reacting inertia forces.

(a) Manoeuvring. The follo wing conditions, speeds, aileron deflections and cockpit roll control motions (except as the deflections and the motions may be limited by pilot effort) must be considered in combination with an aeroplane load factor of zero and of two - thirds of the positi ve manoeuvring factor used in design. For aeroplanes equipped with electronic flight controls, where the motion of the control surfaces does not bear a direct relationship to the motion of the cockpit control devices, these conditions must be considered in combination with an aeroplane load factor ranging from zero to two thirds of the positive manoeuvring factor used in design. In determining the required or resulting aileron deflections, the torsional flexibility of the wing must be considered in accordan ce with CS 25.301(b) : (1) Conditions corresponding to steady rolling velocities must be investigated. In addition, conditions corresponding to maximum angular acceleration must be investigated for aeroplanes with engines or other weight concentrations outboard of the fuselage, and for aeroplanes equipped with electronic flight controls, where the motion of the control surfaces does not bear a direct relationship to the motion of the cockpit control devices.

For the angular acceleration conditions, zero rolling velocity may be assumed in the absence of a rational time history investigation of the manoeuvre.

(2) At V , a sudden deflection of the aileron to the stop is assumed.

A (3) At V C , the aileron deflection must be that required to produce a rate of roll not less than tha t obtained in sub - paragraph (a) (2) of this paragraph.

(4) At V , the aileron deflection must be that required to produce a rate of roll not less than D one - thi rd of that in sub - paragraph (a) (2) of thi s paragraph.

(5) For aeroplanes equipped with electronic flight controls, where the motion of the control surfaces does not bear a direct relationship to the motion of the cockpit control devices, in lieu of subparagraphs (a)(2), (a)(3), and (a)(4), the fo llowing apply: (i) At V , movement of the cockpit roll control up to the limit is assumed. The position A of the cockpit roll control must be maintained until a steady roll rate is achieved and then it must be returned suddenly to the neutral position.

(ii) At V , the cockpit roll control must be moved suddenly and maintained so as to C achieve a roll rate not less than that obtained in subparagraph (a)(5)(i) of this Powered by EASA eRules Page 241 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS paragraph. The return of cockpit control to neutral is initiated suddenly when steady roll rate is reached.

(iii) At V , the cockpit roll control must be moved suddenly and maintained so as to D achieve a roll rate not less than one third of that obtained in subparagraph (a)(5)(i) of this paragraph.

The conditions specified in this subparagraph must be investigated without any corrective yaw control action (pilot or system induced) to maximise sideslip, and, as a separate condition, with corrective yaw control action (pilot or system induced) to reduce sideslip as far as possible. The first condition (without any corrective yaw control action) may be considered as a failure condition under CS 25.302.

(See AMC 25.349(a) ) (b) Unsymmetrical gusts. The aeroplane is assumed to be subjected to unsymmetrical vertica l gusts in level flight. The resulting limit loads must be determined from either the wing maximum airload derived directly from CS 25.341(a) , or the wing maximum airload derived indirectly from the vertical load factor calculated from CS 25.341(a) . It must be assumed that 100 percent of the wing airload acts on one side of the aeroplane and 80 percent of the wing airload acts on the other side.

[Amdt 25/13] [Amdt 25/18]

AMC 25.349(a) Rolling conditions

ED Decision 2013/010/R The physical limitations of the aircraft from the cockpit roll control device to the control surface deflection, such as control stops position, maximum power and displacement rate of the servo controls, and control law limiters, may be taken into account.

[Amdt 25/13]

CS 25.351 Yaw manoeuvre conditions

ED Decision 2013 / 010/R (see AM C 25.351 ) The aeroplane must be designed for loads resulting from the yaw manoeuvre conditions specified in subparagraphs (a) through (d) of this paragraph at speeds from V to V . Unbalanced aerodynamic MC D moments about the centre of gravity must be reacted in a rational or conservative manner considering the aeroplane inertia forces. In computing the tail loads the yawing velocity may be assumed to be zero.

(a) With the aeroplane in unaccelerated flight at zero yaw, it is assumed that the cockpit rudder co ntrol is suddenly displaced to achieve the resulting rudder deflection, as limited by: (1) the control system or control surface stops; or (2) a limit pilot force of 1335 N (300 lbf) from V to V and 890 N (200 lbf) from V /M to MC A C C V /M , with a linear var iation between V and V /M .

D D A C C (b) With the cockpit rudder control deflected so as always to maintain the maximum rudder deflection available within the limitations specified in subparagraph (a) of this paragraph, it is assumed that the aeroplane yaws to the overswing sideslip angle.

Powered by EASA eRules Page 242 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS (c) With the aeroplane yawed to the static equilibrium sideslip angle, it is assumed that the cockpit rudder control is held so as to achieve the maximum rudder deflection available within the limitations specified in sub - paragra ph (a) of this paragraph.

(d) With the aeroplane yawed to the static equilibrium sideslip angle of sub - paragraph (c) of this paragraph, it is assumed that the cockpit rudder control is suddenly returned to neutral.

[Amdt 25/13]

AMC 25.351 Yaw manoeuvre conditions

ED Decision 2013/010/R The physical limitations of the aircraft from the cockpit yaw control device to the control surface deflection, such as control stops position, maximum power and displacement rate of the servo controls, and contr ol law limiters, may be taken into account.

[Amdt 25/13]

CS 25.353 Rudder control reversal conditions

ED Decision 2018/010/R /R (See AMC 25.353 ) The aeroplane must be designed for loads, considered to be ultimate, resulting from the yaw manoeuvre conditions specified in sub - paragraphs (a) through (e) at speed from V to V /M . Any MC C C permanent deformation resulting from these ultimate load conditions must not prevent continued safe flight and landing. These conditions are to be considered with the landing gear retracted and speed brakes (or spoilers when used as speed brakes) retracted. Flaps (or flaperons or any other aerodynamic devices when used as flaps) and slats - extended configurations are also to be co nsidered if they are used in en - route conditions. Unbalanced aerodynamic moments about the centre of gravity must be reacted in a rational or conservative manner considering the aeroplane inertia forces. In computing the loads on the aeroplane, the yawing velocity may be assumed to be zero. The applicant must assume a pilot force of 890 N (200 lbf) when evaluating each of the following conditions: (a) With the aeroplane in un - accelerated flight at zero yaw, it is assumed that the cockpit rudder control is s uddenly and fully displaced to achieve the resulting rudder deflection, as limited by the control system or the control surface stops.

(b) With the aeroplane yawed to the overswing sideslip angle, it is assumed that the cockpit rudder control is suddenly a nd fully displaced in the opposite direction to achieve the resulting rudder deflection, as limited by the control system or the control surface stops.

(c) With the aeroplane yawed to the opposite overswing sideslip angle, it is assumed that the cockpit ru dder control is suddenly and fully displaced in the opposite direction to achieve the resulting rudder deflection, as limited by the control system or the control surface stops.

(d) With the aeroplane yawed to the subsequent overswing sideslip angle, it is assumed that the cockpit rudder control is suddenly and fully displaced in the opposite direction to achieve the resulting rudder deflection, as limited by the control system or the control surface stops.

(e) With the aeroplane yawed to the opposite overswing sideslip angle, it is assumed that the cockpit rudder control is suddenly returned to neutral.

[Amdt No: 25/22] Powered by EASA eRules Page 243 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS

AMC 25.353 Rudder control reversal conditions

ED Decision 2018/010/R 10 /R 1. Purpose.

This AMC describes acceptable means o f compliance with the specifications of CS 25.353 . These specifications provide structural design load conditions that apply to the airframe, and that occur as a result of multiple cockpit rudder control (e. g. peda l) inputs.

2 . Related CS - 25 specifications.

a. CS 25.351 , Yaw manoeuvre conditions.

b. CS 25.353 , Rudd er control reversal conditions.

3. Background.

a. Specifications . CS 25.351 and CS 25.353 specify structural design load conditions that occur as a result of cockpit rudder control inputs. These conditions are intended to encompass all of the rudder manoeuvre load s expected to occur in service.

b. Yaw manoeuvre conditions . The design load conditions specified in CS 25.351 are considered to be limit load conditions, and a safety fact or of 1.5 is applie d to obtain the ultimate loads.

c. Rudder control reversal load conditions . The design load conditions specified in this CS 25.353 are more severe than those in CS 25.351 , and include cockpit rudder control reversals. These conditions are anticipated to occur very rarely, and therefore these are considered to be ultimate load conditions, and no addit ional safety factor is applied.

d. Overswing sideslip ang le definition : the maximum (peak) sideslip angle reached by the aeroplane with the cockpit rudder control displaced as sp ecified in paragraph 4.b below.

4. App lication of the specifications.

a. General (1) The aeroplane must be designed for the cockpit rudder control reversal load conditions specified in CS 25.353 . These are considered to be ultimate load conditions and, therefore, no additional safety factor is appl ied. However, any resulting permanent deformation must not prevent con tinued safe flight and landing.

(2) Design loads must be determined as specified in CS 25.321 . The load conditions are considered from V MC to V C /M C . A pilot force of 890 N (200 lbf) is assumed to be applied for all conditions. These conditions are to be considered with the landing gear retracted and speed brakes (or spoilers when used as speed brakes) retracted.

Flaps (or flaperons or any other aerodynamic devices when used as flaps) and slats - extended configurations are also to be considered if they a re used in en - route conditions.

(3) System effects. System effects should be taken into account in the evaluation of this manoeuvre. For exam ple, fly - by - wire aeroplanes should be analysed assuming that the aeroplane is in the normal control law mode. Any system function used to demonstrate compliance with these requirements should me et the following criteria: Powered by EASA eRules Page 244 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS (i) The system is normally operativ e during flight in accordance with the aeroplane flight manual procedures, although limited dispatch with the system inoperative could be allowed under applicable master minimum equipment list (MMEL) provisions, provided that the MMEL requirements are stil l complied with, taking into account the rudder reversal pedal inputs as the next critical event un der dispatch configuration; and (ii) Appropriate crew procedures should be provided in the event of a loss of function. If a loss of system function would no t be detected by the flight crew, the probability of a loss of function (i.e. the failure rate multiplied by the maximum exposure peri od) should be less than 1/1000.

(4) Failure conditions. Assuming that the systems which are used to demonstrate compliance with CS 25.353 meet the criteria in 4.a(3)(i) and (ii) above, considering the very low probability of a full rudder control (e.g. pedal) doublet event, failure scenarios do not need to be addressed in combination with the rudder control reversal load con ditions specified in CS 25.353 .

b. Yaw manoeuvre conditions Conditions (a) through (e) of CS 25.353 are intended to be a full displacement cockpit rudder control input followed by three cockpit rudder control rev ersals and a return to neutral.

The aeroplane airspeed should be kept reasonably constant throughout the manoeuvre using pitch control.

These c onditions should be investigated assuming rational or conservative roll control input (pilot or system induced).

Refer to the illustration in Figure 1 below.

(1) Rudder control input . In the context of CS 25.353 , ‘suddenly’ means as fast as possible within human and system limitations. In the absence of a rational analysis, the initial rudder control displacement is achieved in no more than 0.2 seconds, and full cockpit rudder control reversal displacement is achie ved in 0.4 seconds.

Alternatively, the applicant may assume that the rudder control is displaced instantaneously. The resulting rudder displacement should take into account any additional displacement caused by sideslip build - up, and the effects of flexibi lity shou ld be considered when relevant.

(2) Rudder control reversals . As soon as the maximum overswing yaw angle is achieved, full opposite rudder control input is applied. The achieved rudder deflection may be limited by control laws, system architectur e, or air loads, and may not be of the same magnitude as the initial rudder deflection prior to the rudder control reversal. For a critically damped aeroplane response, the maximum overswing yaw angle may be assumed to occur when the sideslip angle is subs tantially stabilised.

Two additional rudder control reversals are performed as defined in paragraph 4.b(1) above. After the second reversal, as soon as the aeroplane yaws to the opposite overswing yaw angle, the rudder control is suddenly returned to neutr al.

Powered by EASA eRules Page 245 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FLIGHT MANOEUVRE AND GUST CONDITIONS Figure 1: Illustration of the cockpit rudder control inputs [Amdt No: 25/22] Powered by EASA eRules Page 246 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) SUPPLEMENTAR Y CONDITIONS

SUPPLEMENTARY CONDITIONS

CS 25.361 Engine and auxiliary power unit torque

ED Decision 200 9 / 017 / R (See AMC 25.361 ) (a) For engine installations: (1) Each engine mount , pylon and adjacent supporting airframe structures must be designed for the effects of – (i ) A limit engine torque corresponding to take - off power /thrust and , if applicable, corresponding propeller speed , acting simultaneously with 75% of the limit loads from flight condition A of CS 25.333(b) ; ( ii ) A limit engine torque corresponding to the maximum continuo us power/thrust and, if applicable, corresponding propeller speed acting simultaneously with the limit loads from flight condition A of CS 25.333(b) ; and (iii ) For turbo - propeller installations only , in addition to the conditions specified in subparagraphs (a) (1) (i) and ( ii ), a limit engine torque corresponding to take - off power and propeller speed, multiplied by a factor accounting for propeller control system malfunction, including quick feathering, acting simultaneously with 1 g level flight loads. In th e absence of a rational analysis, a factor of 1·6 must be used.

(2) The limit engine torque to be con sidered under sub - paragraph ( 1 ) must be obtained by: (i) for turbo - propeller installations, multiplying mean engine torque for the specified power/thrust and speed by a factor of 1·25.

(ii) for other turbine engines, the limit engine torque must be equal to the maximum accelerating torque for the case considered.

(3) The engine mounts, pylons, and adjacent supporting airframe structure must be designed to withstand 1g level flight loads acting simultaneously with the limit engine torque loads imposed by each of the following conditions to be considered separately: (i) sudden maximum engine deceleration due to a malfunction or abnormal conditio n; and (ii) the maximum acceleration of the engine.

(b) For auxiliary power unit installations: The power unit mounts and adjacent supporting airframe structure must be designed to withstand 1g level flight loads acting simultaneously with the limit t orque loads imposed by the following conditions to be considered separately: (1) sudden maximum auxiliary power unit deceleration due to malfunction or abnormal condition or structural failure; and (2) the maximum acceleration of the auxiliary power un it.

[Amdt 25/8] Powered by EASA eRules Page 247 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) SUPPLEMENTARY CONDITIONS

AMC 25.361 Engine and auxiliary power unit torque

ED Decision 2009/017/R CS 25.361(a)(1) is applicable to all engine installations, including turbo - fans, turbo - jets and turbo - propellers, except CS 25.361(a)(1)(iii) which applies only to turbo - propeller installations.

CS 25.361(a)(2)(i) - “Mean engine torque” refers to the value of the torque, for the specified condit ion, with any dynamic oscillations removed.

CS 25.361(a)(3)(i) - Examples are; high power compressor surges, blade tip rub during manoeuvres, small and medium bird encounters, or combinations of these events.

CS 25.361(a)(3)(ii) and (b)(2) - As an example, the term “maximum acceleration” is taken to be that torque seen by the engine mounts under a runaway of the fuel metering unit up to its maximum flow stop.

[Amdt 25/8]

CS 25.362 Engine failure loads

ED Decision 2009/017/R (See AMC 25.362 .)

(a) For engine mounts, pylons and adjacent supporting airframe structure, an ultimate loading condition must be considered that combines 1g flight loads with the most critical transient dynamic loads and vibrations, as determined by dynamic analysis, resulting from failure of a blade, shaft, bearing or bearing support, or bird strike event. Any permanent deformation from these ultimate load conditions should not prevent continued safe flight and landing.

(b) The ultimate loads developed from the conditions specified in paragraph (a) are to be: (1) multiplied by a factor of 1.0 when applied to engine mounts and py lons; and (2) multiplied by a factor of 1.25 when applied to adjacent supporting airframe structure.

[Amdt 25/8]

AMC 25.362 Engine Failure Loads

ED Decision 2009/017/R 1. PURPOSE. This AMC describes an acceptable means for showing compliance with the requirements of CS 25.362 “Engine failure loads”. These means are intended to provide guidance to supplement the engineering and operational judgement that must form the basis of any compliance findings relative to the design of engine mounts, pylons and adjacent supporting airframe structure, for loads developed from the engine failure conditions described in CS 25.362 .

2. RELATED CS PARAGRAPHS.

a. CS - 25: CS 25.361 “Engine and auxiliary power unit torque” CS 25.901 “Powerplant installation” Powered by EASA eRules Page 248 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) SUPPLEMENTARY CONDITIONS b. CS - E: CS - E 520 “Strength” CS - E 800 “Bird strike and ingestion” CS - E 810 “Compressor and turbine blade failure” CS - E 850 “Compressor, Fan and Turbine Shafts” 3. DEFINITIONS. Some new terms have been defined for t he transient engine failure conditions in order to present criteria in a precise and consistent manner in the following pages. In addition, some terms are employed from other fields and may not necessarily be in general use. For the purposes of this AMC, t he following definitions should be used.

a. Adjacent supporting airframe structure: Those parts of the primary airframe that are directly affected by loads arising within the engine.

b. Ground Vibration Test: Ground resonance tests of the aeroplane normal ly conducted for compliance with CS 25.629 , “Aeroelastic stability requirements.” c. Transient failure loads: Those loads occurring from the time of the engine structural failure, up to the time at which the engine stops rotating or achieves a steady windmilling rotational speed.

d. Windmilling engine rotational speed: The speed at which the rotating shaft systems of an unpowered engine will rotate due to the flow of air into the engine as a result of the forward motion of the aeroplane.

4. BACKGROUND.

a. Requirements. CS 25.362 (“Engine failure loads”) requires that the engine mounts, pylons, and adjacent supporting airframe structure be designed to withstand 1g flight loads combined with the transient dynamic loads resulting from each engine structural failure condition. The aim being to ensure that the aeroplane is capable of continued safe flight and landing after sudden engine stoppage or engine structural failure, including ensuing damage to other parts of the engine.

b. Engine failure loads. Turbine engines have experienced failure conditio ns that have resulted in sudden engine deceleration and, in some cases, seizures. These failure conditions are usually caused by internal structural failures or ingestion of foreign objects, such as birds or ice. Whatever the source, these conditions may p roduce significant structural loads on the engine, engine mounts, pylon, and adjacent supporting airframe structure. With the development of larger high - bypass ratio turbine engines, it became apparent that engine seizure torque loads alone did not adequat ely define the full loading imposed on the engine mounts, pylons, and adjacent supporting airframe structure. The progression to high - bypass ratio turbine engines of larger diameter and fewer blades with larger chords has increased the magnitude of the tra nsient loads that can be produced during and following engine failures. Consequently, it is considered necessary that the applicant performs a dynamic analysis to ensure that representative loads are determined during and immediately following an engine fa ilure event.

A dynamic model of the aircraft and engine configuration should be sufficiently detailed to characterise the transient loads for the engine mounts, pylons, and adjacent supporting airframe structure during the failure event and subsequent run down.

Powered by EASA eRules Page 249 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTU RE (CS - 25) SUPPLEMENTARY CONDITIONS c. Engine structural failure conditions. Of all the applicable engine structural failure conditions, design and test experience have shown that the loss of a fan blade is likely to produce the most severe loads on the engine and airframe. Therefo re, CS 25.362 requires that the transient dynamic loads from these blade failure conditions be considered when evaluating structural integrity of the engine mounts, pylons and adjacent supporting airframe structure . However, service history shows examples of other severe engine structural failures where the engine thrust - producing capability was lost, and the engine experienced extensive internal damage. For each specific engine design, the applicant should consider whether these types of failures are applicable, and if they present a more critical load condition than blade loss. In accordance with CS - E 520(c)(2), other structural failure conditions that should be considered in this respect are: — failure of a shaft, o r — failure or loss of any bearing/bearing support, or — a bird ingestion.

5. EVALUATION OF TRANSIENT FAILURE CONDITIONS a. Evaluation. The applicant’s evaluation should show that, from the moment of engine structural failure and during spool - down to the tim e of windmilling engine rotational speed, the engine - induced loads and vibrations will not cause failure of the engine mounts, pylon, and adjacent supporting airframe structure. (Note: The effects of continued rotation (windmilling) are described in AMC 25 - 24 ).

Major engine structural failure events are considered as ultimate load conditions, since they occur at a sufficiently infrequent rate. For design of the engine mounts and pylon, the ultimate loads may be take n without any additional multiplying factors. At the same time, protection of the basic airframe is assured by using a multiplying factor of 1.25 on those ultimate loads for the design of the adjacent supporting airframe structure.

b. Blade loss condition . The loads on the engine mounts, pylon, and adjacent supporting airframe structure should be determined by dynamic analysis. The analysis should take into account all significant structural degrees of freedom. The transient engine loads should be determin ed for the blade failure condition and rotor speed approved per CS - E, and over the full range of blade release angles to allow determination of the critical loads for all affected components.

The loads to be applied to the pylon and airframe are normally determined by the applicant based on the integrated model, which includes the validated engine model supplied by the engine manufacturer.

The calculation of transient dynamic loads should consider: — the effects of the engine mounting station on the aeroplane (i.e., right side, left side, inboard position, etc.); and — the most critical aeroplane mass distribution (i.e., fuel loading for wing - mounted engines and payload distribution for fuselage - mounted engines).

For calculation of the combined ultimat e airframe loads, the 1g component should be associated with typical flight conditions.

Powered by EASA eRules Page 250 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) SUPPLEMENTARY CONDITIONS c. Other failure conditions. As identified in paragraph 4(c) above, if any other engine structural failure conditions, applicable to the specific engine design, could result in higher loads being developed than the blade loss condition, they should be evaluated by dynamic analysis to a similar standard and using similar considerations to those described in paragraph 5.b., above.

6. ANALYSIS METHODOLOGY.

a. Objective of the methodology. The objective of the analysis methodology is to develop acceptable analytical tools for conducting investigations of dynamic engine structural failure events. The goal of the analysis is to produce loads and accelerations suitable for evaluations of structural integrity. However, where required for compliance with CS 25.901 (“Powerplant installation”), loads and accelerations may also need to be produced for evaluating the continued function of aircraft systems, including those related to the engine installation that are essential for immediate flight safety (for example, fire bottles and fuel shut off valves).

b. Scope of the analysis. The analysis of the aircraft and engine configuration shoul d be sufficiently detailed to determine the transient and steady - state loads for the engine mounts, pylon, and adjacent supporting airframe structure during the engine failure event and subsequent run - down.

7. MATHEMATICAL MODELLING AND VALIDATION a. Components of the integrated dynamics model. The applicant should calculate airframe dynamic responses with an integrated model of the engine, engine mounts, pylon, and adjacent supporting airframe structure. The model should provide representative connect ions at the engine - to - pylon interfaces, as well as all interfaces between components (e.g., inlet - to - engine and engine - to - thrust reverser). The integrated dynamic model used for engine structural failure analyses should be representative of the aeroplane t o the highest frequency needed to accurately represent the transient response. The integrated dynamic model consists of the following components that must be validated: — Airframe structural model.

— Propulsion structural model (including the engine model rep resenting the engine type - design).

b. Airframe Structural Model and Validation (1) An analytical model of the airframe is necessary in order to calculate the airframe responses due to the transient forces produced by the engine failure event. The airframe manufacturers currently use reduced lumped mass finite element analytical models of the airframe for certification of aeroelastic stability (flutter) and dynamic loads. A typical model consists of relatively few lumped masses connected by weightless beams. A full aeroplane model is not usually necessary for the engine failure analysis, and it is normally not necessary to consider the whole aircraft response, the effects of automatic flight control systems, or unsteady aerodynamics.

(2) A lumped mass beam m odel of the airframe, similar to that normally used for flutter analysis, is acceptable for frequency response analyses due to engine structural failure conditions. However, additional detail may be needed to ensure adequate fidelity for the engine structu ral failure frequency range. In particular, the engine structural failure analysis requires calculating the response of the Powered by EASA eRules Page 251 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) SUPPLEMENTARY CONDITIONS airframe at higher frequencies than are usually needed to obtain accurate results for the other loads analyses, such as dynamic gust and landing impact. The applicant should use finite element models as necessary. As far as possible, the ground vibration tests normally conducted for compliance with CS 25.629 (“Aeroelastic stability requirement s”) should be used to validate the analytical model.

(3) Structural dynamic models include damping properties, as well as representations of mass and stiffness distributions. In the absence of better information, it will normally be acceptable to assume a value of 0.03 (i.e., 1.5% equivalent critical viscous damping) for all flexible modes. Structural damping may be increased over the 0.03 value to be consistent with the high structural response levels caused by extreme failure loads, provided it is justif ied.

c. Propulsion Structural Model and Validation For propulsion structural model and validation, see AMC 25 - 24 .

[Amdt 25/8]

CS 25.363 Side load on engine and auxiliary power unit mounts

ED Decision 2003/ 2/RM (a) Each engine and auxiliary power unit mount and its supporting structure must be designed for a limit load factor in a lateral direction, for the side load on the engine and auxiliary power unit mount, at least equal to the maximum load factor obtained in t he yawing conditions but not less than – (1) 1·33; or (2) One - third of the limit load factor for flight condition A as prescribed in CS 25.333(b) .

(b) The side load prescribed in sub - paragraph (a) of this paragraph may be assumed to be independent of other flight conditions.

CS 25.365 Pressurised compartment loads

ED Decision 2016 / 0 10/R (See AMC 25.365) For aeroplanes with one or more pressurised compartments the following apply: (a) The aeroplane structur e must be strong enough to withstand the flight loads combined with pressure differential loads from zero up to the maximum relief valve setting.

(b) The external pressure distribution in flight, and stress concentrations and fatigue effects must be accoun ted for.

(c) If landings may be made with the compartment pressurised, landing loads must be combined with pressure differential loads from zero up to the maximum allowed during landing.

(d) The aeroplane structure must be strong enough to withstand the pr essure differential loads corresponding to the maximum relief valve setting multiplied by a factor of 1·33, omitting other loads.

(e) Any structure, component or part, inside or outside a pressurised compartment, the failure of which could interfere with continued safe flight and landing, must be designed to withstand the Powered by EASA eRules Page 252 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPA RT C – STRUCTURE (CS - 25) SUPPLEMENTARY CONDITIONS effects of a sudden release of pressure through an opening in any compartment at any operating altitude resulting from each of the following conditions: (1) The penetration of the compartment by a portion of an engine following an engine disintegration.

(2) Any opening in any pressurised compartment up to the size Ho in square feet; however, small compartments may be combined with an adjacent pressurised compartment and both considered as a single compartment for openings that cannot reasonably be expected to be confined to the small compartment. The size Ho must be compu ted by the following formula: 𝐻 = 𝑃𝐴 0 𝑠 where, H = maximum opening in square feet, need not exceed 20 square feet.

o 𝐴 𝑠 P = + . 024 As = maximum cross sectional area of the pressurised shell normal to the longitudinal axis, in square feet; and (3) The maximum opening caused by aeroplane or equipment failures not shown to be extremely improbable. (See AMC 25.365(e) .)

(f) In complying with sub - paragraph (e) of this paragraph, the fail - safe features of the design may be considered in determining the probability of failure or penetration and probable size of openings, provided that possible improper operation of closure devices and inadvertent door openings are also considered. Furthermore, th e resulting differential pressure loads must be combined in a rational and conservative manner with 1 g level flight loads and any loads arising from emergency depressurisation conditions. These loads may be considered as ultimate conditions; however, any deformation associated with these conditions must not interfere with continued safe flight and landing. The pressure relief provided by the intercompartment venting may also be considered.

(g) Bulkheads, floors, and partitions in pressurised compartments f or occupants must be designed to withstand conditions specified in sub - paragraph (e) of this paragraph. In addition, reasonable design precautions must be taken to minimise the probability of parts becoming detached and injuring occupants while in their se ats.

[Amdt 25/18]

AMC 25.365(e) Pressurised compartment l oads

ED Decision 2003/2/RM The computed opening size from 25.365(e)(2) should be considered only as a mathematical means of developing ultimate pressure desi gn loads to prevent secondary structural failures. No consideration need be given to the actual shape of the opening, nor to its exact location on the pressure barrier in the compartment. The damage and loss of strength at the opening location should not b e considered.

A hazard assessment should determine which structures should be required to withstand the resulting differential pressure loads. The assessment of the secondary consequences of failures of these structures should address those events that ha ve a reasonable probability of interfering with safe flight and landing, for example failures of structures supporting critical systems. For this assessment the risk of impact on the main structure from non critical structures, such as fairings, detached f rom the aircraft due to decompression need not be considered.

Powered by EASA eRules Page 253 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) SUPPLEMENTARY CONDITIONS

CS 25.367 Unsymmetrical loads due to engine failure

ED Decision 2003/ 2/RM (a) The aeroplane must be designed for the unsymmetrical loads resulting from the failure of the critical engine. Turbo - propeller aeroplanes must be designed for the following conditions in combination with a single malfunction of the propeller drag limiting system, considering the probable pilot corrective action on the flight controls: (1) At speeds between V and V , t he loads resulting from power failure because of fuel MC D flow interruption are considered to be limit loads.

(2) At speeds between V and V , the loads resulting from the disconnection of the engine MC C compressor from the turbine or from loss of the turbine bla des are considered to be ultimate loads.

(3) The time history of the thrust decay and drag build - up occurring as a result of the prescribed engine failures must be substantiated by test or other data applicable to the particular engine - propeller combinatio n.

(4) The timing and magnitude of the probable pilot corrective action must be conservatively estimated, considering the characteristics of the particular engine - propeller - aeroplane combination.

(b) Pilot corrective action may be assumed to be initiated a t the time maximum yawing velocity is reached, but not earlier than two seconds after the engine failure. The magnitude of the corrective action may be based on the control forces specified in CS 25.397(b) except t hat lower forces may be assumed where it is shown by analysis or test that these forces can control the yaw and roll resulting from the prescribed engine failure conditions.

CS 25.371 Gyroscopic loads

ED Decision 2005 / 006/R The structure supporting any engine or auxiliary power unit must be designed for the loads, including gyroscopic loads, arising from the conditions specified in CS 25.331 , CS 25.341 , CS 25.349 , CS 25.351 , CS 25.473 , CS 2 5.479 , and CS 25.481 , with the engine or auxiliary power unit at the maximum rpm appropriate to the condition. For the purposes of compliance with this paragraph, the pitch manoeuvre in CS 25.331(c)(1) must be carried out until the positiv e limit manoeuvring load factor (point A in CS 25.333(b) ) is reached.

[Amdt 25/1]

CS 25.373 Speed control devices

ED Decision 2005/006/R If speed control devices (such as spoilers and drag flaps) are installed f or use in en - route conditions: (a) The aer oplane must be designed for the symmetrical manoe uvres and gusts prescribed in CS 25.333 , CS 25.337 , the yawing manoeuvres in CS 25.351 , and the vertical and lateral gust and turbulence conditions prescribed in CS 25.341(a ) and (b) at each setting and the maximum speed associated with that setting; and (b) If the device has automatic operating or load limiting features, the aeroplane must be designed for the manoeuvre and gust conditions prescribed in sub - paragraph (a) of t his paragraph, at the speeds and corresponding device positions that the mechanism allows.

[ Amdt 25/1] Powered by EASA eRules Page 254 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) CONTROL SURFACE AND SYSTEM LOADS

CONTROL SURFACE AND SYSTEM LOADS

CS 25.391 Control surface loads: general

ED Decision 2005 / 006/R The control su rfaces must be designed for the limit loads resulting from the flight conditions in CS 25.331 , CS 25.341(a) and (b) , CS 25.349 and CS 25.351 , co nsidering the requirements for: (a) Loads parallel to hinge line, in CS 25.393 ; (b) Pilot effort effects, in CS 25.397 ; (c) Trim tab effects, in CS 25.407 ; (d) Unsymmetrical loads, in CS 25.427 ; and (e) Auxil iary aerodynamic surfaces, in CS 25.445 .

[Amdt 25/1]

CS 25.393 Loads parallel to hinge line

ED Decision 2016 / 010/R (See AMC 25.393) (a) Control surfaces and supporting hinge brackets must be designed for inertia loads acting parallel to the hinge line. (See AM C 25.393(a) .)

(b) In the absence of more rational data, the inertia loads may be assumed to be equal to KW, where – (1) K = 24 for vertical surfaces; (2) K = 12 for horizontal surfaces; and (3) W = weight of the movable surfaces.

[Amdt 25/18]

AMC 25.393(a) Loads parallel to hinge l ine

ED Decision 2003/2/RM The loads parallel to the hinge line on primary control surfaces and other movable surfaces, such as tabs, spoilers, speedbrakes, flaps, slats and all - moving tailplanes, should take account of a xial play between the surface and its supporting structure in complying with CS 25.393(a) . For the rational analysis, the critical airframe acceleration time history in the direction of the hinge line from all flight and ground design conditions (except the emergency landing conditions of CS 25.561 ) sh ould be considered. The play assumed in the control surface supporting structure, should include the maximum tolerable nominal play and the effects of wear.

Powered by EASA eRules Page 255 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) CONTROL SURFACE AND SYSTEM LOADS

CS 25.395 Control system

ED Decision 2003/2/RM (a) Longitudinal, lateral, directional and drag co ntrol systems and their supporting structures must be designed for loads corresponding to 125% of the computed hinge moments of the movable control surface in the conditions prescribed in CS 25.391 .

(b) The system limit loads of paragraph (a) need not exceed the loads that can be produced by the pilot (or pilots) and by automatic or power devices operating the controls.

(c) The loads must not be less than those resulting from application of the minimum forces presc ribed in CS 25.397(c) .

CS 25.397 Control system loads

ED Decision 2016 / 010/R (a) General. The maximum and minimum pilot forces, specified in sub - paragraph (c) of this paragraph, are assumed to act at the appropri ate control grips or pads (in a manner simulating flight conditions) and to be reacted at the attachment of the control system to the control surface horn.

(b) Pilot effort effects. In the control surface flight loading condition, the air loads on movabl e surfaces and the corresponding deflections need not exceed those that would result in flight from the application of any pilot force within the ranges specified in sub - paragraph (c) of this paragraph. Two - thirds of the maximum values specified for the ai leron and elevator may be used if control surface hinge moments are based on reliable data. In applying this criterion, the effects of servo mechanisms, tabs, and automatic pil ot systems, must be considered.

(c) Limit pilot forces and torques. The limit pi lot forces and torques are as follows: Control Maximum forces or torques Minimum forces or torques Aileron: Stick 445 N (100 lbf) 178 N (40 lbf) Wheel* 356 DNm (80 D in.lb)** 178 DNm (40 D in.lbf) Elevator: Stick 1112 N (250 lbf) 445 N (100 lbf) Wheel (symmetrical) 1335N(300 lbf) 445 N(100 lbf) Wheel (unsymmetrical)† 445 N (100 lbf) Rudder 1335 N (300 lbf) 578 N 130 lbf *The critical parts of the aileron control system must be designed for a single tangential force with a limit value equal to 1·25 times the couple force determined from these criteria.

**D = wheel diameter in m (inches) †The unsymmetrical forces must be applied at one of the normal handgrip points on the periphery of the control wheel.

(d) For aeroplanes equipped with side stick controls, designed for forces to be applied by one wrist and not by the arms, the limit pilot forces are as follows: (1) For all components between and including the handle and its control stops: PITCH ROLL Nose U p 890 N (200 lbf) Roll L eft 445 N (100lbf) Nose D own 890 N (200 lbf) Roll R ight 445 N (100 lbf) Powered by EASA eRules Page 256 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) CONTROL SURFACE AND SYSTEM LOADS (2) For all other components of the side stick control assembly, but excluding the internal components of the electrical sensor assemblies, to avoid damage as a result of an in - flight jam: PITCH ROLL Nose U p 556 N (125 lbf) Roll L eft 222 N (50 lbf) Nose D own 556 N (125 lbf) Roll R ight 222 N (50 lbf) [Amdt 25/13] [Amdt 25/18]

CS 25.399 Dual control system

ED Decision 2006 / 005/R (a) Each dual control system must be designed for the pilots operating in opposition, using individual pilot forces not less than – (1) 0·7 5 times those obtained under CS 25.395 ; or (2) The minimum forces specified in CS 25.397(c) .

(b) The control system must be designed for pilot forces applied in the same direction, using individual pilot forces not less than 0·75 times those obtained under CS 25.395 .

[Amdt 25/2]

CS 25.405 Secondary control sys tem

ED Decision 200 7 / 010 /R Secondary controls, such as wheel brake, spoiler, and tab controls, must be designed for the maximum forces that a pilot is likely to apply to those controls. The following values may be used: PILOT CONTROL FOR CE LIMITS (SECONDA RY CONTROLS).

Control Limit pilot forces 25 . 4 + 𝑅 Miscellaneous: ( ) ( ) 𝑥 222 𝑁 50 𝑙𝑏𝑓 , *Crank, wheel, or lever.

76 . 2 but not less than 222 N (50 lbf) nor more than 667 N (150 lbf) (R = radius in mm ).

o (Ap plicable to any angle within 20 of plane of contro l).

Twist 15 Nm (133 in.lbf) Push - pull To be chosen by applicant.

*Limited to flap, tab, stabiliser, spoiler, and landing gear operation controls.

[Amdt. 25/3]

CS 25.407 Trim tab effects

ED Decision 2003/2/RM The effects of trim tabs on the control surface design conditions must be accounted for only where the surface loads are limited by maximum pilot effort. In these cases, the tabs are considered to be deflected in the direction that would assist the pilot, and the deflections are – (a) For elevator trim tabs, those required to trim the aeroplane at any point within the positive portion of the pertinent flight envelope in CS 25.333(b) , except as limited by the stops; and Powered by EASA eRules Page 257 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) CONTROL SURFACE AND SYSTEM LOADS (b) For aileron and rudder trim tabs, those required to trim the aeroplane in the critical unsymmetrical power and loading conditions, with appropriate allowance for rigging tolerances.

CS 25.409 Tabs

ED Decision 2003/2/RM (a) Trim tabs. Trim tabs m ust be designed to withstand loads arising from all likely combinations of tab setting, primary control position, and aeroplane speed (obtainable without exceeding the flight load conditions prescribed for the aeroplane as a whole), when the effect of the tab is opposed by pilot effort forces up to those specified in CS 25.397(b) .

(b) Balancing tabs. Balancing tabs must be designed for deflections consistent with the primary control surface loading conditions.

(c) Servo tabs. Servo tabs must be designed for deflections consistent with the primary control surface loading conditions obtainable within the pilot manoeuvring effort, considering possible opposition from the trim tabs.

CS 25.415 Ground gust conditions

ED Decision 2016 / 010/R (See AMC 25.415) (a) The flight control systems and surfaces must be designed for the limit loads generated when the aircraft is subjected to a horizontal 33.44 m/sec (65 knots) ground gust from any direction, while taxying with the c ontrols locked and unlocked and while parked with the controls locked.

(b) The control system and surface loads due to ground gust may be assumed to be static loads and the hinge moments H, in Newton metres (foot pounds), must be computed from the formula: 𝐻 = 𝐾 1 / 2 𝜌 𝑉 𝑐𝑆 𝑜 where: K = hinge moment factor for ground gusts derived in subparagraph (c) of this paragraph 3 3 2 4 ρ = density of air at sea level = 1.225 (kg/m ) (0.0023769 (slugs/ft ) = 0.0023769 (lb - sec / ft )) o V = 33.44 m/sec (65 knots = 109.71 fps) relative to the aircraft 2 2 S = area of the control surface aft of the hinge line (m ) (ft ) c = mean aerodynamic chord of the control surface aft of the hinge line (m) (ft) (c) The hinge moment factor K for ground gu sts must be taken from the following table: Surface K Position of controls (a) Aileron 0.75 Control column lo cked or lashed in mid - position.

(b) Aileron *±0.50 Ailerons at full throw.

(c) Elevator *±0.75 Elevator full down.

(d) Elevator *±0.75 Elevator full up.

(e) Rudder 0.75 Rudder in neutral.

(f) Rudder 0.75 Rudder at full throw.

* A positive value of K indicates a moment tending to depress the surface, while a negative value of K indicates a momen t tending to raise the surface.

Powered by EASA eRules Page 258 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) CONTROL SURFACE AND SYSTEM LOADS (d) The computed hinge moment of subparagraph (b) must be used to determine the limit loads due to ground gust conditions for the control surface. A 1.25 factor on the computed hinge moments must be used in calculating limit control system loads.

(e) Where control system flexibility is such that the rate of load application in the ground gust conditions might produce transient stresses appreciably higher than those corresponding to static loads, in the absence of a rational analysis an addit ional factor of 1.60 must be applied to the control system loads of subparagraph (d) to obtain limit loads. If a rational analysis is used, the additional factor must not be less than 1.20.

(f) For the condition of the control locks engaged, the control su rfaces, the control system locks and the parts of the control systems (if any) between the surfaces and the locks must be designed to the respective resultant limit loads. Where control locks are not provided then the control surfaces, the control system s tops nearest the surfaces and the parts of the control systems (if any) between the surfaces and the stops must be designed to the resultant limit loads. If the control system design is such as to allow any part of the control system to impact with the sto ps due to flexibility, then the resultant impact loads must be taken into account in deriving the limit loads due to ground gust.

(g) For the condition of taxying with the control locks disengaged, the following apply: (1) The control surfaces, the control system stops nearest the surfaces and the parts of the control systems (if any) between the surfaces and the stops must be designed to the resultant limit loads.

(2) The parts of the control systems between the stops nearest the surfaces and the cockpit c ontrols must be designed to the resultant limit loads, except that the parts of the control system where loads are eventually reacted by the pilot need not exceed: (i) The loads corresponding to the maximum pilot loads in CS 25.397(c) for each pilot alone; or (ii) 0.75 times these maximum loads for each pilot when the pilot forces are applied in the same direction [Amdt 25/18]

AMC 25.415 Ground gust c onditions

ED Decision 2006 / 005/R 1. PURPOSE . This AMC sets forth a cceptable methods of compliance with the provisions of CS - 25 dealing with the certification requirements for ground gust conditions. Guidance information is provided for showing compliance with CS 25.415 , relating to structural design of the control surfaces and systems while taxying with control locks engaged and disengaged and when parked with control locks engaged. Other methods of compliance with the requirements may be acceptable.

2. RELATED C ERTIFICATION SPECIFICATIONS .

CS 25.415 “Ground Gust Conditions”.

CS 25.519 “Jacking and Tie - down Provisions” 3. BACKGROUND .

a. The requirement to consider the effects of ground gusts has been applied to large/transport aeroplanes since 1950. The purpose of the requirement was to protect the flight control system from excessive peak ground wind loads while the aeroplane is Powered by EASA eRules Page 259 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) CONTROL SURFACE AND SYSTEM LOADS parked or while taxying downwind. For developing t he original regulation, the control surface load distribution was considered to be triangular with the peak at the trailing edge representing reversed flow over the control surface. This assumption, along with assumptions about the wind approach angle and typical control surface geometries were developed into a table of hinge moment factors and set forth in the regulation. These hinge moment factors have been carried forward to the existing table in CS 25.415 . The m aximum design wind speed was originally set at 96 km/h (88 feet per second (52 knots)) under the presumption that higher speeds were predictable storm conditions and the aircraft owner could take additional precautions beyond engaging the standard gust loc ks.

b. The conditions of CS 25.519 require consideration of the aeroplane in a moored or jacked condition in wind speeds up to 120 km/h (65 knots). In order to be consistent in the treatment of ground winds, the w ind speeds prescribed by CS 25.415 , concerning ground gust conditions on control surfaces, was increased to 120 km/h (65 knots) at Change 15 of JAR - 25.

c. There have been several incidents and accidents caused by hidden damage that had previously occurred in ground gust conditions. Although many of these events were for aeroplanes that had used the lower wind speeds from the earlier rules, analysis indicates that the most significant contributor to the damage was t he dynamic load effect. The dynamic effects were most significant for control system designs in which the gust locks were designed to engage the control system at locations far from the control surface horn. Based on these events additional factors are def ined for use in those portions of the system and surface that could be affected by dynamic effects.

d. The flight control system and surface loads prescribed by CS 25.415 are limit loads based on a peak wind speed of 120 km/h (65 knots) EAS. In operation, the peak wind speed would most often be caused by an incremental fluctuation in velocity imposed on top of a less rapidly changing mean wind speed. Therefore, an appropriate peak wind speed limitation should be re flected in the applicable documents, when there is a poten tial risk of structural damage.

4. COMPLIANCE .

a. The ground gust requirements take into account the conditions of the aeroplane parked with controls locked, and taxying with controls either locke d or unlocked. In either of the locked conditions the control surface loads are assumed to be reacted at the control system locks. In the unlocked condition the pilot is assumed to be at the controls and the controls are assumed to be powered, if applicabl e. In the latter condition, the control surface loads are assumed to be reacted, if necessary, at the cockpit controls by the pilot(s) up to the limits of the maximum pilot forces and torques given in CS 25.397(c) .

b. Where loads are eventually reacted at the cockpit controls, the loads in those parts of the control system between the control system stops nearest the control surfaces and the cockpit controls need not exceed those that would result from th e application of the specified maximum pilot effort effects. However, higher loads can be reacted by the control system stops. Those parts of the control system from the control surfaces to the control system stops nearest the surfaces should be designed t o the resultant limit loads including dynamic effects, if applicable, and regardless of pilot effort limitations.

Similarly, pilot effort limitations would not apply to parts of control systems where the loads are not eventually reacted at the cockpit cont rols, for example an aileron control Powered by EASA eRules Page 260 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) CONTROL SURFACE AND SYSTEM LOADS system where the right hand side aileron loads are reacted by the left hand side aileron, without participation by the pilot(s).

c. In either the taxying condition (controls locked or unlocked) or the parked condition (controls locked), if the control system flexibility is such that the rate of load application in the ground gust conditions might produce transient stresses appreciably higher than those corresponding to static loads, the effects of this rate of applicati on are required to be considered. Manually powered control systems and control systems where the gust lock is located remotely from the control surface are examples of designs that might fall in this category. In such cases the control system loads are req uired by CS 25.415(e) to be increased by an additional factor ov er the standard factor of 1.25.

[Amdt 25/2]

CS 25.427 Unsymmetrical loads

ED Decision 2005 / 006/R (a) In designing the aeroplane for lateral gust, yaw manoeuvre and roll manoeuvre conditions, account must be taken of unsymmetrical loads on the empennage arising from effects such as slipstream and aerodynamic interference with the wing, vertical fin and other aerodynamic surfaces.

(b) The horizontal t ail must be assumed to be subjected to unsymmetrical loading conditions determined as follows: (1) 100% of the maximum loading from the symmetrical manoeuvre conditions of CS 25.331 and the vertical gust conditions of CS 25.341(a) acting separately on the surface on one side of the plane of symmetry; and (2) 80% of these loadings acting on the other side.

(c) For empennage arrangements where the horizontal tail surfaces hav e dihedral angles greater than plus or minus 10 degrees, or are supported by the vertical tail surfaces, the surfaces and the supporting structure must be designed for gust velocities specified in CS 25.341(a) acting in any orientation at right angles to t he flight path.

(d) Unsymmetrical loading on the empennage arising from buffet conditions of CS 25.305(e) must be taken into account.

[Amdt 25/1]

CS 25.445 Outboard fins

ED Decision 2003/ 2/RM (a) When significant, the aerodynamic influence between auxiliary aerodynamic surfaces, such as outboard fins and winglets, and their supporting aerodynamic surfaces must be taken into account for all loading conditions including pitch, roll and yaw manoeuvres, and gusts as sp ecified in CS 25.341(a) acting at any orientation at right angles to the flight path.

(b) To provide for unsymmetrical loading when outboard fins extend above and below the horizontal surface, the critical vertical surface loading (load per unit area) determined under CS 25.391 must also be applied as follows: (1) 100% to the area of the vertical surfaces above (or below) the horizontal surface.

(2) 80% to the ar ea below (or above) the horizontal surface.

Powered by EASA eRules Page 261 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) CONTROL SURFACE AND SYSTEM LOADS

CS 25.457 Wing - flaps

ED Decision 2003/2/RM Wing flaps, their operating mechanisms, and their supporting structures must be designed for critical loads occurring in the conditions prescribed in CS 25.345 , accounting for the loads occurring during transition from one wing - flap position and airspeed to another.

CS 25.459 Special devices

ED Decision 2003/ 2/RM The loading for special devices using aero - dynamic surfaces (such as slots, slats and spoilers) must be determined from test data.

Powered by EASA eRules Page 262 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – S TRUCTURE (CS - 25) GROUND LOADS

GROUND LOADS

CS 25.471 General

ED Decision 2003/ 2/RM (a) Loads and equilibrium. For limit ground loads – (1) Limit ground loads obtained under this Subpart are considered to be external forces applied to the aeroplane structure; and (2) In each specified ground load condition, the external loads must be placed in equilibrium with the linear and angular inertia loads in a rational or conservative manner.

(b) Criti cal centres of gravity. The critical centres of gravity within the range for which certification is requested must be selected so that the maximum design loads are obtained in each landing gear element. Fore and aft, vertical, and lateral aeroplane centres of gravity must be considered.

Lateral displacements of the centre of gravity from the aeroplane centreline which would result in main gear loads not greater than 103% of the critical design load for symmetrical loading conditions may be selected without considering the effects of these lateral centre of gravity displacements on the loading of the main gear elements, or on t he aeroplane structure provided – (1) The lateral displacement of the centre of gravity results from random passenger or cargo disposi tion within the fuselage or from random unsymmetrical fuel loading or fuel usage; and (2) Appropriate loading instructions for random disposable loads are included under the provisions of CS 25.1583(c)(1) to ensure that the lateral displacement of the centre of gravity is maintained within these limits.

(c) Landing gear dimension data. Figure 1 of Appendix A contains the basic landi ng gear dimension data.

CS 25.473 Landing load conditions and assumptions

ED Decision 2003/ 2/RM (a)For the landing conditions specified in CS 25.479 to 25.485 , the aeroplane is assumed to contact the groun d: (1)In the attitudes defined in CS 25.479 and CS 25.481 .

(2) With a limit descent velocity of 3·05 m/sec (10 fps) at the design landing weight (the maximum weight for lan ding conditions at maximum descent velocity); and (3) With a limit descent velocity of 1·83 m/sec (6 fps) at the design take - off weight (the maximum weight for landing conditions at a reduced descent velocity).

(4) The prescribed descent velocities may be modified if it is shown that the aeroplane has design features that make it impossible to develop these velocities.

(b) Aeroplane lift, not exceeding aeroplane weight, may be assumed, unless the presence of systems or procedures significantly affects the l ift.

Powered by EASA eRules Page 263 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS (c) The method of analysis of aeroplane and landing gear loads must take into account at least the following elements: (1) Landing gear dynamic characteristics.

(2) Spin - up and spring back.

(3) Rigid body response.

(4) Structural dynamic response of the airframe, if significant.

(d) The landing gear dynamic characteristics must be validated by tests as defined in CS 25.723(a) .

(e) The coefficient of friction between the tyres and the ground may be established by considering the effects of skidding velocity and tyre pressure. However, this coefficient of friction need not be more than 0·8.

CS 25.477 Landing gear arrangement

ED Decision 2003/2/RM CS 25.479 to 25.485 apply to aeroplanes with conventional arrangements of main and nose gears, or main and tail gears, when normal operating techniques are used.

CS 25.479 Level landing conditions

ED Decision 2003/ 2/RM (a) In the level attitude, the aeroplane is assumed to contact the ground at forward velocity components, ranging from V to 1·25 V parallel to the ground under the conditions prescribed L1 L2 in CS 25.473 with: (1) V equal to V (TAS) at the appropriate landing weight and in standard sea - level L1 S0 conditions; and (2) V , equal to V (TAS) at the appropriate landing weight and altitudes in a ho t day L2 S0 temperatu re of 22.8 ° C (41 ° F) above standard.

(3) The effects of increased contact speed must be investigated if approval of downwind landings exceeding 19 km/h (10 knots) is requested.

(b) For the level landing attitude for aeroplanes with tail wheels, the conditio ns specified in this paragraph must be investigated with the aeroplane horizontal reference line horizontal in accordance with Figure 2 of Appendix A of CS - 25.

(c) For the level landing attitude for aeroplanes with nose wheels, shown in Figure 2 of Appendix A of CS - 25, the conditions specified in this paragraph must be investigated assuming the following attitudes: (1) An attitude in which the main wheels are assumed to cont act the ground with the nose wheel just clear of the ground; and (2) If reasonably attainable at the specified descent and forward velocities an attitude in which the nose and main wheels are assumed to contact the ground simultaneously.

(d) In addition to the loading conditions prescribed in sub - paragraph (a) of this paragraph, but with maximum vertical ground reactions calculated from paragraph (a), the following apply: (1) The landing gear and directly affected structure must be designed for the maximum vertical ground reaction combined with an aft acting drag component of not less than 25% of this maximum vertical ground reaction.

Powered by EASA eRules Page 264 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS (2) The most severe combination of loads that are likely to arise during a lateral drift landing must be taken into account. In absence of a more rational analysis of this condition, the following must be investigated: (i) A vertical load equal to 75% of the maximum ground reaction of CS 25.473(a)(2) must be considered in combination wit h a drag and side load of 40% and 25%, respectively, of that vertical load.

(ii) The shock absorber and tyre deflections must be assumed to be 75% of the deflection corresponding to the maximum ground reaction of C S 25.473(a)(2) . This load case need not be considered in combination with flat tyres.

(3) The combination of vertical and drag components is considered to be acting at the wheel axle centreline.

CS 25.481 Tail - down landing conditions

ED Decision 2003/ 2/RM (a) In the tail - down attitude, the aeroplane is assumed to contact the ground at forward velocity components, ranging from V to V , parallel to the ground under the conditions prescribed in L1 L2 CS 25.473 with: (1) V equal to V (TAS) at the appropriate landing weight and in standard sealevel L1 S0 conditions; and (2) V equal to V (TAS) at the appropriate landing weight and altitudes in a h ot - day L2 S0 temperature of 22.8 ° C (41 ° F) above standard.

The combinati on of vertical and drag components is considered to be acting at the main wheel axle centreline.

(b) For the tail - down landing condition for aeroplanes with tail wheels, the main and tail wheels are assumed to contact the ground simultaneously, in accorda nce with Figure 3 of Appendix A .

Ground reaction conditions on the tail wheel are assumed to act – (1) Vertically; and (2) Up and aft through the axle at 45 ° to the ground line.

(c) For the tail - down landing condit ion for aeroplanes with nose wheels, the aeroplane is assumed to be at an attitude corresponding to either the stalling angle or the maximum angle allowing clearance with the ground by each part of the aeroplane other than the main wheels, in accordance wi th Figure 3 of Appendix A , whichever is less.

CS 25.483 One - gear landing conditions

ED Decision 2003/2/RM For the one - gear landing conditions, the aeroplane is assumed to be in the level attitude and to contact the ground on one main landing gear, in accordance with Figure 4 of Appendix A of CS - 25. In this attitude – (a) The ground reactions must be the same as those obtained on that side under CS 25.479(d)(1) , and (b) Each unbalanced external load must be reacted by aeroplane inertia in a rational or conservative manner.

Powered by EASA eRules Page 265 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS

CS 25.485 Side load conditions

ED Decision 2003/2/RM In addition to CS 25.479(d)(2) the following conditions must be considered: (a) For the side load condition, the aeroplane is assumed to be in the leve l attitude with only the main wheels contacting the ground, in accordance with Figure 5 of Appendix A .

(b) Side loads of 0·8 of the vertical reaction (on one side) acting inward and 0·6 of the vertical reaction (o n the other side) acting outward must be combined with one - half of the maximum vertical ground reactions obtained in the level landing conditions. These loads are assumed to be applied at the ground contact point and to be resisted by the inertia of the ae roplane. The drag loads may be assumed to be zero.

CS 25.487 Rebound landing condition

ED Decision 2003/2/RM (a) The landing gear and its supporting structure must be investigated for the loads occurring during rebound of the aeroplane from the landing sur face.

(b) With the landing gear fully extended and not in contact with the ground, a load factor of 20·0 must act on the unsprung weights of the landing gear. This load factor must act in the direction of motion of the unsprung weights as they reach their limiting positions in extending with relation to the sprung parts of the landing gear.

CS 25.489 Ground handling conditions

ED Decision 2003/ 2/RM Unless otherwise prescribed, the landing gear and aeroplane structure must be investigated for the conditions in CS 25.491 to 25.509 with the aeroplane at the design ramp weight (the maximum weight for ground handling conditions). No wing lift may be considered. The shock absorbers and tyres may be assumed to be in their static position.

CS 25.491 Taxi, take - off and landing roll

ED Decision 2016/010/R (See AMC 25.415) Within the range of appropriate ground speeds and approved weights, the aeroplane structure and landing gear are as sumed to be subjected to loads not less than those obtained when the aircraft is operating over the roughest ground that may reasonably be expected in normal operation.

[Amdt 25/18] Powered by EASA eRules Page 266 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPA RT C – STRUCTURE (CS - 25) GROUND LOADS

AMC 25.491 Taxy, take - off and landing roll

ED Decision 2003/ 2/RM 1. PURPOSE . This AMC sets forth acceptable methods of compliance with the provisions of CS - 25 dealing with the certification requirements for taxy, take - off and landing roll design loads.

Guidance information is provided for showing compliance with CS 25.491 , relating to structural design for aeroplane operation on paved runways and taxy - ways normally used in commercial operations. Other methods of compliance with the requirements may be acceptable.

2. RELATED C ERTIFICATION S PECIFICATIONS . The contents of this AMC are considered by the Agency in determining compliance with CS 25.491 . Related paragraphs are CS 25.305(c) and CS 25.2 35 .

3. BACKGROUND .

a. All paved runways and taxy - ways have an inherent degree of surface unevenness, or roughness. This is the result of the normal tolerances of engineering standards required for construction, as well as the result of events such as une ven settlement and frost heave. In addition, repair of surfaces on an active runway or taxy - way can result in temporary ramped surfaces. Many countries have developed criteria for runway surface roughness. The Inter - national Civil Aviation Organisation (IC AO) standards are published in ICAO Annex 14.

b. In the late 1940's, as aeroplanes became larger, more flexible, and operated at higher ground speeds, consideration of dynamic loads during taxy, landing rollout, and take - off became important in aeroplane design. CS 25.235 , CS 25.491 and CS 25.305(c) apply.

c. Several approaches had been taken by different manufacturers in complying with the noted regulations. If dynamic ef fects due to rigid body modes or airframe flexibility during taxy were not considered critical, some manufacturers used a simplified static analysis where a static inertia force was applied to the aeroplane using a load factor of 2.0 for single axle gears or 1.7 for multiple axle gears. The lower 1.7 factor was justified based on an assumption that there was a load alleviating effect resulting from rotation of the beam, on which the forward and aft axles are attached, about the central pivot point on the st rut. The static load factor approach was believed to encompass any dynamic effects and it had the benefit of a relatively simple analysis.

d. As computers became more powerful and dynamic analysis methods became more sophisticated, it was found that dynam ic effects sometimes resulted in loads greater than those which were predicted by the static criterion. Some manufacturers performed calculations using a series of harmonic bumps to represent a runway surface, tuning the bumps to excite various portions of the structure at a given speed. U.S. Military Standard 8862 defines amplitude and wavelengths of 1 - cosine bumps intended to excite low speed plunge, pitch and wing first bending modes.

e. Some manufacturers used actual runway profile data to calculate lo ads. The runway profiles of the San Francisco Runway 28R or Anchorage Runway 24, which were known to cause high loads on aeroplanes and were the subject of pilot complaints until resurfaced, have been used in a series of bi - directional constant speed analy tical runs to determine loads. In some cases, accelerated runs have been used, starting from several points along the runway. The profiles of those runways are described in NASA Reports CR - 119 and TN D - 5703. Such deterministic dynamic analyses have in gene ral proved to be satisfactory.

Powered by EASA eRules Page 267 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS f. Some manufacturers have used a statistical power spectral density (PSD) approach, especially to calculate fatigue loads. Extensive PSD runway roughness data exist for numerous world runways. The PSD approach is not consid ered practical for calculation of limit loads.

g. Because the various methods described above produce different results, the guidance information given in paragraphs 4, 5, and 6 of this AMC should be used when demonstrating compliance with CS 25.491 .

4. RUNWAY PROFILE CONDITION .

a. Consideration of airframe flexibility and landing gear dynamic characteristics is necessary in most cases. A deterministic dynamic analysis, based on the San Francisco Runway 28R (before it was resurfaced), described in Table 1 of this AMC, is an acceptabl e method for compliance. As an alternative means of compliance, the San Francisco Runway 28R (before it was resurfaced) may be used with the severe bump from 1530 to 1538 feet modified per Table 2. The modifications to the bump reflect the maximum slope ch ange permitted in ICAO Annex 14 for temporary ramps used to transition asphalt overlays to existing pavement. The points affected by this modification are outlined in Table 1.

b. Aeroplane design loads should be developed for the most critical conditions arising from taxy, take - off, and landing run. The aeroplane analysis model should include significant aeroplane rigid body and flexible modes, and the appropriate landing gear and tyre characteristics. Unless the aeroplane has design features that would re sult in significant asymmetric loads, only the symmetric cases need be investigated.

c. Aeroplane steady aerodynamic effects should normally be included. However, they may be ignored if their deletion is shown to produce conservative loads. Unsteady aerod ynamic effects on dynamic response may be neglected.

d. Conditions should be run at the maximum take - off weight and the maximum landing weight with critical combinations of wing fuel, payload, and extremes of centre of gravity (c.g.) range. For aeroplanes with trimable stabilisers, the stabiliser should be set at the appropriate setting for take - off cases and at the recommended final approach setting for landing cases. The elevator should be assumed faired relative to the stabiliser throughout the take - off or landing run, unless other normal procedures are specified in the flight manual.

e. A series of constant speed runs should be made in both directions from 37 km/h (20 knots) up to the maximum ground speeds expected in normal operation (V defined at R ma ximum altitude and temperature for take - off conditions, 1.25 V for landing L2 conditions). Sufficiently small speed increments should be evaluated to assure that maximum loads are achieved. Constant speed runs should be made because using accelerated runs m ay not define the speed/roughness points which could produce peak dynamic loads. For maximum take - off weight cases, the analysis should account for normal take - off flap and control settings and consider both zero and maximum thrust.

For maximum landing wei ght cases, the analysis should account for normal flap and spoiler positions following landing, and steady pitching moments equivalent to those produced by braking with a coefficient of friction of 0.3 with and without reverse thrust.

The effects of automa tic braking systems that reduce braking in the presence of reverse thrust may be taken into account.

Powered by EASA eRules Page 268 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS 5. DISCRETE LOAD CONDITION . One of the following discrete limit load conditions should be evaluated: a. With all landing gears in contact with the groun d, the condition of a vertical load equal to 1.7 times the static ground reaction should be investigated under the most adverse aeroplane loading distribution at maximum take - off weight, with and without thrust from the engines; b. As an alternative to pa ragraph 5.a. above, it would be acceptable to undertake dynamic analyses under the same conditions considered in paragraph 4 of this AMC considering the aircraft response to each of the following pairs of identical and contiguous 1 - cosine upwards bumps on an otherwise smooth runway: (i) Bump wavelengths equal to the mean longitudinal distance between nose and main landing gears, or between the main and tail landing gears, as appropriate; and separately: (ii) Bump wavelengths equal to twice this distance.

T he bump height in each case should be defined as: 𝐻 = 𝐴 + 𝐵 𝐿 √ Where: H = the bump height L = the bump wavelength A = 1.2, B = 0.023 if H and L are expressed in inches A = 30.5, B = 0.116 if H and L are expressed in millimetres 6. COMBINED LOAD CONDITION . A condition of combined vertical, side and drag loads should be investigated for the main landing gear. In the absence of a more rational analysis a vertical load equa l to 90% of the ground reaction from paragraph 5 above should be combined with a drag load of 20% of the vertical load and a side load of 20% of the vertical load. Side loads acting either direction should be considered.

7. TYRE CONDITIONS . The calculatio n of maximum gear loads in accordance with paragraphs 4, 5, and 6, may be performed using fully inflated tyres. For multiple wheel units, the maximum gear loads should be distributed between the wheels in accordance with the criteria of CS 25.511 .

[Amdt 25/2] Powered by EASA eRules Page 269 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS ED Decision 2003/ 2/RM TABLE 1 SAN FRANCISCO RUNWAY 28R ONE TRACK LENGTH: 3880 FEET NUMBER OF POINTS: 1941 POINT SPACING: 2 FEET ELEVATIONS: FEET REFERENCE SOURCE: REPORT TO NASA (EFFECTS OF RUNWAY UNEVENNESS ON THE DYNAMIC RESPONSE OF SUPERSONIC TRANSPORTS), JU LY 1964, U. OF CALIF.

BERKELEY.

RUNWAY ELEVATION POINTS IN FEET (READ ROW WISE): Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.

0.00 10.30 2.00 10.31 4.00 10.30 6.00 10.30 8.00 10.31 10.00 10.32 12.00 10.33 14.00 10.34 16.00 10.35 18.00 10.36 20.00 10.36 22.00 10.37 24.00 10.37 26.00 10.37 28.00 10.38 30.00 10.39 32.00 10.40 34.00 10.40 36.00 10.41 38.00 10.41 40.00 10.42 42.00 10.43 44.00 10.43 46.00 10.44 48.00 10.44 50.00 10.44 52.00 10.44 54.00 10.44 56.00 10.45 58.00 10.46 60.00 10.47 62.00 10.47 64.00 10.48 66.00 10.49 68.00 10.49 70.00 10.50 72.00 10.50 74.00 10.50 76.00 10.50 78.00 10.50 80.00 10.50 82.00 10.49 84.00 10.49 86.00 10.49 88.00 10.49 90.00 10.50 92.00 10.50 94.00 10.51 96.00 10.51 98.00 10.52 100.00 10.52 102.00 10.52 104.00 10.53 106.00 10.53 108.00 10.54 110.00 10.54 112.00 10.55 114.00 10.55 116.00 10.55 118.00 10.55 120.00 10.54 122.00 10.55 124.00 10.55 126.00 10.56 128.00 10.57 130.00 10.57 132.00 10.57 134.00 10.57 136.00 10.57 138.00 10.58 140.00 10.57 142.00 10.57 144.00 10.58 146.00 10.57 148.00 10.56 150.00 10.56 152.00 10.56 154.00 10.56 156.00 10.56 158.00 10.56 160.00 10.56 162.00 10.56 164.00 10.55 166.00 10.55 168.00 10.55 170.00 10.56 172.00 10.57 174.00 10.57 176.00 10.57 178.00 10.57 180.00 10.56 182.00 10.55 184.00 10.55 186.00 10.55 188.00 10.55 190.00 10.55 192.00 10.56 194.00 10.56 196.00 10.56 198.00 10.56 200.00 10.55 202.00 10.54 204.00 10.53 206.00 10.52 208.00 10.52 210.00 10.52 212.00 10.52 214.00 10.52 216.00 10.52 218.00 10.53 220.00 10.52 222.00 10.52 224.00 10.51 226.00 10.52 228.00 10.52 230.00 10.51 232.00 10.52 234.00 10.52 236.00 10.53 238.00 10.53 240.00 10.53 242.00 10.53 244.00 10.53 246.00 10.53 248.00 10.53 250.00 10.53 252.00 10.53 254.00 10.52 256.00 10.53 258.00 10.54 260.00 10.54 262.00 10.54 264.00 10.54 266.00 10.54 268.00 10.54 270.00 10.55 272.00 10.55 274.00 10.54 276.00 10.55 278.00 10.55 280.00 10.56 282.00 10.57 284.00 10.58 286.00 10.59 Powered by EASA eRules Page 270 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.

288.00 10.60 290.00 10.61 292.00 10.62 294.00 10.63 296.00 10.65 298.00 10.66 300.00 10.66 302.00 10.67 304.00 10.66 306.00 10.67 308.00 10.67 310.00 10.67 312.00 10.67 314.00 10.67 316.00 10.66 318.00 10.66 320.00 10.65 322.00 10.65 324.00 10.65 326.00 10.65 328.00 10.66 330.00 10.67 332.00 10.67 334.00 10.67 336.00 10.68 338.00 10.68 340.00 10.68 342.00 10.69 344.00 10.69 346.00 10.69 348.00 10.70 350.00 10.71 352.00 10.71 354.00 10.72 356.00 10.72 358.00 10.71 360.00 10.72 362.00 10.72 364.00 10.72 366.00 10.71 368.00 10.72 370.00 10.72 372.00 10.73 374.00 10.73 376.00 10.74 378.00 10.75 380.00 10.75 382.00 10.78 384.00 10.77 386.00 10.78 388.00 10.79 390.00 10.80 392.00 10.81 394.00 10.81 396.00 10.82 398.00 10.83 400.00 10.84 402.00 10.85 404.00 10.86 406.00 10.86 408.00 10.86 410.00 10.86 412.00 10.85 414.00 10.86 416.00 10.86 418.00 10.87 420.00 10.87 422.00 10.87 424.00 10.87 426.00 10.87 428.00 10.86 430.00 10.85 432.00 10.84 434.00 10.84 436.00 10.83 438.00 10.83 440.00 10.84 442.00 10.85 444.00 10.86 446.00 10.87 448.00 10.87 450.00 10.88 452.00 10.89 454.00 10.90 456.00 10.92 458.00 10.93 460.00 10.94 462.00 10.95 464.00 10.95 466.00 10.95 468.00 10.95 470.00 10.95 472.00 10.95 474.00 10.96 476.00 10.97 478.00 10.98 480.00 10.98 482.00 10.99 484.00 10.99 486.00 10.99 488.00 11.00 490.00 11.01 492.00 11.01 494.00 11.01 496.00 11.01 498.00 10.98 500.00 10.96 502.00 10.95 504.00 10.95 506.00 10.95 508.00 10.96 510.00 10.97 512.00 10.97 514.00 10.98 516.00 10.97 518.00 10.97 520.00 10.98 522.00 10.99 524.00 11.00 526.00 11.01 528.00 11.03 530.00 11.03 532.00 11.03 534.00 11.03 536.00 11.03 538.00 11.03 540.00 11.03 542.00 11.03 544.00 11.02 546.00 11.02 548.00 11.03 550.00 11.04 552.00 11.05 554.00 11.05 556.00 11.04 558.00 11.06 560.00 11.07 562.00 11.07 564.00 11.08 566.00 11.08 568.00 11.09 570.00 11.10 572.00 11.12 574.00 11.13 576.00 11.14 578.00 11.14 580.00 11.15 582.00 11.16 584.00 11.17 586.00 11.17 588.00 11.17 590.00 11.17 592.00 11.17 594.00 11.18 596.00 11.18 598.00 11.18 600.00 11.17 602.00 11.17 604.00 11.17 606.00 11.17 608.00 11.19 610.00 11.17 612.00 11.18 614.00 11.18 616.00 11.18 618.00 11.19 620.00 11.19 622.00 11.19 624.00 11.20 626.00 11.21 628.00 11.21 630.00 11.21 632.00 11.20 634.00 11.20 636.00 11.20 638.00 11.19 640.00 11.18 642.00 11.18 644.00 11.17 646.00 11.16 648.00 11.15 650.00 11.14 652.00 11.14 654.00 11.14 656.00 11.12 658.00 11.11 660.00 11.09 662.00 11.09 664.00 11.09 666.00 11.09 668.00 11.09 670.00 11.09 672.00 11.09 674.00 11.09 676.00 11.09 678.00 11.09 680.00 11.09 682.00 11.09 684.00 11.09 686.00 11.08 688.00 11.08 690.00 11.08 692.00 11.08 694.00 11.07 696.00 11.06 698.00 11.05 700.00 11.04 702.00 11.03 704.00 11.02 706.00 11.01 708.00 11.00 710.00 10.99 712.00 10.99 714.00 10.98 716.00 10.99 718.00 10.98 720.00 10.98 722.00 10.98 724.00 10.98 726.00 10.98 728.00 10.98 730.00 10.99 732.00 10.99 734.00 11.00 Powered by EASA eRules Page 271 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.

736.00 11.00 738.00 11.00 740.00 11.00 742.00 11.00 744.00 11.01 746.00 11.02 748.00 11.02 750.00 11.02 752.00 11.02 754.00 11.02 756.00 11.02 758.00 11.01 760.00 11.01 762.00 11.00 764.00 11.00 766.00 11.00 768.00 11.00 770.00 11.00 772.00 11.00 774.00 10.99 776.00 10.99 778.00 10.98 780.00 10.99 782.00 10.99 784.00 11.00 786.00 11.01 788.00 11.01 790.00 11.01 792.00 11.03 794.00 11.04 796.00 11.03 798.00 11.05 800.00 11.06 802.00 11.07 804.00 11.06 806.00 11.07 808.00 11.08 810.00 11.08 812.00 11.08 814.00 11.09 816.00 11.09 818.00 11.08 820.00 11.08 822.00 11.08 824.00 11.08 826.00 11.08 828.00 11.08 830.00 11.07 832.00 11.08 834.00 11.08 836.00 11.08 838.00 11.08 840.00 11.09 842.00 11.08 844.00 11.08 846.00 11.07 848.00 11.07 850.00 11.06 852.00 11.05 854.00 11.05 856.00 11.04 858.00 11.05 860.00 11.04 862.00 11.04 864.00 11.04 866.00 11.04 868.00 11.04 870.00 11.04 872.00 11.04 874.00 11.03 876.00 11.03 878.00 11.03 880.00 11.03 882.00 11.02 884.00 11.02 886.00 11.02 888.00 11.02 890.00 11.02 892.00 11.02 894.00 11.03 896.00 11.03 898.00 11.04 900.00 11.05 902.00 11.05 904.00 11.06 906.00 11.06 908.00 11.06 910.00 11.07 912.00 11.07 914.00 11.07 916.00 11.07 918.00 11.07 920.00 11.08 922.00 11.08 924.00 11.07 926.00 11.07 928.00 11.07 930.00 11.06 932.00 11.06 934.00 11.06 936.00 11.06 938.00 11.06 940.00 11.07 942.00 11.07 944.00 11.08 946.00 11.08 948.00 11.09 950.00 11.09 952.00 11.09 954.00 11.09 956.00 11.10 958.00 11.09 960.00 11.09 962.00 11.09 964.00 11.09 966.00 11.08 968.00 11.08 970.00 11.07 972.00 11.07 974.00 11.06 976.00 11.07 978.00 11.09 980.00 11.10 982.00 11.10 984.00 11.11 986.00 11.11 988.00 11.12 990.00 11.12 992.00 11.12 994.00 11.11 996.00 11.11 998.00 11.11 1000.00 11.11 1002.00 11.11 1004.00 11.10 1006.00 11.11 1008.00 11.11 1010.00 11.12 1012.00 11.12 1014.00 11.12 1016.00 11.11 1018.00 11.11 1020.00 11.12 1022.00 11.11 1024.00 11.11 1026.00 11.11 1028.00 11.10 1030.00 11.10 1032.00 11.12 1034.00 11.13 1036.00 11.15 1038.00 11.16 1040.00 11.17 1042.00 11.18 1044.00 11.18 1046.00 11.19 1048.00 11.19 1050.00 11.20 1052.00 11.22 1054.00 11.22 1056.00 11.23 1058.00 11.23 1060.00 11.23 1062.00 11.24 1064.00 11.25 1066.00 11.25 1068.00 11.26 1070.00 11.24 1072.00 11.27 1074.00 11.28 1076.00 11.28 1078.00 11.30 1080.00 11.31 1082.00 11.32 1084.00 11.33 1086.00 11.34 1088.00 11.34 1090.00 11.34 1092.00 11.34 1094.00 11.33 1096.00 11.32 1098.00 11.32 1100.00 11.31 1102.00 11.32 1104.00 11.32 1106.00 11.31 1108.00 11.31 1110.00 11.31 1112.00 11.32 1114.00 11.31 1116.00 11.32 1118.00 11.33 1120.00 11.34 1122.00 11.35 1124.00 11.35 1126.00 11.36 1128.00 11.36 1130.00 11.36 1132.00 11.37 1134.00 11.37 1136.00 11.37 1138.00 11.37 1140.00 11.38 1142.00 11.38 1144.00 11.38 1146.00 11.38 1148.00 11.38 1150.00 11.38 1152.00 11.38 1154.00 11.38 1156.00 11.38 1158.00 11.37 1160.00 11.37 1162.00 11.37 1164.00 11.37 1166.00 11.38 1168.00 11.38 1170.00 11.39 1172.00 11.38 1174.00 11.38 1176.00 11.39 1178.00 11.40 1180.00 11.41 1182.00 11.41 Powered by EASA eRules Page 272 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.

1184.00 11.42 1186.00 11.43 1188.00 11.44 1190.00 11.44 1192.00 11.45 1194.00 11.46 1196.00 11.46 1198.00 11.46 1200.00 11.46 1202.00 11.47 1204.00 11.48 1206.00 11.48 1208.00 11.48 1210.00 11.49 1212.00 11.50 1214.00 11.50 1216.00 11.50 1218.00 11.50 1220.00 11.50 1222.00 11.50 1224.00 11.49 1226.00 11.49 1228.00 11.49 1230.00 11.48 1232.00 11.47 1234.00 11.46 1236.00 11.46 1238.00 11.48 1240.00 11.46 1242.00 11.47 1244.00 11.47 1246.00 11.47 1248.00 11.47 1250.00 11.46 1252.00 11.45 1254.00 11.45 1256.00 11.45 1258.00 11.46 1260.00 11.46 1262.00 11.46 1264.00 11.45 1266.00 11.45 1268.00 11.45 1270.00 11.45 1272.00 11.45 1274.00 11.46 1276.00 11.46 1278.00 11.46 1280.00 11.48 1282.00 11.47 1284.00 11.47 1286.00 11.48 1288.00 11.48 1290.00 11.48 1292.00 11.48 1294.00 11.49 1296.00 11.49 1298.00 11.50 1300.00 11.51 1302.00 11.52 1304.00 11.52 1306.00 11.52 1308.00 11.52 1310.00 11.52 1312.00 11.52 1314.00 11.52 1316.00 11.53 1318.00 11.52 1320.00 11.52 1322.00 11.52 1324.00 11.53 1326.00 11.53 1328.00 11.53 1330.00 11.53 1332.00 11.53 1334.00 11.53 1336.00 11.54 1338.00 11.53 1340.00 11.52 1342.00 11.52 1344.00 11.51 1346.00 11.53 1348.00 11.52 1350.00 11.54 1352.00 11.53 1354.00 11.54 1356.00 11.53 1358.00 11.54 1360.00 11.53 1362.00 11.54 1364.00 11.55 1366.00 11.54 1368.00 11.54 1370.00 11.54 1372.00 11.54 1374.00 11.53 1376.00 11.52 1378.00 11.51 1380.00 11.50 1382.00 11.49 1384.00 11.49 1386.00 11.49 1388.00 11.49 1390.00 11.49 1392.00 11.48 1394.00 11.47 1396.00 11.47 1398.00 11.47 1400.00 11.46 1402.00 11.47 1404.00 11.47 1406.00 11.48 1408.00 11.47 1410.00 11.46 1412.00 11.46 1414.00 11.46 1416.00 11.46 1418.00 11.46 1420.00 11.47 1422.00 11.47 1424.00 11.47 1426.00 11.46 1428.00 11.46 1430.00 11.44 1432.00 11.43 1434.00 11.41 1436.00 11.40 1438.00 11.39 1440.00 11.38 1442.00 11.37 1444.00 11.36 1446.00 11.36 1448.00 11.35 1450.00 11.35 1452.00 11.35 1454.00 11.35 1456.00 11.35 1458.00 11.34 1460.00 11.34 1462.00 11.33 1464.00 11.32 1466.00 11.32 1468.00 11.32 1470.00 11.31 1472.00 11.31 1474.00 11.30 1476.00 11.29 1478.00 11.29 1480.00 11.28 1482.00 11.28 1484.00 11.28 1486.00 11.28 1488.00 11.28 1490.00 11.27 1492.00 11.27 1494.00 11.27 1496.00 11.26 1498.00 11.26 1500.00 11.25 1502.00 11.25 1504.00 11.24 1506.00 11.23 1508.00 11.22 1510.00 11.21 1512.00 11.19 1514.00 11.18 1516.00 11.17 1518.00 11.17 1520.00 11.15 1522.00 11.13 1524.00 11.12 1526.00 11.10 1528.00 11.10 1530.00 11.18 1532.00 11.17 1534.00 11.14 1536.00 11.14 1538.00 11.12 1540.00 11.00 1542.00 10.97 1544.00 10.95 1546.00 10.94 1548.00 10.92 1550.00 10.91 1552.00 10.92 1554.00 10.92 1556.00 10.91 1558.00 10.93 1560.00 10.93 1562.00 10.93 1564.00 10.93 1566.00 10.93 1568.00 10.93 1570.00 10.93 1572.00 10.93 1574.00 10.93 1576.00 10.93 1578.00 10.93 1580.00 10.94 1582.00 10.94 1584.00 10.94 1586.00 10.94 1588.00 10.95 1590.00 10.94 1592.00 10.93 1594.00 10.94 1596.00 10.94 1598.00 10.93 1600.00 10.92 1602.00 10.92 1604.00 10.92 1606.00 10.91 1608.00 10.91 1610.00 10.91 1612.00 10.91 1614.00 10.90 1616.00 10.89 1618.00 10.88 1620.00 10.87* 1622.00 10.89 1624.00 10.88 1626.00 10.88 1628.00 10.88 1630.00 10.87 Powered by EASA eRules Page 273 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.

1632.00 10.86 1634.00 10.85 1636.00 10.86 1638.00 10.86 1640.00 10.85 1642.00 10.85 1644.00 10.85 1646.00 10.84 1648.00 10.84 1650.00 10.84 1652.00 10.83 1654.00 10.83 1656.00 10.82 1658.00 10.82 1660.00 10.81 1662.00 10.81 1664.00 10.80 1666.00 10.79 1668.00 10.79 1670.00 10.79 1672.00 10.79 1674.00 10.79 1676.00 10.79 1678.00 10.80 1680.00 10.80 1682.00 10.81 1684.00 10.82 1686.00 10.82 1688.00 10.83 1690.00 10.84 1692.00 10.85 1694.00 10.85 1696.00 10.85 1698.00 10.87 1700.00 10.87 1702.00 10.88 1704.00 10.87 1706.00 10.88 1708.00 10.87 1710.00 10.87 1712.00 10.87 1714.00 10.87 1716.00 10.86 1718.00 10.85 1720.00 10.84 1722.00 10.84 1724.00 10.84 1726.00 10.84 1728.00 10.84 1730.00 10.83 1732.00 10.82 1734.00 10.82 1736.00 10.82 1738.00 10.82 1740.00 10.82 1742.00 10.82 1744.00 10.83 1746.00 10.82 1748.00 10.83 1750.00 10.82 1752.00 10.82 1754.00 10.82 1756.00 10.82 1758.00 10.81 1760.00 10.81 1762.00 10.81 1764.00 10.81 1766.00 10.82 1768.00 10.82 1770.00 10.82 1772.00 10.83 1774.00 10.83 1776.00 10.83 1778.00 10.84 1780.00 10.84 1782.00 10.85 1784.00 10.86 1786.00 10.86 1788.00 10.86 1790.00 10.88 1792.00 10.87 1794.00 10.86 1796.00 10.86 1798.00 10.86 1800.00 10.87 1802.00 10.87 1804.00 10.86 1806.00 10.85 1808.00 10.85 1810.00 10.89 1812.00 10.91 1814.00 10.91 1816.00 10.92 1818.00 10.92 1820.00 10.93 1822.00 10.93 1824.00 10.93 1826.00 10.94 1828.00 10.94 1830.00 10.95 1832.00 10.94 1834.00 10.93 1836.00 10.93 1838.00 10.92 1840.00 10.93 1842.00 10.91 1844.00 10.91 1846.00 10.90 1848.00 10.90 1850.00 10.90 1852.00 10.91 1854.00 10.91 1856.00 10.89 1858.00 10.90 1860.00 10.91 1862.00 10.91 1864.00 10.91 1866.00 10.92 1868.00 10.93 1870.00 10.94 1872.00 10.94 1874.00 10.94 1876.00 10.94 1878.00 10.94 1880.00 10.95 1882.00 10.93 1884.00 10.93 1886.00 10.93 1888.00 10.93 1890.00 10.92 1892.00 10.93 1894.00 10.93 1896.00 10.93 1898.00 10.93 1900.00 10.91 1902.00 10.90 1904.00 10.91 1906.00 10.91 1908.00 10.91 1910.00 10.91 1912.00 10.91 1914.00 10.91 1916.00 10.91 1918.00 10.90 1920.00 10.90 1922.00 10.89 1924.00 10.90 1926.00 10.90 1928.00 10.90 1930.00 10.91 1932.00 10.90 1934.00 10.91 1936.00 10.89 1938.00 10.89 1940.00 10.89 1942.00 10.89 1944.00 10.89 1946.00 10.88 1948.00 10.88 1950.00 10.87 1952.00 10.87 1954.00 10.87 1956.00 10.86 1958.00 10.88 1960.00 10.87 1962.00 10.86 1964.00 10.87 1966.00 10.87 1968.00 10.86 1970.00 10.85 1972.00 10.85 1974.00 10.85 1976.00 10.86 1978.00 10.85 1980.00 10.86 1982.00 10.86 1984.00 10.86 1986.00 10.87 1988.00 10.87 1990.00 10.87 1992.00 10.87 1994.00 10.87 1996.00 10.88 1998.00 10.87 2000.00 10.88 2002.00 10.87 2004.00 10.88 2006.00 10.88 2008.00 10.88 2010.00 10.88 2012.00 10.88 2014.00 10.89 2016.00 10.90 2018.00 10.89 2020.00 10.89 2022.00 10.89 2024.00 10.89 2026.00 10.90 2028.00 10.89 2030.00 10.89 2032.00 10.88 2034.00 10.87 2036.00 10.88 2038.00 10.87 2040.00 10.87 2042.00 10.87 2044.00 10.87 2046.00 10.88 2048.00 10.88 2050.00 10.88 2052.00 10.88 2054.00 10.88 2056.00 10.88 2058.00 10.89 2060.00 10.89 2062.00 10.89 2064.00 10.89 2066.00 10.89 2068.00 10.89 2070.00 10.89 2072.00 10.88 2074.00 10.88 2076.00 10.89 2078.00 10.88 Powered by EASA eRules Page 274 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.

2080.00 10.89 2082.00 10.88 2084.00 10.88 2086.00 10.88 2088.00 10.88 2090.00 10.88 2092.00 10.87 2094.00 10.87 2096.00 10.87 2098.00 10.87 2100.00 10.87 2102.00 10.88 2104.00 10.88 2106.00 10.88 2108.00 10.89 2110.00 10.89 2112.00 10.90 2114.00 10.91 2116.00 10.92 2118.00 10.92 2120.00 10.93 2122.00 10.92 2124.00 10.92 2126.00 10.92 2128.00 10.92 2130.00 10.92 2132.00 10.92 2134.00 10.92 2136.00 10.93 2138.00 10.93 2140.00 10.93 2142.00 10.93 2144.00 10.93 2146.00 10.94 2148.00 10.93 2150.00 10.93 2152.00 10.93 2154.00 10.93 2156.00 10.93 2158.00 10.92 2160.00 10.92 2162.00 10.91 2164.00 10.90 2166.00 10.92 2168.00 10.91 2170.00 10.91 2172.00 10.90 2174.00 10.90 2176.00 10.90 2178.00 10.88 2180.00 10.88 2182.00 10.86 2184.00 10.85 2186.00 10.85 2188.00 10.84 2190.00 10.84 2192.00 10.84 2194.00 10.84 2196.00 10.85 2198.00 10.85 2200.00 10.85 2202.00 10.85 2204.00 10.85 2206.00 10.85 2208.00 10.86 2210.00 10.86 2212.00 10.86 2214.00 10.87 2216.00 10.88 2218.00 10.88 2220.00 10.89 2222.00 10.90 2224.00 10.91 2226.00 10.91 2228.00 10.92 2230.00 10.92 2232.00 10.93 2234.00 10.94 2236.00 10.94 2238.00 10.95 2240.00 10.96 2242.00 10.96 2244.00 10.97 2246.00 10.99 2248.00 10.99 2250.00 10.99 2252.00 10.99 2254.00 11.00 2256.00 11.00 2258.00 11.00 2260.00 11.01 2262.00 11.01 2264.00 11.02 2266.00 11.02 2268.00 11.02 2270.00 11.04 2272.00 11.05 2274.00 11.05 2276.00 11.06 2278.00 11.06 2280.00 11.05 2282.00 11.04 2284.00 11.03 2286.00 11.03 2288.00 11.02 2290.00 11.03 2292.00 11.03 2294.00 11.04 2296.00 11.05 2298.00 11.06 2300.00 11.07 2302.00 11.09 2304.00 11.10 2306.00 11.10 2308.00 11.11 2310.00 11.12 2312.00 11.14 2314.00 11.14 2316.00 11.15 2318.00 11.16 2320.00 11.16 2322.00 11.16 2324.00 11.15 2326.00 11.15 2328.00 11.16 2330.00 11.15 2332.00 11.14 2334.00 11.14 2336.00 11.14 2338.00 11.14 2340.00 11.14 2342.00 11.14 2344.00 11.15 2346.00 11.15 2348.00 11.15 2350.00 11.15 2352.00 11.15 2354.00 11.15 2356.00 11.16 2358.00 11.16 2360.00 11.15 2362.00 11.15 2364.00 11.16 2366.00 11.16 2368.00 11.16 2370.00 11.16 2372.00 11.16 2374.00 11.16 2376.00 11.16 2378.00 11.16 2380.00 11.17 2382.00 11.17 2384.00 11.17 2386.00 11.17 2388.00 11.17 2390.00 11.17 2392.00 11.17 2394.00 11.16 2396.00 11.15 2398.00 11.15 2400.00 11.14 2402.00 11.14 2404.00 11.14 2406.00 11.13 2408.00 11.12 2410.00 11.12 2412.00 11.12 2414.00 11.12 2416.00 11.12 2418.00 11.12 2420.00 11.13 2422.00 11.13 2424.00 11.14 2426.00 11.15 2428.00 11.16 2430.00 11.17 2432.00 11.18 2434.00 11.19 2436.00 11.20 2438.00 11.20 2440.00 11.22 2442.00 11.23 2444.00 11.24 2446.00 11.24 2448.00 11.25 2450.00 11.26 2452.00 11.27 2454.00 11.28 2456.00 11.28 2458.00 11.29 2460.00 11.30 2462.00 11.30 2464.00 11.30 2466.00 11.31 2468.00 11.30 2470.00 11.31 2472.00 11.31 2474.00 11.31 2476.00 11.31 2478.00 11.30 2480.00 11.30 2482.00 11.30 2484.00 11.29 2486.00 11.29 2488.00 11.29 2490.00 11.29 2492.00 11.29 2494.00 11.29 2496.00 11.29 2498.00 11.29 2500.00 11.29 2502.00 11.30 2504.00 11.30 2506.00 11.31 2508.00 11.31 2510.00 11.32 2512.00 11.32 2514.00 11.33 2516.00 11.33 2518.00 11.34 2520.00 11.35 2522.00 11.35 2524.00 11.35 2526.00 11.35 Powered by EASA eRules Page 275 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.

2528.00 11.35 2530.00 11.35 2532.00 11.36 2534.00 11.36 2536.00 11.35 2538.00 11.35 2540.00 11.35 2542.00 11.35 2544.00 11.35 2546.00 11.35 2548.00 11.34 2550.00 11.34 2552.00 11.34 2554.00 11.34 2556.00 11.35 2558.00 11.35 2560.00 11.35 2562.00 11.34 2564.00 11.33 2566.00 11.33 2568.00 11.33 2570.00 11.33 2572.00 11.33 2574.00 11.33 2576.00 11.33 2578.00 11.32 2580.00 11.33 2582.00 11.33 2584.00 11.33 2586.00 11.33 2588.00 11.33 2590.00 11.34 2592.00 11.34 2594.00 11.34 2596.00 11.35 2598.00 11.35 2600.00 11.35 2602.00 11.35 2604.00 11.35 2606.00 11.35 2608.00 11.35 2610.00 11.35 2612.00 11.36 2614.00 11.36 2616.00 11.36 2618.00 11.35 2620.00 11.35 2622.00 11.35 2624.00 11.35 2626.00 11.35 2628.00 11.35 2630.00 11.36 2632.00 11.36 2634.00 11.36 2636.00 11.36 2638.00 11.36 2640.00 11.37 2642.00 11.38 2644.00 11.38 2646.00 11.39 2648.00 11.39 2650.00 11.40 2652.00 11.41 2654.00 11.42 2656.00 11.42 2658.00 11.43 2660.00 11.43 2662.00 11.42 2664.00 11.42 2666.00 11.43 2668.00 11.43 2670.00 11.43 2672.00 11.43 2674.00 11.43 2676.00 11.43 2678.00 11.44 2680.00 11.44 2682.00 11.45 2684.00 11.46 2686.00 11.46 2688.00 11.47 2690.00 11.48 2692.00 11.48 2694.00 11.49 2696.00 11.49 2698.00 11.50 2700.00 11.50 2702.00 11.51 2704.00 11.52 2706.00 11.52 2708.00 11.52 2710.00 11.52 2712.00 11.52 2714.00 11.52 2716.00 11.52 2718.00 11.52 2720.00 11.52 2722.00 11.52 2724.00 11.51 2726.00 11.51 2728.00 11.51 2730.00 11.50 2732.00 11.50 2734.00 11.50 2736.00 11.50 2738.00 11.51 2740.00 11.51 2742.00 11.51 2744.00 11.52 2746.00 11.52 2748.00 11.52 2750.00 11.52 2752.00 11.53 2754.00 11.53 2756.00 11.53 2758.00 11.52 2760.00 11.52 2762.00 11.52 2764.00 11.52 2766.00 11.52 2768.00 11.52 2770.00 11.53 2772.00 11.53 2774.00 11.53 2776.00 11.54 2778.00 11.53 2780.00 11.53 2782.00 11.54 2784.00 11.54 2786.00 11.54 2788.00 11.54 2790.00 11.53 2792.00 11.53 2794.00 11.53 2796.00 11.53 2798.00 11.54 2800.00 11.54 2802.00 11.54 2804.00 11.55 2806.00 11.55 2808.00 11.55 2810.00 11.56 2812.00 11.55 2814.00 11.55 2816.00 11.55 2818.00 11.55 2820.00 11.54 2822.00 11.53 2824.00 11.53 2826.00 11.53 2828.00 11.51 2830.00 11.52 2832.00 11.52 2834.00 11.53 2836.00 11.53 2838.00 11.54 2840.00 11.55 2842.00 11.56 2844.00 11.56 2846.00 11.57 2848.00 11.57 2850.00 11.57 2852.00 11.58 2854.00 11.58 2856.00 11.58 2858.00 11.58 2860.00 11.58 2862.00 11.58 2864.00 11.59 2866.00 11.59 2868.00 11.59 2870.00 11.59 2872.00 11.58 2874.00 11.57 2876.00 11.57 2878.00 11.58 2880.00 11.57 2882.00 11.57 2884.00 11.57 2886.00 11.58 2888.00 11.58 2890.00 11.59 2892.00 11.60 2894.00 11.62 2896.00 11.61 2898.00 11.61 2900.00 11.61 2902.00 11.61 2904.00 11.61 2906.00 11.62 2908.00 11.63 2910.00 11.64 2912.00 11.65 2914.00 11.66 2916.00 11.67 2918.00 11.67 2920.00 11.67 2922.00 11.68 2924.00 11.70 2926.00 11.72 2928.00 11.73 2930.00 11.74 2932.00 11.76 2934.00 11.77 2936.00 11.78 2938.00 11.80 2940.00 11.82 2942.00 11.82 2944.00 11.82 2946.00 11.83 2948.00 11.82 2950.00 11.82 2952.00 11.83 2954.00 11.84 2956.00 11.83 2958.00 11.83 2960.00 11.83 2962.00 11.83 2964.00 11.83 2966.00 11.83 2968.00 11.84 2970.00 11.85 2972.00 11.86 2974.00 11.87 Powered by EASA eRules Page 276 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.

2976.00 11.88 2978.00 11.88 2980.00 11.89 2982.00 11.90 2984.00 11.90 2986.00 11.90 2988.00 11.90 2990.00 11.90 2992.00 11.90 2994.00 11.91 2996.00 11.91 2998.00 11.90 3000.00 11.91 3002.00 11.91 3004.00 11.91 3006.00 11.91 3008.00 11.90 3010.00 11.91 3012.00 11.91 3014.00 11.92 3016.00 11.92 3018.00 11.92 3020.00 11.92 3022.00 11.92 3024.00 11.92 3026.00 11.92 3028.00 11.91 3030.00 11.91 3032.00 11.92 3034.00 11.91 3036.00 11.91 3038.00 11.91 3040.00 11.91 3042.00 11.90 3044.00 11.90 3046.00 11.90 3048.00 11.90 3050.00 11.90 3052.00 11.90 3054.00 11.90 3056.00 11.90 3058.00 11.90 3060.00 11.90 3062.00 11.91 3064.00 11.92 3066.00 11.92 3068.00 11.92 3070.00 11.93 3072.00 11.93 3074.00 11.93 3076.00 11.93 3078.00 11.94 3080.00 11.94 3082.00 11.95 3084.00 11.95 3086.00 11.95 3088.00 11.96 3090.00 11.96 3092.00 11.96 3094.00 11.96 3096.00 11.96 3098.00 11.96 3100.00 11.95 3102.00 11.94 3104.00 11.93 3106.00 11.92 3108.00 11.92 3110.00 11.92 3112.00 11.92 3114.00 11.92 3116.00 11.92 3118.00 11.92 3120.00 11.92 3122.00 11.92 3124.00 11.92 3126.00 11.92 3128.00 11.91 3130.00 11.90 3132.00 11.90 3134.00 11.90 3136.00 11.90 3138.00 11.90 3140.00 11.90 3142.00 11.90 3144.00 11.90 3146.00 11.90 3148.00 11.90 3150.00 11.90 3152.00 11.90 3154.00 11.90 3156.00 11.90 3158.00 11.90 3160.00 11.90 3162.00 11.89 3164.00 11.88 3166.00 11.88 3168.00 11.87 3170.00 11.87 3172.00 11.86 3174.00 11.86 3176.00 11.85 3178.00 11.85 3180.00 11.84 3182.00 11.84 3184.00 11.84 3186.00 11.84 3188.00 11.84 3190.00 11.85 3192.00 11.87 3194.00 11.89 3196.00 11.89 3198.00 11.90 3200.00 11.89 3202.00 11.92 3204.00 11.95 3206.00 11.95 3208.00 11.95 3210.00 11.94 3212.00 11.94 3214.00 11.93 3216.00 11.92 3218.00 11.92 3220.00 11.91 3222.00 11.90 3224.00 11.90 3226.00 11.89 3228.00 11.88 3230.00 11.87 3232.00 11.86 3234.00 11.85 3236.00 11.84 3238.00 11.84 3240.00 11.84 3242.00 11.83 3244.00 11.82 3246.00 11.82 3248.00 11.81 3250.00 11.83 3252.00 11.83 3254.00 11.83 3256.00 11.84 3258.00 11.84 3260.00 11.84 3262.00 11.84 3264.00 11.82 3266.00 11.83 3268.00 11.82 3270.00 11.83 3272.00 11.83 3274.00 11.84 3276.00 11.84 3278.00 11.84 3280.00 11.85 3282.00 11.84 3284.00 11.84 3286.00 11.84 3288.00 11.85 3290.00 11.85 3292.00 11.85 3294.00 11.86 3296.00 11.86 3298.00 11.84 3300.00 11.84 3302.00 11.84 3304.00 11.84 3306.00 11.84 3308.00 11.84 3310.00 11.84 3312.00 11.84 3314.00 11.84 3316.00 11.84 3318.00 11.84 3320.00 11.84 3322.00 11.83 3324.00 11.83 3326.00 11.83 3328.00 11.82 3330.00 11.83 3332.00 11.83 3334.00 11.83 3336.00 11.82 3338.00 11.82 3340.00 11.83 3342.00 11.82 3344.00 11.83 3346.00 11.83 3348.00 11.84 3350.00 11.84 3352.00 11.83 3354.00 11.83 3356.00 11.83 3358.00 11.83 3360.00 11.83 3362.00 11.84 3364.00 11.84 3366.00 11.84 3368.00 11.85 3370.00 11.85 3372.00 11.85 3374.00 11.85 3376.00 11.84 3378.00 11.84 3380.00 11.85 3382.00 11.85 3384.00 11.86 3386.00 11.86 3388.00 11.87 3390.00 11.87 3392.00 11.87 3394.00 11.87 3396.00 11.87 3398.00 11.86 3400.00 11.87 3402.00 11.87 3404.00 11.88 3406.00 11.89 3408.00 11.89 3410.00 11.89 3412.00 11.91 3414.00 11.91 3416.00 11.92 3418.00 11.93 3420.00 11.95 3422.00 11.95 Powered by EASA eRules Page 277 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.

3424.00 11.96 3426.00 11.96 3428.00 11.96 3430.00 11.96 3432.00 11.95 3434.00 11.96 3436.00 11.96 3438.00 11.96 3440.00 11.96 3442.00 11.95 3444.00 11.95 3446.00 11.94 3448.00 11.96 3450.00 11.98 3452.00 11.99 3454.00 12.01 3456.00 12.03 3458.00 12.04 3460.00 12.05 3462.00 12.05 3464.00 12.05 3466.00 12.05 3468.00 12.05 3470.00 12.05 3472.00 12.04 3474.00 12.06 3476.00 12.06 3478.00 12.07 3480.00 12.07 3482.00 12.07 3484.00 12.07 3486.00 12.06 3488.00 12.07 3490.00 12.07 3492.00 12.08 3494.00 12.08 3496.00 12.08 3498.00 12.09 3500.00 12.09 3502.00 12.08 3504.00 12.08 3506.00 12.08 3508.00 12.08 3510.00 12.08 3512.00 12.09 3514.00 12.10 3516.00 12.10 3518.00 12.10 3520.00 12.10 3522.00 12.10 3524.00 12.11 3526.00 12.11 3528.00 12.12 3530.00 12.13 3532.00 12.13 3534.00 12.13 3536.00 12.13 3538.00 12.14 3540.00 12.14 3542.00 12.13 3544.00 12.13 3546.00 12.13 3548.00 12.11 3550.00 12.10 3552.00 12.07 3554.00 12.06 3556.00 12.07 3558.00 12.08 3560.00 12.09 3562.00 12.10 3564.00 12.11 3566.00 12.11 3568.00 12.12 3570.00 12.06 3572.00 12.01 3574.00 12.03 3576.00 12.04 3578.00 12.05 3580.00 12.05 3582.00 12.06 3584.00 12.06 3586.00 12.05 3588.00 12.04 3590.00 12.03 3592.00 12.02 3594.00 12.02 3596.00 12.02 3598.00 12.02 3600.00 12.01 3602.00 11.99 3604.00 11.98 3606.00 11.94 3608.00 11.94 3610.00 11.93 3612.00 11.93 3614.00 11.92 3616.00 11.91 3618.00 11.90 3620.00 11.90 3622.00 11.90 3624.00 11.90 3626.00 11.90 3628.00 11.91 3630.00 11.90 3632.00 11.88 3634.00 11.87 3636.00 11.87 3638.00 11.86 3640.00 11.86 3642.00 11.85 3644.00 11.86 3646.00 11.86 3648.00 11.85 3650.00 11.85 3652.00 11.85 3654.00 11.86 3656.00 11.86 3658.00 11.87 3660.00 11.86 3662.00 11.86 3664.00 11.85 3666.00 11.84 3668.00 11.85 3670.00 11.85 3672.00 11.87 3674.00 11.89 3676.00 11.88 3678.00 11.88 3680.00 11.88 3682.00 11.89 3684.00 11.90 3686.00 11.91 3688.00 11.91 3690.00 11.91 3692.00 11.91 3694.00 11.92 3696.00 11.92 3698.00 11.93 3700.00 11.94 3702.00 11.94 3704.00 11.95 3706.00 11.95 3708.00 11.95 3710.00 11.95 3712.00 11.95 3714.00 11.96 3716.00 11.95 3718.00 11.95 3720.00 11.96 3722.00 11.97 3724.00 11.98 3726.00 11.98 3728.00 11.99 3730.00 12.00 3732.00 12.00 3734.00 11.99 3736.00 11.99 3738.00 11.99 3740.00 12.00 3742.00 12.00 3744.00 12.01 3746.00 12.02 3748.00 12.02 3750.00 12.03 3752.00 12.04 3754.00 12.05 3756.00 12.06 3758.00 12.06 3760.00 12.06 3762.00 12.06 3764.00 12.06 3766.00 12.06 3768.00 12.06 3770.00 12.06 3772.00 12.07 3774.00 12.08 3776.00 12.09 3778.00 12.10 3780.00 12.09 3782.00 12.12 3784.00 12.13 3786.00 12.14 3788.00 12.13 3790.00 12.14 3792.00 12.14 3794.00 12.14 3796.00 12.15 3798.00 12.15 3800.00 12.16 3802.00 12.16 3804.00 12.17 3806.00 12.17 3808.00 12.17 3810.00 12.15 3812.00 12.14 3814.00 12.13 3816.00 12.12 3818.00 12.11 3820.00 12.10 3822.00 12.09 3824.00 12.09 3826.00 12.09 3828.00 12.08 3830.00 12.07 3832.00 12.07 3834.00 12.06 3836.00 12.05 3838.00 12.03 3840.00 12.03 3842.00 12.02 3844.00 12.01 3846.00 12.02 3848.00 12.01 3850.00 12.01 3852.00 12.01 3854.00 12.01 3856.00 12.02 3858.00 12.02 3860.00 12.01 3862.00 12.00 3864.00 12.00 3866.

Powered by EASA eRules Page 278 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS *The National Aeronautics and Space Administration (NASA) Report CR - 119 identifies an elevation of 10.97 feet at 1620 feet. This is considered a typographical error and has been corrected in Table 1. The elevation is 10.87 feet.

Powered by EASA eRules Page 279 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes (CS - 25) SUBPART C – STRUCTURE GROUND LOADS TABLE 2 SF28R SEVERE BUMP MODIFICATIONS PER ICAO ANNEX 14, SPECIFICATION 9.4.15 Distance Original Elevation (ft) Modified Elevation (ft) 1530 11.18 11.10 1532 11.17 11.11 1534 11.14 11.11 1536 11.14 11.07 1538 11.12 11.04 Powered by EASA eRules Page 280 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS

CS 25.493 Braked roll conditions

ED Decision 2003/ 2/RM (a) An aeroplane with a tail wheel is assumed to be in the level attitude with the load on the main wheels, in accordance with Figure 6 of Appendix A . The limit vertical load factor is 1·2 at the design landing weight, and 1·0 at the design ramp weight. A drag reaction equal to the vertical reaction multiplied by a coefficient of friction of 0·8, must be combined with the vertical ground reaction and applied at the ground contact point.

(b) For an aeroplane with a nose wheel, the limit vertical load factor is 1·2 at the design landing weight, and 1·0 at the design ramp weight. A drag reaction equal to the vertical reaction, multiplied by a coefficient of friction of 0·8, must be combined with the vertical reaction and ap plied at the ground contact point of each wheel with brakes. The following two attitudes, in accordance with Figure 6 of Appendix A , must be considered: (1) The level attitude with the wheels contacting the ground and the loads distributed between the main and nose gear. Zero pitching acceleration is assumed.

(2) The level attitude with only the main gear contacting the ground and with the pitching moment resisted by angular acceleration.

(c) A drag reaction lower t han that prescribed in this paragraph may be used if it is substantiated that an effective drag force of 0·8 times the vertical reaction cannot be attained under any likely loading condition.

(d) An aeroplane equipped with a nose gear must be designed to w ithstand the loads arising from the dynamic pitching motion of the aeroplane due to sudden application of maximum braking force. The aeroplane is considered to be at design takeoff weight with the nose and main gears in contact with the ground, and with a steady state vertical load factor of 1·0. The steady state nose gear reaction must be combined with the maximum incremental nose gear vertical reaction caused by sudden application of maximum braking force as described in sub - paragraphs (b) and (c) of this paragraph.

(e) In the absence of a more rational analysis, the nose gear vertical reaction prescribed in subparagraph (d) of this paragraph must be calculated in accordance with the following formula: 𝑊 𝑓𝜇𝐴𝐸 𝑇 𝑉 = { 𝐵 + } 𝑁 𝐴 + 𝐵 𝐴 + 𝐵 + 𝜇𝐸 Where: V = Nose gear vertical reaction N W = Design take - off weight T A = Horizontal distance between the c.g. of the aeroplane and the nose wheel.

B = Horizontal distance between the c.g. of the aeroplane and the line joining the centres of the main wheels.

E = Vertical height of the c.g. of the aeroplane above the ground in the 1·0 g static condition.

μ = Coefficient of friction of 0·8.

f = Dynamic response factor; 2·0 is to be used unless a lower factor is substantiated.

Powered by EASA eRules Page 281 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS In the absence of othe r information, the dynamic response factor f may be defined by the equation.

− 𝜋 ξ 𝑓 = 1 + 𝑒𝑥𝑝 [ ] √ 1 − ξ Where: ξ is the critical damping ratio of the rigid body pitching mode about the main landing gear effective ground contact point.

CS 25.495 Turning

ED Decisi on 2003/2/RM In the static position, in accordance with Figure 7 of Appendix A , the aeroplane is assumed to execute a steady turn by nose gear steering, or by application of sufficient differential power, so that the limit load factors applied at the centre of gravity are 1·0 vertically and 0·5 laterally. The side ground reaction of each wheel must b e 0·5 of the vertical reaction.

CS 25.497 Tail - wheel yawing

ED Decision 2003/ 2/RM (a) A vertical ground reaction equal to the static load on the tail wheel, in combination with a side component of equal magnitude, is assumed.

(b) If there is a swivel, the tail whee l is assumed to be swivelled 90 ° to the aeroplane longitudinal axis with the resultant load passing thr ough the axle.

(c) If there is a lock, steering device, or shimmy damper the tail wheel is also assumed to be in the trailing position with the side load acting at the ground contact point.

CS 25.499 Nose - wheel yaw and steering

ED Decision 2003/ 2/RM (a) A vertical load factor of 1·0 at the aeroplane centre of gravity, and a side component at the nose wheel ground contact equal to 0·8 of the vertical ground reaction at that point are assumed.

(b) With the aeroplane assumed to be in static equilibrium with th e loads resulting from the use of brakes on one side of the main landing gear, the nose gear, its attaching structure, and the fuselage structure forward of the centre of gravity must be designed for the following loads: (1) A vertical load factor at the c entre of gravity of 1·0.

(2) A forward acting load at the aeroplane centre of gravity of 0·8 times the vertical load on one main gear.

(3) Side and vertical loads at the ground contact point on the nose gear that are required for static equilibrium.

(4) A side load factor at the aeroplane centre of gravity of zero.

(c) If the loads prescribed in sub - paragraph (b) of this paragraph result in a nose gear side load higher than 0·8 times the vertical nose gear load, the design nose gear side load may be limited to 0·8 times the vertical load, with unbalanced yawing moments assumed to be resisted by aeroplane inertia forces.

(d) For other than the nose gear, its attaching structure, and the forward fuselage structure the loading conditions are those prescribed in sub - paragraph (b) of this paragraph, except that – Powered by EASA eRules Page 282 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS (1) A lower drag reaction may be used if an effective drag force of 0·8 times the vertical reaction cannot be reached under any likely loading condition; and (2) The forward acting load at the centre of g ravity need not exceed the maximum drag reaction on one main gear, determined in accordance with CS 25.493(b) .

(e) With the aeroplane at design ramp weight, and the nose gear in any steerable position, the combined application of full normal steering torque and vertical force equal to 1·33 times the maximum static reaction on the nose gear must be considered in designing the nose gear, its attaching structure and the forward fuselage structure.

CS 25.503 Pivoting

ED Decision 2003/2/RM (a) The aeroplane is assumed to pivot about one side of the main gear with the brakes on that side locked. The limit vertical load factor must be 1·0 and the coefficient of friction 0·8.

(b) The aeroplane is assumed to be in static equ ilibrium, with the loads being applied at the ground contact points, in accordance with Figure 8 of Appendix A .

CS 25.507 Reversed braking

ED Decision 2003/2/RM (a) The aeroplane must be in a three point static g round attitude. Horizontal reactions parallel to the ground and directed forward must be applied at the ground contact point of each wheel with brakes. The limit loads must be equal to 0·55 times the vertical load at each wheel or to the load developed by 1·2 times the nominal maximum static brake torque, whichever is less.

(b) For aeroplanes with nose wheels, the pitching moment must be balanced by rotational inertia.

(c) For aeroplanes with tail wheels, the resultant of the ground reactions must pass thro ugh the centre of gravity of the aeroplane.

CS 25.509 Towing Loads

ED Decision 2013 / 010/R (See AMC 25.509 ) (a) The towing loads specified in sub - paragraph (d) of this paragraph must be considered separately. These loads must be applied at the towing fittings and must act parallel to the ground. In addition – (1) A vertical load factor equal to 1·0 must be considered acting at the centre of gravity; (2) The shock struts and tyres must be in their st atic positions; and (3) With W as the design ramp weight, the towing load, F is – T TOW (i) 0.3 W for W less than 30 000 pounds; T T 6 𝑊 + 450 000 𝑇 (ii) for W between 30 000 and 100 000 pounds; and T (iii) 0·15 W for W over 100 000 pounds.

T T (b) For towing points not on the landing gear but near the plane of symmetry of the aeroplane, the drag and side tow load components specified for the auxiliary gear apply. For towing points located outboard of the main gear, the drag and side tow load components specif ied for the Powered by EASA eRules Page 283 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS main gear apply. Where the specified angle of swivel cannot be reached, the maximum obtainable angle must be used.

(c) The towing loads specified in sub - paragraph (d) of this paragraph must be reacted as follows: (1) The side component of the t owing load at the main gear must be reacted by a side force at the static ground line of the wheel to which the load is applied.

(2) The towing loads at the auxiliary gear and the drag components of the towing loads at the main gear must be reacted as foll ows: (i) A reaction with a maximum value equal to the vertical reaction must be applied at the axle of the wheel to which the load is applied. Enough aeroplane inertia to achieve equilibrium must be applied.

(ii) The loads must be reacted by aeroplane iner tia.

(d) The prescribed towing loads are as specified in the following Table: Load Tow Point Position Magnitude No. Direction 1 Forward, parallel to drag axis 0·75 F TOW per 2 Forward, at 30 ° to drag axis Main gear main gear unit 3 Aft, parallel to drag axis 4 Aft, at 30 ° to drag axis 5 Forward Swivelled forward 6 Aft 1·0 F TOW 7 Forward Swivelled aft 8 Aft Auxiliary gear Swivelled 45 ° from 9 Forward, in plane of wheel forward 10 Aft, in plane of wheel 0·5 F TOW 11 Forward, in plane of wheel Swivelled 45 ° from aft 12 Aft, in plane of wheel [Amdt 25/13]

AMC 25.509 Towbarless towing

ED Decision 2013/010/R (a) General Towbarless towing vehicles are generally considered as ground equipment and are as such not subject to direct approval by the (aircraft) certifying agencies. However, these vehicles should be qualified in accordance with the applicable SAE ARP documents. I t should be ensured that the nose landing gear and supporting structure is not being overloaded (by static and dynamic (including fatigue) loads) during towbarless towing operations with these vehicles. This should be ensured by the aircraft manufacturer, either by specific investigations as described in subparagraphs (b) and (c) below, or alternatively, by publishing aircraft load limitations in a towbarless towing vehicle assessment document, to allow towbarless towing vehicle manufacturers to demonstrate their vehicles will not overload the aircraft.

(b) Limit static load cases For the limit static load cases, the investigation may be conducted by rational analysis supported by test evidence. The investigation should take into account the influence on t he towing loads of the tractive force of the towing vehicle including consideration of its weight and pavement roughness.

Powered by EASA eRules Page 284 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS Furthermore, the investigation should include, but may not be limited to, the following towbarless towing operation scenarios: (1) P ushback towing: Moving a fully loaded aircraft (up to Maximum Ramp Weight (MRW)) from the parking position to the taxiway. Movement includes: pushback with turn, a stop, and short tow forward to align aircraft and nose wheels. Engines may or may not be ope rating. Aeroplane movement is similar to a conventional pushback operation with a towbar.

(2) Maintenance towing: The movement of an ae roplane for maintenance/remote parking purposes (e.g. from the gate to a maintenance hangar). Aircraft is typically unl oaded with minimal fuel load.

(3) Dispatch (operational) towing: Towing a revenue aircraft (loaded with passengers, fuel, and cargo up to Maximum Ramp Weight (MRW) from the terminal gate/remote parking area to a location near the active runway. The movem ent may cover several kilometres with speeds according to SAE ARP 5283 technical standards, with several starts, stops, and turns. It replaces typical taxiing operations prior to take - off.

Operations that are explicitly prohibited need not to be addressed .

(c) Fatigue evaluation Fatigue evaluation of the impact of towbarless towing on the airframe should be conducted under the provision of CS 25.571 and CS 25.1529 .

Specifically, the contribution of the towbarless towing operational loads to the fatigue load spectra for the nose landing gear and its support structure needs to be evaluated. The impact of the towbarless towing on the certified life limits of the landing gear and supporting structure needs to be determined.

The fatigue spectra used in the evaluation should consist of typical service loads encountered during towbarless towing operations, which cover the loading scenarios noted above for static considerations. Furthermore, the spectra should be based on measure d statistical data derived from simulated service operation or from applicable industry studies.

(d) Other considerations Specific combinations of towbarless towing vehicle(s) and aircraft that have been assessed as described above and have been found t o be acceptable, along with any applicable towing instructions and/or limitations should be specified in the Instructions for Continued Airworthiness as described in Appendix H, paragraph H25.3(a)(4) and in the Aer oplane Flight Manual as specified in AMC 25.745(d) .

Aircraft braking, while the aircraft is under tow, may result in loads exceeding the aircraft’s design load and may result in structural damage and/or nose gear collapse. For these reasons, the aircraft manufacturer should ensure that the appropriate information is provided in the Aeroplane Maintenance Manual and in the Aeroplane Flight Manual to preclude aircraft braking during normal towbarless towing. Appropria te information should also be provided in the Instructions for Continued Airworthiness to inspect the affected structure should aircraft braking occur, for example in an emergency situation.

[Amdt 25/13] Powered by EASA eRules Page 285 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOA DS

CS 25.511 Ground load: unsymmetrical loads on multip le - wheel

units

ED Decision 2003/ 2/RM (a) General . Multiple - wheel landing gear units are assumed to be subjected to the limit ground loads prescribed in this Subpart under sub - paragraphs (b) through (f) of this paragraph. In addition – (1) A tandem strut g ear arrangement is a multiple - wheel unit; and (2) In determining the total load on a gear unit with respect to the provisions of sub - paragraphs (b) through (f) of this paragraph, the transverse shift in the load centroid, due to unsymmetrical load distribu tion on the wheels, may be neglected.

(b) Distribution of limit loads to wheels; tyres inflated . The distribution of the limit loads among the wheels of the landing gear must be established for each landing, taxying, and ground handling condition, taking i nto account the effects of the following factors: (1) The number of wheels and their physical arrangements. For truck type landing gear units, the effects of any see - saw motion of the truck during the landing impact must be considered in determining the m aximum design loads for the fore and aft wheel pairs.

(2) Any differentials in tyre diameters resulting from a combination of manufacturing tolerances, tyre growth, and tyre wear. A maximum tyre - diameter differential equal to two - thirds of the most unfavou rable combination of diameter variations that is obtained when taking into account manufacturing tolerances, tyre growth and tyre wear, may be assumed.

(3) Any unequal tyre inflation pressure, assuming the maximum variation to be ±5% of the nominal tyre in flation pressure.

(4) A runway crown of zero and a runway crown having a convex upward shape that may be approximated by a slope of 1·5% with the horizontal. Runway crown effects must be considered with the nose gear unit on either slope of the crown.

(5) The aeroplane attitude.

(6) Any structural deflections.

(c) Deflated tyres. The effect of deflated tyres on the structure must be considered with respect to the loading conditions specified in sub - paragraphs (d) through (f) of this paragraph, taking into a ccount the physical arrangement of the gear components. In addition – (1) The deflation of any one tyre for each multiple wheel landing gear unit, and the deflation of any two critical tyres for each landing gear unit using four or more wheels per unit, m ust be considered; and (2) The ground reactions must be applied to the wheels with inflated tyres except that, for multiple - wheel gear units with more than one shock strut, a rational distribution of the ground reactions between the deflated and inflated t yres, accounting for the differences in shock strut extensions resulting from a deflated tyre, may be used.

(d) Landing conditions . For one and for two deflated tyres, the applied load to each gear unit is assumed to be 60% and 50%, respectively, of the limit load applied to each gear for each of the prescribed landing conditions. However, for the drift landing condition of CS 25.485 , 100% of the vertical load must be applied.

Powered by EASA eRules Page 286 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) GROUND LOADS (e) Taxying and ground handling conditions. For one and for two deflated tyres – (1) The applied side or drag load factor, or both factors, at the centre of gravity m ust be the most critical value up to 50% and 40%, respectively, of the limit side or drag load factors, or both factors, corresponding to the most severe condition resulting from consideration of the prescribed taxying and ground handling conditions.

(2) F or the braked roll conditions of CS 25.493(a) and (b)(2) , the drag loads on each inflated tyre may not be less than those at each tyre for the symmetrical load distribution with no deflated tyres; (3) The vertical load factor at the centre of gravity must be 60% and 50% respectively, of the factor with no deflated tyres, except that it may not be less than 1 g; and (4) Pivoting need not be considered.

(f) Towing conditions . For one and for two deflated tyre s, the towing load, F , must be 60% and TOW 50% respec tively, of the load prescribed.

CS 25.519 Jacking and tie - down provisions

ED Decision 2003/ 2/RM (a) General . The aeroplane must be designed to withstand the limit load conditions resulting from the static ground load conditions of sub - paragraph (b) of this paragraph and, if applicable, sub - paragraph (c) of this paragraph at the most critical combinations of aeroplane weight and centre of gravity. The maximum allowable load at each jack pad must be specifie d.

(b) Jacking . The aeroplane must have provisions for jacking and must withstand the following limit loads when the aeroplane is supported on jacks: (1) For jacking by the landing gear at the maximum ramp weight of the aeroplane, the aeroplane structure must be designed for a vertical load of 1·33 times the vertical static reaction at each jacking point acting singly and in combination with a horizontal load of 0·33 times the vertical static reaction applied in any direction.

(2) For jacking by other aer oplane structure at maximum approved jacking weight: (i) The aeroplane structure must be designed for a vertical load of 1·33 times the vertical reaction at each jacking point acting singly and in combination with a horizontal load of 0·33 times the vertic al static reaction applied in any direction.

(ii) The jacking pads and local structure must be designed for a vertical load of 2·0 times the vertical static reaction at each jacking point, acting singly and in combination with a horizontal load of 0·33 tim es the vertical static reaction applied in any direction.

(c) Tie - down. If tie - down points are provided, the main tie - down points and local structure must withstand the limit loads resulting from a 120 km/h (65 - knot) horizontal wind from any direction.

Powered by EASA eRules Page 287 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) EMERGENCY LANDING CONDITIONS

EMER GENCY LANDING CONDITIONS

CS 25.561 General

ED Decision 2003/ 2/RM (See AMC 25.561 .)

(a) The aeroplane, although it may be damaged in emergency landing conditions on land or water, must be designed as prescribed in this paragraph to protect each occupant under those conditions.

(b) The structure must be designed to give each occupant every reasonable chance of escaping serious injury in a minor crash landing when – (1) Proper use is made of seats, belts , and all other safety design provisions; (2) The wheels are retracted (where applicable); and (3) The occupant experiences the following ultimate inertia forces acting separately relative to the surrounding structure: (i) Upward, 3·0g (ii) Forward, 9·0g ( iii) Sideward, 3·0g on the airframe and 4·0g on the seats and their attachments (iv) Downward, 6·0g (v) Rearward, 1·5g (See AMC 25.561(b)(3) .)

(c) For equipment, cargo in the passenger compartments and any other large masses, the following apply: (1) These items must be positioned so that if they break loose they will be unlikely to: (i) Cause direct injury to occupants; (ii) Penetrate fuel tanks or lines or cause fire or explosion hazard by damage to adjac ent systems; or (iii) Nullify any of the escape facilities provided for use after an emergency landing.

(2) When such positioning is not practical (e.g. fuselage mounted engines or auxiliary power units) each such item of mass must be restrained under all loads up to those specified in sub - paragraph (b)(3) of this paragraph. The local attachments for these items should be designed to withstand 1·33 times the specified loads if these items are subject to severe wear and tear through frequent removal (e.g. qu ick change interior items).

(d) Seats and items of mass (and their supporting structure) must not deform under any loads up to those specified in sub - paragraph (b)(3) of this paragraph in any manner that would impede subsequent rapid evacuation of occupant s. (See AMC 25.561(d) .)

Powered by EASA eRules Page 288 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) EMERGENCY LANDING CO NDITIONS

AMC 25.561 General

ED Decision 2003/2/RM In complying with the provisions of CS 25.561(b) & (c) , the loads arising from the restraint of seats and items of equipment etc. should be taken into the structure to a point where the stresses can be dissipated (e.g. for items attached to the fuselage floor, the load paths from the attachments through to the fuselage primary structure should be taken into a ccount).

AMC 25.561 (b)(3) Commercial Accommodation Equipment

ED Decision 2011/004/R Commercial accommodation equipment complying only with FAR 25.561 pre - Amendment 25 - 91 need additional substantiation by analysis, tests or combination thereof to cover the 1·33 factor for their attachments as specified in CS 25.561(c) .

[Amdt 25/11]

AMC 25.561(d) General

ED Decision 2003/2/RM For th e local attachments of seats and items of mass it should be shown by analysis and/or tests that under the specified load conditions, the intended retaining function in each direction is still available.

CS 25.562 Emergency landing dynamic conditions

ED De cision 2018 / 005 /R (See AMC 25.562 ) (a) The seat and restraint system in the aeroplane must be designed as prescribed in this paragraph to protect each occupant during an emergency landing condition when – (1) Proper use is made of seats, safety belts, and shoulder harnesses provided for in the design; and (2) The occupant is exposed to loads resulting from the conditions prescribed in this paragraph.

(b) E ach seat type design approved for occupancy must success fully complete dynamic tests or be demonstrated by rational analysis based on dynamic tests of a similar seat type , in accordance with each of the following emergency landing conditions. The tests must be conducted with an occup ant simulated by a 77kg (170 lb) anthropomorphic, test dummy sitting in the normal upright position: (1) A change in downward vertical velocity, (∆v) of not less than 10·7 m/s, (35 ft/s) with the aeroplane’s longitudinal axis canted downward 30 degrees with respect to the horizontal plane and with the wings level. Peak floor deceleration must occur in not more than 0·08 seconds after impact and must reach a minimum of 14 g.

(2) A change in forward longitudinal velocity (∆v) of not less than 13·4 m/s, (44 ft/s) with the aero plane’s longitudinal axis horizontal and yawed 10 degrees either right or left, whichever would cause the greatest likelihood of the upper torso restraint system (where installed) moving off the occupant’s shoulder, and with the wings level. Peak floor dec eleration must occur in not more than 0·09 seconds after impact and must reach a minimum of 16 g. With the exception of flight deck crew seats that are mounted in the forward conical area of the fuselage, w here floor rails or floor fittings are used to att ach Powered by EASA eRules Page 289 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) EMERGENCY LANDING CONDITIONS the seating devices to the test fixture, the rails or fittings must be misaligned with respect to the adjacent set of rails or fittings by at least 10 degrees vertically (i.e. out of parallel) with one rolled 10 degrees.

(c) The following performance m easures must not be exceeded during the dynamic tests conducted in accordance with sub - paragraph (b) of this paragraph: (1) Where upper torso straps are used tension loads in indivi dual straps must not exceed 794 kg. (1750lb) If dual straps are used for re straining the upper torso, the total strap tension loads must not exceed 907kg (2000 lb)).

(2) The maximum compressive load measured between the pelvis and the lumbar column of the anthropomorphic dummy must not exceed 680 kg. (1500lb) (3) The upper torso restraint straps (where installed) must remain on the occupant’s shoulder during the impact.

(4) The lap safety belt must remain on the occupant’s pelvis during the impact.

(5) Each occupant must be protected from serious head injury under the conditions p rescribed in sub - paragraph (b) of this paragraph. Where head contact with seats or other structure can occur, protection must be provided so that the head impact does not exceed a Head Injury Criterion (HIC) of 1000 units. The level of HIC is defined by th e equation – 2 . 5 𝑡 𝐻𝐼𝐶 = { ( 𝑡 − 𝑡 ) [ ∫ 𝑎 ( 𝑡 ) 𝑑𝑡 ] } 2 1 ( 𝑡 − 𝑡 ) 2 1 𝑡 𝑚𝑎𝑥 Where – t is the initial integration time, t is the final integration time, and a(t) is the total acceleration vs. time curve for the head strike, and where (t) is in seconds, and (a) is in units of gravity (g).

(6) Where leg injuries may result from contact with seats or other structure, protection must be provided to prevent axially compressive loads exceeding 1021 kg (2250 lb) in each femur.

(7) The seat must remain attached at all poin ts of attachment, although the structure may have yielded.

(8) Seats must not yield under the tests specified in sub - paragraphs (b)(1) and (b)(2) of this paragraph to the extent they would impede rapid evacuation of the aeroplane occupants.

[Amdt 25/15] [A mdt 25/17] [Amdt 25/21] Powered by EASA eRules Page 290 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) EMERGENCY LANDING CONDITIONS

AMC 25.562 Emergency landing dynamic conditions

ED Decision 2020/024/R FAA Advisory Circular (AC) 25.562 - 1B Change 1, Dynamic Evaluation of Seat Restraint Systems and Occupant Protection on Transport Airplanes , dated 30.9.2015 , and FAA AC 20 - 146A, Methodology for Dynamic Seat Certification by Analysis for Use in Parts 23, 25, 27, and 29 Airplanes and Rotorcraft , dated 29.6.2018, are accepted by the Agency as providing acceptable means of compliance with CS 25.562 .

[Amdt 25/17] [Amdt 25/26]

CS 25.563 Structural ditching provisions

ED Decision 2003/ 2/RM Structural strength considerations of ditching provisions must be in accordance with CS 25.801(e) .

Powered by EASA eRules Page 291 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – S TRUCTURE (CS - 25) FATIGUE EVALUATION

FATIGUE EVALUATION

CS 25.571 Damage tolerance and fatigue evaluation of structure

ED Decision 2017 / 015 /R (See AMC 2 5.571) (a) General. An evaluation of the strength, detail design, and fabrication must show that catastrophic failure due to fatigue, manufacturing defects, environmental deterioration, or accidental damage, will be avoided throughout the operational life of the aeroplane. This evaluation must be conducted in accordance with the provisions of subparagraphs (b) of this paragraph, except as specified in subparagraph (a)(4) of this paragraph, for each part of the structure that could contribute to a catastroph ic failure. Additionally, a discrete source damage evaluation must be conducted in accordance with subparagraph (e) of this paragraph, and those parts which could contribute to a catastrophic failure must also be evaluated in accordance with subparagraph ( d) of this paragraph. In addition, the following apply: (1) The evaluations of subparagraphs (b) and (c) must include : (i) The typical loading spectra, temperatures, and humidities expected in service; (ii) The identification of principal structural elemen ts and detail design points, the failure of which could contribute to a catastrophic failure of the aeroplane; and (iii) An analysis, supported by test evidence, of the principal structural elements and detail design points identified in sub - paragraph (a)( 1) (ii) of this paragraph.

(2) The service history of aeroplanes of similar structural design, taking due account of differences in operating conditions and procedures, may be used in the evaluations required by this paragraph.

(3) Based on the evaluations required by this paragraph, inspections or other procedures must be established as necessary to prevent catastrophic failure, and must be included in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness required by CS 25.1529 . The limit of validity of the engineering data that supports the structural maintenance programme (hereafter referred to as LOV), stated as a number of total accumulated flight cycles or flight hours or both, es tablished by this paragraph, must also be included in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness.

(4) If the results of the evaluation required by subparagraph (b) show that damage tolerance - based inspections are impractical, then an evaluation must be performed in accordance with the provisions of subparagraph (c).

If the results of the evaluation show that damage tolerance - based inspections are practical, then inspection thresholds must be established for all principal structural elements and detail design points. For the following types of structure, the threshold must be established based on analyses and/or tests, assuming the structure contains an initial flaw representative of a defect or damage of the maxi mum probable size that could exist as a result of manufacturing processes or manufacturing or service - induced damage: (i) single load path structure; and (ii) multiple load path ‘fail - safe’ structure and crack arrest ‘fail - safe’ structure, where it canno t be demonstrated that the resulting load path failure or partial failure (including arrested cracks) will be detected and repaired during normal Powered by EASA eRules Page 292 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION maintenance, inspection, or operation of an aeroplane prior to failure of the remaining structure.

(5) Inspection programmes must be established to protect the structure evaluated under subparagraph (b) and (c) against the effects of environmental deterioration and service - induced accidental damage. In addition, a baseline corrosion and prevention control p rogramme (CPCP) must be established. The Airworthiness Limitations Section of the Instructions for Continued Airworthiness must include a statement that requires the operator to include a CPCP in their maintenance programme that will control corrosion to L evel 1 or better.

(b) Fatigue and damage tolerance evaluation. The evaluation must include a determination of the probable locations and modes of damage due to fatigue, environmental deterioration (e.g.

corrosion), or accidental damage. Repeated load a nd static analyses, supported by test evidence and (if available) service experience, must be incorporated in the evaluation. Damage at multiple sites due to prior fatigue exposure (including special consideration of widespread fatigue damage) must be incl uded in the evaluation where the design is such that this type of damage could occur. An LOV must be established that corresponds to the period of time, stated as a number of total accumulated flight cycles or flight hours or both, for which it has been de monstrated by full - scale fatigue test evidence that widespread fatigue damage will not occur in the aeroplane structure.

The type certificate may be issued prior to completion of the full - scale fatigue testing provided that EASA has approved a plan for co mpleting the required tests and analyses, and that at least one calendar year of safe operation has been substantiated at the time of type certification. In addition, the Airworthiness Limitations Section of the Instructions for Continued Airworthiness mus t specify an interim limitation restricting aircraft operation to not more than half the number of the flight cycles or flight hours accumulated on the fatigue test article, until such testing is completed, freedom from widespread fatigue damage has been e stablished and the LOV is approved.

The extent of damage for residual strength evaluation at any time within the operational life of the aeroplane must be consistent with the initial detectability and subsequent growth under repeated loads. The residual strength evaluation must show that the remaining structure is able to withstand loads (considered as static ultimate loads) corresponding to the following conditions: (1) The limit symmetrical manoeuvring conditions specified in CS 25.331 at all speeds up to VC and in CS 25.345.

(2) The limit gust conditions specified in CS 25.341 at the specified speeds up to V and in C CS 25.345 .

(3) The limit rolling conditions specified in CS 25.349 and the limit unsymmetrical conditions specified in CS 25.367 and CS 25.427(a) through (c) , at speeds up to V .

C (4) The limit yaw manoeuvring conditions specif ied in CS 25.351 at the specified speeds up to V .

C (5) For pressurised cabins, the following conditions: (i) The normal operating differential pressure combined with the expected external aerodynamic pressures appl ied simultaneously with the flight loading conditions specified in sub - paragraphs (b)(1) to (b)(4) of this paragraph if they have a significant effect.

Powered by EASA eRules Page 293 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION (ii) The maximum value of normal operating differential pressure (including the expected external aerodynamic pressures during 1 g level flight) multiplied by a factor of 1·15 omitting other loads.

(6) For l anding gear and other affected airframe structure, the limit ground loading conditions specified in CS 25.473 , CS 25.491 and CS 25.493 .

If significant changes in structural stiffness or geometry, or both, follow from a structural failure, or partial failure, the effec t on damage tolerance must be further evaluated.

(c) Fatigue (safe - life) evaluation . Compliance with the damage - tolerance requirements of sub - paragraph (b) of this paragraph is not required if the applicant establishes that their application for particular structure is impractical. This structure must be shown by analysis, supported by test evidence, to be able to withstand the repeated loads of variable magnitude expected during its service life without detectable cracks. Appropriate safe - life scatter fact ors must be applied.

Until such time as all testing that is required for compliance with this subparagraph is completed, the replacement times provided in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness may not exceed the total accumulated flight cycles on the test article test life divided by the applicable scatter factor.

(d) Sonic fatigue strength. It must be shown by analysis, supported by test evidence, or by the service history of aeroplanes of similar structural design and sonic excitation env ironment, that: (1) Sonic fatigue cracks are not probable in any part of the flight structure subject to sonic excitation; or (2) Catastrophic failure caused by sonic fatigue cracks is not probable assuming that the loads pre scribed in sub - paragraph (b) of this paragraph are applied to all areas affected by those cracks.

(e) Discrete source damage tolerance evaluation. The aeroplane must be capable of successfully completing a flight during which likely structural damage occur s as a result of b ird impact as specified in CS 25.631 .

The damaged structure must be able to withstand the static loads (considered as ultimate loads) which are reasonably expected to occur at the time of the occu rrence and during the completion of the flight. Dynamic effects on these static loads do not need to be considered.

Corrective action to be taken by the pilot following the incident, such as limiting manoeuvres, avoiding turbulence, and reducing speed, may be considered. If significant changes in structural stiffness or geometry, or both, follow from a structural failure or partial failure, the effect on damage tolerance must be further investigated.

[Amdt 25/18] [Amdt 25/19]

AMC 25.571 Damage tolerance an d fatigue evaluation of structure

ED Decision 2017/017/R 1. PURPOSE This AMC provides guidance for compliance with the provisions of CS 25.571 pertaining to the damage tolerance and fatigue evaluation requirements for aeroplane metallic and non - metallic structure. It also provides rational guidelines for the evaluation of scatter factors for the determination of life limits for parts categorised as safe - life. Additional guidance material for certification of non - metallic structures that must also comply with CS 25.571 is contained in AMC 20 - 29.

Powered by EASA eRules Page 294 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUA TION 2. (RESERVED) 3. REFERENCES CS 25.571 Damage tolerance and fatigue evaluation of structure, CS 25.1529 Instructions for Continued Airworthiness, AMC 20 - 20 Continued Structural Integrity Programme, AMC 20 - 29 Composite Structure.

4. DEFINITIONS OF TERMS USED IN THIS AMC ‘Damage tolerance’ is the attribute of the structure that permits it to retain its required residual strength without detrimental structural deformation for a period of use after the st ructure has sustained a given level of fatigue, environmental, accidental, or discrete source damage.

‘Fatigue critical structure (FCS)’ is structure that is susceptible to fatigue cracking that could lead to a catastrophic failure of an aircraft.

‘Safe - l ife’ of a structure is that number of events such as flights, landings, or flight hours, during which there is a low probability that the strength will degrade below its design ultimate value due to fatigue cracking.

‘Design service goal (DSG)’ is the per iod of time (in flight cycles or flight hours, or both) established at design and/or certification during which the aircraft structure is reasonably free from significant cracking.

‘Principal structure element (PSE)’ is an element that contributes signifi cantly to the carrying of flight, ground, or pressurisation loads, and whose integrity is essential in maintaining the overall structural integrity of the aeroplane.

‘Detail design point (DDP)’ is an area of structure that contributes to the susceptibility of the structure to fatigue cracking or degradation such that the structure cannot maintain its load carrying capability, which could lead to a catastrophic failure.

In ‘single load path structure’ the applied loads are carried through a single structural member, the failure of which would result in the loss of the structural capability to carry the applied loads.

In ‘multiple load path structure’ the applied loads are distributed through redundant structural members so that the failure of a single structu ral member does not result in the loss of structural capability to carry the applied loads.

‘Widespread fatigue damage (WFD)’ in a structure is characterised by the simultaneous presence of cracks at multiple structural details that are of sufficient size and density whereby the structure will no longer meet the residual strength requirement of CS 25.571(b).

(1) ‘Multiple site damage (MSD)’ is a source of widespread fatigue damage characterised by the simultaneous presence of fatigue cracks in the same stru ctural element.

(2) ‘Multiple element damage (MED)’ is a source of widespread fatigue damage characterised by the simultaneous presence of fatigue cracks in adjacent structural elements.

(3) ‘Structural modification point (SMP)’ is the point in time when a structural area must be modified to preclude WFD.

Powered by EASA eRules Page 295 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION (4) ‘Inspection start point (ISP)’ is the point in time when special inspections of the fleet are initiated due to a specific probability of having an MSD/MED condition.

‘Scatter factor’ is a life reduc tion factor used in the interpretation of fatigue analysis and fatigue test results.

‘Limit of validity’ (LOV) of the engineering data that supports the structural maintenance programme is not more than the period of time, stated as a number of total accum ulated flight cycles or flight hours or both, during which it is demonstrated by test evidence, analysis and, if available, service experience and teardown inspection results of high - time aeroplanes, that widespread fatigue damage will not occur in the aer oplane structure ‘Normal maintenance’ is understood to be those scheduled maintenance checks during minor or base maintenance inputs requiring general visual inspections and is normally associated with a zonal programme. The zonal programme is a collective term comprising selected general visual inspections and visual checks that are applied to each zone, defined by access and area, to check system and power plant installations and structure for security and general condition.

A general visual inspection is a visual examination of an interior or exterior area, installation, or assembly to detect obvious damage, failure, or irregularity. This level of inspection is made from within touching distance unless otherwise specified. A mirror may be necessary to enh ance visual access to all exposed surfaces in the inspection area. This level of inspection is made under normally available lighting conditions such as daylight, hangar lighting, flashlight, or droplight and may require removal or opening of access panels or doors. Stands, ladders, or platforms may be required to gain access.

‘Teardown inspection’ is the process of disassembling structure and using destructive inspection techniques or visual (magnified glass and dye penetrant) or other, and non - destructive inspection methods (eddy current, ultrasonic) to identify the extent of damage, within a structure, caused by fatigue, environmental and accidental damage.

‘Fail - safe’ is the attribute of the structure that permits it to retain its required residual strength for a period of unrepaired use after the failure or partial failure of a principal structural element.

‘WFD ’ is the point in time when, without intervention, 50 % of the fleet is expected (average behaviour) to develop WFD for a particula r structure.

‘Level 1 corrosion’ is: damage occurring between successive inspections that is within allowable damage limits; or damage occurring between successive inspections that does not require structural reinforcement, replacement or new damage toler ance based inspections; or corrosion occurring between successive inspections that exceeds allowable limits but can be attributed to an event not typical of operator usage of other aircraft in the same fleet; or light corrosion occurring repeatedly between inspections that eventually requires structural reinforcement, replacement, or new damage - tolerance - based inspections.

5. BACKGROUND (a) Since the early 1970s, there have been significant state - of - the - art and industry - practice developments in the area of structural fatigue and fail - safe strength evaluation of transport category aeroplanes. Recognising that these developments could warrant some revision of the existing fatigue requirements of § 25.571 and 25.573 of 14 CFR Part 25, the Federal Aviation Admi nistration (FAA), on 18 November 1976 (41 FR 50956), gave notice of the Transport Category Aeroplane Fatigue Regulatory Review Programme and Powered by EASA eRules Page 296 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION invited interested persons to submit proposals to amend those requirements. The proposals and related discussions f ormed the basis for the revision of the structural fatigue evaluation standards of § 25.571 and § 25.573 of 14 CFR Part 25 and the development of guidance material. To that end, § 25.571 was revised, § 25.573 was deleted (the scope of § 25.571 was expanded to cover the substance of the deleted section), and guidance material (FAA AC 25.571 - 1) was provided which contained compliance provisions related to the proposed changes.

(b) Since the issuance of FAA AC 25.571 - 1 on 28 September 1978, additional guidance material, including information regarding discrete source damage, was developed and incorporated in revision 1A on 5 March 1986. The AC was further revised on 18.2.1997 (revision 1B) to add guidance on the elements to be considered in developing safe - life scatter factors for certification. Although FAR, JAR, and CS 25.571 have, since 1978, required consideration of fatigue damage originating at multiple sites, the FAA AC was further revised on 29 April 1998 (revision 1C) to add guidance material whose obje ctive was to preclude widespread fatigue damage (resulting from MSD or MED) from occurring within the design service goal of the aeroplane, and to aid in the determination of thresholds for fatigue inspection and/or other special fleet actions. JAR/CS 25.5 71 were not harmonised with the 1998 amendment of 14 CFR 25.571. Under the auspices of the Aviation Rulemaking Advisory Committee (ARAC), the General Structure Harmonization Working Group (GSHWG) drafted NPA 25C - 292 proposing the Limit of Validity (LOV), g reater emphasis on testing, corrosion and manufacturing, and accidental damage in the 25.571 requirements and corresponding AC material to support this. EASA AMC 20 - 20 ‘Continuing Structural Integrity Programme’ introduced the LOV - concept in 2007.

AC 25.57 1 - 1D, issued on 13 January 2011, provides guidance in support of 14 CFR 25 Amdt 132 which introduced the LOV requirement. Thus, AMC 25.571 has been revised to provide guidance for establishing an LOV for the structural maintenance programme as will now be required by CS 25.571. In conclusion, this AMC revision based on the GSHWG work and recently developed FAA guidance, now better harmonises with the EASA guidance, AC 25.571 - 1D, and industry practice.

6. INTRODUCTION (a) General The content of this AMC is considered by EASA in determining compliance with the requirements of CS 25.571. The objective is to prevent catastrophic structural failures caused by fatigue damage (FD) (including e.g. widespread fatigue damage (WFD)), environmental deterioration (ED) ( e.g. corrosion damage), or accidental damage (AD).

Compliance involves good design practice to ensure that damage tolerance can be achieved and the establishment of maintenance actions developed in compliance with CS 25.1529. Taken together, they result in a structure where the combination of design characteristics and maintenance actions will serve to preclude any failure due to FD, ED, or AD.

CS 25.571(a)(3) requires the applicant to establish inspections or other procedures (herein also referred to as maintenance actions) as necessary to avoid catastrophic failure during the operational life of the aeroplane based on the results of the prescribed fatigue and damage tolerance evaluations.

CS 25.571(a)(5) requires development of inspections for ED and AD. CS 25.571(b) requires the applicant to establish an LOV. Furthermore, CS 25.571(b) and (c) require establishment of inspections and replacement times respectively based on the damage Powered by EASA eRules Page 297 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION tolerance and fatigue characteristics of the structure. The LOV is, in effect, the operational life of the aeroplane consistent with the evaluations accomplished and maintenance actions established to prevent WFD. The LOV is established based on WFD considerations and it is intended that all maintenance actions require d to address fatigue damage, environmental deterioration (e.g. corrosion damage for metallics, moisture for composites), and accidental damage (e.g. impact, lightning), up to the LOV, are identified in the structural maintenance programme. All inspections and other procedures (e.g.

modification times, replacement times) that are necessary to prevent a catastrophic failure due to fatigue, up to the LOV, must be included in the Airworthiness Limitations Section (ALS) of the Instructions for Continued Airworth iness (ICA), as required by CS 25.1529, along with the LOV.

CS 25.571(d) requires the structure to be designed such that sonic fatigue cracking is not probable or, if it arises, it will not result in a catastrophic failure. CS 25.571(e) requires the struct ure to be designed to withstand damage caused by specified threats such that the flight during which the damage is sustained can be completed.

(1 ) CS 25.571(a)(5) — Environmental and accidental damage inspections and associated procedures Inspections for ED and AD must be defined. Special consideration should be given to those areas where past service experience indicates a particular susceptibility to attack by the environment or vulnerability to impact and/or abuse. It is intended that these inspections will be effective in discovering ED or AD before it interacts with fatigue related phenomena, and that the ED or AD will, therefore, be removed/repaired before it presents a significant risk. Typically these inspections are largely defined based on past se rvice experience using a qualitative or quantitative process in combination with the Airline Transportation Association (ATA) Maintenance Steering Group (MSG) - 3 process. For new structure and materials, testing may be required to evaluate likely AD and the subsequent tolerance of the design to it. For ED prevention, an effective CPCP is necessary, which will contain tasks and procedures in addition to inspections that will help prevent initiation and, when necessary, the recurrence of corrosion (see AMC 20 - 20). Furthermore, CS 25.571 requires that the ALS must include a statement that requires the operator to include a CPCP in their maintenance programme that will control the corrosion to Level 1 or better.

Any special inspections required for AD and ED, i.e . ones in addition to those that would be generated through the use of the MSG - 3 process for AD and ED, or the baseline CPCP development, and which are necessary to prevent catastrophic failure of the aeroplane, must be included in the ALS of the ICA requi red by CS 25.1529. If a location is prone to accidental or environmental damage and the only means for detection is one that relies on the subsequent development of a fatigue crack from the original damage, then that inspection must be placed in the ALS of the ICA.

Note: The AD and ED inspection programme including the baseline CPCP are equally applicable to structures showing compliance with CS 25.571(b) and (c) respectively.

Powered by EASA eRules Page 298 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION (2) CS 25.571(b) and (c) — Fatigue damage inspections or replacement times Ins pections for fatigue damage or replacement times must be established as necessary. These actions must be based on quantitative evaluations of the fatigue characteristics of the structure. In general, analysis and testing will be required to generate the in formation needed. The applicant should perform crack growth and residual strength testing to produce the design data needed to support crack growth and residual strength analyses. Full - scale fatigue test evidence is required to support the evaluation of st ructure that is susceptible to WFD. Test evidence is needed to support analysis used to establish safe - life replacement times.

(i ) Inspection or replacement Compliance with CS 25.571(b) is required unless it can be demonstrated to the satisfaction of the authority that compliance cannot be shown due to practical constraints. Under these circumstances, compliance with CS 25.571(c) is required. The only common example of structure where compliance with the requirements of CS 25.571(c), in lieu of CS 25.571(b), might be accepted, would be the landing gear and its local attachments.

(ii) ALS of the ICA All inspections and replacement times necessary to detect or preclude fatigue cracking scenarios, before they become critical, must be includ ed in the ALS of the ICA required by CS 25.1529.

(iii) Limit of Validity (LOV) An LOV for the structural maintenance programme must also be determined and included in the ALS of the ICA. See section 11 of this AMC for additional guidance on the LOV.

(b) Ty pical loading spectrum expected in service The loading spectrum should be based on measured statistical data of the type derived from government and industry load history studies, and where insufficient data are available on a conservative estimate of the anticipated use of the aeroplane. The development of the loading spectrum includes the definition of the expected flight plan, which involves ground manoeuvres, climb, cruise, descent, flight times, operating speeds, weights and altitudes, and the approxi mate time to be spent in each of the operating regimes. The principal loads that should be considered in establishing a loading spectrum are flight loads (gust and manoeuvre), ground loads (taxiing, landing impact, turning, engine run - up, braking, thrust r eversing and towing), and pressurisation loads.

Operations for crew training and other pertinent factors, such as the dynamic stress characteristics of any flexible structure excited by turbulence or buffeting, should also be considered. For pressurised ca bins, the loading spectrum should include the repeated application of the normal operating differential pressure and the superimposed effects of flight loads and aerodynamic pressures.

(c) Areas to be evaluated When assessing the possibility of serious fat igue failures, the design should be examined to determine probable points of failure in service. In this examination consideration should be given, as necessary, to the results of stress analyses, static tests, fatigue tests, strain gauge surveys, tests of similar structural configurations, and service experience.

Service experience has shown that special attention should be focused on the design Powered by EASA eRules Page 299 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION details of important discontinuities, main attach fittings, tension joints, splices, and cut - outs such as window s, doors, and other openings. Locations prone to accidental damage (such as that due to the impact with ground servicing equipment near aeroplane doors) or to corrosion should be identified for analysis.

(d) Analyses and tests Fatigue and damage tolerance analyses should be conducted unless it is determined that the normal operating stresses are of such a low order that crack initiation and, where applicable, significant damage growth is extremely improbable. Any method used in the analyses should be suppor ted by test or service experience. Typical (average) values of fatigue respectively fracture mechanics material properties may be used in fatigue analysis respectively residual strength and crack growth analyses. The effects of environment on these propert ies should be accounted for if significant.

Generally, testing will also be necessary to support compliance with CS 25.571(b) or (c).

The nature and extent of testing of complete structures or portions will depend on applicable previous design and structu ral tests and service experience with similar structures. Structural areas such as attachment fittings, major joints, changes in section, cut - outs, and discontinuities almost always require some level of testing in addition to analysis. When less than the complete structure is tested, care should be taken to ensure that the internal loads and boundary conditions are valid. When tests are conducted to support the identification of areas susceptible to fatigue, the duration of the test should take into accoun t factors such as material and loading spectrum variability, together with the expected operational life. Refer to Appendix 2 for specific guidance regarding testing required to establish the LOV.

(e) Discrete source damage It must be shown that the aeropl ane is capable of successfully completing a flight during which specified incidents occur and result in immediately obvious damage. The maximum extent of the damage must be quantified and the structure must be shown to be capable of sustaining the maximum load (considered as ultimate) expected during the completion of the flight. There are no maintenance actions that result from this evaluation.

7. DAMAGE TOLERANCE EVALUATION (a) General The damage tolerance requirements of CS 25.571(b) are intended to ens ure that, should fatigue, corrosion, or accidental damage occur within the LOV, the structure will be capable of withstanding the loading conditions specified in CS 25.571(b)(1) through (b)(6) without failure or detrimental structural deformation until the damage is detected. The evaluation should include identifying the PSEs, defining the loading conditions and conducting sufficiently representative structural tests or analyses, or both, to provide sufficient data for the establishment of the inspection pr ogramme. Although this process applies to either single or multiple load path structure, the use of multiple load path structures should be given priority in achieving a damage - tolerant design. The principle analytical tool used for metallic materials to p erform a damage tolerance evaluation is based on fracture mechanics. A discussion of this approach is presented in Appendix 1 of this guidance material. The means of establishing the LOV and maintenance actions specifically associated to WFD is addressed i n detail in Section 11 of this AMC.

Powered by EASA eRules Page 300 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION (b) Damage - tolerant characteristics A damage - tolerant structure has two notable attributes: (1) The structure can tolerate a significant amount of damage, due to fatigue, environmental or accidental deterioration witho ut compromising the continued airworthiness of the aeroplane (residual strength and rigidity).

(2) The structure can sustain that damage long enough to be found and repaired during scheduled or unscheduled maintenance (inspectability).

(c) Design considerations To achieve a damage - tolerant structure, criteria should be established to guide the design process so that this design objective is achieved. The design process should include a damage tolerance evaluation (test and analysis) to demonstrate that the damage - tolerant design objectives are achieved, and to identify inspections or other procedures necessary to prevent catastrophic failure. Reliance on special inspections should be minimised by designing structure with easily detectabl e (e.g. visual) cracking modes.

Since the occurrence of WFD can complicate a damage - tolerant evaluation to the point that reliable inspections programmes cannot be developed even with extremely intensive inspection methods, it must be demonstrated, with su fficient full - scale fatigue test evidence, that adequate maintenance procedures are contained in the ALS of the ICA, such that WFD will not occur within the LOV. A discussion on several issues that an applicant might face in demonstrating freedom from WFD is contained in Appendix 2 to this AMC.

(d) Design features Design features which should be considered in attaining a damage - tolerant structure include the following: (1 ) multiple load path construction and/or the use of damage containment features to arre st fast fracture or reduce the crack growth rate, and to provide adequate residual strength; (2) materials and stress levels that provide a slow rate of crack propagation combined with high residual strength; and (3) arrangement of design details to ensure a sufficiently high probability that a failure in any critical structural element will be detected before the strength has been reduced below the level necessary to withstand the loading conditions specified in CS 25.571(b).

(e) Probabilistic evaluations No guidance is provided in this AMC on probabilistic evaluation. Normally, damage tolerance assessments consist of a deterministic evaluation of design features described in paragraphs 7(d)(1), (2) and (3). Paragraphs (f) to (i) below provide guidelines f or this approach.

(f) PSEs, detail design points, and locations to be evaluated In accordance with CS 25.571(a), a damage tolerance and fatigue evaluation should be conducted for each part of the structure which could contribute to a catastrophic failure.

PSEs such as wing, empennage, control surfaces and their systems, the fuselage, engine mountings, landing gears, and their related primary attachments, and all DDPs susceptible to fatigue that could contribute to a catastrophic failure should be evaluated .

Powered by EASA eRules Page 301 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes S UBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION In accordance with CS 25.571(a)(1)(ii), this evaluation must include the identification of PSEs and DDPs, the failure of which could contribute to catastrophic failure of the aeroplane. As defined in this AMC, a principal structural element is an element of structure that contributes significantly to the carrying of flight, ground, or pressurisation loads and whose integrity is essential in maintaining the overall structural integrity of the aeroplane. When identifying PSEs, consideration should be given to the effect caused by partial or complete loss or failure of structure with respect to continued safe flight and landing, considering all flight phases including stability, control and aeroelasticity.

A DDP is an area at higher risk of fatigue cracking t han other areas, and may warrant specific actions such as special inspections or other procedures to ensure continued airworthiness.

(1 ) Locations requiring evaluation can be determined by analysis or by fatigue tests on complete structures or subcomponent s. However, tests may be necessary when the basis for analytical prediction is not reliable, such as for complex components.

If less than the complete structure is tested, care should be taken to ensure that the internal loads and boundary conditions are v alid.

The selection criteria for DDPs should also include the following considerations: (a ) any evidence of cracking encountered in service on a comparable structure; (b) any evidence of cracking found during fatigue testing on a comparable structure; (c ) available strain gauge data; (d) locations where permanent deformation occurred on static test articles; (e) areas analytically shown to have a relatively low crack initiation life; (f) susceptibility to corrosion or other environmental deterioration (e. g.

disbonding); (g) potential for manufacturing anomalies (e.g. new or novel manufacturing processes where the potential for damage may not be well understood); (h) vulnerability to in - service induced accidental damage; (i) areas whose failure would create high stresses in the remaining structure; (j) elements in high tension or shear; (k) low static margin; (l) high stress concentrations; (m) high load transfer; (n) materials with high crack growth rates; (o) some DDPs may exist outside of PSEs and may also have been classified as fatigue critical structure, e.g. undercarriage door attachments (see Appendix 5 for discussion on PSEs, FCS and DDP); (p) areas where detection of damage would be difficult; (q) locations subject to vibrations or other mechanis ms that may lead to premature wear fastener holes; and (r) locations vulnerable to moisture ingress or retention.

Powered by EASA eRules Page 302 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION (2) Examples of principal structural elements (PSEs) Typical examples of structure which are usually considered to be PSEs are: (i ) Wing and empennage (a) control surfaces, slats, flaps, and their mechanical systems and attachments (hinges, tracks, and fittings); (b) primary fittings; (c) principal splices; (d) skin or reinforcement around cut - outs or discontinuities; (e) skin - stringer comb inations or integrally stiffened plates; (f) spar caps; (g) spar webs; and (h) ribs and bulkheads.

(ii) Fuselage (a ) circumferential frames and adjacent skin; (b) pilot window posts; (c) pressure bulkheads; (d) skin and any single frame or stiffener elemen t around a cut - out; (e) skin or skin splices, or both, under circumferential loads; (f) skin or skin splices, or both, under fore and aft loads; ( g) skin and stiffener combinations under fore and aft loads; (h) door skins, frames, stops and latches; (i) window frames; and (j) floor beams .

(iii) Landing gear and their attachments (iv) Engine mounts and struts (v) Thrust reverser components, whose failure could result in inadvertent deployment (3) Extent of Dama ge.

Each particular design should be assessed to establish appropriate damage criteria in relation to inspectability and damage - extension characteristics. In any damage determination, including those involving multiple cracks, it is possible to establish the e xtent of damage in terms of detectability with the inspection techniques to be used, the associated initially detectable crack size, the residual strength capabilities of the structure, and the likely damage - extension rate considering the expected stress r edistribution under the repeated loads expected in service and with the expected inspection frequency. Thus, an obvious partial failure could be Floor beams are not always critical but should be checked for criticality, particularly those located next to cut - outs or within non - circular pressurised sections.

Powered by EASA eRules Page 303 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION considered to be the extent of the damage or residual strength assessment, provided a positive determination is made that the fatigue cracks will be detectable by the available inspection techniques at a sufficiently early stage of the crack development. The following are typical examples of partial failures which should be considered in the evaluation: (i ) Detecta ble skin cracks emanating from the edge of structural openings or cutouts; (ii) A detectable circumferential or longitudinal skin crack in the basic fuselage structure; (iii) Complete severance of interior frame elements or stiffeners in addition to a dete ctable crack in the adjacent skin; (iv) A detectable failure of one element where dual construction is utilised in components such as spar caps, window posts, window or door frames, and skin structure; (v) The presence of a detectable fatigue failure in at least the tension portion of the spar web or similar element; and (vi) The detectable failure of a primary attachment, including a control surface hinge and fitting.

(g) Inaccessible areas Every reasonable effort should be made to ensure inspectability (r eference CS 25.611) of all structural parts. In those cases where inaccessible and uninspectable blind areas exist, the damage tolerance evaluation should allow for extension of damage into detectable areas or demonstrate sufficient residual strength up to the LOV without inspection.

(h) Residual strength testing of principal structural elements Analytical prediction of the residual strength of structures can be very complex due to non - linear behaviour, load redistribution and the potential for a multiplici ty of failure modes. The nature and extent of residual strength tests will depend on previous experience with similar structures. Simulated cracks should be as representative as possible of actual fatigue damage. Where it is not practical to produce actual fatigue cracks, damage can be simulated by cuts made with a fine saw, sharp blade, guillotine, or other suitable means. Whatever artificial means are used to simulate sharp fatigue cracks, sufficient evidence should be available from tests to indicate equ ivalent residual strength. If equivalency cannot be shown, every attempt should be made to apply enough cyclic loading to generate fatigue cracks from the artificial damage prior to applying residual strength loads. Special consideration should be given to the procedure for pre - cracking so that subsequent test results are representative. This can be an issue when slow stable tearing in ductile sheet or plate material is part of the failure mechanism.

Inappropriate pre - cracking loads can lead to non - conserva tive results. In those cases where bolt failure, or its equivalent, is to be simulated as part of a possible damage configuration in joints or fittings, bolts can be removed to provide that part of the simulation.

Powered by EASA eRules Page 304 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FA TIGUE EVALUATION (i ) Damag e tolerance analysis and tests (1) It should be determined by analysis, sup ported by test evidence, that: (i) the structure, with the extent of damage established for residual strength evaluation, can withstand the specified residual strength loads (considered as ultimate loads); and ( ii) the crack growth life under the repeated loads expected in service (between the time the damage becomes initially detectable and the time the extent of damage reaches the value for residual strength evaluation) provides a practical basis for developmen t of the inspection programme and procedures described in Section 8 of this AMC.

(2) The repeated loads should be as defined in the loading, temperature, and humidity spectra. The loading conditions should take into account the effects of structural flexibility and rate of loadi ng where they are significant.

(3) The damage tolerance characteristics can be shown analytically by reliable or conservative methods such as the following: (i) By demonstrating quantitative relationships with struct ure already verified as damage - tolerant; or (ii) By demonstrating that the repeated loads and residual strength load stresses do not exceed those of previously verified designs of similar configuration, materials, and inspectability.

8. INSPECTION REQUIREM ENTS (a) Damage detection Detection and repair of damage before it becomes critical is the most important factor in ensuring that the damage tolerance characteristics of the structure are maintained. For this reason, CS 25.571 requires that the applicant e stablish inspections or other procedures, as necessary, to prevent catastrophic failure from accidental, environmental, or fatigue damage, and include those inspections and procedures in the ALS of the Instructions for Continued Airworthiness required by C S 25.1529 (see also Appendix H to Part - 25).

Due to the complex interactions of the many parameters that affect the damage tolerance evaluation, such as operating practices, environmental effects, load sequence effects on crack growth, and variations in ins pection methods, operational experience should be taken into account in establishing inspection thresholds, repeat intervals, and inspection procedures.

(b) Environmental and accidental damage inspection programmes The inspections developed under CS 25.57 1(b) are primarily for the detection of cracks developing from fatigue, accidental damage, and corrosion. As required by CS 25.571(a)(5), a separate programme needs to be implemented for the early detection of environmental and accidental damage. This is i ntended to minimise the risk of: (1 ) interaction between corrosion and fatigue cracking; (2) accidental damage developing into fatigue cracks; or Powered by EASA eRules Page 305 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION (3) corrosion developing due to accidental damage.

In many cases this can be accomplished through the Maintenance Review Board (MRB) activity or equivalent process agreed by EASA, for a new large aeroplane model using MSG - 3 procedures. These procedures also require that a CPCP be developed.

For ED and AD programmes developed under the auspices of the MRB, the minimum ALS content associated with AD and ED may generally be limited to: — a reference to the documents that contain the MRB report (MRBR) derived maintenance tasks for AD and ED; and — the need to inc orporate and maintain an effective CPCP in the operators’ programme; and — a statement requiring operators to control corrosion to Level 1 or better.

It is also important to explain to operators the link between the AD and ED inspection programmes and CS 25 .571 and CS 25.1529 compliance.

Inspections that are designed to detect fatigue cracking resulting from AD or ED, where the originating damage cannot otherwise be demonstrated to be detected prior to the development of the fatigue cracks, must also be dir ectly included in the ALS. For new structure where there is limited supporting data from service experience, the MRB will depend heavily on input from the analyses and test programmes conducted by the applicant during certification, and for this reason sig nificant cooperation is required between those involved directly in certification and those participating in the MRBR development. Care should also be taken to ensure that the damage assumptions made remain conservative after entry into service. A check of the continued validity of the certification assumptions can be achieved through fleet leader programmes and robust reporting requirements. If there is any doubt about the likely performance of a completely new structure with respect to AD and ED, certain specific inspections in vulnerable areas may be better placed in the ALS.

The baseline CPCP may be established through the MRB Industry Steering Committee (ISC) using existing procedures for MRBR development or developed by the applicant and submitted dire ctly to EASA. (Note: Provided the operator has an NAA - approved maintenance programme that controls corrosion to Level 1 or better, it does not need to follow exactly the baseline CPCP offered by the type certificate holder (TCH). However, all revisions to the TCH’s programme for ED and AD must be considered by the operator for incorporation in the operators MP under the Part - M requirements.)

Reporting requirements for these programmes should extend to overhaul procedures where the condition of the part shou ld be assessed and reported if outside of approved limits, whether or not it is to remain on the component being overhauled.

Changes and supplemental type certificates (STC) must also be provided with inspection programmes that address ED and AD.

(c) Inspe ction threshold for fatigue cracking The inspection threshold is the point in time at which the first planned structural inspection is performed following entry into service. The threshold may be as low as the repeat interval, or may allow for a longer period of operation, provided certain co nditions are met.

Powered by EASA eRules Page 306 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION The concept of delaying an inspection threshold beyond the repeat interval is based on the premise that it will take a certain amount of time before fatigue cracks would develop to a size that would be detectable during a structural insp ection. Consequently, it may be acceptable to wait some period of time before starting to inspect for fatigue cracks.

CS 25.571(a)(4) requires inspection thresholds for certain structure to be derived assuming that the structure contains an initial flaw o f the maximum probable size that could exist as a result of manufacturing processes or manufacturing or service - induced damage. For metallic structure this would typically be achieved using crack growth analysis supported by tests. This approach applies to : (1 ) single load path structure, and (2) multiple load path ‘fail - safe’ structure and crack arrest ‘fail - safe’ structure, where it cannot be demonstrated that the resulting load path failure or partial failure (including arrested cracks) will be detected and repaired during normal maintenance, inspection, or operation of an aeroplane prior to failure of the remaining structure.

In this context, normal maintenance includes general visual structural inspections for accidental and environmental damage derived from processes such as the MRB application of MSG - 3. Inspections should begin early enough to ensure that there is a high confidence of detecting cracks before they could lead to a catastrophic structural failure.

For the locations addressed by CS 25.571 (a)(4) that are also susceptible to accidental (manufacturing or service induced) damage, the assumed initial flaw size for crack growth determination of the threshold should not be less than that which can be supported by service experience or test eviden ce. For example, if the type of damage expected is well defined, e.g. it is limited to dents, then there may be data that supports a longer threshold than would be derived by the assumption of a crack that is similar in size to the dent.

However, in this c ase, the worst case manufacturing flaw should still be considered as a crack and the most conservative resulting threshold adopted. If supporting data is not available (e.g. for a completely new design where no specific investigation of the accidental dama ge threats or their influence on fatigue has been made), then the fatigue cracking inspection threshold should be set equal to the repeat interval derived for a crack detectable by general visual inspection means, since the initial damage and its growth is not well defined and could occur at any time.

The remaining areas of the structure evaluated under CS 25.571(b), i.e. multiple load path ‘fail - safe’ structure and crack arrest ‘fail - safe’ structure, where it can be demonstrated that the resulting load pa th failure, partial failure, or crack arrest will be detected and repaired during normal maintenance, inspection, or operation of an aeroplane prior to failure of the remaining structure must also have thresholds established for fatigue cracking. For these locations, methods that do not account for worst - case damage may be used in lieu of crack growth analysis if desired. For example, fatigue SN analysis and tests with an appropriate scatter factor or slow crack growth analysis based on appropriate initial manufacturing damage, i.e. typical manufacturing flaws as opposed to the maximum probable flaw (e.g. a 0.127 mm corner crack representing a typical manufacturing flaw in a fastener hole versus a 1.27 mm crack representing the maximum probable flaw).

The me ans of establishing the LOV and maintenance actions (including inspections) specifically associated to WFD is addressed in detail in Section 11 of this AMC.

Powered by EASA eRules Page 307 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION All inspections necessary to detect fatigue cracking that have thresholds less than the approved op erating limitation (LOV or interim limitations) of the maintenance programme must be included in the ALS.

Appendix 3 provides further details on threshold determination.

(d) Inspection The basis for setting inspection intervals is the period of time duri ng which damage is detectable and the residual strength remains above the required levels. The reliability of the repeat inspection programme (i.e. frequency of inspections and probability of detection) should assure damage detection before the residual st rength of the aircraft is compromised. Inspection intervals must be established by applying appropriate reduction factors to this period to ensure that the crack or other damage or failed load path will typically be found well before the residual strength of the structure drops below the required level. Long periods of exposure to residual strength levels only just above the load limit should be avoided. This applies in particular to crack - arrest structure. It should be borne in mind that CS 25.305 is the p rinciple requirement for strength of the airframe, and that CS 25.571 is primarily intended to provide an inspection programme that will ensure the timely detection and repair of damage in order to restore the aircraft to the required (CS 25.305) strength capability and preserve this capability throughout the majority of the aircraft’s operational life.

Detectable crack sizes and shapes assumed to determine inspection intervals should be consistent with the inspection method capabilities and the cracking c haracteristics of the structure being evaluated. If concurrent cracking in adjacent areas or surrounding structure is expected within the operational life of the aeroplane, then this should be accounted for in the cracking scenario assumed.

9. FATIGUE (SAF E - LIFE) EVALUATION 9.1. Reserved 9.2. Fatigue (safe - life) evaluation 9.2.1. General The evaluation of structure under the following fatigue (safe - life) strength evaluation methods is intended to ensure that catastrophic fatigue failure, as a result of the repeated loads of variable magnitude expected in service, will be avoided throughout the structure’s operational life. Under these methods the fatigue life of the structure should be determined. The evaluation should include the following: (a) estimati ng or measuring the expected loading spectra of the structure; (b) conducting a structural analysis, including consideration of the stress concentration effects; (c) performing fatigue testing of structure which cannot be related to a test background to es tablish response to the typical loading spectrum expected in service; (d) determining reliable replacement times by interpreting the loading history, variable load analyses, fatigue test data, service experience, and fatigue analysis; Powered by EASA eRules Page 308 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION (e) evaluating the po ssibility of fatigue initiation from sources such as corrosion, stress corrosion, disbonding, accidental damage, and manufacturing defects based on a review of the design, quality control, and past service experience; and (f) providing necessary maintenanc e instructions including replacement times in the ICA in accordance with CS 25.1529.

9.2.2. Scatter factor for safe - life determination In the interpretation of fatigue analyses and test data the effect of variability should, under CS 25.571(c), be accounted for by an appropriate scatter factor. In this process it is appropriate that the applicant justifies the scatter factor chosen for any safe - life part. The following guidance is provided (see Figure 1): (a) The base scatter factor s (BSF) applicable to test results are: BSF1 = 3.0, and BSF2 = (see paragraph 9.2.2(e) of this AMC). If the applicant can meet the requirements of 9.2.2(c) of this AMC, he/she may use BSF1 or, at his/her option, BSF2.

(b) The base scatter factor, BSF1, is associated with test results of one representative test specimen.

(c) Justification for use of BSF1. BSF1 may only be used if the following criteria are met: (i) Understanding of load paths and failure modes Service and test experience of similar in - service components that were designed using similar design criteria and methods should demonstrate that the load paths and potential failure modes of the components are well understood.

(ii) Control of design, material, and manufacturing process qualit y The applicant should demonstrate that his/her quality system (e.g.

design, process control, and material standards) ensures the scatter in fatigue properties is controlled, and that the design of the fatigue - critical areas of the part account for the mat erial scatter.

(iii) Representativeness of the test specimen (A ) The test article should be full scale (component or subcomponent) and represent that portion of the production aircraft requiring test. All differences between the test article and the produc tion article should be accounted for either by analysis supported by test evidence, or by testing itself.

(B) Construction details, such as bracket attachments, clips, etc., should be accounted for, even though the items themselves may be non - loadbearing.

(C) Points of load application and reaction should accurately reflect those of the aircraft, ensure correct behaviour of the test article, and guard against uncharacteristic failures.

Powered by EASA eRules Page 309 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION (D) Systems used to protect the structure against environmental degradat ion can have a negative effect on fatigue life, and therefore, should be included as part of the test article.

(d) Adjustments to base scatter factor BSF1. Having satisfied the criteria of paragraph 9.2.2(c), justifying the use of BSF1, the base value of 3 .0 should be adjusted to account for the following considerations, as necessary, where not wholly taken into account by design analysis. As a result of the adjustments, the final scatter factor may be less than, equal to, or greater than 3.0.

(i) Material fatigue scatter. Material properties should be investigated up to a 99 % probability of survival and a 95 % level of confidence.

(ii) Spectrum severity. Test load spectrum should be derived based on a spectrum sensitive analysis accounting for variations i n both utilisation (i.e. aircraft weight, cg, etc.) and occurrences/size of loads.

The test load spectrum applied to the structure should be demonstrated to be conservative when compared to the expected usage in - service.

(iii) Number of representative test specimens. Well established statistical methods should be used that associate the number of items tested with the distribution chosen to obtain an adjustment to the base scatter factor.

(e) If the applicant cannot satisfy the intent of all of paragraph 9. 2.2(c) of this AMC, BSF2 should be used.

(i) The applicant should propose scatter factor BSF2 based on careful consideration of the following issues: the required level of safety, the number of representative test specimens, how representative the test is, expected fatigue scatter, type of repeated load test, the accuracy of the test loads spectrum, spectrum severity, and the expected service environmental conditions.

(ii) In no case should the value of BSF2 be less than 3.0.

(f) Resolution of test loadings to actual loadings. The applicant may use a number of different approaches to reduce both the number of load cycles and the number of test set - ups required.

These include the following: — spectrum blocking (i.e., a change in the spectrum load sequence to r educe the total number of test set - ups); — high - load clipping (i.e., reduction of the highest spectrum loads to a level at which the beneficial effects of compression yield are reduced or eliminated); and — low - load truncation (i.e., the removal of non - damagin g load cycles to simplify the spectrum).

Due to the modifications to the flight - by - flight loading sequence, the applicant should propose either analytical or empirical approaches to quantify an adjustment to the number of test cycles which represents the Powered by EASA eRules Page 310 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION difference between the test spectrum and t he assumed flight - by - flight spectrum. In addition, an adjustment to the number of test cycles may be justified by raising or lowering the test load levels as long as appropriate data supports the applicant’s position. Other effects to be considered are dif ferent failure locations, different response to fretting conditions, temperature effects, etc. The analytical approach should use well - established methods or be supported by test evidence.

Powered by EASA eRules Page 311 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION Powered by EASA eRules Page 312 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION 9.3. Replacement times Replacement times should be established for parts with established safe - lives and should, under CS 25.571(a)(3), be included in the information prepared under CS 25.1529. These replacement times can be extended if additional data indicates an extension is warranted. Important factors which should be considered for such extensions include, but are not limited to, the following: 9.3.1. Comparison of original evaluation with service experience 9.3.2. Recorded load and stress data Recorded load and stress data entails instrumenting aerop lanes in service to obtain a representative sampling of actual loads and stresses experienced.

The data to be measured includes airspeed, altitude and load factor versus time ; or airspeed, altitude and strain ranges versus time ; or similar data. This dat a, obtained by instrumenting aeroplanes in service, provides a basis for correlating the estimated loading spectrum with the actual service experience.

9.3.3. Additional analyses and tests If additional test data and analyses based on repeated load tests of additional or surviving specimens are obtained, a re - evaluation of the established safe - life can be made.

9.3.4. Tests of parts removed from service Repeated load tests of replaced parts can be utilised to re - evaluate the established safe - life. The tes ts should closely simulate service loading conditions.

Repeated load testing of parts removed from service is especially useful where recorded load data obtained in service are available since the actual loading experienced by the part prior to replacement is known.

9.3.5. Repair or rework of the structure In some cases, repair or rework of the structure can gain further life.

9.4 . Type design developments and changes For design developments, or design changes, involving structural configurations similar to those of a design already shown to comply with the applicable provisions of CS 25.571(c), it might be possible to evaluate the variations in critical portions of the structure on a comparative basis. A typical example would be redesign of the landing g ear structure for increased loads. This evaluation should involve analysis of the predicted stresses of the redesigned primary structure and correlation of the analysis with the analytical and test results used in showing compliance of the original design with CS 25.571(c).

10. DISCRETE SOURCE DAMAGE (a) General The purpose of this section is to establish EASA guidelines for the consistent selection of load conditions for residual strength substantiation in showing compliance with CS 25.571(e) and CS 25.90 3(d). The intent of these guidelines is to define, with a satisfactory level of confidence, the load conditions that will not be exceeded on the flight during which the specified incident of CS 25.571(e) or CS 25.903(d) occurs. In defining these load Powered by EASA eRules Page 313 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION condi tions, consideration has been given to the expected damage to the aeroplane, the anticipated response of the pilot at the time of the incident, and the actions of the pilot to avoid severe load environments for the remainder of the flight consistent with h is/her knowledge that the aeroplane may be in a damaged state. Under CS 25.631 continued safe flight and landing is required following the bird impact. Following the guidance of this paragraph for assessing structural damage to any part whose failure or pa rtial failure may prevent continued safe flight and landing is an acceptable means of compliance to CS 25.631.

(b) The maximum extent of immediately obvious damage from discrete sources (CS 25.571(e)) should be determined and the remaining structure shown , with an acceptable level of confidence, to have static strength for the maximum load (considered as ultimate load) expected during completion of the flight. For uncontained rotor failure addressed under the CS 25.903(d) requirements and for applicants fo llowing AMC 20 - 128A, likely structural damage may be assumed to be equivalent to that obtained by using the rotor burst model and associated trajectories defined in AMC 20 - 128A, paragraph 9.0 ‘Engine and APU Failure Model’. This assessment should also incl ude an evaluation of the controllability of the aircraft in the event of damag e to the flight control system.

(c) The loads considered as ultimate should not be less than those developed from the following: (1) At the time of the occurrence: (i) the maxi mum normal operating differential pressure including the external aerodynamic pressures during 1.0 g level flight, multiplied by a 1.1 factor, combined with 1.0 g flight loads; (ii) starting from 1.0 g level flight at speeds up to Vc, any manoeuvre or any other flight path deviation caused by the specified incident of CS 25.571(e), taking into account any likely damage to the flight controls and pilot normal corrective action.

(2) F or the continuation of the flight, the maximum appropriate cabin differential pressure (including the external aerodynamic pressure), combined with: (i) 70 % of the limit flight manoeuvre loads as specified in CS 25.571(b) and, separately; (ii) at the maximum operational speed, taking into account any appropriate reconfiguration and flight limitations, the 1.0 g loads plus incremental loads arising from application of 40 % of the limit gust velocity and turbulence intensities as specified in CS 25.341 a t Vc.

(d) At any time, the aeroplane must be shown, by analysis, to be free from flutter and other aeroelastic instabilities up to the boundary of the aeroelastic stability envelope described in CS 25.629(b)(2) with any change in structural stiffness res ulting from the incident, consistent with CS 25.629(d)(8), CS 25.571(e), and CS 25.903(d).

11. ESTABLISHING THE LOV AND MAINTENANCE ACTIONS TO PREVENT WFD (a) Structural maintenance programme Theoretically, if an aircraft is properly maintained it cou ld be operated indefinitely.

However, it should be noted that structural maintenance tasks for an aircraft are not constant with time. Typically, tasks are added to the maintenance programme as the aircraft ages. It is reasonable to expect then that confid ence in the effectiveness of the Powered by EASA eRules Page 314 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION current structural maintenance tasks may not, at some future point, be sufficient for continued operation.

Maintenance tasks for a particular aircraft can only be determined based on what is known about that aircraft model at any given time: from analyses, tests, service experience, and teardown inspections. Widespread fatigue damage is of particular concern be cause inspection methods cannot be relied on solely to ensure the continued airworthiness of aircraft indefinitely. When inspections are focused on details in small areas and have a high probability of detection, they may be used by themselves to ensure co ntinued airworthiness, unless or until there are in - service findings. Based on findings, these inspections may need to be modified, and it may be necessary to modify or replace the structure rather than continue with the inspection alone.

When inspections examine multiple details over large areas for relatively small cracks, they should not be used by themselves. Instead, they should be used to supplement the modification or replacement of the structure. This is because it would be difficult to achieve the probability of detection required to allow inspection to be used indefinitely as a means to ensure continued operational safety.

To prevent WFD from occurring, the structure must, therefore, occasionally be modified or replaced. Establishing all the repl acements and modifications required to operate the aircraft indefinitely is an unbounded problem. This problem is solved by establishing an LOV of the engineering data that supports the structural maintenance programme. All necessary modifications and repl acements are required to be established to ensure continued airworthiness up to the LOV. See paragraph 11(f) for the steps to extend the LOV .

(b) Widespread fatigue damage Structural fatigue damage is progressive. It begins as minute cracks, and those c racks grow under the action of repeated stresses. It can be due to normal operational conditions and design attributes, or to isolated incidents such as material defects, poor fabrication quality, or corrosion pits, dings, or scratches. Fatigue damage can occur locally, in small areas or structural design details, or globally. Global fatigue damage is general degradation of large areas of structure with similar structural details and stress levels. Global damage may occur within a single structural element, such as a single rivet line of a lap splice joining two large skin panels (multiple site damage). Or it may be found in multiple elements, such as adjacent frames or stringers (multiple element damage).

Multiple site damage and multiple element damage cra cks are typically too small initially to be reliably detected with normal inspection methods. Without intervention these cracks will grow, and eventually compromise the structural integrity of the aircraft in a condition known as widespread fatigue damage. Widespread fatigue damage is increasingly likely as the aircraft ages, and is certain to occur if the aircraft is operated long enough without any intervention.

(c) Steps for establishing an LOV The LOV is established as an upper limit to aeroplane ope ration with the inspections and other procedures provided under CS 25.1529 and Appendix H. The LOV is required by CS 25.571(a)(3) and is established because of increased uncertainties in fatigue and damage tolerance assessment and the probable development of widespread fatigue damage associated with aeroplane operation past the limit.

To support the establishment of the LOV, the applicant must demonstrate by test evidence and analysis at a minimum, and, if available, service experience and teardown Powered by EASA eRules Page 315 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION inspect ion results of high - time aircraft, that WFD is unlikely to occur in that aircraft up to the LOV.

The process for establishing an LOV involves four steps: — identifying a ‘candidate LOV’; — identifying WFD - susceptible structure; — performing a WFD evaluation of all susceptible structure; and — finalising the LOV and establishing necessary maintenance actions.

Step 1 — Candidate LOV Any LOV can be valid as long as it has been demonstrated that the aircraft model will be free from WFD up to the LOV based on the aircraft's inherent fatigue characteristics and that any required maintenance actions are in place. Early in the certification process applicants typically establish design service goals or their equivalent and set a design service objective to have struc ture remain relatively free from cracking, up to the design service goal. A recommended approach sets the ‘candidate LOV’ equal to the design service goal. The final LOV would depend on both how well that design objective was met, and the applicant’s consi deration of the economic impact of maintenance actions required to preclude WFD up to the final LOV.

Step 2 — Identify WFD - susceptible structure The applicant should identify the structure that is susceptible to WFD to support post - fatigue test teardown inspections or residual strength testing necessary to demonstrate that WFD will not occur in the aircraft structure up to the LOV. Appendix 2 to AMC 20 - 20 provides examples and illustrations of structure where multiple site damage or multiple element damag e has been documented. The list in Appendix 2 to AMC 20 - 20 is not meant to be inclusive of all structure that might be susceptible to WFD on any given aircraft model and it should only be used for general guidance. It should not be used to exclude any part icular structure.

The applicant should do the following when developing the list of structure susceptible to WFD: (1) Establish criteria that could be used for identifying what structure is susceptible to WFD based on the definitions of multiple site damage, multiple element damage, and WFD. For example, structural details and elements that are repeated over large areas a nd operate at the same stress levels are obvious candidates. The criteria should be part of the applicant’s compliance data.

(2) Provide supporting rationale for including and excluding specific structural areas.

This should be part of the applicant’s co mpliance data.

(3) Identify the structure to a level of detail required to support post - test activities that the applicant will use to evaluate the residual strength capabilities of the structure. Structure is free from WFD if the residual strength meets or exceeds that required by CS 25.571(b). Therefore, post - test activities such as teardown inspections and residual strength tests must provide data that support the determination of strength.

— For teardown inspections, specific structural details (e.g. h oles, radii, fillets, cut - outs) need to be identified.

Powered by EASA eRules Page 316 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION — For residual strength testing, the identification at the component or subcomponent level (e.g. longitudinal skin splices) may be sufficient.

Step 3 — Evaluation of WFD - susceptible structure Applican ts must evaluate all susceptible structure identified in Step 2. Applicants must demonstrate, by full - scale fatigue test, evidence that WFD will not occur in the aircraft structure prior to the LOV. This demonstration typically entails full - scale fatigue t esting, followed by teardown inspections and a quantitative evaluation of any finding or residual strength testing, or both. Additional guidance about full - scale fatigue test evidence is included in Appendix 2 to this AMC.

Step 4 — Finalise LOV After all susceptible structure has been evaluated, finalise the LOV. The results of the evaluations performed in Step 3 will either demonstrate that the strength at the candidate LOV meets or exceeds the levels required by CS 25.571(b) or not. If it is demonstrate d that the strength is equal to or greater than that required, the final LOV could be set to the candidate LOV without further evidence. If it is demonstrated that the strength is less than the required level, at least two outcomes are possible: (1) The final LOV may be equal with the candidate LOV. However, this would result in maintenance actions, design changes, or both, maintenance actions and design changes, to support operation of aircraft up to LOV. For MSD/MED, the applicant may use damage toleran ce - based inspections to supplement the replacement or modification required to preclude WFD when those inspections have been shown to be practical and reliable.

(2) The final LOV may be less than the candidate LOV. This could reduce the need for maintena nce actions or making design changes.

Maintenance actions In some cases maintenance actions may be necessary for an aircraft to reach its LOV.

These maintenance actions could include inspections, modifications, replacements, or any combination thereof.

— For initial certification, these actions should be specified as airworthiness limitation items and incorporated into the ALS of the ICA.

— For post - certified aircraft, these actions should be specified as service information by the TCH or included in an upd ated ALS and may be mandat ed by Airworthiness Directives.

Design changes The applicant may determine that developing design changes to prevent WFD in future production aircraft is to their advantage. The applicant must substantiate the design changes according to the guidance contained in this AMC In addition to the technical considerations, the LOV may be influenced by several other factors, including: — maintenance considerations; — operator’s input; and — economics.

Powered by EASA eRules Page 317 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVAL UATION (d) Airworthiness Limitations Section (ALS) In accordance with Part - 21 the TCH must provide the ICA (which includes the ALS) with the aircraft. However, the TCH may or may not have completed the full - scale fatigue test programme at the time of type certification.

Under CS 25.571, EASA may issue a t ype certificate for an aircraft model prior to the applicant’s completion of the full - scale fatigue testing, provided that EASA has agreed to the applicant’s plan for completing the required tests.

Until the full - scale fatigue testing is completed and EAS A has approved the LOV, the applicant must establish a limitation that is equal to not more than one half of the number of cycles accumulated on the test article supporting the WFD evaluation. Under Appendix H to CS - 25, the ALS must contain the limitation preventing operation of the aircraft beyond one half of the number of cycles accumulated on the fatigue test article approved under CS 25.571. This limitation is an airworthiness limitation. No aircraft may be operated beyond this limitation until fatigue testing is completed and an LOV is approved.

As additional cycles on the fatigue test article are accumulated, this limitation may be adjusted accordingly. Upon completion of the full - scale fatigue test, applicants should perform specific inspections and a nalyses to determine whether WFD has occurred.

Additional guidance on post - test WFD evaluations is included in Appendix 2 to this AMC.

At the time of type certification, the applicant should also show that at least one calendar year of safe operation has been substantiated by the fatigue test evidence agreed to be necessary to support other elements of the damage tolerance and safe - life substantiations. Some of these tests may require application of scatter factors greater than two resulting in more restri ctive operating limitations on some parts of the structure.

After the full - scale fatigue test and the WFD evaluation have been completed, the applicant must include the following in the ALS: — Under Appendix H to CS 25, the ALS must contain the LOV stated a s a number of total accumulated flight cycles or flight hours approved under CS 25.571; and — Depending on the results of the evaluation under Step 3 above, the ALS may also include requirements to inspect, modify or replace the structure.

(e) Repairs and type design changes Any person applying for a change to a type certificate (TC) or a supplemental type certificate (STC) must demonstrate that any affected structure is free from WFD up to the LOV. ( Note: It is possible that the STC applicant may generat e a new LOV for the aeroplanes as part of the STC limitations).

Applicants for a major repair to the original aircraft or to an aircraft modified under a major change or an STC must demonstrate that any affected structure is free from WFD up to the LOV.

Powered by EASA eRules Page 318 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION The evaluation should assess the susceptibility of the structure to WFD and, if it is susceptible, demonstrate that WFD will not occur prior to the LOV. If WFD is likely to occur before LOV is reached, the applicant must either: (1) redesign the proposed repair to preclude WFD from occurring before the aircraft reaches the LOV; or (2) develop maintenance actions to preclude WFD from occurring before the aircraft reaches the LOV; or (3) for significant major changes and STCs only, establish a new LOV.

For repairs, the applicant must identify and include these actions as part of the repair.

For major changes and STCs, the applicant must identify and include these actions as airworthiness limitation items in the ALS of the ICA. WFD evaluation is consider ed part of the fatigue and damage tolerance evaluation with respect to the three - stage repair approval process.

(f) Extended LOV To extend an LOV, an application for a major change is required.

Typically, the data necessary to extend an LOV includes ad ditional full - scale fatigue test evidence. The primary source of this test evidence should be full - scale fatigue testing.

This testing should follow the guidance contained in Appendix 2 to this AMC.

[Amdt 25/19] Powered by EASA eRules Page 319 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION

Appendix 1 – Crack growth analysis and tes ts

ED Decision 2017/015/R Crack growth characteristics should be determined for each detail design point identified in accordance with 7(f) above. This information, when combined with the results from the residual strength analyses and tests, will be the basis for establishing the inspection requirements as discussed in Section 8. Crack growth characteristics can be determined by analysis or test. However, due to the large number of detail design points that are typically evaluated, and the practical l imitations involved with testing, analyses are generally relied on to determine crack growth at the detail design point.

(a) Analyses. In order to perform a crack - growth analysis a number of key elements are needed.

These include: (1) a load/stress spectrum applicable to the detail design point; (2) an initial crack size and shape to be assumed; (3) a cracking scenario to be followed; (4) applicable stress intensity solution(s); (5) a crack growth algorithm; and (6) material c rack growth rate properties.

A loading spectrum must be developed for each detail design point. It is derived from the overall aircraft usage spectrum that is discussed in paragraph 6(b). The spectra at each detail design point may be modified for various reasons. The most common modification for metallic structure involves the deletion of high infrequent loads that may have an unrepresentative beneficial effect on crack growth if retardation is considered. Also, local load events that are not part of the o verall aircraft spectrum should be included (e.g. flutter damper loads during pre - flight control surface checks).

The initial crack size and shape and subsequent cracking scenario to be followed are problem - dependent.

Applicable stress intensity solutions may be available in the public domain or may need to be developed. Many references exist which provide technical guidance for the application and development of stress intensity solutions. Care should be taken to ensure that the reference stress used for t he spectrum load and stress intensity solution are compatible.

Crack - growth algorithms used in predicting crack extension range from simple linear models to complex ones that can account for crack growth retardation and acceleration. It is generally accept ed that the use of a linear model will result in conservative results. A non - linear model, on the other hand, can be conservative or non - conservative and generally requires a higher level of validation and analysis/test correlation to adequately validate t he accuracy of the algorithm. Coupon testing should be performed using representative materials and spectra types (e.g. wing lower cover, pylon support lug, horizontal - stabiliser upper cover) that will be encountered in the course of the overall aircraft c rack - growth evaluation.

Crack growth rate data (e.g. da/dN vs ∆K vs R, da/dN vs ∆Keff) for many common aerospace materials is available in the public domain. Additionally, testing standards (e.g. ASTM) exist for performing tests to gather this data. The ge nerally accepted practice is to use typical or average representation of this data for performing crack growth evaluations.

(b) Tests. Crack - growth testing using coupons is typically performed to generate crack growth rate data and to validate crack growt h algorithms used for analyses. Simple specimens are generally used that have well - established stress intensity solutions for the characteristic cracking that can Powered by EASA eRules Page 320 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION be expected. The primary issue for these tests is the pre - cracking required to achieve a well - behaved fatigue crack before data is collected. Effective pre - cracking procedures (e.g. ‘load shedding’) have been established and are described in the public domain. Care must be taken to ensure that subsequent crack growth is not affected by the prior p re - cracking.

In order to minimise the test time for actual structural components and/or full - scale test articles, the test loading spectrum may be modified by eliminating small magnitude load events or by replacing them with a fewer number of larger load events that give equivalent crack growth.

Crack - growth behaviour may be obtained from actual structural components and/or full - scale test articles. However, inducing active fatigue cracks of the desired initial size and at the desired locations can be extr emely difficult. Past success in obtaining useful data has been achieved on an opportunistic basis when natural fatigue cracks have developed in the course of normal cyclic testing. Naturally occurring and artificially induced fatigue cracks may be monitor ed and data collected for at least a portion of the overall crack - growth period to be used for setting inspection requirements. This data can be extremely useful in supplementing and validating the analytical predictions, in some cases it may be the sole b asis for the establishment of inspection requirements. Where fatigue test crack growth data is used, the results should be corrected to address expected operational conditions.

[Amdt 25/19] Powered by EASA eRules Page 321 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION

Appendix 2 – Full - scale fatigue test evidence

ED Decision 2017/ 015/R (a) Overview CS 25.571(b) requires that special consideration for widespread fatigue damage (WFD) be included where the design is such that this type of damage could occur. This Appendix focuses on the test evidence in support of establishing the LO V and applicants will also need to consider and agree with EASA the extent of testing required in support of compliance with CS 25.571 in general, in particular for validation of hot spots, areas of complex loading exhibiting crack growth, single load path components, and safe - life items. CS 25.571(b) requires the effectiveness of the provisions to preclude the possibility of widespread fatigue damage occurring within the limits of validity of the structural maintenance programme to be demonstrated with suf ficient full - scale fatigue test evidence. The determination of what constitutes ‘sufficient full - scale test evidence’ requires a considerable amount of engineering judgment and is a matter that should be discussed and agreed to between the applicant and EA SA early in the planning stage for a certification project. In general, sufficient full - scale test evidence to support an LOV consists of full - scale fatigue testing to at least two times the LOV, followed by specific inspections and analyses to determine t hat widespread fatigue damage has not occurred. It may be appropriate to allow for three life times of testing, especially if inspection may not be practical for areas subject to WFD and requiring SMPs to be established.

The following factors should be con sidered in determining the sufficiency of evidence: Factor 1 : The comparability of the load spectrum between the test and the projected usage of the aeroplane.

Factor 2 : The comparability of the airframe materials, design and build standards between the test article and the certified aeroplane.

Factor 3 : The extent of post - test teardown inspection, residual strength testing and analysis for determining if widespread fatigue cracking has occurred.

Factor 4 : The duration of the fatigue testing.

Factor 5 : Th e size and complexity of a design or build standard change. This factor applies to design changes made to a model that has already been certified and for which full - scale fatigue test evidence for the original structure should have already been determined to be sufficient.

Small, simple design changes, comparable to the original structure, or changes that are derived from the original design using the same basic design configuration and where very similar load paths and similar operating stress levels are r etained could be analytically determined to be equivalent to the original structure in their propensity for WFD. In such cases, additional full - scale fatigue test evidence should not be necessary.

Factor 6 : In the case of major changes and STCs, the age of an aeroplane being modified. This factor applies to aeroplanes that have already accumulated a portion of their LOV prior to being modified. An applicant should only be required to demonstrate freedom from WFD up to the LOV in place for the original aerop lane.

(b) Elements of a full - scale fatigue test programme The following guidance addresses elements of a test programme that is intended to generate the data necessary to support compliance. It is generally applicable to all certification projects.

(1) Article. The test article should be representative of the s tructure of the aircraft to be certified (i.e. ideally a production standard article). The attributes of the type design that could affect MSD/MED initiation, growth and subsequent residual strength capability Powered by EASA eRules Page 322 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION should be replicated as closely as possible on the test article. Critical attributes include, but are not limited to, the following: — material types and forms; — dimensions; — joining methods and details; — coating and plating; — use of faying surface sealant; — assembly processes and sequences; and — influ ence of secondary structure (e.g. loads induced due to proximity to the structure under evaluation).

(2) Test set - up and loading. The test set - up and loading should result in a realistic simulation of expected operational loads.

(i) Test set - up. The tes t set - up dictates how loads are introduced into the structure and reacted. Every effort should be made to introduce and react loads as realistically as possible. When a compromise is made (e.g. wing air loading), the resulting internal loads should be eval uated (e.g. using finite element methods) to ensure that the structure is not being unrealistically underloaded or overloaded locally or globally.

(ii) Test loading. The test loading spectrum should include loads from all damaging sources (e.g. cabin pres surisation, manoeuvers, gusts, engine thrust, control surface deflection, and landing impact) that are significant for the structure being evaluated. Supporting rationale should be provided when a source is not represented in a sequence. Additionally, diff erences between the test sequence and expected operational sequence should be justified. For example, it is standard practice to eliminate low loads that are considered to be non - damaging and clip high infrequent loads that may non - conservatively bias the outcome, but care should be taken in both cases so that the test results are representative. Paragraph 9.2.2(f) provides some guidance on justifying the test loading sequence.

(3) Test duration. AMC 20 - 20 includes guidance on how to establish mandatory m aintenance actions for WFD - susceptible structure needed to preclude WFD occurrence in that structure. For any WFD - susceptible area the average time in flight cycles and/or hours to develop WFD must first be determined. This is referred to as the WFD averag e behaviour for the subject area. The AMC 20 - 20 guidance states that the area should be modified/replaced at one third of this time unless inspection for MSD/MED is practical. If inspection is practical the guidance states that inspection should start at o ne third of the WFD average behaviour with modification/replacement at one half of that time. It is standard practice to interpret the non - factored fatigue life of one specimen as the average life. It follows that if a full - scale fatigue test article survi ves a test duration of X without WFD occurrence, it can be conservatively assumed that the WFD average behaviour of all susceptible areas is equal to X. Based on this, and assuming that the susceptible areas are impractical to inspect for MSD/MED, the guid ance of AMC 20 - 20 would require that replacement/modification would have to be implemented at X/3. For areas where MSD/MED inspections were practical replacement/modification could be deferred until X/2, but MSD/MED inspections would have to start at X/3. The preceding should be kept in mind when deciding what the test duration will be.

Powered by EASA eRules Page 323 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION (4) Post - test evaluation. One of the primary objectives of the full - scale fatigue test is to generate data needed to determine the absolute WFD average behaviour for each s usceptible area, or to establish a lower bound. Recall that the definition of WFD average behaviour is the average time required for MSD/MED to initiate and grow to the point that the static strength capability of the structure is reduced below the residua l strength requirements of CS 25.571(b). Some work is required at the end of the test to determine the strength capability of the structure either directly or indirectly.

(i) Residual strength tests. One acceptable way to demonstrate freedom from WFD at t he end of a full - scale fatigue test is to subject the article to the required residual strength loads specified in CS 25.571(b). If the test article sustains the loads it can be concluded that the point of WFD has yet to be reached for any areas. However, because fatigue cracks that might exist at the end of the test are not quantified it is not possible to determine how far beyond the test duration WFD would occur in any of the susceptible areas without accomplishing additional work (e.g. teardown inspecti on). Additionally, metallic test - articles may be non - conservatively compromised relative to their future fatigue performance if static loads in excess of representative operational loads are applied. Residual strength testing could preclude the possibility of using an article for additional fatigue testing.

(ii) Teardown inspections. The residual strength capability may be evaluated indirectly by performing teardown inspections to quantify the size of any MSD/MED cracks that might be present or to establi sh an upper bound on crack size based on inspection method capability. Once this is done the residual strength capability can be estimated analytically. Depending on the results crack - growth analyses may also be required to project backwards or forwards in time to estimate the WFD average behaviour for an area. As a minimum, teardown inspection methods should be capable of detecting the minimum size of MSD or MED cracking that would result in a WFD condition (i.e. residual strength degraded below the level specified in CS 25.571(b)). Ideally it is recommended that inspection methods be used that are capable of detecting MSD/MED cracking before it degrades strength below the required level. Effective teardown inspections required to demonstrate freedom from W FD typically require significant resources. They typically require disassembly (e.g. fastener removal) and destruction of the test article. All areas that are or may be susceptible to WFD should be identified and examined.

(c) Examples of fatigue test ev idence for various types of certification projects.

The following examples offer some guidance on the types of data sets that might constitute ‘sufficient evidence’ for some kinds of certification projects. The scope of the test specimen and the duration of the test are considered.

(1) New type certificates. Normally this type of project would necessitate its own full - scale fatigue test of the complete airframe to represent the new structure and its loading environment. Nevertheless, prior to full - scale f atigue test evidence from earlier tests performed by the applicant, or others, may also be used and could supplement additional tests on the new model. Ultimately, the evidence needs to be sufficient to conclude with confidence that, within the LOV of the airframe, widespread fatigue damage will not occur. Factors 1 through 4 should be considered in determining the sufficiency of the evidence.

A test duration of a minimum of twice the LOV for the aeroplane model would normally be necessary if the loading spectrum is realistic, the design and construction for the test Powered by EASA eRules Page 324 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION article principal structure is the same as for the certified aeroplane, and the post - test teardown is exhaustive. If the conformance to Factors 1 through 3 is less than ideal, a significantly longer test duration would be needed to conclude with confidence that WFD will not occur within the LOV. Moreover, no amount of fatigue testing will suffice if the conformance to Factors 1 through 3 above is not reasonable. Consideration should also be given to the possible future need for life extension or product development, such as potential weight increases, etc.

(2) Derivative models. The default position would be to test the entire airframe. However, it may be possible to reliably determine the occurrence of widespread fatigue damage for part or all of the derivative models from the data that the applicant generated or assembled during the original certification project. Nevertheless, the evidence needs to be sufficient to allow confidence in the calculations that show that widespread fatigue damage will not occur within the LOV of the aeroplane. Factors 1 through 5 s hould be considered in determining the sufficiency of the evidence for derivative models. For example, a change in the structural design concept, a change in the aerodynamic contour, or a modification of the structure that has a complex internal load distr ibution might well make analytical extrapolation from the existing full - scale fatigue test evidence very uncertain. Such changes might well necessitate full - scale fatigue testing of the actual derivative principal structure. On the other hand, a typical de rivative often involves extending the fuselage by inserting ‘fuselage plugs’ that consist of a copy of the typical semi - monocoque construction for that model with slightly modified material gauges.

Normally this type of project would not necessitate its ow n full - scale fatigue test, particularly if very similar load paths and operating stress levels are retained.

(3) Type design changes — Service bulletins. Normally this type of project would not necessitate the default option of a full - scale fatigue test because the applicant would have generated, or assembled, sufficient full - scale fatigue test evidence during the original certification project that could be applied to the change. Nevertheless, as cited in the previous example, the evidence needs to be su fficient to allow confidence in the calculations that show that widespread fatigue damage will not occur within the LOV of the aeroplane. In addition, Factor 5 ‘The size and complexity of a design change’ should be considered. Therefore, unless otherwise j ustified, based on existing test data or a demonstration that the design change is not susceptible to WFD, the applicant should perform full - scale tests for the types of design changes listed in Appendix 4.

(4) Supplemental type certificates (STCs) Unle ss otherwise justified according to the guidance below or based on existing test data or a demonstration that the design change is not susceptible to WFD, the applicant for an STC should perform full - scale tests for the types of de sign changes listed in Ap pendix 4.

(i) Sufficient full - scale test evidence for structure certified under an STC may necessitate additional full - scale fatigue testing, although the extent of the design change may be small enough to use Factor 5 to establish the sufficiency of the e xisting full - scale fatigue test evidence. The applicant for an STC may not have access to the original equipment manufacturer’s full - scale fatigue test data. For aircraft types where an LOV has been published, the STC applicants may assume that the basic s tructure is free from WFD up to the LOV, unless: — EASA has issued an airworthiness directive (AD), or intends to take such action (proposed AD), to alleviate a WFD condition; or — inspections or modifications exist in the ALS relating to WFD conditions.

Powered by EASA eRules Page 325 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION Fo r the purpose of the STC applicant’s demonstration, it may be assumed that the aeroplane to which the LOV is applicable has received at least two full LOV of fatigue testing under realistic loads, and has received a thorough post - test inspection that eithe r did not detect any WFD or the ALS includes from the outset details of modifications required to address WFD that will need specific consideration by the STC applicant. With this knowledge, and considering the Factors 1 through 5, the STC applicant may be able to demonstrate that WFD will not occur on its modification (or the underlying original structure) within the LOV or a suitably revised value. If, however, the modification significantly affects the distribution of stress in the underlying structure, or significantly alters loads in other parts of the aeroplane, or significantly alters the intended mission for the aeroplane, or, if the modification is significantly different in structural concept from the certified aeroplane being modified, additional representative fatigue test evidence would be necessary.

(ii) In addition, Factor 6 ‘The age of the aeroplane being modified’ could be considered for modifications made to older aeroplanes. The STC applicant should demonstrate freedom from WFD up to the LO V of the aeroplane being modified. For example, an applicant for an STC to an aeroplane that has reached an age equivalent to 75 % of its LOV should demonstrate that the modified aeroplane will be free from WFD for at least the remaining 25 % of the LOV. A lthough an applicant could attempt to demonstrate freedom from WFD for a longer period, this may not be possible unless the original equipment manufacturer cooperates by providing data for the basic structure. A short design service goal for the modificati on could simplify the demonstration of freedom from WFD for the STC applicant.

( 5) Repairs. New repairs that differ from the repairs contained in the original equipment manufacturer’s structural repair manual, but that are equivalent in design to such rep airs, and that meet CS - 25 in other respects, would not necessitate full - scale fatigue testing to support freedom from WFD up to the LOV. Concerning major repair solutions (that may be susceptible to WFD) which utilise design concepts that are different fro m previous approved repair data (e.g. new materials, other production processes, new design details), further testing may be required.

(d) Use of existing full - scale fatigue test data In some cases, especially for derivative models and type design chang es accomplished by the type certificate holder, there may be existing full - scale fatigue test data that may be used to support compliance and mitigate the need to perform additional testing.

Any physical differences between the structure originally tested and the structure being considered that could affect its fatigue behaviour must be identified and reconciled. Differences that should be addressed include, but are not limited to, differences in any of the physical attributes listed under section (b)(1) o f this Appendix and differences in operational loading.

Typical developments that affect the applicability of the original LOV demonstration data are: (1) gross weight (e.g. increases); (2) cabin pressurisation (e.g. change in maximum cabin or operatin g altitude); and (3) flight segment parameters.

The older the test data, the harder it may be to demonstrate that it is sufficient. Often test articles were not conformed, nor were test plans or reports submitted to EASA as part of the compliance data p ackage. Loading sequence rigor varied significantly over the years and from Powered by EASA eRules Page 326 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION applicant to applicant. Additionally, testing philosophies and protocols were not standardised.

For example, post - test evaluations, if any, varied significantly and in some cases c onsisted of nothing more than limited visual inspections. However, there may be acceptable data from early full - scale fatigue tests that the applicant proposes to use to support compliance. In order to use such data the configuration of the test article an d loading must be verified and the issue of the residual strength capability of the article (or teardown data) at the end of the test must be addressed.

(e) Use of in - service data. There may be in - service data that can be used to support WFD evaluations. Examples of such data are as follows: — Documented positive findings of MSD/MED cracks that include location, size and the time in service of the affected aircraft along with a credible record of how the aircraft had been op erated since original delivery.

— D ocumented negative findings from in - service inspections for MSD/MED cracks on a statistically significant number of aircraft with the time in service of each aircraft and a credible record of how each aircraft had been operated since original delivery. For this data to be useful, the inspections methods used should have been capable of detecting MSD/MED crack sizes equal to or smaller than those sizes that could reduce the strength of the structure below the residual strength le vels specified in CS 25.571(b ).

— Documented findings from the destructive teardown inspection of structure from in - service aircraft. This might be structure (e.g. fuselage splices) removed from aircraft that were subsequently returned to service, or from retired aircraft. It would also be necessary to have a credible record of the operational loading experienced by the subject structure up to the ti me it was taken out of service.

— Prior to using in - service data any physical and usage/loading differences that exist between the structure o f the in - service or retired aircraft and the structure being certified should be identified and reconciled as discussed above.

[Amdt 25/19] Powered by EASA eRules Page 327 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION

Appendix 3 – Methods for inspection threshold determination

ED Decision 2017/015/R Different approaches have been used to calculate inspection thresholds, although these are essentially variants of one of two methods, being: (a) the fatigue (stress - life or strain - life) method, which uses fatigue endurance data collected under constant stress or constant strain conditions, and a linear damage accumulation model (Palmgren - Miner rule); (b) the crack growth method, which uses crack propagation and residual strength data to calculate the growth from an assumed initial crack size to a criti cal crack length, according to fracture mechanics principles.

CS 25.571(a)(4) requires certain types of structure to have thresholds based upon crack growth analyses or test assuming the maximum probable flaw due to manufacturing or service - induced dama ge . This approach applies to: (a) single load path structure; and (b) multiple load path ‘fail - safe’ structure and crack arrest ‘fail - safe’ structure, where it cannot be demonstrated that the resulting load path failure or partial failure (including arres ted cracks) will be safely detected and repaired during normal maintenance, inspection, or operation of an aeroplane prior to failure of the remaining structure.

Paragraph 8(c) of this AMC provides further details on identifying this structure.

In lieu o f other data, an acceptable threshold for inspection for cracks emanating from the maximum probable manufacturing flaw at a fastener hole may be obtained for aluminium alloy airframe structure if an initial corner crack of radius 0.05’’ (1.27 mm) is assume d and the total crack growth life is divided by 2. Whether this approach is also sufficient to conservatively address all probable forms of manufacturing and service - induced damage needs careful consideration and is highly design dependent. Where specific test or service data for service damage exists that can be used to reliably establish an appropriate threshold for all likely types of service damage then crack growth analysis may only need to consider the manufacturing flaw.

For structure susceptible to WFD specific methods for setting inspection thresholds are applicable when agreed to be practical; see Section 11 and Appendix 2 to this AMC.

Regardless of the approach used, the calculated thresholds should be su pported with appropriate fatigue test evidence. The best sources of fatigue test evidence are from service experience and large component or full - scale fatigue tests. Large component and full - scale fatigue test specimens are generally constructed using the same manufacturing processes as on the actual aircraft. The results of such tests should provide sufficient information to reliably establish the typical manufacturing quality and possibly its lower bound, especially when those results are combined with s ervice experience.

Conversely, simple test specimens used to generate fatigue endurance and crack growth data, which are typically assembled under laboratory or workshop conditions, may not be representative of the actual range of manufacturing quality in the structure under consideration. Therefore, in the absence of information from the full - scale fatigue tests and service experience, consideration should be given to generating fatigue endurance and crack growth data on simple test specimens which include artificial damages that are introduced at the beginning of the test, and are representative of the lower bound of manufacturing quality.

[Amdt 25/19] Powered by EASA eRules Page 328 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION

Appendix 4 – Examples of changes that may require full - scale

fatigue testing

ED Decision 2017/015/R The following are examples of types of modifications that may require full - scale fatigue testing: (1) passenger - to - freighter conversions (including addition of cargo doors); (2) gross weight increases (e.g. increased operating weights, increased zero - fuel weights, increased landing weights, and increased maximum take - off weights); (3) installation of fuselage cut - outs (e.g. passenger entry doors, emergency exit doors or crew escape hatches, fuselage access doors, and cabin window relocations); (4) complete re - engine or pylon change; (5) engine hush kits; (6) wing modifications (e.g. installation of winglets, changes in flight - control settings such as flap droop, and change of wing trailing - edge structure); (7) modified or replaced skin splice; (8) any modification that affects three or more stiffening memb ers (e.g. wing stringers and fuselage frames); (9) a modification that results in operational - mission change, which significantly changes the original equipment manufacturer’s load/stress spectrum (e.g. extending the flight duration from 2 hours to 10 ho urs); and (10) a modification that changes areas of the fuselage from being externally inspectable using visual means to being non - inspectable (e.g. installation of a large, external fuselage doubler that results in hiding details beneath it).

[Amdt 25/1 9] Powered by EASA eRules Page 329 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION

Appendix 5 – PSE, FCS, and WFD - susceptible structure

ED Decision 2017/015/R (a) Overview Four key terms used when showing compliance to the damage tolerance and fatigue requirements of CS - 25 and EASA guidance for the continued structural integrity o f ageing aircraft in AMC 20 - 20 are: ‘principle structural element (PSE)’, ‘fatigue critical structure (FCS)’, ‘widespread fatigue damage (WFD) - susceptible structure’ and ‘design detail point (DDP)’.

This Appendix provides clarification on the intended mea nings of these terms and how they relate to each other.

(b) Principal structural element (PSE) (1) The term ‘principal structural element (PSE)’ is defined in this AMC as follows: ‘Principal structural element (PSE)’ is an element that contributes sig nificantly to the carrying of flight, ground or pressurisation loads, and whose integrity is essential in maintaining the overall structural integrity of the aeroplane.

(2) While this definition does not specifically address the fatigue susceptibility of the structure, or environmental or accidental damage, it is intended to address the majority of the structure that must be evaluated according to CS 25.571. CS 25.571(a) states the following: ‘This evaluation must be conducted for each part of the struct ure that could contribute to a catastrophic failure’.

(3) Examples of PSEs are found in paragraph 7(f) of this AMC.

(4) The above reinforces the notion that the identification of PSEs should be based solely on the importance of the structure to assure the overall aeroplane integrity.

(5) Paragraph 7(f) of this AMC provides guidance for identifying PSEs. Many manufacturers use this list as a starting point for their list of Fatigue Critical Structure (FCS). CS 25.571(b) is intended to address all struc ture that could contribute to a catastrophic failure resulting from fatigue, environmental and accidental damage, and, therefore, may include some structure that is not considered FCS. Nevertheless, all PSE should be considered when developing a list of FC S.

(6) The definitions used by applicants to identify PSEs have not been consistent among applicants and, in some cases, among models produced by the same applicant. The lack of standardisation of the usage and understanding of the term ‘PSE,’ and the resulting d iversity that exists between type design PSE lists, led authorities to introduce the new term ‘Fatigue Critical Structure (FCS)’ in the ‘Ageing Aircraft Requirements and Guidance Material’.

(c) Fatigue Critical Structure (FCS) (1) ‘Fatigue critical structure (FCS)’ is defined as aircraft structure that is susceptible to fatigue cracking, which could contribute to a catastrophic failure. Fatigue critical structure also includes structure which, if repaired or modified, could be susce ptible to fatigue cracking and contribute to a catastrophic failure. Structure is most often susceptible to fatigue cracking when subjected to tension - dominated repeated loads during operation. Such structure may be part of the baseline structure or part o f a modification. ‘baseline structure’ means structure that is designed under the original type Powered by EASA eRules Page 330 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) FATIGUE EVALUATION certificate or amended type certificate for that aircraft model (i.e. the as - delivered - aeroplane model configuration).

(2) Fatigue critical structure is genera lly a subset of principal structural elements, specifically those elements that are susceptible to fatigue damage. The exception may be a DDP that is susceptible to fatigue and, although not part of a PSE, could result in catastrophic failure if it were to fail (e.g. an undercarriage door hinge has been categorised by some TCHs as a DDP and FCS, when its failure would lead to loss of the door and the door could impact the aircraft with catastrophic results. In this case the door was not classified as a PSE because the TCH had not considered the door to contribute significantly to carrying flight, ground or pressurisation loads. Considering further aspects of the PSE definition now adopted, it might be claimed that the door is not essential to maintain the ov erall integrity of the aircraft, i.e. the aircraft may be safe without it. However, due to the need to identify all detail design points and FCS whose failure could cause catastrophic failure of the aircraft it is in any case subject to the fatigue and dam age tolerance requirements.)

(d) Detail design points (DDP) ‘Detail design point’ is an area of structure that contributes to the susceptibility of the structure to fatigue cracking or degradation such that the structure cannot maintain its load carrying capability, which could lead to a catastrophic failure.

(e) Widespread fatigue damage (WFD) - susceptible structure (1) ‘Widespread fatigue damage (WFD)’ is the simultaneous presence of cracks at multiple structural locations, which are of sufficient si ze and density such that the structure no longer meets the residual strength requirements of CS 25.571(b).

(2) ‘Multiple site damage (MSD)’ and ‘Multiple element damage (MED)’ are conditions that, with no intervention, can lead to WFD. The term ‘WFD - susc eptible structure’ refers to areas of structure that, under normal circumstances, could be expected to eventually develop MSD and/or MED cracks, which could lead to WFD.

(3) Although not explicitly stated, structure susceptible to WFD cannot be inspected reliably to preclude WFD. Unless a flight cycles and/or flight hours limit is placed on an aeroplane, modifications may be needed to preclude WFD. Structure susceptible to WFD is a subset of FCS.

[Amdt 25/19] Powered by EASA eRules Page 331 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) LIGHTNING PROTECTION

LIGHTNING PROTECTION

CS 25.581 Lightning protection

ED Decision 2016 / 010/R (See AMC 25.581) (a)The aeroplane must be protected against catastrophic effects from lightning. (See CS 25.899 and AMC 25.581 .)

(b) For metallic components, compliance with sub - paragraph (a) of this paragraph may be shown by – (1) Bonding the components properly to the airframe; or (2) Designing the components so that a strike wi ll not endanger the aeroplane.

(c) For non - metallic components, compliance with sub - paragraph (a) of this paragraph may be shown by – (1) Designing the components to minimise the effect of a strike; or (2) Incorporating acceptable means of diverting the r esulting electrical current so as not to endanger the aeroplane.

[Amdt 25/18]

AMC 25.581 Lightning p rotection

ED Decision 2020/024/R 1 INDUSTRY STANDARDS The following documents may be used when showing compliance with CS 25.581 : — EUROCAE document ED - 84A dated July 2013 (Aircraft Lightning Environment and Related Test Waveforms) or the equivalent SAE ARP5412B.

— EUROCA E document ED - 91A (Aircraft Lightning Zoning) or the equivalent SAE ARP5414B.

— EUROCAE document ED - 105A (Aircraft Lightning Test Methods) or the equivalent SAE ARP 5416A.

— EUROCAE document ED - 113 (Aircraft Lightning Direct Effects Certification) or the equiv alent SAE ARP 5577.

2 EXTERNAL METAL PARTS 2.1 External metal parts should either be – a. Electrically bonded to the main earth system by primary bonding paths, or b. So designed and/or protected that a lightning discharge to the part (e.g. a radio aerial) will cause only local damage which will not endanger the aeroplane or its occupants.

2.2 In addition, where internal linkages are connected to external parts (e.g. control surfaces), the linkages should be bonded to main earth or airframe by primary bondi ng paths as close to the external part as possible.

Powered by EASA eRules Page 332 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART C – STRUCTURE (CS - 25) LIGHTNING PROTECTION 2.3 Where a primary conductor provides or supplements the primary bonding path across an operating jack (e.g. on control surfaces or nose droop) it should be of such an impedance and so designed as to lim it to a safe value the passage of current through the jack.

2.4 In considering external metal parts, consideration should be given to all flight configurations (e.g. lowering of landing gear and wing - flaps) and also the possibility of damage to the aeropla ne electrical system due to surges caused by strikes to protuberances (such as pitot heads) which have connections into the electrical system.

3 EXTERNAL NON - METALLIC PARTS 3.1 External non - metallic parts should be so designed and installed that – a. They are provided with effective lightning diverters which will safely carry the lightning discharges described in EUROCAE document ED - 84A dated July 2013 titled: Aircraft Lightning Environment and Related Test Waveforms, or the equivalent SAE ARP5412B doc ument.

b. Damage to them by lightning discharges will not endanger the aeroplane or its occupants, or c. A lightning strike on the insulated portion is improbable because of the shielding afforded by other portions of the aeroplane.

Where lightning diverte rs are used the surge carrying capacity and mechanical robustness of associated conductors should be at least equal to that required for primary conductors.

3.2 Where unprotected non - metallic parts are fitted externally to the aeroplane in situations where they may be exposed to lightning discharges (e.g. radomes) the risks include the following: a. The disruption of the materials because of rapid expansion of gases within them (e.g. water vapour), b. The rapid build - up of pressure in the enclosures provide d by the parts, resulting in mechanical disruption of the parts themselves or of the structure enclosed by them, c. Fire caused by the ignition of the materials themselves or of the materials contained within the enclosures, and d. Holes in the non - metalli c part which may present a hazard at high speeds.

3.3 The materials used should not absorb water and should be of high dielectric strength in order to encourage surface flash - over rather than puncture. Laminates made entirely from solid material are prefer able to those incorporating laminations of cellular material.

3.4 Those external non - metallic part which is not classified as primary structure should be protected by primary conductors.

3.5 Where damage to an external non - metallic part which is not classified as primary structure may endanger the aeroplane, the part should be protected by adequate lightning diverters.

3.6 Confirmatory tests may be required to check the adequacy of the lightning protection provided (e.g. to confirm the adequacy of the location and size of bonding strips on a large radome.)

[Amdt 25/26] Powered by EASA eRules Page 333 of 1495 | Jan 2023

Next: SUBPART D – DESIGN AND CONSTRUCTION →

SUBPART D – DESIGN AND CONSTRUCTION

Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL

SUBPART D – DESIGN AND CONSTRUCTION

GENERAL

CS 25.601 General

ED Decision 2003/2/RM The aeroplane may not have design features or details that experience has shown to be ha zardous or unreliable. The suitability of each questionable design detail and part must be established by tests.

CS 25.603 Materials

ED Decision 2021/015/R ( See AMC 25.603 ; f or c omposite m aterials , see AMC 20 - 29 ; f or use of glass in passenger cabins, see AMC No 2 to CS 25.603(a) ) The suitability and durability of materials used for parts, the failure of which could adversely affect safety, must : (a) b e established on the basis of experience or tests; (see AMC No°1 to CS 25.603(a) ); (b) c onform to approved specifications that ensure their having the strength and other properties assumed in the design data ( s ee AMC 25.603(b) ); and (c) t ake into account the effects of environmental conditions, e.g. temperature and humidity, expected in service.

[Amdt 25/9] [Amdt 25/18] [Amdt 25/19] [Amdt 25/ 27 ]

AMC 25.603 Suitability and durability of materials

ED Decision 2021/015/R The term ‘material’ is differently interpreted, ranging from raw feedstock material to the material state in a final complex part configuration that may have undergone various processes. CS 25.603 , CS 25.605 , CS 25.613 , and AMC 25.613 should therefore be considered together to ensure the cohere nt and safe design and production of parts and thus maintain occupant and aeroplane safety throughout the aeroplane’s operational life. This is of growing importance as more and more production methods allow the design of complex part configurations for wh ich the characteristics of the materials are defined close to completion of the part production, e.g. castings, composite resin transfer methods, bonding, or additive manufacturing methods. The applicants should therefore discuss with EASA, at an early sta ge of the certification project, potential details supporting the means of compliance with CS 25.603 , CS 25.605 , and CS 25.613 .

No te: organisations engaged in the design and certification of modifications or repairs should also comply with these CSs and consider the related AMC.

Powered by EASA eRules Page 334 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL Appropriately defined tests and analysis pyramids (e.g. as outlined in AMC 20 - 29 for composite materials) should support the certification of materials, processes, and/or fabrication methods, including the development of the associated design values in more complex part configurations and assemblies.

[Amdt No: 25/27]

AMC No 1 to CS 25.603(a) Suitabi lity and durability of materials —

Experience or tests

ED Decision 2021/015/R To show compliance with CS 25.603 and CS 25.605 , applicants may use previous applicable expe rience and/or tests together with material specifications and material process specifications. Applicants should therefore carefully consider the controls on materials and material processing that are appropriate to the design data to be used for any part (e.g. controls on additive manufacturing powder material handling processes). However, as material strength and other properties may result from the process limitations that are specific to the configuration of some complex parts, the applicability of prev ious experience to new part configurations may be limited.

Shared databases: when the material strength and other properties that are used in the design data are not only influenced by the constituent materials and/or material processes, but also by the ma nufacturing and assembly processes, demonstrating controls on constituent materials and material processes may assist applicants in developing the final design data. For example, if an applicant successfully demonstrates data equivalence with established a nd accepted databases, this may create confidence in the applicant’s production processes, if not providing existing design values.

[Amdt No: 25/27]

AMC No 2 to CS 25.603(a) Suitability and durability of materials —

Large glass items

ED Decision 2021/015/R 1. General This AMC defines acceptable minimum performance standards for the specific case of large glass items used as an interior material in passenger cabin installations whereby the glass items carry no other loads than those resulting from the mass of the glass itself, rapid depressurisation , or abuse loading.

Large glass items should be shown not to be a hazard during events such as an emergency landing and cabin depressurisation.

1.1. A large glass item is defined as: (a) a glass item with a dimen sion that exceeds 51 cm (20 in.); (b) a glass panel with a surface area on one side that exceeds 0.12 m² (200 in.²); or (c) a glass item with a mass exceeding 4 kg.

In case of multiple items in close proximity, the accumulated surface area of glass as well as the total mass should be considered (i.e. effects such as tiling should be considered).

Powered by EASA eRules Page 335 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 1.2. A large glass item should meet the following requirements whenever installed in compartments that may be occupied during taxiing, take - off, and landing, or m ay be traversed during an emergency evacuation: (a) The glass item should be subjected to, and pass, ball impact testing (see paragraph 2 below).

(b) The glass item should be subjected to, and pass, abuse load testing (see paragraph 3 below).

(c) The glass item should meet the requirements outlined in CS 25.561(b)(3), (c) and (d). A safety factor of 2.0 should be applied to glass items to account for variability in the production of the material and for long - term degradation.

(d) Cracking of glass shou ld not produce a condition where the material may become hazardous to the occupants (e.g. sharp edges, splinters or separated pieces). This requires destructive testing. If any of the test conditions defined below (see paragraphs 2 and 3 below) do not resu lt in a significant failure of the glass item, testing at a higher impact energy (ball impact test) or load (abuse load test) should be performed until destruction, or until an impact energy of 80 J or double the specified abuse load is reached.

Tests should be performed for worst - case conditions (e.g. the largest glass item should be tested with the maximum engraving). Similarity justification may then be used for other items.

These tests do not need to be performed for glass items that have tradition ally been installed in large aeroplanes, provided that their installation method, location, etc. are not unusual (e.g. standard lavatory mirrors, light bulbs, light tubes, galley equipment).

The instructions for continued airworthiness should reflect the fastening method used and should ensure the reliability of all methods used (e.g. life limit of adhesives, or scheduled check for security of a clamp connection). For example, inspection methods and intervals for an adhesive - based design should be defined in accordance with adhesion data from the manufacturer of the adhesive, or actual adhesion test data, as necessary.

2. Ball Impact Tests The test procedure(s) and pass/fail criteria of the Underwriters Laboratories standard UL 61965, Mechanical safety for cathode ray tubes, Edition 2, 27 July 2004, or former UL 1418, Standard for safety cathode ray tubes, Edition 5, 31 December 1992, or other equivalent approved method are the basis of the ball impact strength and no - hole tests described in this paragraph, combined with the impact energy in Section 5.12.2 of ANSI/SAE Z26.1, Safety glazing materials for glazing motor vehicles and motor vehicle equipment operating on land highways — safety standard, 1 December 1997.

The glass samples should be installed in a t est fixture representative of the actual installation in the cabin.

Powered by EASA eRules Page 336 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 2.1. Strength Test The large glass item should be subjected to a single impact applied in accordance with the test conditions of paragraph 2.3 below. The impact energy should be 21 J, ca used by a 51 - mm diameter ball or, alternatively, by a 40 - mm diameter ball, as specified in paragraph 2.3.2 below.

The test is passed if the expulsion of glass within a 1 - min period after the initial impact satisfies the following criteria: (a) there is no glass particle (a single piece of glass having a mass greater than 0.025 g) between the 0.90 and 1.50 - m barriers (see paragraph 2.3.1) on either side (if appropriate); (b) the total mass of all pieces of glass between the 0.90 and 1.50 - m barriers (see para graph 2.3.1) does not exceed 0.1 g on either side (if appropriate); and (c) there is no glass expelled beyond the 1.50 - m barrier (see paragraph 2.3.1) on either side (if appropriate).

2.2 No - Hole Test The large glass item should be subjected to a single im pact applied in accordance with the test conditions of paragraph 2.3 below. The impact energy should be 3.5 J, caused by a 51 - mm diameter ball as specified in paragraph 2.3.2 below.

The test is passed if the large glass item does not develop any opening th at may allow a 3 mm diameter rod to enter.

Note: If the large glass item does not develop any opening that would allow a 3 mm rod to enter when subjected to the strength test defined in paragraph 2.1 above, the no - hole test defined in this paragraph does n ot need to be performed.

2.3 Test Conditions 2.3.1 Test Apparatus and Setup The large glass item should be mounted in a way representative of the aeroplane installation.

The centre of the large glass item should be 1.00 ± 0.05 m above the floor.

For the strength test (see paragraph 2.1 above), two barriers, each one made of material 10 – 20 mm thick, 250 mm high, and 2.00 m long, should be placed on the floor in front of the test item (or on both sides in case of a glass partition) at the specified location , measured horizontally from the front surface of the large glass item to the near surface of the barrier. The barriers may be less than 2.00 m long, provided that they extend to the walls of the test room. A non - skid surface such as a blanket or rug may b e placed on the floor.

A solid, smooth, steel ball of the size specified in paragraph 2.3.2 below should be suspended by suitable means such as a fine wire or chain and allowed to fall freely as a pendulum and strike the large glass item with the specified impact energy. The large glass item should be placed in a way that its surface is vertical and in the same vertical plane as the suspension point of the pendulum. A single impact should be applied to any point on the surface of the large glass item at a d istance of at least 25 mm from the edge of the surface.

Powered by EASA eRules Page 337 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 2.3.2 Impact Objects The 51 - mm diameter steel ball, used as an impact object, should have a mass of approximately 0.5 kg and a minimum Scale C Rockwell Hardness of 60.

The 40 - mm diameter steel ball, used as an impact object, should have a mass of approximately 0.23 kg and a minimum Scale C Rockwell Hardness of 60.

3. Abuse Loads Tests The large glass item should withstand the abuse loads defined in paragraph 3.2 below when subjected to the test conditions defined in paragraph 3.1. The panel should remain attached to the fixture, and any failure should be shown to be non - hazardous (e.g. no sharp edges, no separation of pieces).

3.1 Test conditions Abuse loads should be applied: (a) at the points t hat would create the most critical loading conditions; and (b) at least at the geometrical centre, and at one point located along the perimeter.

For the above - mentioned load applications, it is acceptable to use any loading pad with a shape and dimensions that fit into a 15.24 - cm (6 - in.) diameter circle.

For all tests, the glass item should be mounted in a test fixture representative of the actual installation in the cabin.

3.2 Loads to be applied Abuse loads should be considered as ultimate loads, therefor e, no additional factors (e.g.

fitting factors, casting factors, etc.) need to be applied for abuse load analysis/testing.

Unless it is justified that one or more abuse load cases are not applicable due to the shape/size/location of the glass item making i t unlikely or impossible for persons to apply loads in the direction(s) concerned, the following abuse loads should be considered (see also Figure 1 below): 3.2.1 Pushing loads Pushing loads are 133 daN (300 lbf) from 0 – 1.5 m (60 in.) above the floor, redu cing linearly to 44 daN (100 lbf) at 2 m (80 in.) above the floor lev el (see (1) in Figure 1 below).

3.2.2 Pulling loads One - hand pull loads (where it is not possible to grab with two hands) are 66 daN (150 lbf) from 0 – 1.5 m (60 in.) above the floor, reduc ing linearly to 22 daN (50 lbf) at 2 m (80 in.) above the floor level (see (3) in Figure 1 below).

Two - hands pull loads are 133 daN (300 lbf) from 0 – 1.5 m (60 in.) above the floor, reducing linearly to 44 daN (100 lbf) at 2 m (80 in.) above the floor level (see (1) in Figure 1 below).

3.2.3 Up loads Up loads are 66 daN (150 lbf) from 0 – 1.5 m (60 in.) above the floor, reducing linearly to 22 daN (50 lbf) at 2 m (80 in.) above the floor level (see (2) in Figure 1 below).

Powered by EASA eRules Page 338 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 3.2.4 Downloads Downloads are 133 daN (300 lbf) from 0 - 1.5 m (60 in.) above the floor, reducing linearly to 44 daN (100 lbf) at 2 m (80 in.) above the floor level (see (1) in Figure 1 below).

3.2.5 Stepping, Seating loads In the case of large glass items which may be stepped or sat on, a l oad of 222 daN (500 lbf) should be used. This load is to be applied at the most critical point, and on any relevant surface up to 1 m (38 in.) above the floor level (see (4) in Figure 1 below).

Figure 1 [Amdt No: 25/19] [Amdt No: 25/27]

AMC 25.603(b) Suitability and durability of materials — Approved

material specifications and material process specifications

ED Decision 2021/015/R The approved material specifications and material process specifications should: — be suitable for the appli cation; — define material and material process controls; — include requirements to assist the applicant in managing raw/feedstock/unfinished materials, as appropriate to the technology (e.g. the feedstock powder used in additive manufacturing, or matrix system s used in pre - impregnated composites).

Powered by EASA eRules Page 339 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL The material strength and other properties that are used in design data (including fatigue and damage tolerance characteristics, when applicable) are governed by, and can be significantly sensitive to, the related var iables of the material production process (including raw - material considerations).

Furthermore, these properties may also be influenced by other higher - level fabrication processes (manufacturing and assembly), including other post - processing activities (e. g. adhesive material and bonding properties produced in a bonded joint of a complex part may not be the same as those produced in a test coupon).

The material specifications, material process specifications, and/or production drawings should identify key c haracteristics and parameters to be monitored by in - process quality control, including the acceptable limits to the characteristics of materials and processes (e.g. acceptable anomalies or flaws), and should address anisotropy, when applicable. This inform ation may also help applicants identify other defect types and damage modes than the anomalies and flaws that are accepted under the specifications, including those that may occur in service. Such data may be used to help applicants show compliance with ot her specifications, e.g. CS 25.571 . However, showing compliance with CS 25.571 does not relieve from the requirement for material process controls.

Note: approved material specifications and approved material process specifications can be, for example, industry or military specifications, or European Technical Standard Orders (ETSOs).

[Amdt No: 25/27]

CS 25.605 Fabrication methods

ED Decision 2021/015/R (See AMC 25.605 ) (a) The fabrication methods used (i.e. the manufacturing and assembly methods, including consideration of the materials and material processes) must produce the strength and other properties necessary to ensure a consistently safe part. If a fabrication method includes processes that require close control to reach this objective, then those processes must be performed under representative approved fabrication process specifications, supported by appropriately approved material specifications (including considering the raw/feedstock/unfinished material specifications) with appropriate controls for the design data.

(b) Each new fabrication method must be substantiated by a test programme that is representative of the application .

[Amdt No: 25/27]

AMC 25.605(a) Fabrication methods — Approved process

specifications

ED Decision 2021/015/R Examples of fabrication method processes that may require close control to consistently produce safe parts incl ude the following: — castings, — composite resin transfer methods, — bonding, — welding, Powered by EASA eRules Page 340 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL — heat - treating, or — additive manufacturing methods.

Fabrication method process specifications should include all critical inspection steps and/or process controlled steps, and s hould be substantiated (they may require re - evaluation and new substantiation, if modified later). All the inherent part characteristics that result from the fabrication method and affect the material strength and other properties should be closely correla ted with non - destructive inspection (NDI) and/or process control variables. Furthermore, the applicant should show that the equipment used to support the process - critical manufacturing steps (particularly those steps that are not directly supported and con trolled through inspection) is under appropriate process control, to ensure the consistent production of safe parts.

Note 1: ‘safe parts’ must comply with CS 25.603 and CS 25.605 to ensure safety by maintaining the appropriate ‘material strength and other properties’ that are assumed in the design data. Therefore, applicants are reminded that, beyond the consideration of airframe strength, these CSs are also applicable to ot her applications for which safety relies on strength or stiffness, e.g. system structures.

Furthermore, the reference to ‘other properties’ is intended to ensure that safety is also maintained for applications for which safety relies on ‘other properties’ (for example, safe interior cabin parts that rely upon suitable flammability properties).

Note 2: approved fabrication process specifications and approved material specifications can be, for example, industry or military specifications, or European Technic al Standard Orders (ETSOs).

[Amdt No: 25/27]

AMC 25.605(b) New fabrication methods — Test programme

ED Decision 2021/015/R The test programme should initially consider the material strength and other properties resulting from each new fabrication method (‘new’ means new to the industry, an applicant, or an application configuration). The scope of the test programme should include considering the potential for anisotropic properties unless the applicant has already established an underst anding of these properties.

The test programme that is required for the certification of new fabrication methods should be used to evaluate the critical process variables. Based on that evaluation, the applicant should establish in the fabrication specific ations the relevant parameters that govern the final material strength and other properties of the part at the time of its production and throughout its operational life.

Furthermore, the applicant should evaluate the sensitivity of the material strength a nd other properties to the critical process variables to ensure that the established parameters are both robust and practical.

Note: the test programme may also be used to help applicants understand the defect types and damage modes to be considered when showing compliance with other specifications, e.g. CS 25.571 .

Understanding the potent ial defects and damage modes is particularly important for sensitive fabrication processes, e.g. those used for structural bonding.

[Amdt No: 25/27] Powered by EASA eRules Page 341 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL

CS 25.607 Fasteners

ED Decision 2003/ 2/RM (See AMC 25.607 ) (a) Each removable bolt, screw, nut, pin or other removable fastener must incorporate two separate locking devices if – (1) Its loss could preclude continued flight and landing within the design limitations of the aeroplane using normal pilot skill and strengt h; or (2) Its loss could result in reduction in pitch, roll or yaw control capability or response below that r equired by Subpart B of this CS - 25.

(b) The fasteners specified in sub - paragraph (a) of this paragraph and their locking devices may not be adversely affected by the environmental conditions associated with the particular installation.

(c) No self - locking nut may be used on any bolt subject to rotation in operation unless a non - friction locking device is used in addition to the self - locking de vice.

AMC 25.607 Fasteners

ED Decision 2003/2/RM FAA Advisory Circular AC 20 - 71 Dual Locking Devices on Fasteners, date 12 - 8 - 70, is accepted by the Agency as providing acceptable means of compliance with CS 25.607 .

CS 25.609 Protection of structure

ED Decision 2016 / 010/R (See AMC 25.609 ) Each part of the structure must - (a) Be suitably protected against deterioration or loss of strength in service due to any cause, inclu ding – (1) Weathering; (2) Corrosion; and (3) Abrasion; and (b) Have provisions for ventilation and drainage where necessary for protection.

[Amdt 25/18]

AMC 25.609 Protection of s tructure

ED Decision 2003/2/RM The comprehensive and detailed material standards accepted in the member states will be accepted as satisfying the requirement of CS 25.609 .

CS 25.611 Accessibility provisions

ED Decision 2008/006/R (a) Means must be provided to allow inspection (including inspection of principal structural elements and control systems), replacement of parts normally requiring replacement, Powered by EASA eRules Page 342 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL adjustment, and lubrication as necessary for continued airworthiness. The inspection means fo r each item must be practicable for the inspection interval for the item. Non - destructive inspection aids may be used to inspect structural elements where it is impracticable to provide means for direct visual inspection if it is shown that the inspection is effective and the inspection procedures are specified in the maintenance manual required by CS 25.1529 .

(b) Electrical wiring interconnection systems must meet the accessibility requirements of CS 25.1719 .

[Amdt 25/5]

CS 25.613 Material strength properties and Material Design V alues

ED Decision 2005 / 006/R (See AMC 25.613 ) (a) Material strength properties must be based on enough tests of material meeting approved specifications to establish design values on a statistical basis.

(b) Material design values must be chosen to minimise the probability of structural failures due to material variability. Except as provided in sub - paragraphs (e) and (f) of this paragraph, compliance must be shown by selecting material design values which assure material strength with the following probabili ty: (1) Where applied loads are eventually distributed through a single member within an assembly, the failure of which would result in loss of structural integrity of the component, 99% probability with 95% confidence.

(2) For redundant structure, in whic h the failure of individual elements would result in applied loads being safely distributed to other load carrying members, 90% probability with 95% confidence.

(c) The effects of environmental conditions, such as temperature and moisture, on material desi gn values used in an essential component or structure must be considered where these effects are significant within the aeroplane operating envelope.

(d) Reserved (e) Greater material design values may be used if a “premium selection” of the material is made in which a specimen of each individual item is tested before use to determine that the actual strength properties of that particular item will equal or exceed those used in design.

(f) Other material design values may be used if approved b y the Agency.

[ Amdt 25/1] Powered by EASA eRules Page 343 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL

AMC 25.613 Material strength properties and material design

values

ED Decision 2021/015/R 1. Purpose. This AMC sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of CS - 25 related to material strength properties and material design values.

2. Related Certification Specifications.

CS 25.571 “Damage - tolerance and fatigue evaluation of structure” CS 25.603 “Materials” CS 25.613 "Material strength properties and material design values” 3. General . CS 25.613 contains the requirements for material strength prop erties and material design values. Material properties used for fatigue and damage tolerance analysis are addressed by CS 25.571 and AMC 25.571(a) .

When developing the material strength properties and material design values, the applicant should also consider potential anisotropies and establish all properties and design values relevant to the application of the material.

4. Material Strength Properties and Material Design Values.

4.1. Definitions.

Mate rial strength properties. Material properties that define the strength related characteristics of any given material. Typical examples of material strength properties are: ultimate and yield values for compression, tension, bearing, shear, etc.

Material de sign values. Material strength properties that have been established based on the requirements of CS 25.613(b) or other means as defined in this AMC. These values are generally statistically determined based on eno ugh data that when used for design, the probability of structural failure due to material variability will be minimised. Typical values for moduli can be used.

Aeroplane operating envelope. The operating limitations defined for the product under Subpart G of CS - 25.

4.2. Statistically Based Design Values . Design values required by CS 25.613(b) must be based on sufficient testing to assure a high degree of confidence in the values. In all cases, a statistical analysis of the test data must be performed.

The ‘ A ’ and ‘ B ’ properties published in t he SAE ‘ Metallic Materials Properties Development and Standardization (MMPDS) H andbook ’ or ESDU 00932 are acceptable, as are the statistical methods specified in the applicable c hapters/sections of these handbooks. Other methods of developing material design values may be acceptable to EASA .

The test specimens used for material property certification testing should be made from material produced using production processes. Test sp ecimen design, test methods , and testing should: (i) conform to universally accepted standards such as those of the American Society for Testing Materials (ASTM), European Aerospace Series Standards (EN), Powered by EASA eRules Page 344 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL International Standard Organisation (ISO), or other national standards acceptable to the Agency, or: (ii) conform to those detailed in the applicable chapters/sections of t he SAE MMPDS H andbook, Composite Materials Handbook 17 (CMH - 17) , ESDU 00932 or other accepted equivalent material data handbooks, or: (iii) be accomplished in accordance with an approved test plan which includes definition of test specimens and test methods. This provision would be used, for example, when the material design values are to be based on tests that include effects of specifi c geometry and design features as well as material.

EASA may approve the use of other material test data after review of test specimen design, test methods, and test procedures that were used to generate the data.

The use of some materials and processes ma y allow the applicant to design parts for which the material strength and other properties are produced during production or repair. Consequently, the use of simple material test coupons (as typically produced, independent of the part) at the base of a typ ical test pyramid (e.g. as defined in AMC 20 - 29 for ‘composite structures’) may not be representative of the material strength and other properties of the final part. When a higher test pyramid is required, then the applicant may need to reduce (for practi cal reasons) the number of specimens below what is normally expected for generating statistically significant values, e.g. as those associated with A and B basis data (as defined in the MMPDS Handbook). Therefore, other mitigating measures are likely neces sary (e.g. coupon testing of prolongations, testing of coupons from sections of production parts, other sampling strategies, more intensive non - destructive inspection (NDIs), etc.). Until industry establishes standards for such situations, the applicant sh ould agree with EASA whether and how to use test articles of a higher test pyramid, as well as associated small datasets, to generate material and design data. In that agreement, EASA may give credit to the applicant for applicable established practices.

4 .3. Consideration of Environmental Conditions . The material strength properties of a number of materials, such as non - metallic composites and adhesives, can be significantly affected by temperature as well as moisture absorption. For these materials, the e ffects of temperature and moisture should be accounted for in the determination and use of material design values. This determination should include the extremes of conditions encountered within the aeroplane operating envelope. For example, the maximum te mperature of a control surface may include effects of direct and reflected solar radiation, convection and radiation from a black runway surface and the maximum ambient temperature. Environmental conditions other than those mentioned may also have signific ant effects on material design values for some materials and should be considered.

4.4. Use of Higher Design Values Based on Premium Selection . Design values greater than those determined under CS 25.613(b) may be used if a premium selection process is employed in accordance with CS 25.613(e) . In that process, individual specimens are tested to determine the actual strength properties of each part to be installed on the airc raft to assure that the strength will not be less than that used for design.

The applicant should have data available to understand if a material is anisotropic and should account for this condition during testing.

Powered by EASA eRules Page 345 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL If premium selection is to be used, the t est procedures and acceptance criteria must be specified on the design drawing.

4.5. Other Material Design Values . Previously used material design values, with consideration of the source, service experience and application, may be approved by the Agency on a case by case basis (e.g. "S" values of "The Metallic Materials Properties Development and Standardization (MMPDS) handbook" or ESDU 00932).

4.6. Material Specifications and Processes. Materials should be produced using production specifications and processes accepted by the Agency.]

[Amdt 25/1] [Amdt 25/ 27 ]

CS 25.619 Special factors

ED Decision 2003/2/RM The factor of safety prescribed in CS 25.303 must be multiplied by the highest pertinent special fac tor of safety prescribed in CS 25.621 through CS 25.625 for each part of the structure whose strength is – (a) Uncertain.

(b) Likely to deteriorate in service before normal replacement; or (c) Subject to appreciable variability because of uncertainties in manufacturing processes or inspection methods.

Where the Agency is not satisfied in a specific case that a special factor is the correct approach to ensuring the nece ssary integrity of the parts of the structure under service conditions, other appropriate measures must be taken.

CS 25.621 Casting factors

ED Decision 2005/006/R (see AMC 25.621 .)

(a) General. For castings used i n structural applications, the factors, tests, and inspections specified in sub - paragraphs (b) through (d) of this paragraph must be applied in addition to those necessary to establish foundry quality control. The inspections must meet accepted specificati ons. Sub - paragraphs (c) and (d) of this paragraph apply to any structural castings except castings that are pressure tested as parts of hydraulic or other fluid systems and do not support structural loads.

(b) Bearing stresses and surfaces. The casting fa ctors specified in sub - paragraphs (c) and (d) of this paragraph: (1) Need not exceed 1.25 with respect to bearing stresses regardless of the method of inspection used; and (2) Need not be used with respect to the bearing surfaces of a part whose bearing fa ctor is larger than the applicable casting factor.

(c) Critical castings. (See AMC 25.621(c) ) Each casting whose failure could preclude continued safe flight and landing of the aeroplane or could result in serious injury to occupants is considered a critical casting. Each critical casting must have a factor associated with it for showing compliance with strength and deformation requirements, and must comply with the following criteria associated with that factor: Powered by EASA eRules Page 346 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL ( 1) A casting factor of 1.0 or greater may be used, provided that: (i) It is demonstrated, in the form of process qualification, proof of product, and process monitoring that, for each casting design and part number, the castings produced by each foundry a nd process combination have coefficients of variation of the material properties that are equivalent to those of wrought alloy products of similar composition. Process monitoring must include testing of coupons cut from the prolongations of each casting ( or each set of castings, if produced from a single pour into a single mould in a runner system) and, on a sampling basis, coupons cut from critical areas of production castings. The acceptance criteria for the process monitoring inspections and tests must be established and included in the process specifications to ensure the properties of the production castings are controlled to within levels used in design.

(ii) Each casting receives: (A) Inspection of 100 percent of its surface, using visual and liquid penetrant, or equivalent, inspection methods; and (B) Inspection of structurally significant internal areas and areas where defects are likely to occur, using radiographic, or equivalent, inspection methods.

(iii) One casting undergoes a static test and is shown to meet the strength and deformation requirements of CS 25.305(a) and (b) .

(see AMC 25.621(c)(1) .)

(2) A casting factor of 1.25 or greater may be used, provided that: (i) Each casting receives: (A) Inspection of 100 percent of its surface, using visual and liquid penetrant, or equivalent inspection methods; and (B) Inspection of structurally significant internal areas and area s where defects are likely to occur, using radiographic, or equivalent, inspection methods.

(ii) Three castings undergo static tests and are shown to meet: (A) The strength requirements of CS 25.305(b) at an ultimate load corresponding to a casting factor of 1.25; and (B) The deformation requirements of CS 25.305(a) at a load of 1.15 times the limit load.

(3) A casting factor of 1.50 or greater may be used, prov ided that: (i) Each casting receives: (A) Inspection of 100 percent of its surface, using visual and liquid penetrant, or equivalent, inspection methods; and (B) Inspection of structurally significant internal areas and areas where defects are likely to oc cur, using radiographic, or equivalent, inspection methods.

Powered by EASA eRules Page 347 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL (ii) One casting undergoes a static test and is shown to meet: (A) The strength requirements of CS 25.305(b) at an ultimate load corresponding to a cast ing factor of 1.50; and (B) The deformation requirements of CS 25.305(a) at a load of 1.15 times the limit load.

(d) Non - critical castings. For each casting other than critical castings, as specified in sub - paragr aph (c) of this paragraph, the following apply: (1) A casting factor of 1.0 or greater may be used, provided that compliance is shown with sub - paragraph (c)(1) of this paragraph, or with the following three conditions: (i) Castings are manufactured to acc epted specifications that specify the minimum mechanical properties of the material in the casting and provides for demonstration of these properties by testing of coupons cut from the castings on a sampling basis.

(ii) Each casting receives: (A) Inspect ion of 100 percent of its surface, using visual and liquid penetrant, or equivalent, inspection methods; and (B) Inspection of structurally significant internal areas and areas where defects are likely to occur, using radiographic, or equivalent, inspectio n methods.

(iii) Three sample castings undergo static tests and are shown to meet the strength and deformation requirements of CS 25.305(a) and (b) .

(2) A casting factor of 1.25 or greater may be used, provided tha t each casting receives: (i) Inspection of 100 percent of its surface, using visual and liquid penetrant, or equivalent, inspection methods; and (ii) Inspection of structurally significant internal areas and areas where defects are likely to occur, using radiographic, or equivalent, inspection methods.

(3) A casting factor of 1.5 or greater may be used, provided that each casting receives inspection of 100 percent of its surface using visual and liquid penetrant, or equivalent, inspection methods.

(4 ) A casting factor of 2.0 or greater may be used, provided that each casting receives inspection of 100 percent of its surface using visual inspection methods.

(5) The number of castings per production batch to be inspected by non - visual methods in accorda nce with sub - paragraphs (d)(2) and (d)(3) of this paragraph may be reduced from 100% when an accepted quality control procedure is established.

[Amdt 25/1]

AMC 25.621 Casting Factors

ED Decision 2005/006/R 1. Purpose.

CS 25.621 is an additional rule/requirement for structural substantiation of cast parts and components. It is used in combination with a number of other paragraphs, and does not replace or negate compliance with any other paragraph of CS - 25. The intent of this AMC is to provide general guidance on the use and background of "Casting Fac tors" as required by CS 25.621 .

Powered by EASA eRules Page 348 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 2. General Guidance For Use Of Casting Factors.

2.1 For the a nalysis or testing required by CS 25.307 , the ultimate load level must include limit load multiplied by the required factor required by CS 25.619 . The testing required in a ccordance with CS 25.621 may be used in showing complianc e with CS 25.305 and CS 25.307 . These factors need not be considered in t he fatigue and damage tolerance eva luations required by CS 25.571 .

2.2 The inspection methods prescribed by CS 25.621(c) and (d) for all production castings must be such th at 100% of the castings are inspected by visual and liquid penetrant techniques, with total coverage of the surface of the casting. With regard to the required radiographic inspection, each production casting must be inspected by this technique or equival ent inspection methods; the inspection may be limited to the structurally significant internal areas and areas wher e defects are likely to occur.

2.3 With the establishment of consistent production, it is possible to reduce the inspection frequency of the non - visual inspections required by the rule for non - critical castings, with the acceptance of the Agency. This is usually accomplished by an accepted quality control procedure incorporating a sampling pla n. (Refer to CS 25.621(d)(5) .)

2.4 The static test specimen(s) should be selected on the basis of the foundry quality control inspections, in conjunction with those inspections presc ribed in CS 25.621(c) and (d) . An attempt should be made to select the worst casting(s) from the first batch produ ced to the production standard.

2.5 If applicable, the effects on material properties due to weld rework should be addres sed.

The extent and scope of weld rework should be deta iled in the manufacturing specifications as well as on the design drawings.

3. Background.

3.1 Regulatory Background. CS 25.621 (“Casting factors”) requires classification of structural castings as either “critical ” or “non - critical.” Depending on classification, the requirement specifies the accomplishment of certain inspections and tests, and the application of special factors of safety for ult imate strength and deformation.

3.2 Application of S pecial Factors of S afety. The application of factors of safety applied to castings is based on the fact that the casti ng process can be inconsistent. Casting is a method of forming an object by pouring molten metal into a mould, allowing the material to solidify inside the m ould, and removing it wh en solidification is complete. Castings are subject to variability in mechanical properties due to this casting process, which can result in imperfections, such as voids, within the cast part. Using certain inspection techniques, f or example radiographic (X - ray), it is possible to detect such imperfections above a minimum detectable size, but accurate detection depends on the dimensions of the part, the inspection equipment used, and the skill of the inspector.

3.2.1 CS 25.619 (“Special factors”) includes a requirement to apply a special factor to the factor of safety prescribed in CS 25.303 for each part of the aeroplane structure whose strength is s ubject to appreciable variability because of uncertainties in the manufacturing pr ocesses or inspection methods. Since the mechanical properties of a casting depend on the casting design, the design values established under CS 25.613 (“Material strength properties and material design values”) for one casting might not be applicable to another casting m ade to the same specification.

Thus, casting factors have been necessary for castings produced by normal Powered by EASA eRules Page 349 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL techniques and methodologies to ensure the structural integrity of castings in light of these uncertainties.

3.2.2 Another approach is to reduce the uncertainties in the casting manufacturing process by use of a “premium casting process” (discussed in AMC 25.621(c)(1) ), which provides a means of using a casting factor of 1.0. CS 25.621 (“Casting factors”) does permit the use of a casting factor of 1.0 for cr itical castings, provided that: — the manufacturer has established tight controls for the casting process , inspection, and testing; and — the material strength properties of the casting have no more variability th an equivalent wrought alloys.

[Amdt 25/1]

AMC 25.621(c) Critical Casting s

ED Decision 2005/006/R Examples of castings that may be critical are: structural attachment fittings; parts of flight control systems; control surface hinges and balance weight attachments; seat, berth, safety belt and fuel and oil tank supports a nd attachments; pressurised door s; and cabin pressure valves.

[Amdt 25/1]

AMC 25.621(c)(1) Premium Castings

ED Decision 2005/006/R 1. Purpose.

This AMC details an acceptable means, but not the only means, for compliance with CS 25.621 for using a casting factor of 1.0 or greater for “critical” castings us ed in structural applications.

A premium casting process is capable of producing castings with predictable properties, thus allowing a casting factor of 1.0 t o be u sed for these components. Three major steps, required by CS 25.621(c)(1)(i) , are essential in characterising a premium casting process: — qualification of the process, — proof of the product, and — monitoring of the pr ocess.

2. Definitions. For the purposes of this AMC, the following definitions apply: 2.1 Prem ium Casting Process: a casting process that produces castings characterised by a high quality and reliability 2.2 Prolongation: an integrally cast test bar or te st coupon.

2.3 Test Casting: a casting produced specifically for the purpose of qualifying the casting process.

Powered by EASA eRules Page 350 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 3. General. The objective of a premium casting process is to consistently produce castings with high quality and reliability. To this end, the casting process is one that is capable of consistently producing castings that include the following characteristics: — Good dimensional tolerance — Minimal distortion — Good surface finish — No cracks — No cold shuts — No laps — Minimal shrinkage cavities — No harmful entrapped oxide films — Minimal porosity — A high level of metallurgical cleanness — Good microstructural characteristics — Minimal residual internal stress — Consistent mechanical properties The majority of these characteristics can be detected, evaluated, and quantified by standard non - destructive testing methods, or from destructive methods on prolongation or casting cut - up tests. However, a number of them cannot. Thus, to ensure an acceptable quality of product, the significant and critical process variab les must be identified and adequately controlled.

4. A Means of Qualification of Casting Process.

4.1 To prove a premium casting process, it should be submitted to a qualification program that is specific to a foundry/material combination. The qualificatio n program should establish the foll owing: (a) The capability of the casting process of producing a consistent quality of product for the specific material grade selected for the intended production component.

(b) The mechanical properties for the material produced by the process have population coefficients of variation equivalent to that of wrought products of similar composition (i.e ., plate, extrusions, and bar). Usage of the population coefficient of variation from forged products does not apply. In mos t cases, the coefficients of variation for tensile ultimate strength and tensile yield strength less than or equal to 3.5% and 4.0% respectively is adequate to demonstrate this equivalency of mechanical properties.

(c) The casting process is capable of pro ducing a casting with uniform properties throughout the casting or, if not uniform, with a distribution of material properties that can be predicted to an acceptable level of accuracy.

(d) The (initial) material design data for the specified material are e stablished.

(e) The material and process spec ifications are clearly defined.

Powered by EASA eRules Page 351 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 4.2 For each material specification, a series of test castings from a number of melts, using the appropriate production procedures of the fo undry, should be manufactured. The te st casting produced should undergo a standardised inspection or investigation of non - destructive inspection and cut - up testing, to determine the consistency of the casting process.

4.3 The test casting should be representative of the intended cast product( s) with regard to section thicknesses and complexity, and should expose any limitations of the casting process. In addition, the test casting should be large enough to provide mechanical test specimens from various areas, for tensile and, if applicable, c ompression, shear, bearing, fatigue, fracture toughness, and crack propagation tests. If the production component complies with these requirements, it may be used to qualify the process. The number of melts sampled should be statistically significant. Ty pically, at least 10 melts are sampled, with no more than 10 castings produced from each melt. If the material specification requires the components to be heat - treated, this should be done in no fewer than 10 heat treatment batches consisting of castings from more than one melt. Reduction of qualification tests may be considered if the casting process and the casting alloy is already well known for aerospace applications and t he relevant data are available.

4.4 Each test casting should receive a non - destr uctive inspection program which should include as a minimum: — inspection of 100% of its surface, using visual and liquid penetrant, or equiv alent, inspection methods; and — inspection of structurally significant internal areas and areas where defects are lik ely to occur, using radiographic methods or equivalent inspection methods. The specific radiographic standard to be employed is to be determined, and the margin by which the test castings exceed the minimum required standard should be recorded.

4.4.1 The progra m of inspection is intended to: (a) confirm that the casting process is capable of producing a consistent quality of product, and (b) verify compliance with the stated objectives of a premium casting process with regard to surface finish, cracks, c old shuts, laps, shrinkage cavities, and porosity, (see paragraph 3), and (c) ensure that the areas from which the mechanical property test samples were taken were typical of the casting as a whole with resp ect to porosity and cleanness.

4.4.2 Guidance on non - destructive inspection techniques and methods can be obtained from national and international standards. The standard listing below is not a comprehensive list but is given as an initial reference guide.

ASTM A802 Standard practice for ste el castings, surface acceptance standards, visual examination.

ASTM A903 Standard specification for steel castings, surface acceptance standards, magnetic particle and liquid penetrant inspection.

ASTM E155 Standard Reference Radiographs for Inspection of Aluminum and Magnesium Castings.

Powered by EASA eRules Page 352 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL ASTM E192 Standard Reference Radiographs for Investment Steel Castings of Aerospace Applications.

ASTM E433 Standard reference photographs for liquid penetrant inspection.

ASTM E1030 Standard test method for radiographic ex amination of metallic castings.

ASTM E1320 Standard Reference Radiographs for Titanium Castings.

ISO 4986 Steel castings - Magnetic particle inspection ISO 4987 S teel castings - Penetrant inspection ISO 49 93 Steel castings - Radiographic inspection ISO 9915 Aluminium alloy castings - Radiography testing ISO 9916 Aluminium alloy and magnesium alloy castings - Liquid penetrant inspection ISO 10049 Aluminium a lloy castings - Visual method for assessing the por osity ISO 11971 Visual examination of su rface quality of steel castings The test castings must show that the Foundry/Process combination is capable of producing product free of cracks, laps, and cold sh uts. Ideally the test castings should be free of detec table sh rinkage cavities and porosity. With regard to dimensional tolerance, distortion, and surface finish guidance for acceptance criteria can be gained from the standards cited above. Consideration that these standards are for general quality castings m ust be given when they are used.

4.5 All test castings should be cut up to a standardised methodology to produce the mechanical test specimens as d etailed by paragraph 4.3 above. Principally, the tests are to establish the variability within the cast compo nent, as well as to determine the variability between components from the sa me melt and from melt to melt. The data gathered also may be used during latter phases to identify deviations from the limits established in the process qualification and product p roving programs.

4.6 All the fracture surfaces generated during the qualification program should be inspected at least visually for detrimental defects. Evidence of inclusions, oxide films, porosity or shrinkage cavities would indicate inadequate control o f the casting pr ocess.

4.7 As part of the cut - up investigation, it is usually necessary to take metallographic samples for cleanness determination and microstructural characterisation.

4.8 When the process has been qualified, it should not be altered witho ut completing comparability studies and ne cessary testing of differences.

5. Proof of Product 5.1 Subsequent to the qualification of the process, the production castings should be subjected t o a production - proving program. Such castings should have at leas t one prolongation; however, large and/or complex castings may require more than one. If a number of castings are produced from a single mould with a single runner system, they may be treated as one single casting. The production - proving program should es tablish the following: (a) The design values developed during the process qualification program are valid (e.g., same statistical distribution) for the production casting.

Powered by EASA eRules Page 353 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL (b) The production castings have the same or less than the level of internal defects as the test castings produced during qualification.

(c) The cast components have a predictable distribution of tensile properties.

(d) The prolongation(s) is representative of the critical area(s) of the casting.

(e) The prolongation(s) consistently reflects the quality process, and material properties of the casting.

5.2 A number of (i.e., at least two) pre - production castings of each part number to be produced should be select ed for testing and inspection. All of the selected castings s hould be non - destructively inspected in accordance wi th the qualification program.

(a) One of these castings should be used as a dimensional tolerance test article. The other selected casting(s) should be cut up for mechanical property testing and metallographic inspection.

(b) The casting(s) should be cut up to a standardised program to yi eld a number of tensile test specim ens and metallographic samples. There should be sufficient cut - up tensile specimens to cover all critical (“critical” with respect to both the casting process and service l oading) areas of the casting.

(c) All prolongati ons should be machined to give tensile speci mens, and subsequently tested.

(d) The production castings should be produced to production procedures identical to those used for these pre - production castings.

5.3 On initial production, a number of castings sh ould undergo a cut - up for mechanical property testing and metallographic inspection, similar to that performed for the pre - production casting(s). The cut - up procedure used should be standardised, although it may differ from that used for the pre - production casting(s). Tensile specimens should be obtained from the most critical areas.

(a) For the first 30 castings produced, at least 1 casting in 10 should undergo this testing pr ogram.

(b) The results from the mechanical property tests should be compared with the results obtained from the prolongations to further substantiate the correlation between prolongation(s) and the cr itical area(s) of the casting.

(c) In addition, if the distribution of mechanical properties derived from these tests is acceptable, when compared to the property values determined in the qualification program, the freque ncy of testing may be reduced. However, if the comparison is found not to be acceptable, the test program may require extension.

5.4 At no point in the production should th e castings contain shrinkage cavities, cracks, cold shuts, laps, porosity, or entrapped oxide film, or have a poor surface finish, exceeding the acceptance level defined in the technical specifications.

6. Monitoring the Process.

6.1 For the product qualit y techniques should be employed to establish the significant/critical foundry process variables that have an impact on the quality of the product. For the product it should be shown that these variables are controlled with positive corrective action throug hout production.

Powered by EASA eRules Page 354 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 6.2 During production, every casting should be non - destructively inspected using the techniques and the acceptance standards employed duri ng the qualification program.

(a) Rejections should be investigated and process corrections made as n ecessary.

(b) Alternative techniques may be employed if the equivalence in the acceptanc e levels can be demonstrated.

(c) In addition, tensile tests should be taken from the prolongations on every component produced, and the results should comply with li mits developed in the process qualification and product proving programs.

(d) Additionally, as previously mentioned, a periodic casting cut - up inspection should be undertaken, with the inspection schedule as agreed upon during the proof of product program.

(e) Deviations from the limits established in the process qualification and product proving programs should be investigated and corrective action taken.

7. Modifications to the Casting Design, Material, and Process.

7.1 Additional testing may be required when alterations are made to the casting geometry, material, significant/critical process variables, process, or production foundry to verify that the alterations have not significantly cha nged the castings’ properties. The verification testing recommended is detailed in Table 1, below: Modifications Verification Testing Case Geometry Material Process Foundry Qualification of Proof of Tests per CS Process Product 25.621(c)(1) 1 yes none none none n ot necessary yes yes (b) 2 none yes none none yes (a) yes yes (b) 3 yes yes none none yes yes yes 4 none none yes None yes (a) yes yes (b) 5 none none none yes yes (a) yes yes (b) (a) The program described in paragraph 4. of this AMC to qualify a new material, process, and foundry combination may not be necessary if the following 3 conditions exist for the new combination: (1) Sufficient data from relevant castings to show that the process is capable of producing a consistent quality of product, and that the quality is comparable to or better than the old combination.

(2) Sufficient data from relevant castings to establish that the mechanical properties of the castings produced from the new combination have a similar or better statistical distribution than the old combination.

(3) Cl early defined material and process specifications.

(b) The casting may be re - qualified by testing partial static test samples (with larger castings, re - qualification could be undertaken by a static test of the casting's critical region only).

[Amdt 25/1] Powered by EASA eRules Page 355 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL

CS 25.623 Bearing factors

ED Decision 2003/2/RM (a) Except as provided in sub - paragraph (b) of this paragraph, each part that has clearance (free fit), and that is subject to pounding or vibration, must have a bearing factor large enough to provide for the effects of normal relative motion.

(b) No bearing factor need be used for a part for which any larger special factor is prescribed.

CS 25.625 Fitting factors

ED Decision 2003/ 2/RM For each fitting (a part or terminal used to join one struc tural member to another), the following apply: (a) For each fitting whose strength is not proven by limit and ultimate load tests in which actual stress conditions are simulated in the fitting and surrounding structures, a fitting factor of at least 1·15 must be applied to each part of – (1) The fitting; (2) The means of attachment; and (3) The bearing on the joined members.

(b) No fitting factor need be used – (1) For joints made under approved practices and based on comprehensive test data (such as conti nuous joints in metal plating, welded joints, and scarf joints in wood); or (2) With respect to any bearing surface for which a larger special factor is used.

(c) For each integral fitting, the part must be treated as a fitting up to the point at which the section properties become typical of the member.

(d) For each seat, berth, safety belt, and harness, the fitting factor specified in CS 25.785(f)(3) applies.

CS 25.629 Aeroelastic stability requirements

ED Decision 2020/001/R (See AMC 25.629 ) (a) General . The aeroelastic stability evaluations required under this paragraph include flutter, divergence, control reversal and any undue loss of stability and control as a result of structural deformation. The aeroelastic evaluation must include whirl modes associated with any propeller or rotating device that contributes significant dynamic forces. Compliance with this paragraph must be shown by analyses, t ests, or some combination thereof as found necessary by the Agency .

(b) Aeroelastic stability envelopes . The aeroplane must be designed to be free from aeroelastic instability for all configurations and design conditions within the aeroelastic stability en velopes as follows: (1) For normal conditions without failures, malfunctions, or adverse conditions, all combinations of altitudes and speeds encompassed by the V /M versus altitude D D envelope enlarged at all points by an increase of 15 percent in equivalen t airspeed at constant Mach number and constant altitude. In addition, a proper margin of stability must exist at all speeds up to V /M and, there must be no large and rapid reduction in D D Powered by EASA eRules Page 356 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL stability as V /M is approached. The enlarged envelope may be limit ed to Mach 1.0 D D when M is less than 1.0 at all design altitudes; and D (2) For the conditions described in CS 25.629(d) below, for all approved altitudes, any airspeed up to the greater airspeed defined by: (i) The V /M envelope determined by CS 25.335(b) ; or, D D (ii) An altitude - airspeed envelope defined by a 15 percent increase in equivalent airspeed above V at constant altitude, from sea level to the altitude of the C intersection of 1.15 V with the extension of the constant cruise Mach number line, C M , then a linear variation in equivalent airspeed to M +.05 at the altitude of the C C lowest V /M intersection; then, at higher altitudes, up to the maximum flight C C altitude, the boundary defined by a .05 Mach increase in M at constant altitude; C and (iii) Failure conditions of certain systems must be treated in accordance with CS 25.302 .

(3) For failure conditions in those systems covered by CS 25.302 , the margins defined in Appendix K of CS - 25 apply.

(c) Balance weights . If balance weights are used, their effe ctiveness and strength, including supporting structure, must be substantiated.

(d) Failures, malfunctions, and adverse conditions . The failures, malfunctions, and adverse conditions which must be considered in showing compliance with this paragraph are: (1 ) Any critical fuel loading conditions, not shown to be extremely improbable, which may result from mismanagement of fuel.

(2) Any single failure in any flutter damper or flutter control system.

(3) For aeroplanes not approved for operation in icing condit ions, the maximum likely ice accumulation expected as a result of an inadvertent encounter.

(4) Failure of any single element of the structure supporting any engine, independently mounted propeller shaft, large auxiliary power unit, or large externally mou nted aerodynamic body (such as an external fuel tank).

(5) For aeroplanes with engines that have propellers or large rotating devices capable of significant dynamic forces, any single failure of the engine structure that would reduce the rigidity of the ro tational axis.

(6) The absence of aerodynamic or gyroscopic forces resulting from the most adverse combination of feathered propellers or other rotating devices capable of significant dynamic forces. In addition, the effect of a single feathered propeller or rotating device must be coupled with the failures of sub - paragraphs (d)(4) and (d)(5) of this paragraph.

(7) Any single propeller or rotating device capable of significant dynamic forces rotating at the highest likely overspeed.

(8) Any damage or failur e condition, required or selected for investigation by CS 25.571 . The single structural failures described in sub - paragraphs (d)(4) and(d)(5) of this paragraph need not be considered in showing compliance with this paragraph if; (i) The structural element could not fail due to discrete source damage resulting from the conditions described in CS 25.571(e) and CS 25.903(d) ; and Powered by EASA eRules Page 357 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL (ii) A damage tolerance investigation in accordance with CS 25.571(b) shows that the maximum extent of damage assumed for the purpose of residual strength evaluation does not involve complete failure of the structural element.

(9) The following flight cont rol system failure combinations where aeroelastic stability relies on flight control system stiffness and/or damping: (i) any dual hydraulic system failure; (ii) any dual electrical system failure; and (iii) any single failure in combination with any proba ble hydraulic system or electrical system failure.

( 10 ) Any damage, failure or malfunction, considered under CS 25.631 , CS 25.671 , CS 25.672 , and CS 25.1309 .

(1 1 ) Any other combination of failures, malfunctions, or adverse conditions not shown to be extremely improbable.

(e) Flight flutter testing . Full scale flight flutter tests at speeds up to V /M must be conducted for DF DF new type designs and for modifications to a type design unless the modifications have been shown to have an insignificant effect on the aeroelastic stability. These tests must demonstrate that the aeroplane has a proper ma rgin of damping at all speeds up to V /M , and that there DF DF is no large and rapid reduction in damping as V /M is approached. If a failure, malfunction, DF DF or adverse condition is simulated during flight test in showing compliance with sub - paragraph (d) of ' this paragraph, the maximum speed investigated need not exceed V /M if it is shown, FC FC by correlation of the flight test data with other test data or analyses, that the aeroplane is free from any aeroelastic instability at all speeds within the altitude - airspeed envelope described in sub - paragraph (b)(2) of this paragraph.

[ Amdt No: 25/1] [Amdt No: 25/18 ] [Amdt No: 25/24]

AMC 25.629 Aeroelastic stability requirements

ED Decision 2020/001/R 1. General .

The general requirement for demonstrating freedom from aeroelastic instability is contained in CS 25.629 , which also sets forth specific requirements for the investigation of these aeroelastic phenomena for various aeroplane configurations and flight conditions. Additionally, there are other conditions defined by the CS - 25 paragraphs listed below to be investigated for aeroelastic stability to assure safe flight. Many of the conditions contained in this AMC pertain only to the current amendment of CS - 25. Type design changes to aeroplanes certified to an earlier CS - 25 amendment must meet the certification basis established for the modified aeroplane.

Related CS - 25 paragraphs: CS 25.251 - Vibration and buffeting CS 25.305 - Strength and deformation CS 25.335 - Design airspeeds CS 25.343 - Design fuel and oil loads CS 25.571 - Damage - tolerance and fatigue evaluation of structure Powered by EASA eRules Page 358 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SU BPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL CS 25.629 - Aeroelastic stability requirements CS 25.631 - Bird strike damage CS 25.671 - General (Control systems) CS 25.672 - Stability augmentation and automatic and power operated sys tems CS 25.1309 - Equipment, systems and installations CS 25.1329 - Flight Guidance system CS 25.1419 - Ice protection CS 25.1420 – Supercooled large drop icing conditions 2. Aeroelastic Stability Envelope 2.1. For nominal conditions without failures, malfunctions, or adverse conditions, freedom from aeroelastic i nstability is required to be shown for all combinations of airspeed and altitude encompassed by the design dive speed (V ) and design dive Mach number (M ) D D versus altitude envelope enlarged at all points by an increase of 15 percent in equivalent airspeed at both constant Mach number and constant altitude. Figure 1A represents a typical design envelope expanded to the required aeroelastic stability envelope. Note that some required Mach number and airspeed combinations correspond to altitudes below standar d sea level.

2.2. The aeroelastic stability envelope may be limited to a maximum Mach number of 1.0 when M is less than 1.0 and there is no large and rapid reduction in damping as MD is D approached.

2.3. Some configurations and conditions that are required to be investigated by CS 25.629 a nd other CS - 25 regulations consist of failures, malfunctions or adverse conditions .

Aeroelastic stability investigations of these conditions need to be carried out only within the design airspeed versus altitude envelope defined by: (i) the V /M envelope determined by CS 25.335(b) ; or, D D (ii) an altitude - airspeed envelope defined by a 15 percent increase in equivalent airspeed above V at con stant altitude, from sea level up to the altitude of the C intersection of 1.15 V with the extension of the constant cruise Mach number line, C M , then a linear variation in equivalent airspeed to M + 0 .05 at the altitude of the C C lowest V /M intersection; then at higher altitudes, up to the maximum flight C C altitude, the boundary defined by a 0 .05 Mach increase in M at constant altitude.

C Figure 1B shows the minimum aeroelastic stability envelope for fail - safe conditions, which is a composite o f the highest speed at each altitude from either the V envelope or D the constructed altitude - airspeed envelope based on the defined V C and M C .

Fail - safe design speeds, other than the ones defined above, may be used for certain system failure conditions whe n specifically authorised by other rules or special conditions prescribed in the certification basis of the aeroplane.

Powered by EASA eRules Page 359 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL FIGURE 1A. MINIMUM REQUIRED AEROELASTIC STABILITY MARGIN FIGURE 1B MINIMUM FAIL - SAFE CLEARANCE ENVELOPE Powered by EASA eRules Page 360 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 3. Configurations and Conditions . The following paragraphs provide a summary of the configurations and conditions to be investigated in demonstrating compliance with CS - 25.

Specific design configurations may warrant additional considerations not discussed in this AMC.

3.1. Nominal Configurations and Conditions . Nominal configurations and conditions of the aeroplane are those that are likely to exist in normal operation. Freedom from aeroelastic instability should be shown throughout the expanded clearance enve lope described in paragraph 2.1 above for: 3.1.1. The range of fuel and payload combinations, including zero fuel in the wing, for wh ich certification is requested.

3.1.2. Configurations with ice mass accumulations on unprotected surfaces for aeroplanes approved for operation in icing conditions. See paragraph 5.1.4.5 below.

3.1.3. All normal combinations of autopilot, yaw damper, or other au tomatic flight control systems.

3.1.4. All possible engine settings and combinations of settings from id le power to maximum available thrust including the conditions of one engine stopped and windmilling, in order to address the influence of gyroscopic loads and thrust on aeroelastic stability.

3.2. Failures, Malfunctions , and Adverse Conditions . The followi ng conditions should be investigated for aeroelastic instability within the fail - safe envelope defined in paragraph 2.3 . above.

3.2.1. Any critical fuel loading conditions, not shown to be extremely improbable, which may result from mismanagement of fuel.

3.2.2. Any single failure in any flutter control system.

3.2.3. For aeroplanes not approved for operation in icing conditions, ice accumulation expected as a resu lt of an inadvertent encounter. For aeroplanes approved for operation in icing conditions, ice accumulation expected as the result of any single failure in the de - icing system, or any combination of failures not shown to be extremely improbable. See paragraph 5.1.4.5 below.

3.2.4. Failure of any single element of the structure supporting any engine , independently mounted propeller shaft, large auxiliary power unit, or large externally mounted aerodynamic body ( such as an external fuel tank).

3.2.5. For aeroplanes with engines that have propellers or large rotating devices capable of significant dyna mic forces, any single failure of the engine structure that would reduce the rigidity of the rotational axis.

3.2.6. The absence of aerodynamic or gyroscopic forces resulting from the most adverse combination of feathered propellers or other rotating devic es capable of significant dynamic forces. In addition, the effect of a single feathered propeller or rotating device should be coupled with the failures of pa ragraphs 3.2.4 and 3.2.5 above.

3.2.7. Any single propeller or rotating device capable of signific ant dynamic forces rotating at the highest likely overspeed.

Powered by EASA eRules Page 361 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPAR T D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 3.2.8. Any damage or failure condition, required or s elected for investigation by CS 25.571 . The single structural failures described in paragraphs 3.2.4 and 3.2.5 above need not be considered in showing comp liance with this paragraph if; (A) The structural element could not fail due to discrete source damage resulting from the conditions described in CS 25.571(e) and CS 25.903(d) ; and (B) A damage tolerance investigation in accordance with CS 25.571(b) shows that the maximum extent of damage assumed for the purpose of residual strength ev aluation does not involve complete fai lure of the structural element.

3.2.9. The following flight control system failure combinations where aeroelastic stability relies on flight control system stiffness and/or damping: (i) any dual hydraulic system failure; (ii) any dual electrical system failure; and (iii) any single failure in combination with any probable hydraulic system or electrical system failure.

3.2.10. Any damage, failure or malfunction, considered under CS 25.631 , CS 25.671 , CS 25.672 , and CS 25.1309 . This includes the condition of two or more engines stopped or wind milling for the design range of fuel and payload combinations, including zero fuel.

3.2.11. Any other combination of failures, malfunctions, or adverse conditions not sh own to be extremely improbable.

4. Detail Design Requirements.

4.1. Main surfaces, such as wing s and stabilisers, should be designed to meet the aeroelastic stability criteria for nominal conditions and should be investigated for meeting fail - safe criteria by considering stiffness changes due to discrete damage or by reasonable parametr ic variations of design values.

4.2. Control surfaces, including tabs, should be investigated for nominal conditions and for failure modes that include single structural failures (such as actuator disconnects, hinge failures, or, in the case of aerodynamic balance pane ls, failed seals), single and dual hydraulic system failures and any other combination of failures not sho wn to be extremely improbable. Where other structural components contribute to the aeroelastic stability of the system, failures of those components should be considered for possible adverse effects.

4.3. Where aeroelastic stability relies on flight control system stiffness and/or damping, additional co nditions should be considered. The actuation system should continuously provide, at least, the minimum stiffness or damping required for showing aeroelastic stability without regard to probability of occurrence for: (i) more than one engine stopped or wind milling, (ii) any discrete single failure resulting in a change of the structural modes o f vibration (for example; a disconnect ion or failure of a mechanical element, or a structural failure of a hydraulic element, such as a hydraulic line, an actuato r, a spool housing or a valve); Powered by EASA eRules Page 362 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL (iii) any damage or failure conditions considered un der CS 25.571 , CS 25.631 and CS 25.671 .

The actuation system minimum requirements should also be continuously met after any - 9 combination of f ailures not shown to be extremely improbable (occurrence less than10 per flight hour). However, some combinations of failures, such as dual electrical system or dual hydraulic system failures, or any single failure in combination with any probable electr ical or hydraulic system failure, are normally not demonstrated as being extremely improbable The reliability assessment should be part of the substantiation documentation. In practice, meeting the above conditions may involve design concepts such as the u se of check valves and accumulators, computerised pre - flight system checks and shortened inspection intervals to protect against undetected failures.

4.4 Consideration of free play may be incorporated as a variation in stiffness to assure adequate limits a re established for wear of components such as control surface actuators, hinge bearings, and engine mounts in order to maintain aeroelastic stability margins.

4.5. If balance weights are used on control surfaces, their effectiveness and strength, including that of their support structure, should be substantiated.

4.6 The automatic flight control system should not interact with the airframe to produce an aeroelastic instability. When analyses indicate possible adverse coupling, tests should be performed to determine the dynamic characteristics of actuation systems such as servo - boost, fully powered servo - control systems, closed - loop aeroplane flight control systems, stability augmentation systems, and other r elated powered - control systems.

5. Compliance. Dem onstration of compliance with aeroelastic stability requirements for an aircraft configuration may be shown by analyses, tests, or some combination thereof. In most instances, analyses are required to determine aeroelastic stability margins for normal ope rations, as well as fo r possible failure conditions. Wind tunnel flutter model tests, where applicable, ma y be used to supplement flutter analyses. Ground testing may be used to collect stiffness or modal data f or the aircraft or components. Flight testing may be used to demonstrate compliance of the aircraft design throughout the design speed envelope.

5.1. Analytical Investigations. Analyses should normally be used to investigate the aeroelastic stability of the aircraft throughout its design flight envelope and as expanded by the required speed margins. Analyses are used to evaluate aeroelastic stability sensitive parameters such as aerodynamic coefficients, stiffness and mass distributions, control surface balance requirements, fuel management sche dules, engine/store locations, and control system characte ristics. The sensitivity of most critical parameters may be determined analytically by varyi ng the parameters from nominal. These investigations are an effective way to account for the operating con ditions and possible failure modes which may have an effect on aeroelastic stability margins, and to account for uncertainties in the values of parameters and expected variations due to in - serv ice wear or failure conditions.

5.1.1. Analytical Modelling. Th e following paragraphs discuss acceptable, but not the only, methods and forms of modelling aircraft configurations and/or components for purposes of aeroelastic stability analysis. The types of investigations generally encountered in the course of aircraf t aeroelastic stability substantiatio n are also discussed. The basic elements to be modelled in aeroelastic stability analyses are the elastic, inertial, and aerodynamic characteristics of the system. The degree of complexity required in the modelling, and the degree to which other Powered by EASA eRules Page 363 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL characteristics need to be included in the modelling, depend upon the system complexity.

5.1.1.1. Structural Modelling. Most forms of structural modelling can be classified into two main categories: (1) modelling using a lumped m ass beam, and (2) finite element modelling. Regardless of the approach taken for structural modelling, a minimum acceptable level of sophistication, consistent with configuration complexity, is necessary to satisfactorily represent the critical modes of de formation of the primary structure and control surfaces. The model should reflect the support structure for the attachment of control surface actuators, flutter dampers, and any other elements for which stiffness is important in prevention of aeroelastic instability. Wing - pylon mounted engines are often significant to aeroelastic stability and warrant particular attention in the modelling of the pylon, and pylon - engine and pylon - wing interfaces. The model should include the effects of cut - outs, doors, and other structural features which may tend to affect the resulting structural effectiveness. Reduced stiffness should be considered in the modelling of aircraft structural components which may exhibit some change in stiffness under limit design flight condit ions. Structural models include mass distributions as well as representations of stiffness and possibly damping characteristics. Results from the models should be compared to test data, such as that obtained from ground vibration tests, in order to determi ne the accuracy of the model and its applicability to the aeroelastic stability investigation.

5 .1.1.2. Aerodynamic Modelling.

(a) Aerodynamic modelling for aeroelastic stability requires the use of unsteady, two - dimensional strip or three - dimensional pane l theory methods for incompressible or compressible flow. The choice of the appropriate technique depends on the complexity of the dynamic structural motion of the surfaces under investigation and the flight s peed envelope of the aircraft. Aerodynamic mode lling should be supported by tests or previous experience with applications to similar configurations.

(b) Main and control surface aerodynamic data are commonly adjusted by weighting factors in the aeroelastic stability solutions. The weighting factors fo r steady flow (k=0) are usually obtained by comparing wind tunnel test results with theoretical data. Special attention should be given to control surface aerodynamics because viscous and other effects may require more extensive adjustment s to theoretical coefficients. Main surface aerodynamic loading due to control surface d eflection should be considered.

5.1.2. Types of Analyses.

5.1.2.1. Oscillatory (flutter) and non - oscillatory (divergence and control reversal) aeroelastic instabilities should be analysed to show compliance with CS 25.629 .

Powered by EASA eRules Page 364 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 5.1.2.2. The flutter analysis methods most exte nsively used involve modal analysis with unsteady aerodynamic forces derived from various two - and three - dimensional theories. These methods are generally for linear systems.

Analyses involving control system characteristics should include equations descri bing system control laws in addition to the equations describing the structural modes.

5.1.2.3. Aeroplane lifting surface divergence analyses should include all appropriate rigid body mode degrees - of - freedom since divergence may occur for a structural mode or the short period mode.

5.1.2.4. Loss of control effectiveness (control reversal) due to the effects of elastic deformations should be investigated. Analyses should include the inertial, elastic, and aerodynamic forces resulting from a control surface d eflection.

5.1.3 Damping Requirements.

5.1.3.1. There is no intent in this AMC to define a flight test level of acceptable minimum damping.

5.1.3.2. Flutter analyses results are usually presented graphically in the form of frequency versus velocity (V - f, F igure 2) and damping versus velocity (V - g, Figures 3 and 4) curves for each root of the flutter solution.

5.1.3.3. Figure 3 details one common method for showing compliance with the requirement for a proper margin of damping. It is based on the assumption that the structural damping available is 0.03 (1.5% critical viscous damping) and is the same for all modes as depicted by the V - g curves shown in Figure 3. No significant mode, such as curves (2) or (4), should cross the g=0 line below V or the g=0.03 line below 1.15 V . An exception may be a mode D D exhibiting damping characteristics similar to curve (1) in Figure 3, whi ch is not critical for flutter. A divergence mode, as illustrated by curve (3) where the frequency approaches zero, should have a diverge nce velocity not less than 1.15 V .

D 5.1.3.4. Figure 4 shows another common method of presenting the flutter analysis results and defining the structural damping requirements. An appropriate amount of structural damping for each mode is entered into the an alysis prior to the flutter solution. The amount of structural damping used should be supported by measurements taken during full scale tests. This results in modes offset from the g=0 line at zero airspeed and, in some cases, flutter solutions different from those obtain ed with no structural damping. The similarity in the curves of Figures 3 and 4 are only for simplifying this example. The minimum acceptable damping line applied to the analytical results as shown in Figure 4 corresponds to 0.03 or the modal damping available at zero airspeed for the particular mode of interest, whichever is less, but in no case less than 0.02. No significant mode should cross this line below V or the g=0 line below 1.15 V .

D D 5.1.3.5. For analysis of failures, malfunctio ns or adverse conditions being investigated, the minimum acceptable damping level obtained analytically would be determined by use of either method above, but with a substitution of V for V and the fail - safe envelope speed at the analysis altitude as C D det ermined by paragraph 2.3 above.

Powered by EASA eRules Page 365 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL FIGURE 2: FREQUENCY VERSUS VELOCITY FIGURE 3: DAMPING VERSUS VELOCITY - Method 1 Powered by EASA eRules Page 366 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL FIGURE 4: DAMPING VERSUS VELOCITY - Method 2 5.1.4. Analysis Considerations. Airframe aeroelastic stability analyses may be used to ver ify the design with respect to the structural stiffness, mass, fuel (including in - flight fuel management), automatic flight control system characteristics, and altitude and Mach number variations wit hin the design flight envelope. The complete aeroplane sh ould be considered as composed of lifting surfaces and bodies, including all primary control surfaces which can interact with the lifting surface s to affect flutter stability. Control surface flutter can occur in any speed regime and has historically been the mos t common form of flutter. Lifting surface flutter is more likely to occur at high dynamic pressure and at high subson ic and transonic Mach numbers. Analyses are necessary to establish the mass balance and/or stiffness and redundancy requirements for the control surfaces and supporting structure and to determine th e basic surface flutter trends. The analyses may be used to determine the sensitivity of the nominal aircraft design to aerodynamic, mass, and stiffness variations. Sources of stiffness var iation may include the effects of skin buckling at limit load factor, air entrapment in hydraulic actuators, expected levels of in - service free play, and control system components which may include elem ents with non - linear stiffness. Mass variations includ e the effects of fuel density and distribution, control surface repairs and painting, and water and ice accumulation.

5.1.4.1. Control Surfaces. Control surface aeroelastic stability analyses should include control surface rotation, tab rotation (if applic able), significant modes of the aeroplane, control surface torsional degrees - of - freedom, and control surface bending (if applicable). Analyses of aeroplanes with tabs should include tab rotation that is both independent and related to the parent control su rface. Control surface rotation frequencies should be varied about nominal values as appropriate for the condition. The control surfaces should be analysed as completely free in rotation unless it can be Powered by EASA eRules Page 367 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DE SIGN AND (CS - 25) CONSTRUCTION GENERAL shown that this cond ition is extremely improbable. A ll conditions between stick - free and stic k - fixed should be investigated. Free play effects should be incorporated to account for any influence of in - se rvice wear on flutter margins. The aerodynamic coefficients of the control surface and tab used in the ae roelastic stability analysis should be adjusted to match experime ntal values at zero frequency. Once the analysis has been conducted with the nominal, experimentally adjusted values of hinge moment coefficients, the analysis should be conducted with parametric variations of these coefficients and other par ameters subject to variability. If aeroelastic stability margins are found to be sensitive to these parameters, then additional verification in the form of model or flight tests may be required.

5.1. 4.2. Mass Balance.

(a) The magnitude and spanwise location of control surface balance weights may be evaluated by analysis and/or wind tunnel flutter model tests. If the control surface torsional degrees of freedom are not included in the analysis, then adequate separation needs to be maintained between the frequency of the control surface first torsion mode and the flutter mode.

(b) Control surface unbalance tolerances should be specified to provide for repair and painting. The accumulation of water, ice, and/or dirt in or near the trailing edge of a control surface should be avoided. Free play between the balance weight, the support arm, and the control surface should not be allowed. Control surface mass properties (weight and static unbalance) should be confirmed by measurement b efore ground vibration testing.

(c) The balance weights and their supporting structure should be substantiated for the extreme load factors expected throughout the design flight envelope. If the absence of a rational investigation, the following limit ac celerations, applied through the balance weight centre of gravity should be used.

— 100g normal to the plane of the surface — 30g parallel to the hinge line — 30g in the plane of the surface and perpendicular to the hinge line 5.1.4.3. Passive Flutter Dampers. C ontrol surface passive flutter dampers may be used to prevent flutter in the event of failure of some element of the control surface actuation system or to prevent control surface buzz. Flutter analyses and/or flutter model wind tunnel tests may be used to verify adequate damping. Damper support structure flexibility should be included in the determination of adequacy of damping at the flutter frequencies. Any single damper failure should be considered. Combinations of multiple damper failures should be exa mined when not shown to be extremely improbable.

The combined free play of the damper and supporting elements between the control surface and fixed surfaces should be considered. Provisions for in - service checks of damper integrity should be considered. R efer to paragraph 4.3 above for conditions to consider where a control surface Powered by EASA eRules Page 368 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL actuator is switched to the role of an active or passive damping element of the flight control system.

5.1.4.4. Intersecting Lifting Surfaces. Intersecting lifting surface aeroe lastic stability characteristics are more difficult to predict accurately than the characteristics of planar surfaces such as wings. This is due to difficulties both in correctly predicting vibration modal characteristics and in assessing those aerodynamic effects which may be of second order importance on planar surfaces, but are signifi cant for intersecting surfaces. Proper representation of modal deflections and unsteady aerodynamic coupling terms between surfaces is essential in assessing the aeroelas ti c stability characteristics. The in - plane forces and motions of one or the other of the intersecting surfaces may have a strong effect on aeroelastic stability; therefore, the analysis should include the effects of steady flight forces and elastic deformat ions on the in - plane effects.

5.1.4.5. Ice Accumulation. Ae roelastic stability analyse s should use the mass distributions derived fro m ice accumulations up to and including those that can accrete in the applicable icing conditions in Appendices C and O to CS - 25. This includes any accretions that could develop on control surfaces. The analyses need not consider the aerodynamic effects of ice shapes. For aeroplanes approved for operation in icing conditions, all of the CS - 25 Appendix C icing conditions and th e Appendix O icing conditions for which certification is sought are applicable. For aeroplanes not approved for operation in icing conditions, all of the Appendix C and O icing conditions are applicable since the inadvertent encounter discussed in paragrap h 3.2.3 of this AMC can occur in any icing condition. For all aeroplanes, the ice accumulation determination should take into account the ability to detect the ice and, if appropriate, the time required to leave the icing condition.

For showing compliance with the CS - 25 specifications relative to SLD icing conditions represented by Appendix O, the applicant may use a comparative analysis. AMC 25.1420(f) provides guidance for comparative analysis.

5.1.4.6. Whirl Flutter.

(a) The evaluation of the aeroelastic stability should include investigations of any significant elastic, inertial, and aerodynamic forces, including those associated with rotations and displacements in the plane of any turbofan or propeller, including propeller or fan blade aerodynamics, pow erplant flexibilities, powerplant mounting characteri stics, and gyroscopic coupling.

(b) Failure conditions are usually significant for whirl instabilities. Engine mount, engine gear box support, or shaft failures which result in a node line shift for pro peller hub pitching or yawing motion are especially significant.

(c) A wind tunnel test with a component flutter model, representing the engine/propeller system and its support system along with correlative vibration and flutter analyses of the flutter mod el, may be used to demonstrate adequate stability of the nominal design and failed conditions.

Powered by EASA eRules Page 369 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 5.1. 4.7. Automatic Control Systems. Aeroelastic stability analyses of the basic configuration should include simulation of any control system for which interacti on may exist between the sensing elements and the structural modes. Where structural/control system feedback is a potential problem the effects of servo - actuator characteristics and the effects of local deformation of the servo mount on the feedback sensor output shoul d be included in the analysis. The effect of control system failures on the aeroplane aeroelastic stability characteristics should be investigated. Failures which significantly affect the system gain and/or phase and are not shown to be extre mely improbable should be analysed.

5.2. Te sting. The aeroelastic stability certification test programme may consist of ground tests, flutter model te sts, and flight flutter tests. Ground tests may be used for assessment of component stiffness and for dete rmining the vibration modal characteristics of aircraft components and the complete airframe. Flutter model testing may be used to establish flutter trends and validate aeroelastic stability boundaries in areas where unsteady aerodynamic calculations requ ire confirmation. Full scale flight flutter testing provides final verification of aeroelastic stability. The results of any of these tests may be used to provide substantiation data, to verify and improve analytical modelling procedures and data, and to identify potential or previously undefined problem areas.

5.2 .1. Structural Component Tests. Stiffness tests or ground vibration tests of structural components are desirable to confirm analytically predicted characteristics and are necessary where stiffne ss calculations cannot accurately predict these characteri stics. Components should be mounted so that the mounting characteristics are well defined or readily measurable.

5.2.2. Control System Component Tests. When reliance is placed on stiffness or damping to prevent aeroelastic instability, the following control sy stem tests should be conducted. If the tests are performed off the aeroplane the test fixtures should reflect local attachment flexibility.

(i) Act uators for primary flight control surfaces and flutter dampers should be tested with their supportin g structure. These tests are to determine the actuator/support structure stiffness for nominal design and failure conditions consid ered in the fail - safe ana lysis.

(ii) Flutter damper tests should be conducted to verify the impedance of damper and support structure. Satisfactory installed damper effectiveness at the potential flutter frequencie s should, however, be assured. The results of these tests can be us ed to determine a suitable, in - service maintenance schedule and replacement life of the damper. The effects of allowable in - service free play should be measured.

Powered by EASA eRules Page 370 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 5.2.3. Ground vibration Tests.

5.2.3.1. Ground vibration tests (GVT) or modal response test s are normally conducted on the complete conforming aeroplane. A GVT may be used to check the mathematical structural model. Alternatively, the use of measured modal data alone in aeroelastic stability analyses, instead of analytical modal data modified to match test data, may be acceptable provided the accuracy and completeness of the measured modal data is established. Whenever structural modifications or inertia changes are made to a previously certified design or a GVT validated model of the basic aero plane, a GVT may not be necessary if these changes are shown not to affect the aeroelastic stability characteristics.

5.2.3.2. The aeroplane is best supported such that the suspended aeroplane rigid body modes are effectively uncoupled from the elastic modes of the aeroplane. Alternatively, a suspension method may be used that couples with the elastic aeroplane provided that the suspension can be analytically de - coupled from the aeroplane structure in the vibration analysis. The former suspensio n criterion is preferred for all ground vibration tests and is necessary in the absence of vibration analysis.

5.2.3.3. The excitation method needs to have sufficient force output and frequency range to adequately excite all significant resonant modes. The effective mass and stiffness of the exciter and attachment hardware should not distort modal response. More than one exciter or exciter location may be necessary to insure that all significant modes are identified. Multiple exciter input may be necessary on structures with significant internal damping to avoid low response levels and phase shifts at points on the structure distant from the point of excitation. Excitation may be sinusoidal, random, pseudo - random, transient, or other short duration, non stat ionary means. For small surfaces the effect of test sensor mass on response frequency should be taken into consideration when analysing the test results.

5.2.3.4. The minimum modal response measurement should consist of acceleration (or velocity) measurem ents and relative phasing at a sufficient number of points on the aeroplane structure to accurately describe the response or mode shapes of all significant structural modes. In addition, the structural damping of each mode should be determined.

5.2.4. Flu tter Model Tests.

5.2.4.1. Dynamically similar flutter models may be tested in the wind tunnel to augment the flutter analysis. Flutter model testing can substantiate the flutter margins directly or indirectly by validating analysis data or methods.

Some a spects of flutter analysis may require more extensive validation than others, for example control surface aerodynamics, T - tails and other configurations with aerodynamic interaction and compressibility effects.

Flutter testing may additionally be useful to test configurations that are impractical to verify in flight test., such as fail - safe conditions or extensive store configurations. In any such testing, the mounting of the model and the associated analysis should be appropriate and consistent with the st udy being performed.

Powered by EASA eRules Page 371 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 5.2.4.2. Direct substantiation of the flutter margin (clearance testing) implies a high degree of dynamic similitude. Such a test may be used to augment an analysis and show a configuration flutter free throughout the expanded design e nvelope. All the physical parameters which have been determined to be significant for flutter response should be appropriately scaled. These will include elastic and inertia properties, geometric properties and dynamic pressure. If transonic effects are i mportant, the Mach number should be maintained.

5.2.4.3. Validation of analysis methods is another appropriate use of wind tunnel flutter testing. When the validity of a method is uncertain, correlation of wind tunnel flutter testing results with a corresp onding analysis may increase confidence in the use of the analytical tool for certification analysis.

A methods validation test should simulate conditions, scaling and geometry appropriate for the intended use of the analytical method.

5.2.4.4. Trend studi es are an important use of wind tunnel flutter testing.

Parametric studies can be used to establish trends for control system balance and stiffness, fuel and payload variations, structural compliances and configuration variations. The set of physical param eters requiring similitude may not be as extensive to study parametric trends as is required for clearance testing. For example, an exact match of the Mach number may not be required to track the effects of payload variations on a transonic aeroplane.

5.2 .5. Flight Flutter Tests.

5.2.5.1. Full scale flight flutter testing of an aeroplane configuration to V /M is a DF DF necessary part of the flutter substantiation. An exception may be made when aerodynamic, mass, or stiffness changes to a certified aeroplane are minor, and analysis or ground tests show a negligible effect on flutter or vibration characteristics. If a failure, malfunction, or adverse condition is simulated during a flight test, the maximum speed investigated need not exceed V /M if it is sh own, by correlation of the flight test data with other FC FC test data or analyses, that the requirements of CS 25.629(b)(2) are met.

5.2.5.2. Aeroplane configurations and control system configurations should be selecte d for flight test based on analyses and, when available, model test results. Sufficient test conditions should be performed to demonstrate aeroelastic stability throughout the entire flight envelope for the selected configurations.

5.2.5.3. Flight flutter testing requires excitation sufficient to excite the modes shown by analysis to be the most likely to couple for flutter. Excitation methods may include control surface motions or internal moving mass or external aerodynamic exciters or flight turbulence. The method of excitation should be appropriate for the modal response frequency being investigated.

The effect of the excitation system itself on the aeroplane flutter characteristics should be determined prior to flight testing.

Powered by EASA eRules Page 372 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION GENERAL 5.2.5.4. Measurement of the response at selected locations on the structure should be made in order to determine the response amplitude, damping and frequency in the critical modes at each test airspeed. It is desirable to monitor the response amplitude, frequency and damping change as V /M DF DF is approached. In demonstrating that there is no large and rapid damping reduction as V /M is approached, an endeavour should be made to DF DF identify a clear trend of damping versus speed. If this is not possible, then sufficie nt test points should be undertaken to achieve a satisfactory level of confidence that there is no evidence of an adverse trend.

5.2.5.5. An evaluation of phenomena not presently amenable to analyses, such as shock effects, buffet response levels, vibratio n levels, and control surface buzz, should also be made during flight testing.

[Amdt 25/1] [Amdt 25/6] [Amdt 25/16] [Amdt 25/18] [Amdt 25/24]

CS 25.631 Bird strike damage

ED Decision 2016/010/R (See AMC 25.631 ) Th e aeroplane must be designed to assure capability of continued safe flight and landing of the aeroplane after impact with a 4 lb bird when the velocity of the aeroplane (relative to the bird along the aeroplane’s flight path) is equal to V at sealevel or 0·85 V at 2438 m (8000 ft), whichever is the C C more critical. Compliance may be shown by analysis only when based on tests carried out on sufficiently representative structures of similar design.

[Amdt 25/18]

AMC 25.631 Bird strike d amage

ED Decision 2003/2/RM Consideration should be given in the early stages of the design to the installation of items in essential services, such as control system components, and items which, if damaged, could cause a hazard, such as ele ctrical equipment. As far as practicable, such items should not be installed immediately behind area s liable to be struck by birds.

Powered by EASA eRules Page 373 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – D ESIGN AND (CS - 25) CONSTRUCTION CONTROL SURFACES

CONTROL SURFACES

CS 25.651 Proof of strength

ED Decision 2003/2/RM (a) Limit load tests of control surfaces are required. T hese tests must include the horn or fitting to which the control system is attached.

(b) Compliance with the special factors requirements of CS 25.619 to 25.625 and 25.657 for control surface hinges must be shown by analysis or individual load tests.

CS 25.655 Installation

ED Decision 2003/2/RM (a) Movable tail surfaces must be installed so that there is no interference between any surfaces when one is held in its extreme position and the others are operated through their full angular movement.

(b) If an adjustable stabiliser is used, it must have stops that will limit its range of travel to the maximum for which the aeroplane is sh own to meet the trim requirements of CS 25.161 .

CS 25.657 Hinges

ED Decision 2003/2/RM (a) For control surface hinges, including ball, roller, and self - lubricated bearing hinges, the approved rating of the bearin g may not be exceeded. For non - standard bearing hinge configurations, the rating must be established on the basis of experience or tests and, in the absence of a rational investigation, a factor of safety of not less than 6·67 must be used with respect to the ultimate bearing strength of the softest material used as a bearing.

(b) Hinges must have enough strength and rigidity for loads parallel to the hinge line.

Powered by EASA eRules Page 374 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS

CONTROL SYSTEMS

CS 25.671 General

ED Decision 2020/001/R ( See AMC 25.671 ) (a) Each flight control system must operate with the ease, smoothness, and positiveness appropriate to its function. In addition, the flight control system shall be designed to continue to operate, re spond appropriately to commands, and must not hinder aeroplane recovery, when the aeroplane is in any attitude or experiencing any flight dynamics parameter that could occur due to operating or environmental conditions.

(b) Each element of each flight cont rol system must be designed to minimise the probability of incorrect assembly that could result in the failure or malfunctioning of the system. Distinctive and permanent marking may be used where design means are impractical, taking into consideration the potential consequence of incorrect assembly.

(c) The aeroplane must be shown by analysis, test, or both, to be capable of continued safe flight and landing after any of the following failures or jams in the flight control system within the normal flight en velope. In addition, it must be shown that the pilot can readily counteract the effects of any probable failure.

(1) Any single failure, excluding failures of the type defined in CS 25.671(c)(3); (2) Any combination of failures not shown to be extremely improbable, excluding failures of the type defined in CS 25.671(c)(3); and (3) Any failure or event that results in a jam of a flight control surface or pilot control that is fixed in position due to a physical interference. The jam must be evalu ated as follows: (i) The jam must be considered at any normally encountered position of the control surface, or pilot controls; (ii) The jam must be assumed to occur anywhere within the normal flight envelope and during any flight phase from take - off to la nding; and In the presence of a jam considered under this sub - paragraph, any additional failure conditions that could prevent continued safe flight and landing shall have a combined probability of 1/1 000 or less.

(d) The aeroplane must be designed so tha t, if all engines fail at any time of the flight: (1) it is controllable in flight; (2) an approach can be made; (3) a flare to a landing, and a flare to a ditching can be achieved; and (4) during the ground phase, the aeroplane can be stopped.

(e) The aer oplane must be designed to indicate to the flight crew whenever the primary control means is near the limit of control authority.

Powered by EASA eRules Page 375 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (f) If the flight control system has multiple modes of operation, appropriate flight crew alerting must be provided whenever the aeroplane enters any mode that significantly changes or degrades the normal handling or operational characteristics of the aeroplane.

[Amdt 25/18] [Amdt 25/ 24]

AMC 25.671 Control Systems — General

ED Decision 2021/015/R 1. PURPOSE This AMC provides an acceptable means, but not the only means, to demonstrate compliance with the control system requirements of CS 25.671 .

2. RELATED DOCUMENTS a. Advisory Circulars, Acceptable Means of Compliance .

(1) FAA Advisory Circular (AC) 25 - 7D, dated 4 May 2018, Flight Test Guide for Certification of Transport Category Airplanes.

(2) AMC 25.1309 System Design and Analysis.

b. Standards.

(1) EUROCAE document ED - 79A, Guidelines for Development of Civil Aircraft and Systems, issued in December 2010, or the equivalent SAE Aerospace Recommended Practice (ARP) 4754A.

(2) SAE Aerospace Recommended Practice (ARP) 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, issued in December 1996.

3. APPLICABILITY OF CS 25.671 CS 25.671 applies to all flight control system installations (including primary, secondary, trim, lift, drag, feel, and stability augmentation systems (refer to CS 25.672 )) regardless of implementation technique (manual, powered, fly - by - wire, or other means).

While CS 2 5.671 applies to flight control systems, CS 25.671(d) does apply to all control systems required to provide control, including deceleration, for the phases specified.

4. DEFINITIONS The following definitions apply to CS 25.671 and this AMC. Unless otherwise stated, they should not be assumed to apply to the same or similar terms used in other rules or AMC.

a. At - Risk Time. The period of time during which an item must fail to cause the failure effect in question. This is usuall y associated with the final fault in a fault sequence leading to a specific failure condition. See also SAE ARP4761.

b. Catastrophic Failure Condition. Refer to AMC 25.1309 (Paragraph 7 FAILURE CONDITION CLASSIFICA TIONS AND PROBABILITY TERMS).

c. Continued Safe Flight and Landing. The capability for continued controlled flight and landing at an aerodrome without requiring exceptional piloting skill or strength.

Powered by EASA eRules Page 376 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS d. Landing. The phase following final approach and star ting with the landing flare. It includes the ground phase on the runway and ends when the aeroplane comes to a complete stop on the runway.

e. Latent Failure. Refer to AMC 25.1309 (Paragraph 5 DEFINITIONS).

f. Erro r. Refer to AMC 25.1309 (Paragraph 5 DEFINITIONS).

g. Event. Refer to AMC 25.1309 (Paragraph 5 DEFINITIONS).

h. Exposure Time. The period of time between the time when an i tem was last known to be operating properly and the time when it will be known to be operating properly again. See also SAE ARP4761.

i. Extremely Improbable. Refer to AMC 25.1309 (Paragraph 7 FAILURE CONDITION CLAS SIFICATIONS AND PROBABILITY TERMS).

j. Failure. Refer to AMC 25.1309 (Paragraph 5 DEFINITIONS).

The following types of failures should be considered when demonstrating compliance with CS 25.671(c) . Since the type of failure and the effect of the failure depend on the system architecture, this list is not exhaustive, but serves as a general guideline.

(1) Jam. Refer to the definition provided below.

(2) Loss of Control of Surface. A failure that results in a surface not responding to commands.

Failure sources can include mechanical disconnection, control cable disconnection, actuator disconnection, loss of hydraulic power, or loss of control commands due to computers, data path or actuator electronics failures. In these conditions, the position of the surface(s) or controls can be determined by analysing the system architecture and aeroplane aerodynamic characteristics; common positions include surface - cen tred (0°) or zero hinge - moment position (surface float).

(3) Oscillatory Failure. A failure that results in undue surface oscillation. Failure sources include control loop destabilisation, oscillatory sensor failure, oscillatory computer or actuator electr onics failure. The duration of the oscillation, its frequency, and amplitude depend on the control loop, monitors, limiters, and other system features.

(4) Restricted Control. A failure that results in the achievable surface deflection being limited.

Failu re sources include foreign object interference, malfunction of a travel limiter, and malfunction of an envelope protection. This type of failure is considered under CS 25.671(c)(1) and CS 25.671(c)(2) , as the system/surface can still be operated.

(5) Runaway or Hardover. A failure that results in uncommanded control surface movement.

Failure sources include servo valve jams, computer or actuator electronics malfunctioning. T he speed of the runaway, the duration of the runaway (permanent or transient), and the resulting surface position (full or partial deflection) depend on the available monitoring, limiters, and other system features. This type of failure is addressed under CS 25.671(c)(1) and (c)(2) .

Runaways that are caused by external events, such as loose or foreign objects, control system icing, or any other environmental or external source are addressed in CS 25.671(c)(2) .

Powered by EASA eRules Page 377 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (6) Stiff or Binding Controls. A failure that results in a significant increase in control forces.

Failure sources include failures of artificial feel systems, corroded bearings, jammed pulleys, and failures causing high friction. This type of failure is considered under CS 25.671(c)(1) and CS 25.671(c)(2) , as the system/surface can still be operated. In some architectures, higher friction may result in reduced centring of the controls.

k. Failure Conditi ons. As used in CS 25.671(c) , this term refers to the sum of all failures and failure combinations contributing to a hazard, apart from the single failure (flight control system jam) being considered.

l. Flight Con trol System. Flight control system refers to the following: primary flight controls from the pilot’s controllers to the primary control surfaces, trim systems from the pilot’s trim input devices to the trim surfaces (including stabiliser trim), speed brake /spoiler systems from the pilot’s control lever to the brake/spoiler panels or other drag/lift - dumping devices, high - lift systems from the pilot’s controls to the high - lift surfaces, feel systems, and stability augmentation systems. Supporting systems (i.e . hydraulic systems, electrical power systems, avionics, etc.) should also be included if failures in these systems have an impact on the function of the flight control system.

Examples of elements to be evaluated under CS 25.671 include, but are not limited to: — linkages, — hinges, — cables, — pulleys, — quadrants, — valves, — actuators (including actuator components), — flap/slat tracks (including track rollers and movable tracks), — bearings, axles and pins, — control surfaces (jam and runaway only), — attachment fittings.

m. In - flight is the time period from the time when the aeroplane is at 10 m (35 ft) above aerodrome level (AAL) following a take - off, up to the time when the aeroplane reaches 15 m (50 ft) AAL prior to landing, including climb, cruise, normal turns, descent, and approach.

n. Jam. A failure or event that results in either a control surface, a pilot control, or a component being fixed in one position.

(i) Control surfaces and pilot contr ols fixed in one position due to a physical interference are addressed under CS 25.671(c)(3) . Causes may include corroded bearings, interference with a foreign or loose object, control system icing, seizure of an a ctuator, or disconnection that results in a jam by creating interference. Normally encountered positions are defined in paragraph 7.b of this AMC.

(ii) All other failures or events that result in either a control surface, a pilot control, or a component b eing fixed in one position are addressed under CS 25.671(c)(1) and 25.671(c)(2) as appropriate. Depending on the system architecture and the location of the failure or the event, some failures or events that cause a jam may not always result Powered by EASA eRules Page 378 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) C ONSTRUCTION CONTROL SYSTEMS in a fixed surface or pilot control; for example, a jammed valve could result in a surface runaway.

o. Landing is the time period from the time when the aeroplane is at 15 m (50 ft) AAL prior to landing, up to the complete stop of the aeroplane on the runway.

p. Probability versus Failure Rate. Failure rate is typically expressed in terms of average probability of occurrence per flight hour. In cases where the failure condition is associa ted with a certain flight condition that occurs only once per flight, the failure rate is typically expressed as average probability of occurrence per flight (or per take - off, or per landing). Failure rates are usually the ‘root’ numbers used in a fault tr ee analysis prior to factoring in latency periods, exposure time, or at - risk time. Probability is non - dimensional and expresses the likelihood of encountering or being in a failed state. Probability is obtained by multiplying a failure rate by the appropri ate exposure time.

q. Take - off is the time period from the brake release up to the time when the aeroplane reaches 10 m (35 ft) AAL.

5. EVALUATION OF FLIGHT CONTROL SYSTEM OPERATION — CS 25.671(a) a. General.

Flight control systems should be designed such that when a movement to one position has been selected, a different position can be selected without waiting for the completion of the initially selected movement, and the system should arrive at the finally selected position without further attention. The movements that follow and the time taken by the system to allow the required sequence of selection should not adversely affect the controllabil ity of the aeroplane.

b. Abnormal Attitude.

Compliance should be demonstrated by evaluation of the closed - loop flight control system. This evaluation is intended to ensure that there are no features or unique characteristics (including numerical singularit ies) which would restrict the pilot’s ability to recover from any attitude.

Open - loop flight control systems should also be evaluated, if applicable.

For aeroplanes that are equipped with a flight control envelope protection, the attitudes of the aeroplan e to be considered should include cases outside the protected envelope.

c. Parameters to be considered The following relevant flight dynamic parameters should be considered by the applicant (non - exhaustive list): — Pitch, Roll or Yaw rate — Vertical load fa ctor — Airspeed — Angle of attack d. Operating and Environmental Conditions The parameters in paragraph 5.c. above should be considered within the limit flight envelope, which is the flight envelope that is associated with the aeroplane design limits or the fl ight control system protection limits.

Powered by EASA eRules Page 379 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS 6. EVALUATION OF FLIGHT CONTROL SYSTEM ASSEMBLY — CS 25.671(b) The intent of CS 25.671(b) is to minimise the risk by design that th e elements of the flight control system are incorrectly assembled, such that this leads to significant safety effects. The intent is not to address configuration control (refer to CS 25.1301(a)(2) ).

The applicant should take adequate precautions during the design process and provide adequate procedures in the instructions for continued airworthiness to minimise the risk of incorrect assembly (i.e. installation, connection, or adjustment) of elements of th e flight control system during production and maintenance. The following steps should be used: (1) assess the potential effects of potential incorrect assemblies of flight control systems elements and determine a classification of the severity of the assoc iated failure conditions; (2) when a failure condition is classified as catastrophic, hazardous, or major, EASA normally only accepts physical prevention means in the design of the elements to prevent an incorrect assembly. If, exceptionally, the applicant considers that providing such design prevention means is impractical, this should be presented to EASA. If agreed by EASA, the applicant may then use a distinctive and permanent marking of the involved elements.

(3) failure conditions that are classified either as minor or with no safety effect are not considered to have a significant safety effect.

Examples of significant safety effects: (1) an out - of - phase action; (2) reversal in the sense of the control; (3) interconnection of the controls between two systems where this is not intended; (4) loss of function.

7. EVALUATION OF FLIGHT CONTROL SYSTEM FAILURES — CS 25.671(c) Development errors (e.g. mistakes in requirements, design, or implementation) sho uld be considered when demonstrating compliance with CS 25.671(c) . However, the guidance provided in this paragraph is not intended to address the means of compliance related to development errors. Development erro rs are managed through development assurance processes and system architecture. Some guidelines are provided in AMC 25.1309 .

CS 25.671 (c) requires that the aeroplane be sho wn by analysis, test, or both, to be capable of continued safe flight and landing following failures in the flight control system within the normal flight envelope.

CS 25.671 (c)(1) requires the evaluation of any single failure, excluding the types of jams addressed in subparagraph CS 25.671 (c)(3) . CS 25.671 (c)(1) requires to consider any single failu re, suggesting that an alternative means of controlling the aeroplane or an alternative load path is provided in the case of a single failure. All single failures must be considered, even if they are shown to be extremely improbable.

CS 25.671 (c)(2) requires the evaluation of any combination of failures not shown to be extremely improbable, excluding the types of jams addressed in CS 25.671 (c)(3) .

Some combinations of fail ures, such as dual electrical system or dual hydraulic system failures, or any single failure in combination with any probable electrical or hydraulic system failure, are normally not demonstrated as being extremely improbable.

Powered by EASA eRules Page 380 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS CS 25.671 (c)(3) requires the evaluation of any failure or event that results in a jam of a flight control surface or pilot control. This subparagraph addresses failure modes that would result in the surface or pilot control being fixed in a p osition. It should be assumed that the fixed position is the position that is commanded at the time of the failure due to some physical interference. The position at the time of the jam should be at any control position normally encountered during take - off , climb, cruise, normal turn manoeuvres, descent, approach, and landing. In some architectures, component jams within the system may result in failure modes other than a fixed surface or pilot control; those types of jams (such as a jammed valve) are consi dered under subparagraphs CS 25.671 (c)(1) and (c)(2) . All single jams must be considered, even if they can be shown to be extremely improbable.

Alleviation means may be use d to show compliance with CS 25.671 (c)(3) . For this purpose, alleviation means include system reconfigurations or any other features that eliminate or reduce the consequences of a jam or permit continued safe fligh t and landing.

Any runaway of a flight control to an adverse position must be accounted for, as per CS 25.671 (c)(1) and (c)(2) , if such a runaway is due to: — a single failure; or — a combination of failures which are not shown to be extremely improbable.

Some means to alleviate the runaway may be used to demonstrate compliance, such as by reconfiguring the control system, deactivating the system (or a failed portion of it ), overriding the runaway by a movement of the flight controls in the normal sense, eliminating the consequences of a runaway to ensure continued safe flight and landing following a runaway. The consideration of a control runaway will be specific to each a pplication and a general interpretation of an adverse position cannot be provided. Where applicable, the applicant is required to assess the resulting surface position after a runaway, if the failure condition is not extremely improbable or can occur due t o a single failure.

It is acknowledged that determining a consistent and reasonable definition of normally encountered flight control positions can be difficult. Experience from in - service aeroplanes shows that the overall - 6 - 7 failure rate for a flight control surface jam is of an order of magnitude between 10 and 10 per flight hour. This failure rate may be used to justify a definition of ‘normally encountered position’ and is not intended to be used to support a probabilistic assessment. Considering this in - service aeroplane data, a reasonable definition of normally encountered positions represents the range of flight control surface deflections (from neutral to the largest deflection) expected to occur in 1 000 random operational flights, without consider ing other failures, for each of the flight phases addressed in this AMC.

One method of establishing acceptable flight control surface deflections is to use the performance - based criteria outlined in this AMC (see sub - paragraph 7.b. below) that were establi shed to eliminate any differences between aeroplane types. The performance - based criteria prescribe environmental and operational manoeuvre conditions, and the resulting deflections may be considered as normally encountered positions for demonstrating comp liance with CS 25.671 (c)(3) .

All approved aeroplane gross weights and centre - of - gravity locations should be considered. However, only critical combinations of gross weight and centre - of - gravity locations should be demonstrated.

a. Compliance with CS 25.671 (c)(2) When demonstrating compliance with the failure requirements of CS 25.671 (c)(2) , the following safety analysis/assessment sh ould be considered.

Powered by EASA eRules Page 381 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS A safety analysis/assessment according to AMC 25.1309 should be supplemented to demonstrate that the aeroplane is capable of continued safe flight and landing following any combination of failur es not shown to be extremely improbable.

The aeroelastic stability (flutter) requirements of CS 25.629 should also be considered.

b. Determination of Flight Control System Jam Positions — CS 25.671 (c)(3) The following flight phases should be considered: ‘take - off’, ‘in - flight’ (climb, cruise, normal turn manoeuvres, descent, and approach), and ‘landing’ (refer to the definitions in paragraph 4.

DEFINITIONS of this AMC).

CS 25.671 (c)(3) requires that the aeroplane be capable of landing with a flight control or pilot control jam. The aeroplane should, therefore, be evaluated for jams in the landing configuration.

Only the aeroplane rigid body modes need to be considered when evaluating the aeroplane response to manoeuvres and continued safe flight and landing.

It should be assumed that, if the jam is detected prior to V , the take - off will be rejected.

Although 1 in 1 000 operational take - offs is expected to include crosswinds of 46 km/h (25 kt) or greater, the short exposure time associated with a flight control surface jam occurring between V and V allows usage of a less conservative crosswind magnitude when determining 1 LOF normally encountered lateral and directional control positions. Given that lateral and directional flight controls are continuously used to maintain runway centre line in a crosswind take - off, and that flight control inputs greater than those necessary at V occur at speeds below V , any jam in these flight control axes during a crosswind take - off is normally detected prior to V . Considering the flight control jam failure rate combined with the short exposure time between V and V , a reasonable crosswind level for the determination of jammed lateral or 1 LOF d irectional flight control positions during take - off is 28 km/h (15 kt).

A similar reasoning applies for the approach and landing flight phases. It leads to consider that a reasonable crosswind level for the determination of jammed lateral or directional co ntrol positions during approach and landing is 28 km/h (15 kt).

The jam positions to be considered in demonstrating compliance should include any position up to the maximum position determined by the following manoeuvres. The manoeuvres and conditions desc ribed in this paragraph should only be used to determine the flight control surface and pilot control deflections to evaluate the continued safe flight and landing capability, and should not be used for the evaluation of flight test manoeuvres; see paragra ph 7.e below.

(1) Jammed Lateral Control Positions (i) Take - off: The lateral flight control position for wings level at V 1 in a steady crosswind of 28 km/h (15 kt) (at a height of 10 m (35 ft) above the take - off surface).

Variations in wind speed from a 10 - m (35 - ft) height can be obtained using the following relationship: 1/7 V = V * (H /10.0) alt 10metres desired where: V = wind speed in knots at 10 m (35 ft) above ground level (AGL) 10metres V = wind speed at desired altitude (kt) alt H = desired altitude for which wind speed is sought (AGL), but not lower than desired 1.5 m (5 ft) Powered by EASA eRules Page 382 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (ii) In - flight: The lateral flight control position to sustain a 12 - degree/second steady roll rate from 1.23V to V /M or V , as appropriate, but not greater than 50 % SR1 MO MO FE of the control input.

(iii) Landing (including flare): The maximum lateral control position is the greater of: (A) the peak lateral control position to maintain wings level in response to a steady crosswind of 28 km/h (15 kt), in manual or autopilot mode; or (B) the peak lateral control position to maintain wings level in response to an atmospheric discrete lateral gust of 16 km/h (15 ft/s) from sea level to 6 096 m (20 000 ft).

Note: If the flight control system augments the pilot’s input, then the maximum sur face deflection to achieve the above manoeuvres should be considered.

(2) Jammed Longitudinal Control Positions (i) Take - off: The following three longitudinal flight control positions should be considered: (A) Any flight control position from that which th e flight controls naturally assume without pilot input at the start of the take - off roll to that which occurs at V using the procedures recommended by the aeroplane manufacturer.

Note: It may not be necessary to consider this case if it can be demonstrate d that the pilot is aware of the jam before reaching V (for example, through a manufacturer’s recommended AFM procedure).

(B) The longitudinal flight control position at V based on the procedures recommended by the aeroplane manufacturer including the co nsideration for any runway condition for which the aeroplane is approved to operate.

(C) Using the procedures recommended by the aeroplane manufacturer, the peak longitudinal flight control position to achieve a steady aeroplane pitch rate of the lesser of 5°/s or the pitch rate necessary to achieve the speed used for all - engines - operating initial climb procedures (V +XX) at 35 ft.

(ii) In - flight: The maximum longitudinal flight control position is the greater of: (A) the longitudinal flight control positio n required to achieve steady state normal accelerations from 0.8 to 1.3 g at speeds from 1.23V to V /M SR1 MO MO or V , as appropriate; FE (B) the peak longitudinal flight control position commanded by the autopilot and/or stability augmentation system in response to atmospheric discrete vertical gust of 16 km/h (15 ft/s) from sea level to 6 096 m (20 000 ft).

(iii) Landing: Any longitudinal con trol position required, in manual or autopilot mode, for performing a flare and landing, using the procedures recommended by the aeroplane manufacturer.

Powered by EASA eRules Page 383 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION C ONTROL SYSTEMS (3) Jammed Directional Control Positions (i) Take - off: The directional flight control position for ta ke - off at V in a steady crosswind of 28 km/h (15 kt) (at a height of 10 m (35 ft) above the take - off surface).

Variations in wind speed from a height of 10 m (35 ft) can be obtained using the following relationship: 1/7 V = V * (H /10.0) alt 10metres desired w here: V = wind speed in knots at 10 m above ground level (AGL) 10metres V = wind speed at desired altitude alt H = desired altitude for which wind speed is sought (AGL), but not lower than desired 1.5 m (5 ft) (ii) In - flight: The directional flight control position is the greater of: (A) the peak directional flight control position commanded by the autopilot and/or stabilit y augmentation system in response to atmospheric discrete lateral gust of 16 km/h (15 ft/s) from sea level to 6 096 m (20 000 ft); (B) maximum rudder angle required for lateral/directional trim from 1.23V to SR1 the maximum all - engines - operating airspeed in level flight with climb power, but not to exceed V /M or V as appropriate. While more commonly a MO MO FE characteristic of propeller aeroplane, this addresses any lateral/directional asymmetry that can occur in flight with symmetric power; or (C) for approac h, the peak directional control position commanded by the pilot, autopilot and/or stability augmentation system in response to a steady crosswind of 28 km/h (15 kt).

(iii) Landing: The maximum directional control position is the greater of: (A) the peak di rectional control position commanded by the pilot, autopilot and/or stability augmentation system in response to a steady crosswind of 28 km/h (15 kt); or (B) the peak lateral control position to maintain wings level in response to an atmospheric discrete lateral gust of 16 km/h (15 ft/s) from sea level to 6 096 m (20 000 ft).

(4) Control Tabs, Trim Tabs, and Trimming Stabilisers Any tabs installed on flight control surfaces are assumed jammed in the position that is associated with the normal deflection o f the flight control surface on which they are installed.

Trim tabs and trimming stabilisers are assumed jammed in the positions that are associated with the procedures recommended by the aeroplane manufacturer for take - off and that are normally used throu ghout the flight to trim the aeroplane from 1.23V SR1 to V /M or V , as appropriate.

MO MO FE Powered by EASA eRules Page 384 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (5) Speed Brakes Speed brakes are assumed jammed in any position for which they are approved to operate during flight at any speed from 1.23V to V /M or V , as appropriate.

SR1 MO MO FE Asymmetric extension and retraction of the speed brakes should be considered. Roll spoiler jam (asymmetric spoiler panel) is addressed in paragraph 7.b(1).

(6) High - Lift Devices Leading edge and trailing edge high - lift devices are assumed to jam in any position for take - off, climb, cruise, approach, and landing. Skew of high - lift devices or asymmetric extension and retraction should be considered. CS 25.701 requires a mechanical interconnection (or equ ivalent means) between flaps or slats, unless the aeroplane has safe flight characteristics with the asymmetric flaps or slats positions.

(7) Load Alleviation Systems (i) Gust Load Alleviation Systems: At any airspeed between 1.23V to V /M or SR1 MO MO V , as appropriate, the flight control surfaces are assumed to jam in the maximum FE position commanded by the gust load alleviation system in response to an atmospheric discrete gust with the following reference velocities: (A) 16 km/h (15 ft/s) equivalent airsp eed (EAS) from sea level to 6 096 m (20 000 ft) (vertical gust); (B) 16 km/h (15 ft/s) EAS from sea level to 6 096 m (20 000 ft) (lateral gust).

(ii) Manoeuvre Load Alleviation Systems: At any airspeed between 1.23V to SR1 V /M or V , as appropriate, th e flight control surfaces are assumed to jam in MO MO FE the maximum position commanded by the manoeuvre load alleviation system during a pull - up manoeuvre to 1.3 g or a push - over manoeuvre to 0.8 g.

c. Considerations for jams just before landing — CS 25.671(c)(3)(i) and (ii) CS 25.671 (c)(3)(ii) requires that failures (leading to a jam) must be assumed to occur anywhere within the normal flig ht envelope and during any flight phase from take - off to landing. This includes the flight phase just before landing and the landing itself. For the determination of the jam position per CS 25.671 (c)(3)(i) and the assessment of continued safe flight and landing, guidance is provided in this AMC. However, there might be exceptional cases where it is not possible to demonstrate continued safe flight and landing. Even jam alleviation means (e.g., disconnection units) m ight not be efficient because of the necessary time for the transfer of pilot controls.

For these exceptional cases, the compliance to CS 25.671 (c)(3)(ii) may be shown by demonstrating that the occurrence of a jam just before landing is extremely improbable.

Therefore, the overall compliance to CS 25.671 (c)(3)(ii) for the flight phase just before landing may be performed as follows: (1) Demonstrate continued safe flight and landing after a jam has occurred just before landing.

Note: The assessment of continued safe flight and landing in paragraph 7.e. below also applies to jams occurring just before landing; (2) If continued safe flight and landing cannot be demonstrated, per form a qualitative assessment of the design, relative to jam prevention features and jam alleviation means, to show that all practical precautions have been taken; or Powered by EASA eRules Page 385 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (3) As a last resort, after agreement by EASA, use data from in - service aeroplanes to sup port an extremely improbable argument (without use of at - risk time).

The typical means of jam prevention/alleviation include low - friction materials, dual - rotation bearings, clearances, jack catchers, priority switch on sidestick.

d. Jam Combinations Failur es — CS 25.671 (c)(3) In addition to the demonstration of jams at ‘normally encountered position’, compliance with CS 25.671 (c)(3) should include an analysis that shows that a minimum level of safety exists when a jam occurs. This additional analysis must show that in the presence of a jam considered under CS 25.671 (c)(3) , the failure conditi ons that could prevent continued safe flight and landing have a combined probability of 1/1 000 or less.

As a minimum, this analysis should include elements such as a jam breakout or override, disconnection means, alternate flight surface control, alternat e electrical or hydraulic sources, or alternate cable paths. This analysis should help to determine the intervals for scheduled maintenance activity or the operational checks that ensure the availability of the alleviation or compensation means.

e. Assessm ent of Continued Safe Flight and Landing — CS 25.671 (c) Following a flight control system failure of the types discussed in paragraphs 7.a., 7.b., 7.c. and 7.d. of this AMC, the manoeuvrability and structural stren gth criteria defined in the following paragraphs should be considered to determine the capability of continued safe flight and landing of the aeroplane. Additionally, a pilot assessment of the aeroplane handling qualities should be performed, although this does not supersede the criteria provided below.

A local structural failure (e.g. via a mechanical fuse or shear - out) that could lead to a surface departure from the aeroplane should not be used as a means of jam alleviation.

(1) Flight Characteristics (i) General. Following a flight control system failure, appropriate procedures may be used including system reconfiguration, flight limitations, and flight crew resource management. The procedures for safe flight and landing should not require exceptional pil oting skills or strengths.

Additional means of control, such as a trim system, may be used if it can be shown that the system is available and effective. Credit should not be given to the use of differential engine thrust to manoeuvre the aeroplane. Howeve r, differential thrust may be used after the recovery in order to maintain lateral/directional trim.

For the cases of longitudinal flight control surface and pilot control jams during take - off prior to rotation, it is necessary to show that the aeroplane c an be safely rotated for lift - off without consideration of field length available.

(ii) Transient Response. There should be no unsafe conditions during the transient condition following a flight control system failure. The evaluation of failures or manoeuv res that lead to a jam is intended to be initiated from 1 - g wings level flight conditions. For this purpose, continued safe flight and landing (within the transition phase) is generally defined as not exceeding any one of the following criteria: (A) a load on any part of the primary structure sufficient to cause a catastrophic structural failure; (B) catastrophic loss of flight path control; Powered by EASA eRules Page 386 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (C) exceedance of V /M ; DF DF (D) catastrophic flutter; (E) excessive vibration or excessive buffeting conditions; (F) bank angle in excess of 90 degrees.

In connection with the transient response, compliance with the requirements of CS 25.302 should be demonstrated. While V is normally an appropriate airspeed F limi t to be considered regarding continued safe flight and landing, temporary exceedance of V may be acceptable as long as the requirements of CS 25.302 are F met.

Paragraph 7.b. of this AMC provides a means to determine flight control surface deflections for the evaluation of flight control jams. In some cases, aeroplane roll, pitch rate, or normal acceleration is used as a basis to determine these deflections.

The roll or pitch rate and/or normal acceleration t hat is used to determine the flight control surface deflection need not be included in the evaluation of the transient condition. For example, the in - flight lateral flight control position determined in paragraph 7.b.(1)(ii) is based on a steady roll rate of 12°/s. When evaluating this condition, either by analysis, simulation, or in - flight demonstration, the resulting flight control surface deflection is simply input while the aeroplane is in wings level flight, at the appropriate speed, altitude, etc. Dur ing this evaluation, the actual roll or pitch rate of the aeroplane may or may not be the same as the roll or pitch rate used to determine the jammed flight control surface position.

(iii) Delay Times. Due consideration should be given to the delays involv ed in pilot recognition, reaction, and operation of any disconnection systems, if applicable.

Delay = Recognition + Reaction + Operation of Disconnection Recognition is defined as the time from the failure condition to the point at which a pilot in service operation may be expected to recognise the need to take action.

Recognition of the malfunction may be through the behaviour of the aeroplane or a reliable failure warning system, and the recognition point should be identified but should not normally be le ss than 1 second. For flight control system failures, except the types of jams addressed in CS 25.671 (c)(3) , control column or wheel movements alone should not be used for recognition.

The following reaction times should be used: Flight condition Reaction time * On ground 1 second * In air (< 300 m (1 000 ft) above ground level 1 second (AGL)) * Manual flight (> 300 m (1 000 ft) AGL) 1 second Automatic flight (> 300 m (1 000 ft) AGL) 3 seconds * 3 seconds if the control must be transferred between the pilots.

Powered by EASA eRules Page 387 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS The time required to operate any disconnection system should be measured either through ground test or flight test. This value should be used during all analysis efforts. However, flight test or manned simulation that requires the pilot to operate the disconnection includes this extra time, therefore, no additional delay time would be needed for these demonstrations.

(iv) Manoeuvre Capability for Continued Safe Flight and Landing. If, using the pr ocedures recommended by the aeroplane manufacturer, the following manoeuvres can be performed following the failure, it will generally be considered that continued safe flight and landing has been shown: (A) A steady 30° banked turn to the left or right; ( B) A roll from a steady 30° banked turn through an angle of 60° so as to reverse the direction of the turn in not more than 11 seconds (in this manoeuvre, the rudder may be used to the extent necessary to minimise side - slip, and the manoeuvre may be unchec ked); (C) A push - over manoeuvre to 0.8 g, and a pull - up manoeuvre to 1.3 g; (D) A wings level landing flare in a 90° crosswind of up to 18.5 km/h (10 kt) (measured at 10 m (33 ft) above the ground); and (E) The aeroplane remains on the paved runway surface during the landing roll, until reaching a complete stop.

Note: In the case of a lateral or directional flight control system jam during take - off as described in paragraph 7.b(1) or 7.b(3) of this AMC, it should be shown that the aeroplane can safely land on a suitable runway, without crosswind and with crosswind in the same direction as during take - off and at speeds up to the value at which the jam was established.

(v) Control Forces. The short - and long - term control forces should not be greater than 1.5 t imes the short - and long - term control forces allowed by CS 25.143(d) or CS 25.143(k) as applicable.

Short - term forces have typically been interpreted to mean the time requi red to accomplish a configuration or trim change. However, taking into account the capability of the crew to share the workload, the short - term forces provided in CS 25.143(d) or CS 25.143(k) , as applicable, may be appropriate for a longer duration, such as the evaluation of a jam on take - off and return to landing.

During the recovery following the failure, transient control forces may exceed these criteria to a limited exte nt. Acceptability of any exceedance will be evaluated on a case - by - case basis.

(2) Structural Strength for Flight Control System Failures.

(i) Failure Conditions per CS 25.671 (c)(1) and (c)(2) . It should be shown that the aeroplane maintains structural integrity for continued safe flight and landing. This should be accomplished by demonstrating compliance with CS 25.302 , where applicable, unless otherwise agreed with EASA.

(ii) Jam Conditions per CS 25.671 (c)(3) . It should be shown that the aeroplane maintains structural integrity for continued safe flight and landing . Recognising that jams are infrequent occurrences and that margins have been taken in the definition of normally encountered positions in this AMC, an acceptable means of Powered by EASA eRules Page 388 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTE MS compliance for structural substantiation of jam conditions is provided below in para graph 7.e.(2)(iii).

(iii) Structural Substantiation. The loads considered as ultimate should be derived from the following conditions at speeds up to the maximum speed allowed for the jammed position or for the failure condition: (A) Balanced manoeuvre of the aeroplane between 0.25 and 1.75 g with high - lift devices fully retracted and in en - route configurations, and between 0.6 and 1.4 g with high - lift devices extended; (B) Vertical and lateral discrete gusts corresponding to 40 % of the limit gust velocit y specified at V in CS 25.341(a) with high - lift devices fully retracted, c and a 5.2 - m/s (17 - ft/s) vertical and a 5.2 - m/s (17 - ft/s) head - on gust with high - lift devices extended. The vertical and lateral gusts should be considered separately.

A flexible aero plane model should be used for load calculations, where the use of a flexible aeroplane model is significant for the loads being assessed.

8. EVALUATION OF ALL - ENGINES - FAILED CONDITION — CS 25.671 (d) a. Explanation .

The intent of CS 25.671 (d) is to assure that in the event of failure of all engines, the aeroplane will be controllable, an approach and a flare to a landing and to a ditching is possible, and, assuming that a su itable runway is available, the aeroplane is controllable on ground and can be stopped.

In this context: — ‘flare to a landing/ditching’ refers to the time until touchdown; — ‘suitable runway’ is a hard - surface runway or equivalent for which the distance avail able following touchdown is consistent with the available aeroplane ground deceleration capability.

Although the rule refers to ‘flare to a landing’ with the implication that the aeroplane is on a runway, it is recognised that, with all engines inoperative, it may not be possible to reach a suitable runway or landing surface. In this case, the aeroplane must still be able to make a flare to a landing attitude.

Compliance with CS 25.671 (d) effectively requires that the aeroplane is equipped with a source(s) of emergency power, such as an air - driven generator, windmilling engines, batteries, or other power source, capable of providing adequ ate power to the systems that are necessary to control the aeroplane.

Analysis, simulation, or a combination of analysis and simulation may be used to demonstrate compliance where the methods are shown to be reliable.

b. Procedures.

(1) The aeroplane shoul d be evaluated to determine that it is possible, without requiring exceptional piloting skill or strength, to maintain control following the failure of all engines and attain the parameters provided in the operational procedure of the aeroplane flight manu al (AFM), taking into account the time necessary to activate any backup systems. The aeroplane should also remain controllable during restart of the most critical engine, whilst following the AFM recommended engine restart procedures.

Powered by EASA eRules Page 389 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (2) The most critical flight phases, especially for aeroplanes with emergency power systems dependent on airspeed, are likely to be the take - off, the landing, and the ditching. Credit may be taken from the hydraulic pressure and/or the electrical power produced while the engin es are spinning down and from any residual hydraulic pressure remaining in the system. Sufficient power must be available to complete a wings level approach and flare to a landing, and flare to a ditching.

Analyses or tests may be used to demonstrate the c apability of the control systems to maintain adequate hydraulic pressure and/or electrical power during the time between the failure of the engines and the activation of any power backup systems. If any of the power backup systems rely on aerodynamic means to generate the power, then a flight test should be conducted to demonstrate that the power backup system can supply adequate electrical and/or hydraulic power to the control systems. The flight test should be conducted at the minimum practical airspeed r equired to perform an approach and flare to a safe landing and ditching attitude.

(3) The manoeuvre capability following the failure of all engines should be sufficient to complete an approach and flare to a landing, and flare to a ditching. Note that the aeroplane weight could be extremely low (e.g. the engine failures could be due to fuel exhaustion). The maximum speeds for approach and landing/ditching may be limited by other CS - 25 specifications (e.g. tyre speeds, flap or landing gear speeds, etc.) or b y an evaluation of the average pilot ability to conduct a safe landing/ditching. At an operational weight determined for this case and for any other critical weights and positions of the centre of gravity identified by the applicant, at speeds down to the approach speeds appropriate to the aeroplane configuration, if the following manoeuvres can be performed, it will generally be considered that compliance has been shown: (i) a steady 30° banked turn to the left or right; (ii) a roll from a steady 30° banke d turn through an angle of 60° so as to reverse the direction of the turn in not more than 11 s (in this manoeuvre, the rudder may be used to the extent necessary to minimise side - slip, and the manoeuvre may be unchecked); (iii) a push - over manoeuvre to 0. 8 g, and a pull - up manoeuvre to 1.3 g; (iv) a wings level landing flare in a 90° crosswind of up to 18.5 km/h (10 kt) (measured at 10 m (33 ft) above the ground).

Note: If the loss of all engines has no effect on the flight control authority of the aeropla ne, then the results of the flight tests of the basic handling qualities with all engines operating may be used to demonstrate the satisfactory handling qualities of the aeroplane with all engines failed.

(4) It should be possible to perform a flare to a s afe landing and ditching attitude, in the most critical configuration, from a stabilised approach using the recommended approach speeds, pitch angles, and the appropriate AFM procedures, without requiring exceptional piloting skills or strengths. For trans ient manoeuvres, forces are allowed up to 1.5 times those specified in CS 25.143(d) or CS 25.143(k) as applicable for temporary application with two hands available for con trol.

Similarly to paragraph 7.e.(1)(v) of this AMC, the acceptability of any exceedance will be evaluated on a case - by - case basis.

Powered by EASA eRules Page 390 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (5) Finally, assuming that a suitable runway is available, it should be possible to control the aeroplane until it comes to a complete stop on the runway. A means of positive deceleration should be provided.

A suitable runway should have the lateral dimensions, length and load - bearing capability that meets the requirements defined in the emergency procedures of the AFM.

It is n ot necessary to consider adverse environmental conditions (e.g. wet or contaminated runway, tailwind) when demonstrating compliance for the on - ground phase.

9. EVALUATION OF CONTROL AUTHORITY AWARENESS — CS 25.671( e) CS 25.671 (e) requires an indication to the flight crew when a flight condition exists in which near - full - flight - control authority (whether or not it is pilot - commanded) is being used. Suitability of such an annunciation should take into account that some pilot - command ed manoeuvres (e.g. rapid roll) are necessarily associated with intended full performance, which may saturate the surface. Therefore, simple alerting systems, which should function in both intended and unexpected flight control - limiting situations, should be properly balanced between needed crew awareness and nuisance alerting.

Nuisance alerting must be minimised per CS 25.1322 by correct setting of the alerting threshold.

Depending on the application, suitable indi cations may include cockpit flight control position, annunciator light, or surface position indicators. Furthermore, this requirement applies to the limits of flight control authority, not necessarily to the limits of any individual surface travel.

When th e aeroplane is equipped with an unpowered manual flight control system, the pilot may be de facto aware of the limit of control authority. In this case, no other means of indication may be required.

10. EVALUATION OF FLIGHT CONTROL SYSTEM MODES OF OPERATI ON — CS 25.671 (f) Some flight control systems, for instance, electronic flight control systems, may have multiple modes of operation not restricted to being either on or off. The applicant should evaluate the diffe rent modes of operation and the transition between them in order to establish if they are intuitive or not.

If these modes, or the transition between them, are not intuitive, an alert to the flight crew may be required. Any alert must comply with CS 25.1322 . This includes the indication to the flight crew of the loss of protections.

11. DEMONSTRATION OF ACCEPTABLE MEANS OF COMPLIANCE It is recognised that it may be neither practical nor appropriate to demonstrate compliance by flight test for all of the failure conditions noted herein. Compliance may be demonstrated by analysis, simulation, a piloted engineering simulator, flight test, or a combination of these methods, as agreed with EASA. Simulation m ethods should include an accurate representation of the aeroplane characteristics and of the pilot response, including time delays as specified in paragraph 7.e(1)(iii) of this AMC.

Compliance with CS 25.671 may re sult in AFM non - normal and emergency procedures. Verification of these procedures may be accomplished in flight, or, with the agreement of EASA, using a piloted simulator.

a. Acceptable Use of Simulations. It is generally difficult to define the types of s imulations that might be acceptable in lieu of flight test without identifying specific conditions or issues.

However, the following general principles can be used as guidance for making this kind of decision: (1) In general, flight test is the preferred m ethod to demonstrate compliance; Powered by EASA eRules Page 391 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBP ART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (2) Simulation may be an acceptable alternative to flight test, especially when: (i) a flight test would be too risky even after attempts to mitigate these risks (e.g.

‘simulated’ take - offs/landings at high altitude); (ii) the required environmental conditions, or the representation of the failure conditions, are too difficult to attain (e.g. wind shear, high crosswinds, system failure configurations); (iii) the simulation is used to augment a reasonably broad flight test programme; (iv) the simulation is used to demonstrate repeatability.

b. Simulation Requirements. In order to be acceptable for use in demonstrating compliance with the requirements for performance and handling qualities, a simulation method should: (1 ) be suitably validated by flight test data for the conditions of interest; furthermore,: (i) this does not mean that there must be flight test data at the exact conditions of interest; the reason why a simulation method is being used may be that it is too difficult or risky to obtain flight test data at the conditions of interest; (ii) the level of substantiation of the simulator to flight correlation should be commensurate with the level of compliance (i.e. unless it is determined that the simulation is c onservative, the closer the case is to being non - compliant, the higher the required quality of the simulation); (2) be conducted in a manner appropriate to the case and conditions of interest: (i) if closed - loop responses are important, the simulation shou ld be piloted by a human pilot; (ii) for piloted simulations, the controls/displays/cues should be substantially equivalent to what would be available in the real aeroplane (unless it is determined that not doing so would provide added conservatism).

12. S PECIFICITIES OF AEROPLANES WITH FLY - BY - WIRE FLIGHT CONTROL SYSTEMS a. Control Signal Integrity.

If the aeroplane is equipped with a conventional flight control system, the transmission of command signals to the primary and secondary flight control surfaces is made through conventional mechanical and hydromechanical means.

The determination of the origin of perturbations to command transmissions is relatively straightforward since failure cases can usually be classified in a limited number of categories that include maintenance error, jamming, disconnection, runaway, failure of mechanical element, or structural failure of hydraulic components. Therefore, it is almost always possible to identify the most severe failure cases that would serve as an envelope to all other cases that have the same consequences.

However, when the aeroplane is equipped with flight control systems using the fly - by - wire technology, incorporating digital devices and software, experience from electronic digital transmission lines shows t hat the perturbation of signals from internal and external sources is not unlikely.

The perturbations are described as signals that result from any condition that is able to modify the command signal from its intended characteristics. They can be classifie d in two categories: Powered by EASA eRules Page 392 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (1) Internal causes that could modify the command and control signals include, but are not limited to: — loss of data bits, frozen or erroneous values; — unwanted transients; — computer capacity saturation; — processing of signals by asynchronous microprocessors; — adverse effects caused by transport lag; — poor resolution of digital signals; — sensor noise; — corrupted sensor signals; — aliasing effects; — inappropriate sensor monitoring thresholds; — structural interactions (such as control surfa ce compliance or coupling of structural modes with control modes) that may adversely affect the system operation.

(2) External causes that could modify the command and control signals include but are not limited to: — high - intensity radiated fields (HIRF); — lightning; — electromagnetic interference (EMI) effects (e.g. motor interference, aeroplane’s own electrical power and power switching transients, smaller signals if they can affect flight control, transients due to electrical failures.)

Spurious signals and /or false data that are a consequence of perturbations in either of the two above categories may result in malfunctions that produce unacceptable system responses equivalent to those of conventional systems such as limit cycle/oscillatory failures, runaway /hardover conditions, disconnection, lockups and false indication/warning that consequently present a flight hazard. It is imperative that the command signals remain continuous and free from internal and external perturbations and common - cause failures.

Th erefore, special design measures should be employed to maintain system integrity at a level of safety at least equivalent to that which is achieved with traditional hydromechanical designs.

These special design measures can be monitored through the system safety assessment (SSA) process, provided specific care is directed to development methods and on quantitative and qualitative demonstrations of compliance.

The following should be considered when evaluating compliance with CS 25.671 (c)(2) : (1) The flight control system should continue to provide its intended function, regardless of any malfunction from sources in the integrated systems environment of the aeroplane.

(2) Any malfunctioning system in the aerodynamic loop should not produce an unsafe level of uncommanded motion and should automatically recover its ability to perform critical functions upon removal of the effects of that malfunction.

(3) Systems in the aerodynamic loop should not be adversel y affected during and/or after exposure to any sources of a malfunction.

Powered by EASA eRules Page 393 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (4) Any disruption to an individual unit or component as a consequence of a malfunction, and which requires annunciation and flight crew action, should be identified to and agreed by EASA to assure that: a) the failure can be recognised by the flight crew, and b) the flight crew action can be expected to result in continued safe flight and landing.

(5) An automatic change from a normal to a degraded mode that is caused by spurious si gnal(s) or malfunction(s) should meet the probability guidelines associated with the hazard assessment established in AMC 25.1309 , e.g. for a condition assessed as ‘major’, - 5 the probability of occurrence should be n o more than ‘remote’ (Pc < 10 per flight hour).

(6) Exposure to a spurious signal or malfunction should not result in a hazard with a probability greater than that allowed by the criteria of AMC 25.1309 . The impa ct on handling qualities should be evaluated.

The complexity and criticality of the fly - by - wire flight control system necessitates the additional laboratory testing beyond that required as part of individual equipment validation and software verification.

It should be shown that either the fly - by - wire flight control system signals cannot be altered unintentionally, or that altered signal characteristics would meet the following criteria: (1) Stable gain and phase margins are maintained for all control surfa ce closed - loop systems.

Pilot control inputs (pilot in the loop) are excluded from this requirement; (2) Sufficient pitch, roll, and yaw control power is available to provide control for continued safe flight and landing, considering all the fly - by - wire f light control system signal malfunctions that are not extremely improbable; and (3) The effect of spurious signals on the systems that are included in the aerodynamic loop should not result in unacceptable transients or degradation of the performance of the aeroplane. Specifically, in case of signals that would cause a significant uncommanded motion of a control surface actuator, either the signal should be readily detected and deactivated or the surface motion should be arrested by other m eans in a satisfactory manner. Small amplitude residual system oscillations may be acceptable.

It should be demonstrated that the output from the control surface closed - loop system does not result in uncommanded, sustained oscillations of flight control su rfaces. The effects of minor instabilities may be acceptable, provided that they are thoroughly investigated, documented, and understood. An example of an acceptable condition would be one where a computer input is perturbed by spurious signals, but the ou tput signal remains within the design tolerances, and the system is able to continue to operate in its selected mode of operation and is not affected by this perturbation.

When demonstrating compliance with CS 25.671 (c) , these system characteristics should be demonstrated using the following means: (1) Systematic laboratory validation that includes a realistic representation of all relevant interfacing systems, and asso ciated software, including the control system components that are part of the pitch, roll, and yaw axis control. Closed - loop aeroplane simulation/testing is necessary in this laboratory validation; (2) Laboratory or aeroplane testing to demonstrate unwante d coupling of electronic command signals and their effects on the mechanical actuators and interfacing structure over the spectrum of operating frequencies; and Powered by EASA eRules Page 394 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (3) Analysis or inspection to substantiate that physical or mechanical separation and segregati on of equipment or components are utilised to minimise any potential hazards.

A successful demonstration of signal integrity should include all the elements that contribute to the command and control signals to the ‘aerodynamic closed loop’ that actuates t he aerodynamic control surfaces (e.g. rudder, elevator, stabiliser, flaps, and spoilers). The ‘aerodynamic closed loop’ should be evaluated for the normal and degraded modes. Elements of the integrated ‘aerodynamic closed loop’ may include, for example: di gital or analogue flight control computers, power control units, control feedback, major data busses, and the sensor signals including: air data, acceleration, rate gyros, commands to the surface position, and respective power supply sources. Autopilot sys tems (including feedback functions) should be included in this demonstration if they are integrated with the fly - by - wire flight control system.

b. Formalisation of Compliance Demonstration for Electronic Flight Control Laws.

On fly - by - wire aeroplanes, flig ht controls are typically implemented according to complex control laws and logics.

The handling qualities certification tests, usually performed on conventional aeroplanes to demonstrate compliance with CS - 25 Subpart B specifications, are not considered t o be sufficient to demonstrate the behaviour of the flight control laws in all foreseeable situations that may be encountered in service.

In order to demonstrate compliance with an adequate level of formalisation, the following should be performed and capt ured within certification documents: — Determination of the flight control characteristics that require detailed and specific test strategy; and — Substantiation of the proposed validation strategy (flight tests, simulator tests, analyses, etc.) covering the c haracteristics and features determined above.

In particular, the following characteristics of flight control laws should be covered: — discontinuities; — robustness versus piloted manoeuvres and/or adverse weather conditions; — protection priorities (entry/exit logic conditions not symmetrical); — control law mode changes with and without failures; and — determination of critical scenarios for multiple failures.

The validation strategy should include, but should not be limited to, operational scenarios. The determina tion that an adequate level of formalisation of validation strategy has been achieved should be based on engineering judgement.

[Amdt No: 25/24] [Amdt No: 25/27] Powered by EASA eRules Page 395 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS

CS 25.672 Stability augmentation and automatic and power -

operated systems

ED Decision 2020/001/R If the functioning of stability augmentation or other automatic or power - operated systems is necessary to show compliance with the flight characteristics requirements of this CS - 25, such systems must comply with CS 25.671 and the following: (a) A warning, which is clearly distinguishable to the pilot under expected flight conditions without requiring his attention, must be provided for any failure in the stability augmentation system or in any other automatic or power - operated system, which could result in an unsafe condition if the pilot were not aware of the failure. Warning systems must not activate the control systems.

(b) The design of the stability augmentation system or of any other autom atic or power - operated system must permit initial counteraction of failures of the type specified in CS 25.671(c) without requiring exceptional pilot skill or strength, by either the deactivation of the system, or a failed portion thereof, or by overriding the failure by movement of the flight controls in the normal sense.

(c) It must be shown that after any single failure of the stability augmentation system or any other automatic or power - operated system : (1) The aeroplane is safely controllable when the failure or malfunction occurs at any speed or altitude within the approved operating limitations that is critical for the type of failure being considered.

(2) The controllability and manoeuvrability requirements of this CS - 25 are met within a practical op erational flight envelope (for example, speed, altitude, normal acceleration, and aeroplane configurations) which is described in the Aeroplane Flight Manual; and (3) The trim, stability, and stall characteristics are not impaired below a level needed to p ermit continued safe flight and landing.

[Amdt 25/18] [Amdt 25/24]

CS 25.675 Stops

ED Decision 2003/ 2/RM (a) Each control system must have stops that positively limit the range of motion of each movable aerodynamic surface controlled by the system.

(b) Ea ch stop must be located so that wear, slackness, or take - up adjustments will not adversely affect the control characteristics of the aeroplane because of a change in the range of surface travel.

(c) Each stop must be able to withstand any loads correspon ding to the design conditions for the control system.

Powered by EASA eRules Page 396 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESI GN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS

CS 25.677 Trim systems

ED Decision 2003/2/RM (a) Trim controls must be designed to prevent inadvertent or abrupt operation and to operate in the plane, and the sense of motion, of the aeroplane.

(b) There must be means adjacent to the trim control to indicate the direction of the control movement relative to the aeroplane motion. In addition, there must be clearly visible means to indicate the position of the trim device with respect to the range of adjustment. The indicator must be clearly marked with the range within which it has been demonstrated that take - off is safe for all centre of gravity positions approved for take - off.

(c) Trim control systems must be designed to prevent creepi ng in flight. Trim tab controls must be irreversible unless the tab is appropriately balanced and shown to be free from flutter.

(d) If an irreversible tab control system is used, the part from the tab to the attachment of the irreversible unit to the aero plane structure must consist of a rigid connection.

CS 25.679 Control system gust locks

ED Decision 2016 / 010/R (See AMC 25.679) (a) There must be a device to prevent damage to the control surfaces (including tabs), and to the control system, from gusts striking the aeroplane while it is on the ground. If the device, when engaged, prevents normal operation of the control surfaces by the pilot, it must – (1) Automatically disengage when the pilot operates the primary flight controls in a normal manne r; or (2) Limit the operation of the aeroplane so that the pilot receives unmistakable warning at the start of take - off. (See AMC 25.679(a)(2) .)

(b) The device must have means to preclude the possibility of it beco ming inadvertently engaged in flight. (See AMC 25.679(b) .)

[Amdt 25/18]

AMC 25.679(a)(2) Control system gust locks

ED Decision 2003/ 2/RM If the device required by CS 25.67 9(a) limits the operation of the aeroplane by restricting the movement of a control that must be set before take - off (e.g. throttle control levers), this device should be such that it will perform the function for which it is designed even when subject to likely maladjustment or wear, so that – a. The movement of that control is restricted as long as the device is engaged; and b. The movement of that control is unrestricted when the device is disengaged.

AMC 25.679(b) Control system gust locks

ED Decision 2003/2/RM For the purposes of meeting the design intent of this paragraph, flight means the time from the moment the aircraft first moves under its own power for the purpose of flight until the moment it comes to rest after landing.

Powered by EASA eRules Page 397 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS

CS 25.681 Limit load static tests

ED Decision 2003/ 2/RM (a) Compliance with the lim it load requirements of this CS - 25 must be shown by tests in which – (1) The direction of the test loads produces the most severe loading in the control system; and (2) Each fitting, pulle y, and bracket used in attaching the system to the main structure is included.

(b) Compliance must be shown (by analyses or individual load tests) with the special factor requirements for control system joints subject to angular motion.

CS 25.683 Operation tests

ED Decision 2003/ 2/RM (a) It must be shown by operation tests that when portions of the control system subject to pilot effort loads are loaded to 80% of the limit load specified for the system and the powered portions of the control system are loa ded to the maximum load expected in normal operation, the system is free from – (1) Jamming; (2) Excessive friction; and (3) Excessive deflection.

(b) It must be shown by analysis and, where necessary, by tests that in the presence of deflections of the aeroplane structure due to the separate application of pitch, roll and yaw limit manoeuvre loads, the control system, when loaded to obtain these limit loads and operated within its operational range of deflections can be exercised about all control axes and remain free from - (1) Jamming; (2) Excessive friction; (3) Disconnection, and (4) Any form of permanent damage.

(c) It must be shown that under vibration loads in the normal flight and ground operating conditions, no hazard can result from interference or contact with adjacent elements.

CS 25.685 Control system details

ED Decision 2016/010/R (See AMC 25.685) (a) Each detail of each control system must be designed and installed to prevent jamming, chafing, and interference from cargo, passengers, loose objects or the freezing of moisture. (See AMC 25.685(a) .)

(b) There must be means in the cockpit to prevent the entry of foreign objects into places where they would jam the system.

(c) There must be means to prevent the slapping of cables or tubes against other parts.

Powered by EASA eRules Page 398 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (d) CS 25.689 and CS 25.693 apply to cable systems and joints.

[Amdt 25/18]

AMC 25.685(a) Control system d etails

ED Decision 2003/ 2/RM In assessing compliance with CS 25.685(a) account should be taken of the jamming of control circuits by the accumulation of water in or on any part which is likely to freeze. Particular attention should be paid to the following: a. The points where controls emerge from pressurised compartments.

b. Components in parts of the aeroplane which could be contam inated by the water systems of the aeroplane in normal or fault conditions; if necessary such components should be shielded.

c. Components in parts of the aeroplane where rain and/or condensed water vapour can drip or accumulate.

d. Components inside whi ch water vapour can condense and water can accumulate.

CS 25.689 Cable systems

ED Decision 2003/ 2/RM (a) Each cable, cable fitting, turnbuckle, splice, and pulley must be approved. In addition – (1) No cable smaller than 3.2 mm (0·125 inch) diameter may be used in the aileron, elevator, or rudder systems; and (2) Each cable system must be designed so that there will be no hazardous change in cable tension throughout the range of travel under operating conditions and temperature variations.

(b) Each kind and size of pulley must correspond to the cable with which it is used. Pulleys and sprockets must have closely fitted guards to prevent the cables and chains from being displaced or fouled. Each pulley must lie in the plane passing through the cable s o that the cable does not rub against the pulley flange.

(c) Fairleads must be installed so that they do not cause a change in cable direction of more than three degrees.

(d) Clevis pins subject to load or motion and retained only by cotter pins may not be used in the control system.

(e) Turnbuckles must be attached to parts having angular motion in a manner that will positively prevent binding throughout the range of travel.

(f) There must be provisions for visual inspection of fairleads, pulleys, terminal s, and turnbuckles.

CS 25.693 Joints

ED Decision 2003/2/RM Control system joints (in push - pull systems) that are subject to angular motion, except those in ball and roller bearing systems must have a special factor of safety of not less than 3·33 with res pect to the ultimate bearing strength of the softest material used as a bearing. This factor may be reduced to 2·0 for joints in cable control systems. For ball or roller bearings, the approved ratings, may not be exceeded.

Powered by EASA eRules Page 399 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS

CS 25.697 Lift and drag devices , controls

ED Decision 2003/ 2/RM (a) Each lift device control must be designed so that the pilots can place the device in any takeoff, en - route, approach, or landing position established under CS 25.101(d) . Lift a nd drag devices must maintain the selected positions, except for movement produced by an automatic positioning or load limiting device, without further attention by the pilots.

(b) Each lift and drag device control must be designed and located to make inadvertent operation improbable. Lift and drag devices intended for ground operation only must have means to prevent the inadvertent operation of their controls in flight if that operation could be hazardous.

(c) The rate of motion of the surfaces in resp onse to the operation of the control and the characteristics of the automatic positioning or load limiting device must give satisfactory flight and performance characteristics under steady or changing conditions of airspeed, engine power, and aeroplane att itude.

(d) The lift device control must be designed to retract the surfaces from the fully extended position, during steady flight at maximum continuous engine power at any speed below V + 17 km/hr F (9·0 knots).

CS 25.699 Lift and drag device indicator

ED Decision 2003/2/RM (a) There must be means to indicate to the pilots the position of each lift or drag device having a separate control in the cockpit to adjust its position. In addition, an indication of unsymmetrical operation or other malfunction in th e lift or drag device systems must be provided when such indication is necessary to enable the pilots to prevent or counteract an unsafe flight or ground condition, considering the effects on flight characteristics and performance.

(b) There must be means to indicate to the pilots the take - off, en - route, approach, and landing lift device positions.

(c) If any extension of the lift and drag device beyond the landing position is possible, the control must be clearly marked to identify this range of extension.

CS 25.701 Flap and slat interconnection

ED Decision 2016 / 010/R (See AMC 25.701) (a) Unless the aeroplane has safe flight characteristics with the flaps or slats retracted on one side and extended on the other, the motion of flaps or slats on opposite sid es of the plane of symmetry must be synchronised by a mechanical interconnection or approved equivalent means.

(b) If a wing - flap or slat interconnection or equivalent means is used, it must be designed to account for the applicable unsymmetrical loads, in cluding those resulting from flight with the engines on one side of the plane of symmetry inoperative and the remaining engines at take - off power.

(c) For aeroplanes with flaps or slats that are not subjected to slipstream conditions, the structure must be designed for the loads imposed when the wing - flaps or slats on one side are carrying the most severe load occurring in the prescribed symmetrical conditions and those on the other side are carrying not more than 80% of that load.

Powered by EASA eRules Page 400 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (d) The interconnection m ust be designed for the loads resulting when interconnected flap or slat surfaces on one side of the plane of symmetry are jammed and immovable while the surfaces on the other side are free to move and the full power of the surface actuating system is appl ied.

(See AMC 25.701(d) .)

[Amdt 25/18]

AMC 25.701(d) Flap and slat interconnection

ED Decision 2019/013/R FAA Advisory Circular AC 25 - 14 High Lift and Drag Devices, dated 5 - 4 - 88, incorporated in FAA Advisory Circular AC 25 - 22, Certification of Transport Airplane Mechanical Systems, dated 14 March 2000, is accepted by EASA as providing acceptable means of compl iance with CS 25.701(d) .

[Amdt No: 25/23]

CS 25.703 Take - off warning system

ED Decision 2003/ 2/RM (See AMC 25.703 ) A take - off warning system must be installed and must meet the following requirements: (a) The system must provide to the pilots an aural warning that is automatically activated during the initial portion of the take - off roll if the aeroplane is in a confi guration, including any of the following that would not allow a safe take - off: (1) The wing - flaps or leading edge devices are not within the approved range of take - off positions.

(2) Wing spoilers (except lateral control spoilers meeting the requirements o f CS 25.671 ), speed brakes, or longitudinal trim devices are in a position that would not allow a safe take - off.

(3) The parking brake is unreleased.

(b) The aural warning required by sub - paragraph (a) of this para graph must continue until – (1) The take - off configuration is changed to allow a safe take - off; (2) Action is taken by the pilot to terminate the take - off roll; (3) The aeroplane is rotated for take - off; or (4) The warning is manually silenced by the pil ot. The means to silence the warning must not be readily available to the flight crew such that it could be operated instinctively, inadvertently, or by habitual reflexive action. Before each take - off, the warning must be rearmed automatically, or manually if the absence of automatic rearming is clear and unmistakable.

(c) The means used to activate the system must function properly for all authorised take - off power settings and procedures, and throughout the ranges of take - off weights, altitudes, and tempe ratures for which certification is requested.

Powered by EASA eRules Page 401 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONST RUCTION CONTROL SYSTEMS

AMC 25.703 Take - off Configuration Warning Systems

ED Decision 2012 / 008 /R 1. PURPOSE . This AMC provides guidance for the certification of take - off configuration warning systems installed in large aeroplanes. Like all AMC material, this AMC is not mandatory and does not constitute a requirement. It is issued to provide guidance and to outline a method of compliance with the rules.

2. RELATED CERTIFICATION SPECIFICATIONS .

CS 25.703 , 25.1301 , 25.1309 , 25.1322 , 25.1357 , 25.1431 , and 25.1529 .

3. RELATED MATERIAL .

a. Federal Aviation Administration and EASA Documents.

(1) Advisory Circular 25.1309 - ( ), System Design and Analysis and AC 25 - 11 Transport Category Airplane Electronic Display Systems. Advisory circulars can be obtained from the U.S. Department of Transportation, M - 443.2, Subsequent Distribution Unit, Washington, D.C. 20590.

(2) Report DOT/FAA/RD - 81/38, II, Aircraft Alerting Systems Standardi zation Study, Volume II, Aircraft Alerting Systems Design Guidelines. This document can be obtained from the National Technical Information Service, Springfield, Virginia 22161.

(3) FAA report, Review of Take - off Configuration Warning Systems on Large Jet Transports, dated April 29, 1988. This document can be obtained from the Federal Aviation Administration, Transport Airplane Directorate, 1601 Lind Avenue, S.W., Renton, Washington, 98055 - 4056.

(4) EASA AMC 25.132 2 (Alerting Systems).

(5) EASA AMC 25 - 11 (Electronic Display Systems).

(6) EASA AMC 25.1309 (System Design and Analysis).

(7) EASA AMC 20 - 115 (Software Considerations for A irborne Systems and Equipment Certification) b. Industry Documents .

(1) Aerospace Recommended Practice (ARP) 450D, Flight Deck Visual, Audible and Tactile Signals; ARP 4012/4, Flight Deck Alerting Systems (FAS). These documents can be obtained from the So ciety of Automotive Engineers, Inc. (SAE), 400 Commonwealth Drive, Warrendale, Pennsylvania 15096.

(2) EUROCAE ED - 14D/RTCA document DO - 160D or latest version, Environmental Conditions and Test Procedures for Airborne Equipment; AMC 20 - 115, Software Conside rations for Airborne Systems and Equipment Certification. RTCA documents can be obtained from the RTCA, One McPherson Square, Suite 500, 1425 K Street Northwest, Washington, D.C. 20005.

(3) ARINC 726, Flight Warning Computer System. This document can be ob tained from the ARINC, 2551 Riva Road, Annapolis, Maryland 21401.

Powered by EASA eRules Page 402 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS 4. BACKGROUND . A number of aeroplane accidents have occurred because the aeroplane was not properly configured for take - off and a warning was not provided to the flight crew by the take - off configuration warning system. Investigations of these accidents have indicated a need for guidance material for design and approval of take - off configuration warning systems.

5. DISCUSSION.

a. Regulatory Basis.

(1) CS 25.703 , "Take - off warning system," requires that a take - off configuration warning system be installed in large aeroplanes. This requirement was introduced with JAR - 25 Amendment 5 effective 1.1.79. On the FAR side, this was added to FAR Part 25 by Amendment 25 - 42 effective on March 1, 1978. CS 25.703 requires that a take - off warning system be installed and provide an aural warning to the flight crew during the initial portion of the take off roll, whenever the aeroplane is not in a configuration which would allow a safe take - off. The inte nt of this rule is to require that the take - off configuration warning system cover (a) only those configurations of the required systems which would be unsafe, and (b) the effects of system failures resulting in wrong surface or system functions if there i s not a separate and adequate warning already provided. According to the preamble of FAR Part 25 Amendment 25 - 42, the take - off warning system should serve as "back - up for the checklist, particularly in unusual situations, e.g., where the checklist is inter rupted or the take - off delayed." Conditions for which warnings are required include wing flaps or leading edge devices not within the approved range of take - off positions, and wing spoilers (except lateral control spoilers meeting the requirements of CS 25.671 ), speed brakes, parking brakes, or longitudinal trim devices in a position that would not allow a safe take - off. Consideration should also be given to adding rudder trim and aileron (roll) trim if these device s can be placed in a position that would not allow a safe take - off.

(2) Prior to JAR - 25 Amendment 5 and FAR Part - 25 Amendment 25 - 42, there was no requirement for a take - off configuration warning system to be installed in large aeroplanes. Since this amendm ent is not retroactive, some large aeroplane models in service today may not have take - off configuration warning systems; however, all large turbojet transports currently in service, even those with a certification basis established prior to 1978, include a take - off configuration warning system in the basic design. These include the majority of large aeroplanes.

(3) Other general rules such as CS 25.1301 , 25.1309 , 25.1322 , 25.1357 and 25.1431 for electronic system installations also apply to take - off configuration warning systems.

b. System Criticality .

(1) It has been Aviation Authorities policy to categorise systems designed to alert the flight crew of potentially hazardous operating conditi ons as being at a level of criticality associated with a probable failure condition. (For a definition of this terminology together with discussions and guidelines on the classification of failure conditions and the probability of failures, see AMC 25.1309 ). This is because failures of these systems, in themselves, are not considered to create an unsafe condition, reduce the capability of the aeroplane, or reduce the ability of the crew to cope with adverse operatin g conditions. Other systems which fall into this category include stall warning systems, overspeed warning systems, ground proximity warning systems, and windshear warning systems.

Powered by EASA eRules Page 403 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS (2) Even though AMC 25.1309 does not define an upper probability limit for probable failure conditions, generally, it can be shown by analysis that such systems have a probability of failure (of the ability to adequately give a warning) which is approximately 1.0 x 10E - 3 or less per fligh t hour. This probability does not take into account the likelihood that a warning will be needed. Systems which are designed to meet this requirement are usually single channel systems with limited built - in monitoring. Maintenance or pre - flight checks are relied on to limit the exposure time to undetected failures which would prevent the system from operating adequately.

(3) Applying the practice given in sub - paragraphs b(1) and b(2) above to take - off configuration warning systems is not considered to resul t in an adequate level of safety when the consequence of the combination of failure of the system and a potentially unsafe take - off configuration could result in a major/catastrophic failure condition. Therefore, these systems should be shown to meet the c riteria of AMC 25.1309 pe rtaining to a major failure condition, including design criteria and in - service maintenance at specified intervals. This will ensure that the risk of the take - off configuration warning syst em being unavailable when required to give a warning, if a particular unsafe configuration occurs, will be minimised.

(4) If such systems use digital electronic technology, a software Development Assurance Level (DAL) should be used, in accordance with AMC 20 - 115, which is compatible with the system integrity determined by the AMC 25.1309 analysis.

(5) Since a false warning during the take - off run at speeds near V1 may result in an unnecessary rejected take - off (RTO), which could lead to a mishap, the occurrence of a false warning during the take - off should be remote in accordance with AMC 25.1309 .

(6) If the take - off configuration warning system is integrated with other systems that provide crew alerting functions, the level of criticality of common elements should be commensurate with that of the take - off configuration warning system unless a higher level is dictated by one or more of the other systems.

c. Design Considerations .

(1) A review of existing take - off configuration warning systems has shown a trend towards increased sophistication of des ign, partly due to the transition towards digital electronic technology which is amenable to self - monitoring and simple testing. The net result has been an improvement in reliability, fewer unwanted warnings and enhanced safety.

(2) With the objective of c ontinuing this trend, new systems should be designed using the objectives and criteria of AMC 25.1309 . Analysis should include all the remote sensors, transducers and the elements they depend on, as well as any tak e - off configuration warning system line replaceable unit (LRU) and the actual visual and aural warning output devices.

(3) Unwanted warnings may be reduced by inhibiting the take - off configuration warning system where it is safer to do so, e.g., between V1 and VR, so that a hazardous rejected take - off is not attempted. Inhibition of the take - off configuration warning system at high speeds will also avoid any confusion from the occurrence of a warning during a touch - and - go landing. This is because the basic message of an alert is to stop because it is unsafe to take off. It may or may not tell Powered by EASA eRules Page 404 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS the flight crew which surface or system is wrong. A warning may be more hazardous than reliance on the flight crew's skill and training to cope with the situation.

(4) Even though CS 25.703 specifies those inputs common to most large aeroplanes that must be included in the design, each aeroplane model should be carefully reviewed to ascertain that any configuration or trim settin g that could jeopardise a safe take - off has an input to the take - off warning system unless a separate and adequate warning is already provided by another system. There may be aeroplane configurations or electronically positioned lateral or longitudinal tri m unique to a particular model that constitute this hazard. In the event that it is necessary to inhibit the warning from a particular system during the entire take - off roll, an equivalent level of safety finding would be required.

(5) Automatic volume adj ustment should be provided to maintain the aural warning volume at an appropriate level relative to cockpit ambient sound. According to Report No. DOT/FAA/RD - 81/38, II entitled "Aircraft Alerting Systems Standardisation Study, Volume II - Aircraft Alerting System Design Guidelines," aural signals should exceed masked threshold by 8 ± 3 dB.

(6) Of particular importance in the design of take - off configuration warning systems is the elimination of nuisance warnings. These are warnings generated by a system whi ch is functioning as designed but which are inappropriate or unnecessary for the particular phase of operation. Attempting to eliminate nuisance warnings cannot be overemphasised because any indication which could cause the flight crew to perform a high sp eed rejected take - off, or which distracts or adversely affects the flight crew's performance of the take - off manoeuvre, creates a hazard which could lead to an accident. In addition, any time there are nuisance warnings generated, there is a possibility th at the flight crew will be tempted to eliminate them through system deactivation, and by continually doing this, the flight crew may be conditioned to ignore a valid warning.

(7) There are a number of operations that could produce nuisance warnings.

Specif ically, single engine taxi for twin engine aeroplanes, or in the case of 3 and 4 engine aeroplanes, taxi with fewer than all engines operating is a procedure used by some operators for the purpose of saving fuel. Nuisance warnings have also been caused by trim changes and speed brake handle adjustments.

(8) The means for silencing the aural warning should not be located such that it can be operated instinctively, inadvertently, or by habitual reflexive action. Silencing is defined as the interruption of the aural warning. When silenced, it is preferred that the system will be capable of rearming itself automatically prior to take - off .

However, if there is a clear and unmistakable annunciation that the system is silenced, manual re - arming is acceptable.

(9) E ach aeroplane model has a different means of arming the take - off configuration warning system, therefore the potential for nuisance warnings varies accordingly.

Some existing systems use only a single throttle position, some use position from multiple thro ttles, some use EPR or N1, and some use a combination of these.

When logic from a single operating engine was used, nuisance warnings were common during less than all engine taxi operations because of the higher power settings required to move the aeroplan e. These systems were not designed for that type of operation. Because this procedure is used, inputs that arm the system Powered by EASA eRules Page 405 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS should be judiciously selected taking into account any likely combination of operating and shut - down engines so that nuisance warnings will not occur if the aeroplane is not in take - off configuration.

(10) CS 25.703 requires only an aural alert for the take - off warning system. CS 25.1322 currently specify requirements for visual alerts while related reading material reference 3a(2), 3a(4) and 3b(1) provide guidance for integrated visual and aural annunciations for warnings, cautions and advisory alerting conditions. It has been common industry practice to incorporate the above mentioned references in their aeroplane designs. FAR/ CS 25.1322 are planned for revision to incorporate the guidance of these references to reflect current industry practices. Manufacturers ma y wish to incorporate these alerting concepts to the take - off warn ing system. If such is the case , the following guidance is offered: a) A master warning (red) attention getting alert may be provided in the pilot's primary field of view simultaneously with the aural attention getting alert.

b) In addition to or instead of the aural attention getting alert (tone), voice may be used to speci fy the general problem (Configuration), or the exact problem (slats, flaps, trim, parking brake, etc…).

c) The visual alert may also specify the general problem (Configuration), or the exact problem (slats, flaps, trim, parking brake, etc…).

d) A visual cautionary alert associated with the failure of the Take - off warning system may be provided e.g. "T/O WARN FAIL".

(11) The EASA Agency approved Master Minimum Equipment List (MMEL) includes those items of equipment related to airworthiness and operating regulations and other items of equipment which the Agency finds may be inoperative and yet maintain an acceptable level of safety by appropriate conditions and limitations.

No MMEL relief is provided for an inoperative take - off configuration warning.

There fore, design of these systems should include proper system monitoring including immediate annunciation to the flight crew should a failure be identified or if power to the system is interrupted.

d. System Tests and Test Intervals .

(1) When manual tests o r checks are required to show compliance with CS 25.1309 , by detecting the presence of and limiting the exposure time to a latent failure that would render the warning inoperative, they should be adequate, simple a nd straight forward in function and interval to allow a quick and proper check by the flight crew and maintenance personnel. Flight crew checks may be specified in the approved Aeroplane Flight Manual (AFM) and, depending on the complexity of the take - off configuration warning system and the aeroplane, maintenance tasks may be conventional Maintenance Review Board (MRB) designed tasks or listed as Certification Check Requirements (CCR) where appropriate, as defined in AMC 25.1309 , and determined as part of the approval process between the manufacturer and the certification office.

(2) The specified tests/checks established in accordance with sub - paragraph 5d(1) above should be demonstrated as part of the approval pro cess and should show that each input sensor as well as the control and logic system and its emitters, including the indication system, are individually verified as required to meet sub - paragraph 5b(3). It should also be demonstrated that the warning self c ancels Powered by EASA eRules Page 406 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTR OL SYSTEMS when required to do so, for example by retarding the throttles or correcting the wrong configuration.

e. Test Considerations .

(1) During flight testing it should be shown that the take - off configuration warning system does not issue nuisance alerts or interfere with other systems. Specific testing should be conducted to ensure that the take - off configuration warning system works satisfactorily for all sensor inputs to the system. Flight testing should include reconfiguration of the aeroplane during touch and go manoeuvres.

(2) It should be shown by test or analysis that for all requested power settings, feasible weights, taxiway slopes, temperatures and altitudes, there will be no nuisance warnings, nor failure to give a warning when necessary (e.g., cold conditions, derated take - off), for any reasonable configuration of engines operating or shut down. This is to test or simulate all expected operational configurations.

Reasonable pilot technique for applying power should be presumed.

(3) The means fo r silencing the aural warning by the flight crew will be evaluated to assure that the device is not accessible instinctively and it is properly protected from inadvertent activation. Automatic or manual re - arming of the warning system will be evaluated.

[A mdt 25/2] [Amdt 25/8] [Amdt 25/12]

CS 25.705 Runway overrun awareness and alerting systems

ED Decision 2020/001/R (See AMC 25.705 ) A runway overrun awareness and alerting system (ROAAS) must be installed. The ROAAS shall reduce the risk of a longitudinal runway excursion during landing by providing alert, in flight and on ground, to the flight crew when the aeroplane is at risk of not being able to stop within the available distance to the end of the runway.

(a) During approach (from a given height above the selected runway) and landing, the ROAAS shall perform real - time energy - based calculations of the predicted landing stopping point, compare that point with the location of the end of the runway , and provide the flight crew with: (1) in - flight, timely, and unambiguous predictive alert(s) of a runway overrun risk, and (2) on - ground, timely, and unambiguous predictive alert(s) of a runway overrun risk. At the option of the applicant, the ROAAS may also provide an automated means of deceleration control that prevents or minimises runway overrun during landing.

(b) The ROAAS shall at least accommodate dry and wet runway conditions for normal landing configurations.

[Amdt 25/24] Powered by EASA eRules Page 407 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION CONTROL SYSTEMS

AMC 25.705 Runway overr un awareness and alerting systems

ED Decision 2020/001/R 1. When demonstrating compliance with CS 25.705, the applicant should take account of EUROCAE Document ED - 250, ‘Minimum Operational Performance Standard for a Runway Overrun Awareness and Alerting System’, dated December 2017.

2. When demonstrating compliance with CS 25.1581 and CS 25.1585, the applicant should include in the aeroplane flight manual the following elements: (1) A description of the runway overrun awareness and alerting system (ROAAS ) operational domain, including all conditions for which the ROAAS is expected to perform its intended function, (2) Any operational limitations applicable to the ROAAS, and (3) Operational procedures to be used by the flight crew when ROAAS alerts are triggered.

[Amdt 25/24] Powered by EASA eRules Page 408 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR

LANDING GEAR

CS 25.721 General

ED Decision 200 7 / 010 /R (See AMC 25.963(d) ) (a) The landing gear system must be designed so that when it fails due to overloads during take - off and landing , the failure mode is not likely to cause spillage of enough fuel to constitute a fire hazard. The overloads must be assumed to act in the upward and aft directions in combination with side loads acting inboard and outboard. In the absence of a more rational analysis, the side loads must be assumed to be up to 20% of the vertical load or 20% of the drag load, whichever is greater.

(b) The aeroplane mus t be designed to avoid any rupture leading to the spillage of enough fuel to constitute a fire hazard as a result of a wheels - up landing on a paved runway, under the following minor crash landing conditions: (1) Impact at 1.52 m/s (5 fps) vertical velocity , with the aeroplane under control, at Maximum Design Landing Weight, (i) with the landing gear fully retracted and, as separate conditions, (ii) with any other combination of landing gear legs not extended.

(2) Sliding on the ground, with - (i) the lan ding gear fully retracted and with up to a 20° yaw angle and, as separate conditions, (ii) any other combination of landing gear legs not extended and with 0° yaw angle.

(c) For configurations where the engine nacelle is likely to come into contact with the ground, the engine pylon or engine mounting must be designed so that when it fails due to overloads (assuming the overloads to act predominantly in the upward direction and separately predominantly in the aft direction), the failure mode is not li kely to cause the spillage of enough fuel to constitute a fire hazard.

[Amdt 25/3]

CS 25.723 Shock absorption tests

ED Decision 2003/ 2/RM (See AMC 25.723 ) (a) The analytical representation of the landing gear dyna mic characteristics that is used in determining the landing loads must be validated by energy absorption tests. A range of tests must be conducted to ensure that the analytical representation is valid for the design conditions specified in CS 25.473 .

(1) The configurations subjected to energy absorption tests at limit design conditions must include at least the design landing weight or the design takeoff weight, whichever produces the greater value of landing impact energy.

(2) The test attitude of the landing gear unit and the application of appropriate drag loads during the test must simulate the aeroplane landing conditions in a manner consistent with the development of rational or conservative limit loads.

Powered by EASA eRules Page 409 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPA RT D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (b) Th e landing gear may not fail in a test, demonstrating its reserve energy absorption capacity, simulating a descent velocity of 3.7 m/s (12 fps) at design landing weight, assuming aeroplane lift not greater than the aeroplane weight acting during the landing impact.

(c) In lieu of the tests prescribed in this paragraph, changes in previously approved design weights and minor changes in design may be substantiated by analyses based on previous tests conducted on the same basic landing gear system that has simi lar energy absorption characteristics.

AMC 25.723 Shock absorption t ests

ED Decision 2006 / 005/R 1. PURPOSE . This AMC sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of CS - 25 related to the use of lan ding gear shock absorption tests and analyses to determine landing loads for large aeroplanes.

2. RELATED C ERTIFICATION S PECIFICATIONS . CS 25.723 "Shock absorption tests" and CS 25.473 "Landing load conditions and assumptions."

3. SHOCK ABSORPTION TESTS .

a. Validation of the landing gear characteristics . Shock absorption tests are necessary to validate the analytical representation of the dynamic characteristics of the landing gear unit that will be used to determine the landing loads. A range of tests should be conducted to ensure that the analytical mo del is valid for all design conditions. In addition, consideration should be given to ensuring that the range of test configurations is sufficient for justifying the use of the analytical model for foreseeable future growth versions of the aeroplane.

b. R ecommended test conditions for new landing gear units . The design takeoff weight and the design landing weight conditions should both be included as configurations subjected to energy absorption tests. However, in cases where the manufacturer has supportin g data from previous experience in validating the analytical model using landing gear units of similar design concept, it may be sufficient to conduct tests of the new landing gear at only the condition associated with maximum energy. The landing gear used to provide the supporting data may be from another model aircraft but should be of approximately the same size with similar components.

c. Changes to type designs . CS 25.723(c) allows changes in previously approv ed design weights and minor changes in design to be substantiated by analyses based on tests of the same basic landing gear unit with similar energy absorption characteristics.

A landing gear unit would be considered to be of “the same basic landing gear system” when the design concept has not been changed. “Similar energy absorption characteristics” means that the changes to the landing gear unit, either taken individually or as a whole, would not have a significant effect on the validation of the analyti cal results for the modified aeroplane. Changes that may be acceptable without further energy absorption tests include minor changes and adjustments incorporated in the landing gear unit to maintain similar energy absorption characteristics with changes in design weight and landing speeds.

For example, the following changes may be acceptable without further tests: (1) Minor changes in shock absorber details including pre - load, compression ratio, orifice sizes, metering pin profiles.

Powered by EASA eRules Page 410 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (2) Minor changes in t yre characteristics.

(3) Minor changes in unsprung mass (e.g. brakes).

(4) Local strengthening or minor sizing changes to the landing gear.

To allow justification by analysis for the reserve energy requirement, neither the shock strut nor the tyres should bottom during the reserve energy analysis or the tests upon wh ich the analysis is correlated.

4. LIMIT FREE DROP TESTS .

a. Compliance with CS 25.723(a) may be shown by free drop tests, provided they are made on the complete aeroplane, or on units consist ing of a wheel, tyre, and shock absorber, in their proper positions, from free drop heights not less than -- (1) 475 mm (18.7 inches) for the design landing weight conditions; and (2) 170 mm (6.7 inches) for the design takeoff weight conditions.

b. If aero plane lift is simulated by air cylinders or by other mechanical means, the weight used for the drop must be equal to W. If the effect of aeroplane lift is represented in free drop tests by a reduced weight, the landing gear must be dropped with an effectiv e weight equal to ℎ + ( 1 − 𝐿 ) 𝑑 𝑊 = 𝑊 [ ] 𝑒 ℎ + 𝑑 where: W = the effective weight to be used in the drop test (kg); e h = specified free drop height (mm); d = deflection under impact of the tyre (at the approved inflation pressure) plus the vertical component of the axle travel relative to the drop weight (mm); W = W for main gear units (kg), equal to the static weight on that unit with the M aeroplane in th e level attitude (with the nose wheel clear in the case of nose wheel type aeroplanes); W = W for tail gear units (kg), equal to the static weight on the tail unit with the T aeroplane in the tail - down attitude; W = W for nose wheel units (kg), equal to the vertical component of the static reaction N that would exist at the nose wheel, assuming that the mass of the aeroplane acts at the centre of gravity and exerts a force of 1.0 g downward and 0.25 g forward; and L = ratio of the assumed aeroplane lift to the aeroplane weight, but not more than 1.0.

c. The drop test attitude of the landing gear unit and the application of appropriate drag loads during the test must simulate the aeroplane landing conditions in a manner consistent with the developmen t of rational or conservative limit loads.

d. The value of d used in the computation of W e in paragraph 4.(b) of this AMC may not exceed the value actually obtained in the drop test.

Powered by EASA eRules Page 411 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR 5. RESERVE ENERGY FREE DROP TESTS .

a. Compliance with the reserve energy absorption condition specified in CS 25.723(b) may be shown by free drop tests provided the drop height is not less than 69 cm (27 inches).

b. If aeroplane lift is simulated by a ir cylinders or by other mechanical means, the weight used for the drop must be equal to W. If the effect of aeroplane lift is represented in free drop tests by an equivalent reduced weight, the landing gear must be dropped with an effective weight: 𝑊 ℎ 𝑊 = [ ] 𝑒 ℎ + 𝑑 where the symbols and other details are th e same as in paragraph 4 above.

[Amdt 25/2]

CS 25.729 Extending and r etracting mechanism s

ED Decision 20 16 / 010 /R (See AMC 25.729 ) (a) General . For aeroplanes with retractable landing gear, the following apply: (1) The landing gear extending and retracting mechanism s , wheel well doors, and supporting structure, must be designed for – : (i) t he loads occurring in the flight conditions when the gear is in the retracted position; (ii) t he combination of friction loads, inertia loads, brake torque loads, air loads, and gyroscopic loads resulting from the wheels rotating at a peripheral speed equal to 1·23 V (with the flaps in takeoff position at design take - off weight), occurring SR during retraction and extension at any airspeed up to 1·5 V with the wing - flaps SR1 in the approach position at design landing weight, and (iii) a ny load factor up to those specified in CS 25.345(a) for the wing - flaps extended condition.

(2) Unless there are other means to decelerate the aeroplane in flight at this speed, the landing gear, the extending and retracting mechanism s , and the aeroplane s tructure (including wheel well doors) must be designed to withstand the flight loads occurring with the landing gear in the extended position at any speed up to 0·67 V .

C (3) Landing gear doors, their operating mechanism, and their supporting structures mus t be designed for the yawing manoeuvres prescribed for the aeroplane in addition to the conditions of airspeed and load factor prescribed in sub - paragraphs (a)(1) and (2) of this paragraph.

(b) Landing gear lock . There must be positive means to keep the la nding gear extended in flight and on the ground. There must be positive means to keep the landing gear and doors in the correct retracted position in flight, unless it can be shown that lowering of the landing gear or doors, or flight with the landing gear or doors extended, at any speed, is not hazardous.

Powered by EASA eRules Page 412 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (c) Emergency operation . There must be an emergency means for extending the landing gear in the event of – (1) a ny reasonably probable failure in the normal extension and retraction system s ; or (2) t he failure of any single source of hydraulic, electric, or equivalent energy supply.

(d) Operation test. The proper functioning of the extending and retracting mechanism s must be shown by operation tests.

(e) Position indicator and warning device. If a retractable landing gear is used, there must be a landing gear position indicator easily visible to the pilot or to the appropriate crew members (as well as necessary devices to actuate the indicator) to indicate without ambiguity that the retractabl e units and their associated doors are secured in the extended (or retracted) position.

The means must be designed as follows: (1) If switches are used, they must be located and coupled to the landing gear mechanical systems in a manner that prevents an e rroneous indication of ‘down and locked’ if the landing gear is not in a fully extended position, or of ‘up and locked’ if the landing gear is not in the fully retracted position. The switches may be located where they are operated by the actual landing ge ar locking latch or device.

(2) The flight crew must be given an aural warning that functions continuously, or is periodically repeated, if a landing is attempted when the landing gear is not locked down.

(3) The warning must be given in sufficient time to allow the landing gear to be locked down or a go - around to be made.

(4) There must not be a manual shut - off means readily available to the flight crew for the warning required by sub - paragraph (e)(2) of this paragraph such that it could be operated instin ctively, inadvertently or by habitual reflexive action.

(5) The system used to generate the aural warning must be designed to minimise false or inappropriate alerts.

(6) Failures of systems used to inhibit the landing gear aural warning, that would prevent the warning system from operating, must be improbable.

(7) A clear indication or warning must be provided whenever the landing gear position is not consistent with the landing gear selector lever position.

[Amdt 25/4] [Amdt 25/14] [Amdt 25/18]

AMC 25.729 Extending retracting m echanism s

ED Decision 201 6 / 010 /R 1. PURPOSE. This Acceptable Means of Compliance (AMC) provides guidance material for use as an acceptable means of demonstrating compliance with the landing gear retracting mechanism requirement s of the Certification Specification (CS) for large aeroplanes.

Powered by EASA eRules Page 413 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR 2. RELATED DOCUMENTS.

a. Related Certification Specifications. CS 25.729 and other paragraphs relating to landing gear extending and retracting mech anism s installations together with their applicable AMCs, if any. Paragraphs which prescribe requirements for the design, substantiation, and certification of landing gear extending and retracting mechanisms include: CS 25.111 Take - off path CS 25.301 Loads CS25.303 Factor of safety CS 25.305 Strength and deformation CS 25.307 Proof of structure CS 25.333 Flight envelope CS 25.471 General [Ground loads] CS 25.561 General [Emergency Landing Conditions] CS 25.601 General [Design and Construction] CS 25.603 Materials CS 25.605 Fabrication methods CS 25.607 Fasteners CS 25.609 Protection of structure CS 25.613 Material strength properties CS 25.619 Special factors CS 25.621 Casting factors CS 25.623 Bearing factors CS 25.625 Fitting factors CS 25.729 Extending and r etracting mechanism s CS 25.777 Cockpit controls CS 25.779 Motion and effect of cockpit controls CS 25.781 Cockpit control knob shape CS 25.863 Flammable fluid fire protection CS 25.869 Fire protection: sys tems CS 25.899 Electrical bonding, etc.

CS 25.1301 Function and installation CS 25.1309 Equipment, systems and installations CS 25.1315 Negative acceleration CS 25.1316 System lightning protection CS 25.1322 Warning, caution and advisory lights CS 25.1353 Electrical equipment and installations Powered by EASA eRules Page 414 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR CS 25.1357 Circuit protective devices CS 25.1360 Precautions against injury CS 25.1435 Hydraulic systems CS 25.1515 Landing gear speeds CS 25.1555 Control markings CS 25.1583 Operating limitations CS 25.1585 Operating procedures b. FAA Advisory Circulars (AC's).

AC 20 - 34D Prevention of Retractable Landing Gear Failures AC 23 - 17B Systems and Equipment Guide for Certification of Part 23 Airplanes and Airships AC 25.1309 - 1A System Design and Analysis AC 25 - 7C Flight Test Guide for Certification of Transport Category Airplanes AC 25 - 22 Certification of Transport Airplane Mechanical Systems AC 43.13 - 1B Acceptable Methods, Techniques and Practices - Aircraft Inspection and Repair.

c. Federal Aviation Administration Orders.

Order 8110.4C Type Certification Process Advisory Circulars and FAA Orders can be obtained from the U.S. Department of Transportation, Subsequent Distribution Office, SVC - 121.23, Ardmore East Business Center, 3341 Q 75th Avenue, Landover, MD 20785.

d. Society of Automotive Engineers (SAE) Documents.

SAE AIR - 4566 Crashworthiness Landing Gear Design SAE ARP - 1311A Landing Gear - Aircraft ISO 7137 Environmental Conditions and Test P rocedures for Airborne Equipment (not an SAE document but is available from the SAE) These documents can be obtained from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania, 15096.

e. Industry Documents .

(1) EUROC AE ED - 14G / RTCA, Inc., Document No. DO - 160G , Environmental Conditions and Test Procedures for Airborne Equipment.

(2) AMC 20 - 115 , Software Considerations in Airborne Systems and Equipment Certification.

These documents can be obtained from EUROCAE, 17 rue Hamelin, 75783 Paris Cedex 15, France f. Military Documents.

MIL - STD - 810 Environmental Test Methods and Engineering Guidelines Powered by EASA eRules Page 415 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR This document can be obtained from the Department of Defence, DODSSP, Standardisation Document Order Desk, 700 Ro bbins Avenue, Building 4D, Philadelphia, PA 19111 - 5094.

4. DISCUSSION.

a. Intent of rule. (Reference CS 25.729 Extending and r etracting mechanism s ) This rule provides minimum design and certification requirements for landing gear actuation systems to address: (1) Structural integrity for the nose and main landing gear, extending and retracting mechanism(s), doors, gear supporting structure for loads imposed during flight; (2) Positive locking of the kinematic mech anisms; (3) Redundant means of extending the landing gear; (4) Demonstration of proper operation by test; (5) Gear up - and - locked and down - and - locked position indications and aural warning; (6) Equipment damage from tyre burst, loose tread, and wheel brake temperatures.

b. Demonstration of extending and retracting mechanism s proper functioning. (Reference CS 25.729(d) Operation test) Guidance addressing flight testing used to demonstrate compliance with this paragr aph may be found in FAA Advisory Circular (AC) 25 - 7C , Flight Test Guide for Transport Category Aeroplanes, Chapter 4, S ection 4, paragraph 52, dated 16 October 2012.

c. Extending and r etracting mechanism s i ndication. (Reference CS 25.729(e) Position indicator and warning device) (1) When light indicators are used, they should be arranged so that - (i) A green light for each unit is illuminated only when the unit is secured in the correct landing position.

(ii) A warning light consistent with CS 25.1322 is illuminated at all times except when the landing gear an d its doors are secured in the landing or retracted position.

(2) The warning required by CS 25.729(e)(2) should preferably operate whatever the position of wing leading - or trailing - edge devices or the number of e ngines operating.

(3) The design should be such that nuisance activation of the warning is minimised, for example - (i) When the landing gear is retracted after a take - off following an engine failure, or during a take - off when a common flap setting is used for take - off and landing; (ii) When the throttles are closed in a normal descent; or (iii) When flying at low altitude in clean or low speed configuration (special operation).

(4) Inhibition of the warning above a safe altitude out of final approach phase either automatically or by some other means to prevent these situations is acceptable, but it should automatically reset for a further approach.

Powered by EASA eRules Page 416 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (5) Means to de - activate the warning required by CS 25.729(e) may be installed for use in abnormal or emergency conditions provided that it is not readily ava ilable to the flight crew, i.e. the control device is protected against inadvertent actuation by the flight crew and its de - activated state is obvious to the flight crew.

d . Definitions. For definitions of V and V , see CS - Definitions Chapter 2, en titled SR C ' Abbreviations and symbols ' .

[Amdt 25/4] [Amdt 25/12] [Amdt 25/14] [Amdt 25/18]

CS 25.731 Wheels

ED Decision 2003/ 2/RM (a) Each main and nose wheel must be approved.

(b) The maximum static load rating of each wheel may not be less than the corresponding static ground reaction with – (1) Design maximum weight; and (2) Critical centre of gravity.

(c) The maximum limit load rating of each wheel must equal or exceed the maximum radial limit load determined under the applicable grou nd load requir ements of this CS - 25.

(d) Overpressure burst prevention. Means must be provided in each wheel to prevent wheel failure and tyre burst that may result from excessive pressurisation of the wheel and tyre assembly.

(e) Braked wheels . Each braked wheel must m eet the applicable requirements of CS 25.735 .

CS 25.733 Tyres

ED Decision 2020/024/R (a) When a landing gear axle is fitted with a single wheel and tyre assembly, the wheel must be fitted with a suitable tyre of proper fit with a speed rating approved by the Agency that is not exceeded under critical conditions, and with a load rating approved by the Agency that is not exceeded under – (1) The loads on the main wheel tyre, corresponding to the most critical combin ation of aeroplane weight (up to the maximum weight) and centre of gravity position; and (2) The loads corresponding to the ground reactions in sub - paragraph (b) of this paragraph, on the nose - wheel tyre, except as provided in sub - paragraphs (b)(2) and (b) (3) of this paragraph.

(b) The applicable ground reactions for nosewheel tyres are as follows: (1) The static ground reaction for the tyre corresponding to the most critical combination of aeroplane weight (up to maximum ramp weight) and centre of gravity position with a force of 1·0 g acting downward at the centre of gravity. This load may not exceed the load rating of the tyre.

(2) The ground reaction of the tyre corresponding to the most critical combination of aeroplane weight (up to maximum lan ding weight) and centre of gravity position combined with forces of 1·0 g downward and 0·31 g forward acting at the centre of Powered by EASA eRules Page 417 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AN D (CS - 25) CONSTRUCTION LANDING GEAR gravity. The reactions in this case must be distributed to the nose and main wheels by the principles of static’s with a drag reac tion equal to 0·31 times the vertical load at each wheel with brakes capable of producing this ground reaction. This nose tyre load may not exceed 1·5 times the load rating of the tyre.

(3) The ground reaction of the tyre corresponding to the most critical combination of aeroplane weight (up to maximum ramp weight) and centre of gravity position combined with forces of 1·0 g downward and 0·20 g forward acting at the centre of gravity. The reactions in this case must be distributed to the nose and main wheel s by the principles of static’s with a drag reaction equal to 0·20 times the vertical load at each wheel with brakes capable of producing this ground reaction. This nose tyre load may not exceed 1·5 times the load rating of the tyre.

(c) When a landing gea r axle is fitted with more than one wheel and tyre assembly, such as dual or dual - tandem, each wheel must be fitted with a suitable tyre of proper fit with a speed rating approved by the Agency that is not exceeded under critical conditions, and with a loa d rating approved by the Agency that is not exceeded by – (1) The loads on each main wheel tyre, corresponding to the most critical combination of aeroplane weight (up to maximum weight) and centre of gravity position, when multiplied by a factor of 1·07; and (2) Loads specified in sub - paragraphs (a)(2), (b)(1), (b)(2) and (b)(3) of this paragraph on each nose - wheel tyre.

(d) Each tyre installed on a retractable landing gear system must, at the maximum size of the tyre type expected in service, have a clear ance to surrounding structure and systems that is adequate to prevent unintended contact between the tyre and any part of the structure or systems.

(e) For an aeroplane with a maximum certificated take - off w eight of more than 34019 kg (75 000 pounds), tyre s mounted on braked wheels must be inflated with dry nitrogen or other gases shown to be inert so that the gas mixture in the tyre does not contain oxygen in excess of 5% by volume, unless it can be shown that the tyre liner material will not produce a vol atile gas when heated, or that means are provided to prevent tyre temperatures from reaching unsafe levels.

(f) A means shall be provided to minimise the risk that a tyre is below its minimum serviceable inflation pressure during operation. (See AMC 25.733(f) ) [Amdt 25/26]

AMC 25.733(f) Tyre inflation pressure check

ED Decision 2020/024/R 1. General ‘Minimum serviceable inflation pressure’ means a tyre inflation pressure specified by the aeroplane type certificate holder below which damage to the tyre, potentially leading to a tyre failure, may occur.

In order to demonstrate compliance with CS 25.733(f) , the applicant should use one, or a combination, of the foll owing means: (a) Provide a task in the Instructions for Continued Airworthiness (ICA) that requires tyres inflation pressure checks to be performed at a suitable time interval, Powered by EASA eRules Page 418 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (b) Install a system that monitors the tyres inflation pressures and: (1) provi des an alert to the flight crew, in compliance with CS 25.1322 , whenever a tyre inflation pressure is below the minimum serviceable inflation pressure, or (2) allows the tyres inflation pressures to be checked prio r to the dispatch of the aeroplane, and a tyre inflation pressure check task is included in the Aeroplane Flight Manual (AFM) pre - flight procedures.

2. ICA Tyre inflation pressure check A ‘suitable time interval’ is the maximum time interval between two co nsecutive tyre inflation pressure checks.

Checks should be conducted daily in order to ensure that the elapsed clock time between two consecutive tyre inflation pressure checks does not exceed 48 hours.

Time intervals longer than 48 hours may be used if th ey are substantiated and agreed by EASA.

This substantiation should at least include an analysis of the expected loss of tyre pressure during operation, taking into account the environmental and operational factors, including the potential for pressure los s at a rate that exceeds the normal diffusion resulting from damage to or degradation of the tyre/wheel assembly. If available, statistical data related to pressure losses gathered from the service experience of aeroplanes equipped with equivalent wheel de signs should also be used. The substantiation should be made in cooperation with the tyre manufacturer(s). In addition, the applicant may take credit from an installed system monitoring the tyre inflation pressures.

3. Tyre inflation pressure monitoring sy stems If a system is installed, its development assurance level should be commensurate with the potential consequences of an alert not being provided, as well as with the consequences of false alerts. If the system includes the indication of tyre pressure levels, the consequence of a false indication should also be taken into account. The assessment of these consequences should include the effects of the failure of one or more tyres (including simultaneous tyre failures) that may be caused by the o peration of the aeroplane with under - inflated tyres.

Instructions for Continued Airworthiness should be provided to ensure that the calibration of the tyre pressure monitoring system is maintained.

[Amdt 25/26]

CS 25.734 Protection against wheel and tyre f ailures

ED Decision 2013/033/R (see AMC 25.734 ) The safe operation of the aeroplane must be preserved in case of damaging effects on systems or structures from: — tyre debris; — tyre burst pressure; — flailing tyre strip; and — wheel flange debris.

[Amdt 25/14] Powered by EASA eRules Page 419 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR

AMC 25.734 Protection against wheel and tyre fail ures

ED Decision 2013/033/R 1. Purpose This AMC provides a set of models defining the threats originating from failures of tyres and wheels. Furthermore, protecting the aircraft against the threats defined in these models would also protect against threat s originating from foreign objects projected from the runway.

These models should be used for protection of aeroplane structure and systems.

2. Related Certification Specifications and Acceptable Means of Compliance CS 25.571 Damage tolerance and fatigue evaluation of structure CS 25.734 Protection against wheel and tyre failures CS 25.963(e) Fuel tanks: general AMC 25.963(e) Fuel Tank Protection CS 25.1309 Equipment, systems and installations AMC 20 - 29 Composite Aircraft Structure 3. General 3.1. Threat models The models provided below encompass the threats applicable to landing gear in the extended, retracting and retracted positions. The threats to be considered are tyre debris, flailing tyre strips, tyre burst pressure effect and wheel flange de bris. The models defined below are applicable to brand - new tyres.

With the landing gear in the extended position, the following models are applicable: — Model 1 — Tyre Debris Threat Model — Model 2 — Wheel Flange Debris Threat Model — Model 3E — Flailing Tyre St rip Threat Model With the landing gear retracting or in the retracted position, the following models are applicable: — Model 3R — Flailing Tyre Strip Threat Model — Model 4 — Tyre Burst Pressure Effect Threat Model 3.2. Structural residual strength and damage tolerance In - service experience shows that traditional large transport aeroplane configurations, featuring high aspect ratio wings built around a single torsion box manufactured of light metal alloy, have demonstrated inherent structural robustness with regard to wheel and tyre debris threats. This results from the intrinsic properties of the structure, including thick wing skin gauges, as well as the general geometric arrangement (relative position of the landing gear to the wing). Residual strength and damage tolerance evaluations might therefore not be required for aeroplanes featuring such design features. For aeroplanes with novel or unusual design features (configuration, material, fuel tank arrangement, etc.), for principal structural elements and primary structures, the debris models are threats to be considered with respect to the related residual strength and Powered by EASA eRules Page 420 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR damage tolerance rules and advisory materials, unless otherwise stated in this AMC or addressed by other means.

3.3. Fuel tank penetra tion In - service experience shows a good safety record for the fuel tanks located within the torsion box of high aspect ratio wings manufactured of light metal alloy, owing to the intrinsic characteristics of the structure, including the wing skin gauge and typical arrangement of the stringers and ribs. Therefore, for tanks located within similar structures, in the absence of any unusual design feature(s), fuel tank penetration evaluation needs only to consider small tyre debris.

3.4. Definitions Carcass of a tyre: This comprises the entire main body of a tyre (also named the casing) including the materials under the tread, the sidewall, and steel belts if any.

Full tread: The thickness of the tread rubber measured from the outer tread surface to the top of the outermost fabric or steel layer, including the rubber thickness above and below the tread groove bottom. Refer to the figure below (section of a tyre): Hazardous fuel leak: a definition is provided in AMC 25.963(e).

Maximum unloaded operational press ure: Unloaded rated tyre pressure (available from the TRA Year Book) divided by the 1.07 factor from CS 25.733(c)(1).

Minimum tyre speed rating: The lowest tyre speed rating certified for the aeroplane in compliance with CS 25.733(a) or (c). The aeroplane manufacturer may decide to certify several tyre speed ratings; in this case, the lowest certified speed rating value should be taken as the ‘minimum tyre speed rating’ used in the models of this AMC.

Total tread area: ∏.D .W G SG Terms used in accordance with the Tire and Rim Association (TRA) Aircraft Year Book : — D = TRA Rim Diameter — D = TRA Grown Tyre Diameter G — W = TRA Maximum Grown Shoulder Width SG The Tire and Rim Association, Inc. (TRA) is the standardizing body for the tire, rim, valve and allied parts industry for the United States.

TRA was founded in 190 3 and its primary purpose is to establish and promulgate interchangeability standards for tires, rims, valves and allied parts. TRA standards are published in the Tire and Rim Year Book, Aircraft Year Book and supplemental publications. Mo re information av ailable at: http://www.us - tra.org/index.html .

Powered by EASA eRules Page 421 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR Tyre speed rating: The maximum ground speed at which the tyre has been tested in accordance with (E)TSO C62e.

4. Threat models Model 1 — Tyre Debris Threat Model Applicability: landing gear extended (1) Threats occurring when the tyre is in contact with the ground release tyre debris.

Two tyre debris sizes are considered.

These debris are assumed to be released from the tread area of the tyre and projected towards the aircraft within the zones of vulnerability identified in Figure 1: (i) a ‘large debris’ with dim ensions WSG × WSG at DG and a thickness of the full tread plus outermost ply (i.e. the reinforcement or protector ply). The angle of vulnerability θ is 15°.

(ii) a ‘small debris’ consisting of 1 per cent of the total tyre mass, with an impact load distrib uted over an area equal to 1.5 per cent of the total tread area. The angle of vulnerability θ is 30°.

The debris have a speed equivalent to the minimum tyre speed rating certified for the aircraft (the additional velocity component due to the release of ca rcass pressure n eed not be taken into account).

Figure 1 – Tyre Debris Threats Powered by EASA eRules Page 422 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (2) Protection of the fuel tank structure and pass - fail criteria on effects of penetration (2.1) The large tyre debris size as defined in (i) above is assumed to penetrate and open the fuel tank or fuel system structure located in the zone of vulnerability defined in (i). It is used to define the opening size of the structural damage. A fuel leakage is assumed to occur whenever either the fuel tank structure or any structur al element of fuel system components is struck by this large debris. It need not be used as a sizing case for structural design.

The fuel leakage should not result in hazardous quantities of fuel entering areas of the aeroplane that could present a hazard such as, but not limited to: 1. an engine air intake, 2. an APU air intake, or 3. a cabin air intake.

All practical measures should be taken to avoid fuel coming into contact with an ignition source (which may also result from the tyre failure event, e.g. electrical wire damage).

This should be shown by test or analysis, or a combination of both, for each engine forward thrust condition and each approved reverse thrust condition.

Alternatively, it is acceptable to demonstrate that the large tyre debris as defined in (i) above will not cause damage sufficient to allow a hazardous fuel leak whenever fuel tank deformation or rupture has been induced (including through propagation of pressure waves or cracking sufficient to allow a hazardous fuel lea k).

(2.2) The small tyre debris as defined in (ii) should not create damage sufficient to allow a hazardous fuel leak in the zone of vulnerability defined in (ii).

(3) Protection of systems and pass - fail criteria The two tyre debris sizes (defined in (i ) and (ii) above) are considered. The sizes of debris are to be considered for the separation of systems.

When shielding is required (to protect a component or system), or when an energy analysis is required (for instance, for the validation of the structu ral parts of systems), the small debris defined in (ii) should be used.

An initial tyre failure can also result in failure of, and debris from, the companion tyre. This can occur even when the tyres have been designed to have double dynamic overload capabi lity.

The analysis for the segregation of systems installation and routing should take this companion tyre failure into account inside the vulnerability zone defined by θ = 15° (either side of the tyre centre line) and only considering both tyres releasing large debris. Inside zones defined by 15° < θ ≤30°, where only the small debris size is applicable, only debris (defined in (ii)) from a single tyre needs to be considered.

A ‘companion’ tyre is a tyre on the same axle.

To demonstrate compliance with the applicable Certification Specifications, the following approach should be used: Powered by EASA eRules Page 423 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (a) Identify all hazards associated with the possible impact areas defined by Figure 1, including simultaneous/cascade failure of companion tyres.

(b) All practicable design precautions should be taken to eliminate all Catastrophic failure situations by means of system separation and/or impact resistant shielding and/or redesign. Impact resistance should be assessed for small debris (type (ii)) impacts only.

Considerati on should also be given to Hazardous failure situations when showing compliance in accordance with CS 25.1309.

(c) Any Catastrophic failure situation that remains after accomplishment of step (b) above will be submitted to the Agency for consideration in accordance with step (d) below.

(d) If the Agency concludes that the applicant has taken all practicable precautions to prevent a Catastrophic failure situation and the probability of the occurrence is consistent with the hazard classification (assuming a probability of companion tyre failure, if applicable, equal to 10 per cent), the design would be considered as compliant with the intent of CS 25.734.

Model 2 — Wheel Flange Debris Threat Model Applicability: gear extended (1) It is considered that a 60° arc segment of the wheel flange can be released laterally, in the zones identified in Figure 2. The speed of release is 100 m/s (328 ft/s).

Where multiple wheels are installed on a landing gear leg, the lateral release of only the flange on the outer whe el halves needs to be considered.

If only a single wheel is installed on a landing gear leg, then the lateral release of either flange shall be considered.

(2) Vertically released debris are covered by Model 1 tyre debris.

(3) The debris should be considered to impact in the most critical condition.

Powered by EASA eRules Page 424 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR Figure 2 – Wheel Flange Release Threat Model 3 — Flailing Tyre Strip Threat Model (1) Model 3E: Landing Gear Extended A flailing tyre strip with a length of 2.5 WSG and a width of WSG/2 will remain attached to the outside diameter of the rotating tyre at take - off speeds.

The thickness (t) of the loose strip of tyre is the full tread plus the carcass of the tyre. If the applicant demonstrates that the carcass will not fail, then the thickness may be reduced to full tread plus outermost ply (i.e. the reinforcement or protector ply).

The strip has a speed equivalent to the minimum tyre speed rating certified for the aircraft. For this threat the zone of vulnerability is 30°, as shown in Figure 3.

(2) M odel 3R: Landing Gear Retracting or Retracted The loose tyre strip and the conditions remain unchanged from that considered for the Gear Extended case. However, due to the wheel spin down after take - off, the rotational speed of the wheel may be lower or ev en zero as it enters the wheel bay.

If the aeroplane is equipped with a system braking the wheel during landing gear retraction (‘retraction brake’), then the applicant may take credit for this system provided: (i) the retraction braking system is reliable and its failure is not latent; (ii) the failure of the retraction brake is independent from a flailing tyre strip event; (iii) the retraction braking stops the rotation of the tyre before the trajectory of the flailing tyre strip can cause a haz ard to the aircraft; and (iv) the effect of a zero velocity retraction with the loose strip of tyre is assessed.

Powered by EASA eRules Page 425 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LA NDING GEAR The strip has an initial speed equivalent to the minimum tyre speed rating certified for the aircraft. Allowance for rotation speed reduction during retraction may be substantiated by the applicant. For this threat the zone of vulnerability is 30°, as shown in Figure 3.

Figure 3 – Flailing Tyre Strip Threat Model 4 — Tyre Burst Pressure Effect Threat Model Applicability: landing gear retracting or landing gear retracted 1) In - flight tyre bursts with the landing gear retracted are considered to result from previous damage to the tyre, which could occur at any point on the exposed surface. A review of the known incidents shows that all case s of retracted tyre burst have occurred to main gear with braked wheels. This hazard is therefore considered to be applicable only to tyres mounted on braked wheels.

2) It is assumed that tyres do not release debris and consequential damage is considered to be caused only from the pressure effects of resulting gas jet (‘blast effect’). The blast effect has been shown to differ between radial and bias tyres.

3) The tyre burst pressure is assumed to be 130 % of the maximum unloaded operational pressure, whi ch is the unloaded tyre rated pressure reduced by a factor of 1.07 (safety factor required by CS 25.733(c)(1)).

Example: For an H44.5 × 16.5 – 21 26PR Tyre — The u nloaded tyre rated pressure is 1 365 kPa (198 psig), so the maximum unloaded operational pres sure is 1 365 / 1.07 = 1 276 kPa (185 psig), i.e. 1 377 kPa absolute pressure (199.7 psia); therefore the tyre burst pressure is 1 377 × 1.3 = 1 790 kPa absolute pressure (259.7 psia).

4) For bias tyres, the burst plume model shown in Figures 4a and 4b sh ould be used, with the blast cone axis rotated over the tread surface of the tyre (± 100° as shown in Figure 4a). The pressure distribution is provided in Figures 4b and 4c.

5) For radial tyres, the burst plume model (‘wedge’ shape) is shown in Figures 4 d and 4e.

The pressure decay formula provided in Figure 4e below should be used. It provides the level of pressure as a function of the distance from the tyre burst surface.

Powered by EASA eRules Page 426 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR 6) The effect of the burst should be evaluated on structure and system items loca ted inside the defined burst plume. In addition, there should be no effect detrimental to continued safe flight and landing due to the increase in pressure of the wheel well as a result of a retracted tyre burst.

Figure 4a – Tyre Burst Pressure Effect – Bi as Tyre Note: ‘Grown dimensions’ should be calculated for bias tyres using TRA formulas.

Figure 4b – Tyre Burst Pressure Effect – Bias Tyre Powered by EASA eRules Page 427 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR Figure 4c – Tyre Burst Pressure Effect – Bias Tyre Air jet pressure distribution Figure 4d – Tyre Burst Pressure Effect – Radial Tyre Powered by EASA eRules Page 428 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR Figure 4e – Tyre Burst Pressure Effect – Radial Tyre Radial Tyre Burst Pressure Decay Formula 𝜓 − ( ) ∙ 𝑥 − 𝜓 ∙ 𝑥 ( ) ( ) 𝑃 𝑥 = 0 . 5283 ∙ 𝑃 − 𝑃 [ 1 . 4 ∙ 𝑒 + 𝑒 ] + 𝑃 𝑡 0 0 Where: 𝐶 𝑥 𝜓 . 𝑥 = ( + 𝐶 ) .

𝐶 𝑖𝑛 .

𝑊 𝐺 ( ) 𝑖𝑛 .

Or: 𝐶 𝑥 𝜓 . 𝑥 = ( + 𝐶 ) .

𝐶 25 . 4 𝑚𝑚 𝑊 𝐺 ( ) 25 . 4 𝑚𝑚 and: C 1 = 12.478, C = 1.222, C = 0.024 W = the Maximum Grown Section Width of the tyre [in or mm] as specified in the Tyre & Rim G Association (TRA) designation for the tyre P = Total or burst pressure [psia or bar] t Powered by EASA eRules Page 429 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR P = Ambient pressure [psia or bar] x = Distance from object to grown tyre surface [in or mm] If P(x) > Pt then P(x) = Pt; otherwise P(x) = P(x).

[Amdt 25/14]

CS 25.735 Brakes and braking systems

ED Decision 20 13 / 033 /R (See AMC 25.735 ) (a) Approval. Each assembly consisting of a wheel(s) and brake(s) must be approved.

(b) Brake system capability. The brake system, associated systems and components must be designed and constructed so that: (1) If any electrical, pne umatic, hydraulic, or mechanical connecting or transmitting element fails, or if any single source of hydraulic or other brake operating energy supply is lost, it is possible to bring the aeroplane to rest with a braked roll stopping distance of not more t han two times that obtained in determining the landing distance as prescribed in CS 25.125 .

(2) Fluid lost from a brake hydraulic system following a failure in, or in the vicinity of, the brakes is insufficient to cause or support a hazardous fire on the ground or in flight.

(c) Brake controls. The brake controls must be designed and constructed so that: (1) Excessive control force is not required for their operation.

(2) If an automatic braking sys tem is installed, means are provided to: (i) Arm and disarm the system, and (ii) Allow the pilot(s) to override the system by use of manual braking.

(d) Parking brake. The aeroplane must have a parking brake control that, when selected on, will, without fu rther attention, prevent the aeroplane from rolling on a dry and level paved runway when the most adverse combination of maximum thrust on one engine and up to maximum ground idle thrust on any, or all, other engine(s) is applied. The control must be suita bly located or be adequately protected to prevent inadvertent operation. There must be indication in the cockpit when the parking brake is not fully released.

(e) Anti - skid system. If an anti - skid system is installed: (1) It must operate satisfactorily o ver the range of expected runway conditions, without external adjustment.

(2) It must, at all times, have priority over the automatic braking system, if installed.

(f) Kinetic energy capacity – (1) Design landing stop. The design - landing stop is an operational landing stop at maximum landing weight. The design landing stop brake kinetic energy absorption requirement of each wheel, brake, and tyre assembly must be determined. It must be substantiated by dynamometer testing that the wheel, brake and tyre assembly is capable of absorbing not less than this level of kinetic energy throughout the defined wear range of the brake.

The energy absorption rate derived from the aeroplane manufacturer’s braking Powered by EASA eRules Page 430 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR requirements must be achieved. Th e mean deceleration must not be less than 3.1 m/s (10 fps ).

(2) Maximum kinetic energy accelerate - stop. The maximum kinetic energy accelerate - stop is a rejected take - off for the most critical combination of aeroplane take - off weight and speed. The accel erate - stop brake kinetic energy absorption requirement of each wheel, brake, and tyre assembly must be determined. It must be substantiated by dynamometer testing that the wheel brake and tyre assembly is capable of absorbing not less than this level of ki netic energy throughout the defined wear range of the brake. The energy absorption rate derived from the aeroplane's braking requirements must be achieved.

2 2 The mean deceleration must not be less than 1.8 m/s (6 fps ).

(3) Most severe landing stop. The mo st severe landing stop is a stop at the most critical combination of aeroplane landing weight and speed. The most severe landing stop brake kinetic energy absorption requirement of each wheel, brake, and tyre assembly must be determined. It must be substan tiated by dynamometer testing that, at the declared fully worn limit(s) of the brake heat sink, the wheel, brake and tyre assembly is capable of absorbing not less than this level of kinetic energy. The most severe landing stop need not be considered for e xtremely improbable failure conditions or if the maximum kinetic energy accelerate - stop energy is more severe.

(g) Brake condition after high kinetic energy dynamometer stop(s). Following the high kinetic energy stop demonstration(s) required by sub - parag raph (f) of this paragraph, with the parking brake promptly and fully applied for at least 3 minutes, it must be demonstrated that for at least 5 minutes from application of the parking brake, no condition occurs (or has occurred during the stop), includin g fire associated with the tyre or wheel and brake assembly, that could prejudice the safe and complete evacuation of the aeroplane.

(h) Stored energy systems. An indication to the flight crew of the usable stored energy must be provided if a stored energ y system is used to show compliance with sub - paragraph (b)(1) of this paragraph. The available stored energy must be sufficient for: (1) At least 6 full applications of the brakes when an anti - skid system is not operating; and (2) Bringing the aeroplane to a complete stop when an anti - skid system is operating, under all runway surface conditions for which the aeroplane is certificated.

(i) Brake wear indicators. Means must be provided for each brake assembly to indicate when the heat sink is wor n to the permissible limit. The means must be reliable and readily visible.

(j) Over - temperature burst prevention. Means must be provided in each braked wheel to prevent a wheel failure, a tyre burst, or both, that may result from elevated brake temperatu res.

Additionally, all wheels must meet the requirements of CS 25.731(d) .

(k) Compatibility . Compatibility of the wheel and brake assemblies with the aeroplane and its systems must be substantiated.

(l) Wheel br ake temperature . Equipment and structure that are essential to the safe operation of the aeroplane and that are located on the landing gear and in wheel wells must be protected from the damaging effects of possible wheel brake temperatures.

[Amdt 25/2] [Am dt 25/14] Powered by EASA eRules Page 431 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR

AMC 25.735 Brakes and Braking Systems Certification Tests and

Analysis

ED Decision 201 6 / 010 /R 1. PURPOSE This AMC (Acceptable Means of Compliance) which is similar to the FAA Advisory Circular AC 25.735 - 1 provides guidance material for use as a n acceptable means, although not the only means, of demonstrating compliance with the requirements of CS 25.731 and CS 25.735 . It also identifies other paragraphs of the EASA Certification Specifications (CS) that contain related requirements and other related and complementary documents.

2. RELATED REGULATORY MATERIAL AND COMPLE MENTARY DOCUMENTS a. Related EASA Certification Specifications PART - 21 and CS - 25 paragraphs (and their associated AMC material where applicable) that prescribe requirements related to the design substantiation and certification of brakes and braking syst ems include: 21 A .303 Compliance with applicable Requirements CS 25.101 General CS 25.109 Accelerate - stop distance CS 25.125 Landing CS 25.301 Loads CS 25.303 Factor of safety CS 25.729 Extending r etracting mechanism s CS 25.733 Tyres CS 25.1301 Function and installation CS 25.1309 Equipment, systems and installations CS 25.1322 Warning, caution and advisory lights CS 25.1501 General: Systems and Equipment Limitations CS 25.1541 Markings and Placards: General CS 25.1591 Supplementary performance information Additional Part - 21 and CS - 25 paragraphs (and their associated AMC material where applicable) that prescribe requirements which can have a significant impact on the overall design and configuration of brakes and braking systems are, but are not limited to: 21 A .101 Design ation of applicable certification specifications and environmental protection requirements CS 25.671 General: Control Systems CS 25.863 Flammable fluid fire protection CS 25.1001 Fuel jettisoning system CS 25.1183 Flammable fluid - carrying components CS 25.1185 Flammable fluids CS 25.1315 Negative acceleration (FAR 25.943) Powered by EASA eRules Page 432 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR b. Complementary Documents Documents that provide appropriate standards for the design substantiation and certification of Brakes and Braking Systems are, but are n ot limited to: (i) European Technical Standard Orders (ETSO) ETSO - C47 Pressure Instruments - Fuel, Oil and Hydraulic ETSO - C26c Aircraft Wheels and Wheel - Brake Assemblies with Addendum I ETSO - 2C75 Hydraulic Hose Assemblies ETSO - C62d Aircraft Tyres ETSO - C135 Transport Aeroplane Wheels and Wheel and Brake Assemblies (ii) Advisory Circulars/Acceptable Means of Compliance AC 25.1309 - 1A System Design and Analysis AC 25 - 7C Flight Test Guide for Certification of Transport Category Airplanes AC 21 - 29A Detecting and Reporting Suspected Unapproved Parts AC 91 - 6A Water, Slush, and Snow on the Runway AMC 25.1591 The derivation and methodology of performance information for u se when taking - off and landing with contaminated runway surface conditions.

AMC 20 - 115 Software Considerations for Airborne Systems and Equipment Certification (iii) Society of Automotive Engineers (SAE) Documents ARP 597C Wheels and Brakes, Supplement ary Criteria for Design Endurance - Civil Transport Aircraft ARP 813A Maintainability Recommendations for Aircraft Wheels and Brakes AIR 1064B Brake Dynamics ARP 1070B Design and Testing of Anti - skid Brake Control Systems for Total Aircraft Compatibility AS 1145A Aircraft Brake Temperature Monitor System (BTMS) ARP 1619 Replacement and Modified Brakes and Wheels AIR 1739 Information on Anti - skid Systems ARP 1907 Automatic Braking Systems Requirements AIR 1934 Use of Carbon Heat Sink Brakes on Aircraft ARP 4102/2 Automatic Braking System (ABS) ARP 4752 Aerospace - Design and Installation of Commercial Transport Aircraft Hydraulic Systems ( No te: This document provides a wide range of Civil, Military and Industry document references and standards which may be appropriate.)

(iv) International Organisatio n for Standardisation (ISO) Documents ISO 7137 Environmental Conditions and Test Procedures for Airborne Equipment.

(v) US Military Documents MIL - STD - 810 Environmental Test Methods and Engineering Guidelines.

Powered by EASA eRules Page 433 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (vi) The European Organisation for Civil Aviation Equipment Documents ED - 14G/RTCA DO - 160G Environmental Conditions and Test Procedures for Airborne Equipment.

AMC 20 - 115 Software Considerations for Airborne Syste ms and Equipment Certificati on.

3. RESERVED 4. DISCUSSION a. Ref. CS 25.735 (a) Approval (1) CS 25.735 (a) states that each assembly consisting of a wheel(s) and brake(s) must be approved. Each wheel and brake assembly fitted with each designated and approved tyre type and size, where appropriate, should be shown to be capable of meeting the minimum standards and capabilities detailed in the applicable European Technical Standard Order (E)TSO, in conjunction with the type certification procedure for the aeroplane, or by any other means approved by the Agency. This applies equally to replacement, modified, and r efurbished wheel and brake assemblies or components, whether the changes are made by the Original Equipment Manufacturer (OEM) or others. Additionally, the components of the wheels, brakes, and braking systems should be designed to: (a) Withstand all press ures and loads, applied separately and in conjunction, to which they may be subjected in all operating conditions for which the aeroplane is certificated.

(b) Withstand simultaneous applications of normal and emergency braking functions, unless adequate de sign measures have been taken to prevent such a contingency.

(c) Meet the energy absorption requirements without auxiliary cooling devices (such as cooling fans).

(d) Not induce unacceptable vibrations at any likely ground speed and condition or any operat ing condition (such as retraction or extension).

(e) Protect against the ingress or effects of foreign bodies or materials (water, mud, oil, and other products) that may adversely affect their satisfactory performance. Following initial aeroplane certifica tion, any additional wheel and brake assemblies should meet the applicable airworthine ss requirements specified in 21 A .101(a) and (b) to eliminate situations that may have adverse consequences on aeroplane braking control and performance. This includes th e possibility of the use of modified brakes either alone (i.e., as a ship set) or alongside the OEM’s brakes and the mixing of separately approved assemblies.

(2) Respecting brake energy qualification limits The ETSO standard for wheels and wheel and bra ke assemblies includes an ‘Accelerate - Stop Test’ and a ‘Most Severe Landing Stop Test’ (if applicable), which establish the kinetic energy (KE) absorption capability of the brake assembly. The ETSO tests demonstrate the KE absorption capability of the brak e with that brake at a predetermined (threshold) start temperature. Both of these tests are required Powered by EASA eRules Page 434 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR to be performed on (new and worn) brakes with threshold temperatures that must ‘as closely as practicable, be representative of a typical in - service condit ion’.

Two methods are permitted and accepted by the Agency to calculate the energy required to bring the heat pack to this representative thermal condition: (a) by a rational analysis; or (b) by the addition of a percentage of the KERT Wheel/Brake Rat ed Accelerate - Stop Energy: 10 % for ‘Accelerate - Stop Test’ or 5 % for ‘Most Severe Landing Stop Test’.

A brake with an initial temperature higher than the threshold temperature has less KE absorption capability than it has at the threshold temperature.

Th is could lead to the brake being unable to generate the required torque to stop the aeroplane in the available distance, or being unable to safely dissipate the additional thermal energy generated during the stop (hence, a risk of fire). Therefore, the app licant should ensure that the demonstrated brake KE absorption capability is not exceeded when the brake is installed on the aeroplane.

It should be demonstrated how the temperature thresholds, determined for the brake qualification testing, will not be e xceeded.

Acceptable methods of demonstrating this include, but are not limited to, the following: (a) use of brake temperature monitoring: by allowing the crew to check the brake temperature prior to a take - off, it can be ensured that that the brake temperature does not exceed thetemperature threshold of the demonstrated brake qualification testing, or (b) use of brake cool - down charts: by establishing the cool - down rate of the brake heat sink, an estimate can be made that relates the energy absorbed by the brake to its temperature and also to the appropriate cool - down time.

Appropriate limitations hav e to be specified in the Aeroplane Flight Manual (AFM) (3 ) Refurbished and Overhauled Equipment. Refurbished and overhauled equipment is equipment overhauled and maintained by the applicable OEM or its designee in accordance with the OEM’s Component Mainte nance Manual (CMM) and associated documents. It is necessary to demonstrate compliance of all refurbished configurations with the applicable (E)TSO and aeroplane manufacturer’s specifications. It is also necessary to verify that performances are compatible for any combination of mixed brake configurations, including refurbished/overhauled and new brakes . It is essential to assure that Aeroplane Flight Manual braking performance and landing gear and aeroplane structural integrity are not adversely altered.

(4 ) Replacement and Modified Equipment. Replacement and modified equipment includes changes to any approved wheel and brake assemblies not addressed under paragraph 4a(2) of this AMC. Consultation with the aeroplane manufacturer on the extent of testing is recommended. Particular attention should be paid to potential differences in the primary brake system parameters (e.g., brake torque, energy capacity, vibration, brake sensitivity, dynamic response, structural strength, and wear state). If comparisons are made to previously approved equipment, the Powered by EASA eRules Page 435 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR test articles (other than the proposed parts to be changed) and conditions should be comparable, as well as the test procedures and equipment on which comparative tests are to be conducted. For wheel and brake as sembly tests, the tyre size, manufacturer, and ply rating used for the test should be the same and the tyre condition should be comparable. For changes of any heat sink component parts, structural parts (including the wheel), and friction elements, it is n ecessary to provide evidence of acceptable performance and compatibility with the aeroplane and its systems.

(a) Minor Changes. Changes to a brake might be considered as a minor change, as long as the changes are not to the friction elements. The proposed change cannot affect the aeroplane stopping performance, brake energy absorption characteristics, and/or continued airworthiness of the aeroplane or wheel and brake assembly (e.g., vibration and/or thermal control, and brake retraction integrity). Technica l evidence justifying a minor change should be provided.

(b) Major Changes. Changes to a wheel assembly outside the limits allowed by the OEM’s CMM should be considered a major change due to potential airworthiness issues.

(c) Past history with friction el ements has indicated the necessity of ongoing monitoring (by dynamometer test) of frictional and energy absorption capabilities to assure that they are maintained over the life of the aeroplane program. These monitoring plans have complemented the detectio n and correction of unacceptable deviations. A monitoring plan should be submitted to the cognisant Certification Office to ensure continued airworthiness of the product.

(d) Intermixing of wheel and brake assemblies from different suppliers is generally n ot acceptable due to complexities experienced with different friction elements, specific brake control tuning, and other factors.

b. Ref. CS 25.735 (b) Brake System Capability (1) The system should be designed so t hat no single failure of the system degrades the aeroplane stopping performance beyond doubling the braked roll stopping distance (refer to CS 25.735 (b)(1) ). Failures are considered to be fracture, leakage, or jamming of a component in the system, or loss of an energy source. Components of the system include all parts that contribute to transmitting the pilot's braking command to the actual generation of braking force. Multiple failures resulting from a single cause should be considered a single failure (e. g., fracture of two or more hydraulic lines as a result of a single tyre failure). Sub - components within the brake assembly, such as brake discs and actuators (or their equivalents), should be considered as connecting or transmitting elements, unless it is shown that leakage of hydraulic fluid resulting from failure of the sealing elements in these sub - components within the brake assembly would not reduce the braking effectiveness below that specified in CS 25.735 (b)(1) .

(a) In order to meet the stopping di stance requirements of CS 25.735 (b)(1) in the event of failure of the normal brake system, it is common practice to provide an alternate brake system. The normal and alternate braking systems should be independent, being supplied by separate power sources.

Following a failure of the normal sys tem, the changeover to a second system Powered by EASA eRules Page 436 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONS TRUCTION LANDING GEAR (whether manually or by automatic means) and the functioning of a secondary power source should be effected rapidly and safely. The changeover should not involve risk of wheel locking, whether the brakes are applied o r not at the time of changeover.

(b) The brake systems and components should be separated or appropriately shielded so that complete failure of the braking system(s) as a result of a single cause is minimised.

(2) Compliance with CS 25.735 (b)(2) may be ach ieved by: (a) Showing that fluid released would not impinge on the brake, or any part of the assembly that might cause the fluid to ignite; (b) Showing that the fluid will not ignite; or (c) Showing that the maximum amount of fluid released is not sufficie nt to sustain a fire.

(3) Additionally, in the case of a fire, it may be shown that the fire is not hazardous, taking into consideration such factors as landing gear geometry, location of fire sensitive (susceptibility) equipment and installations, system status, flight mode, etc.

If more than one fluid is allowed for the hydraulic system, compliance should be addressed for all fluids.

c. Ref. CS 25.735 (c) Brake Controls (1) The braking force should increase or de crease progressively as the force or movement applied to the brake control is increased or decreased (refer to CS 25.735 (c)(1) ). The braking force should respond to the control as quickly as is necessary for safe and satisfactory operation. A brake control intended only for parking need not operate progressively. There should be no requirement to select the parking brake “off” in order to achieve a higher braking force with manual braking.

(2) When an automatic braking system is installed (refer to CS 25.73 5 (c)(2) ) such that various levels of braking (e.g., low, medium, high) may be preselected to occur automatically following a touchdown, the pilot(s) should be provided with a means that is separate from other brake controls to arm and/or disarm the system prior to the touchdown.

(3) The automatic braking system design should be evaluated for integrity and non - hazard, including the probability and consequence of insidious failure of critical components, and non interference with the non - automatic braking sys tem. Single failures in the automatic braking system should not compromise non - automatic braking of the aeroplane. Automatic braking systems that are to be approved for use in the event of a rejected take - off should have a single selector position, set pri or to take - off, enabling this operating mode.

d. Ref. CS 25.735 (d) Parking Brake It should be demonstrated that the parking brake has sufficient capability in all allowable operating conditions (Master Minimum Equipment List (MMEL) to be able to prevent the rotation of braked wheels. This demonstration is to be accomplished with the st ated engine power settings, and with the aeroplane configuration (i.e., ground weight, c.g., Powered by EASA eRules Page 437 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR position and nose - wheel (or tail - wheel) angle) least likely to result in skidding on a dry, level runway surface (refer to CS 25.735 (d) ). Use of ground idle thrust on the “other” engine is not mandatory, higher thrust levels may be used to prevent aeroplane motion due to the asymmetric engine thrust. Where reliable test data are available, substantiation by means other than aeroplane testing may be acceptable.

(1) For compliance with the requirement for indication that the parking brake is not fully released, the indication means should be associated, as closely as is practical, with actual application of the brake rather than the selector (control). The intent is t o minimise the possibility of false indication due to failures between the brake and the point at which the parking brake state is sensed. This requirement is separate from, and in addition, to the parking brake requirements associated with CS 25.703(a)(3) , Take - off warning systems.

(2) The parking brake control, whether or not it is independent of the emergency brake control, should be marked with the words "Parking Brake" and should be constructed in such a way that, once operated, it can remain in the selected position without further flight crew attention. It should be located where inadvertent operation is unlikely, or be protected by suitable means against inadvertent operation.

e. Ref. CS 25.735 (e) Anti - skid System (1) If an anti - skid system is installed (refer to CS 25.735 (e) ), then no single failure in the antiskid system should result in the brakes being applied, unless braking is being commanded by the pilot. In the event of an anti - skid system failure, means should be available to allow continued braking without anti - skid. These means may be automatic, pilot controlled, or both.

(2) Compliance with CS 25.735 (e)(1) and (e)(2) may be achieved by: (a) Failures that render the system ineffective should not prevent manual braking control by the pilot(s) and should normally be indicated. Failure of wheels, brakes, or tyres should not inhibit the function of the anti - skid system for unaffected wheel, brake, and tyre asse mblies.

(b) The anti - skid system should be capable of giving a satisfactory braking performance over the full range of tyre to runway friction coefficients and surface conditions, without the need for preflight or pre - landing adjustments or selections. The range of friction coefficients should encompass those appropriate to dry, wet, and contaminated surfaces and for both grooved and ungrooved runways.

(c) The use of the phrase “without external adjustment” is intended to imply that once the antiskid syste m has been optimised for operation over the full range of expected conditions for which the aeroplane is to be type certificated, pre - flight or pre - landing adjustments made to the equipment to enable the expected capabilities to be achieved are not accepta ble. For example, a specific prelanding selection for a landing on a contaminated low μ (friction level) runway, following a take - off from a dry high μ runway, should not be necessary for satisfactory braking performance to be achieved.

Powered by EASA eRules Page 438 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (d) It should be shown that the brake cycling frequency imposed by the anti - skid installation will not result in excessive loads on the landing gear. Anti - skid installations should not cause surge pressures in the brake hydraulic system that would be detrimental to either the normal or emergency brake system and components.

(e) The system should be compatible with all tyre sizes and type combinations permitted and for all allowable wear states of the brakes and tyres. Where brakes of different types or manufacture are permi tted, compatibility should be demonstrated or appropriate means should be employed to ensure that undesirable combinations are precluded.

(f) The anti - skid function must be able to reduce braking for a wheel/tyre that is going into a skid, whether the brak ing level is commanded by the pilot or an auto - brake system if installed.

f. Ref. CS 25.735 (f) Kinetic Energy Capacity The kinetic energy capacity of each tyre, wheel, and brake assembly should be at least equal to that part of the total aeroplane energy that the assembly will absorb during a stop, with the heat sink at a defined condition at the commencement of the stop ( Refer to CS 25.735 (f) ).

(1) Calculation of Stop Kinetic Energy.

(a) The design landing stop, the maximum kinetic energy accelerate - stop, and the most severe landing stop brake kinetic energy absorption requirements of each wheel and brake assembly should be determined using either of the following methods: (i) A conservative rational analysis of the sequence of events expected during the braking manoeuvre; or (ii) A direct calculation based on the aeroplane kinetic energy at the commencement of the brakin g manoeuvre.

(b) When determining the tyre, wheel, and brake assembly kinetic energy absorption requirement using the rational analysis method, the analysis should use conservative values of the aeroplane speed at which the brakes are first applied, the ra nge of the expected coefficient of friction between the tyres and runway, aerodynamic and propeller drag, powerplant forward thrust, and, if more critical, the most adverse single engine or propeller malfunction.

(c) When determining the tyre, wheel, and b rake assembly energy absorption requirement using the direct calculation method, the following formula, which needs to be modified in cases of designed unequal braking distribution, should be used: KE = 0.0443 WV /N (ft - lb.)

where KE = Kinetic Energy per wheel (ft - lb.)

N = Number of main wheels with brakes W = Aeroplane Weight (lb.)

V = Aeroplane Speed (knots) Powered by EASA eRules Page 439 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes S UBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR or if SI (Metric) units are used: KE = 1/2 mV /N (Joule) where KE = Kinetic Energy per wheel (J) N = Number of main wheels with brakes m = Aeroplane Mass (kg.)

V = Aeroplane Speed (m/s) (d) For all cases, V is the ground speed and takes into account the prevailing operational conditions. All approved landing flap conditions should be considered when determining the design landing stop energy.

(e) These calculations should account for cases of designed unequal braking distributions. “Designed unequal braking distribution” refers to unequal brak ing loads between wheels that result directly from the design of the aeroplane. An example would be the use of both main - wheel and nosewheel brakes, or the use of brakes on a centreline landing gear supporting lower vertical loads per braked wheel than the main landing gear braked wheels.

It is intended that this term should account for effects such as runway crown.

Crosswind effects need not be considered.

(f) For the design landing case, the aeroplane speed should not be less than V /1.3, where V is the aeroplane steady landing approach speed at the REF REF maximum design landing weight and in the landing configuration at sea level. Alternatively, the aeroplane speed should not be less than V , the SO power - off stall speed of the aeroplane at sea level, at the design landing weight, and in the landing configuration.

(g) For the most severe landing case, the effects and consequences of typical single and multiple failure conditions that are foreseeable events and can necessitate landings at abnormal speeds and we ights should be addressed.

The critical landing weight for this condition is the maximum take - off weight, less fuel burned and jettisoned during a return to the departure airfield. A 30 - minute flight should be assumed, with 15 minutes of active fuel jettis oning if equipped with a fuel jettisoning system.

(2) Heat Sink Condition at Commencement of the Stop .

(a) For the maximum kinetic energy accelerate - stop case, the calculation should account for: (i) The brake temperature following a previous typical landi ng, (ii) The effects of braking during taxi - in, the temperature change while parked, (iii) The effects of braking during taxi - out, and (iv) The additional temperature change during the take - off acceleration phase, up to the time of brake application.

(b) T he analysis may not take account of auxiliary cooling devices. Assessment of ambient conditions within the operational limits established by the applicant and the typical time the aeroplane will be on the ground should be used.

Powered by EASA eRules Page 440 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (c) For the most severe land ing stop case, the same temperature conditions and changes used for the maximum kinetic energy accelerate - stop case should be assumed, except that further temperature change during the additional flight phase may be considered.

(d) The brake temperature at the commencement of the braking manoeuvre should be determined using the rational analysis method. However, in the absence of such analysis, an arbitrary heat sink temperature should be used equal to the normal ambient temperature, increased by the amount that would result from a 10 percent maximum kinetic energy accelerate - stop for the acceleratestop case and from a 5 percent maximum kinetic energy accelerate - stop for landing cases. The temperature determined for the beginning of the test becomes the high est allowable temperature at commencement of the take - off run unless another test is performed at a higher temperature.

(3) Substantiation .

(a) Substantiation is required to show that the wheel and brake assembly is capable of absorbing the determined lev els of kinetic energy at all permitted wear states up to and including the declared fully worn limits. The term “wear state" is used to clarify that consideration should be given to possible inconsistencies or irregularities in brake wear in some circumsta nces, such as greater wear at one end of the heat sink than the other end. Qualification related to equally distributed heat sink wear may not be considered adequate. If in - service wear distribution is significantly different from wear distribution used du ring qualification testing, additional substantiation and/or corrective action may be necessary.

(b) The minimum initial brakes - on speed used in the dynamometer tests should not be more than the velocity (V) used in the determination of the kinetic energy requirements of CS 25.735 (f) . This assumes that the test procedure involved a specific rate of decele ration and, therefore, for the same amount of kinetic energy, a higher initial brakes - on speed would result in a lower rate of energy absorption. Such a situation is recognised and is similarly stated in (E)TSO - C135, which provides an acceptable means for brake approval under CS 25.735 (a) .

(c) For certification purposes, a brake having a higher initial brakes - on speed is acceptable if the dynamometer test showed that both the energy absorbed and the energy absorption rates required by CS 25.735 (f) had been achieved.

(d) Brake qualification tests are not intended as a means of determining expected aeroplane stopping performance, but may be used as an indicator for the most critical brake wear state for aeroplane braking performance measurements.

g. Ref. CS 25.735 (g) Brake Condition after High Kinetic Energy Dynamometer Stop(s) (1) Following the high kinetic energy stop(s), the parking brake should be capable of restraining further movement of the aeroplane and shou ld maintain this capability for the period during which the need for an evacuation of the aeroplane can be determined and then fully accomplished. It should be demonstrated that, with a parking brake application within a period not exceeding 20 seconds of achieving a Powered by EASA eRules Page 441 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR full stop, or within 20 seconds from the time that the speed is retarded to 37 km/h (20 knots) (or lower), in the event that the brakes are released prior to achieving a full stop (as permitted by (E)TSO - C135), the parking brake can be applied normally and that it remains functional for at least 3 minutes.

(2) Practical difficulties associated with dynamometer design may preclude directly demonstrating the effectiveness of the parking brake in the period immediately following the high energy dyn amometer stop(s). Where such difficulties prevail, it should be shown that, for the 3 - minute period, no structural failure or other condition of the brake components occurs that would significantly impair the parking brake function.

(3) Regarding the initi ation of a fire, it should be demonstrated that no continuous or sustained fire, extending above the level of the highest point of the tyre, occurs before the 5 - minute period has elapsed. Neither should any other condition arise during this same period or during the stop, either separately or in conjunction with a fire, that could be reasonably judged to prejudice the safe and complete aeroplane evacuation. Fire of a limited extent and of a temporary nature (e.g., those involving wheel bearing lubricant or minor oil spillage) is acceptable. For this demonstration, neither fire - fighting means nor coolants may be applied.

h. Ref. CS 25.735 (h) Stored energy systems (1) Stored energy systems use a self - contained source of power, such as a pressurised hydraulic accumulator or a charged battery (refer to CS 25.735 (h) ). This requirement is not applicable for those aeroplanes that provide a number of independent braking systems, including a stored energy system, but are not "reliant" on the stored energy system for the demonstration of compliance with CS 25.735 (b) .

(2) The indication of usable stored energy should show: (a) The minimum energy level necessary to meet the requirements of CS 25.735 (b)(1) and (h) (i.e., the accep table level for dispatch of the aeroplane); (b) The remaining energy level; and (c) The energy level below which further brake application may not be possible.

(3) If a gas pressurised hydraulic accumulator is to be used as the energy storage means, indica tion of accumulator pressure alone is not considered adequate means to indicate available stored energy, unless verification can be made of the correct pre - charge pressure with the hydraulic system pressure off and the correct fluid volume with the hydraul ic system pressure on. Furthermore, additional safeguards may be necessary to ensure that sufficient energy will be available at the end of the flight. Similar considerations should be made if other stored energy systems are used.

(4) A full brake applicat ion cycle is defined as an application from brakes fully released to brakes fully applied, and back to fully released.

i. Ref. CS 25.735 (i) Brake wear indicators The indication means should be located such that no special tool or illumination (except in darkness) is required. Expert interpretation of the indication should not be necessary (refer to CS 25.735 (i) ).

Powered by EASA eRules Page 442 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR j. Ref. C S 25.731(d) and CS 25.735 (j) Over - temperature and Over - pressure Burst Prevention Over - temperature and over - pressure burst prevention. Generally, two separate types of protection should be provided: one specificall y to release the tyre pressure should the wheel temperature increase to an unacceptable level, and the other to release the tyre pressure should the pressure become unacceptably high, particularly during the inflation process. The temperature sensitive dev ices are required in braked wheels only, but the pressure sensitive devices are required in all wheels (refer to CS 25.735 (j) and 25.731(d) ).

(1) The temperature sensitive devices (e.g., fuse or fusible plugs) sho uld be sufficient in number and appropriately located to reduce the tyre pressure to a safe level before any part of the wheel becomes unacceptably hot, irrespective of the wheel orientation. The devices should be designed and installed so that once operat ed (or triggered) their continued operation is not impaired by the releasing gas. The effectiveness of these devices in preventing hazardous tyre blow - out or wheel failure should be demonstrated. It should also be demonstrated that the devices will not rel ease the tyre pressure prematurely during take - off and landing, including during “quick turnaround” types of operation.

(2) It should be shown that the over - pressurisation devices, or the devices in conjunction with the tyre inflation means permanently ins talled in the wheel, would not permit the tyre pressure to reach an unsafe level regardless of the capacity of the inflation source.

(3) Both types of devices should normally be located within the structure of the wheel in positions that minimise the risk of damage or tampering during normal maintenance.

k. Ref. CS 25.735 (k) Compatibility Compliance with CS 25.735 (k) may be achieved by the following: (1) As part of the overall substantiation of safe and anomaly free operation, it is necessary to show that no unsafe conditions arise from incompatibilities between the brakes and brake system with other aeroplane systems and structures. Areas that should be explored include anti - skid tuning, landing gear dyn amics, tyre type and size, brake combinations, brake characteristics, brake and landing gear vibrations, etc. Similarly, wheel and tyre compatibility should be addressed. These issues should be readdressed when the equipment is modified.

(2) During brake qualification testing, sufficient dynamometer testing over the ranges of permissible brake wear states, energy levels, brake pressures, brake temperatures, and speeds should be undertaken to provide information necessary for systems integration.

Powered by EASA eRules Page 443 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR l. Ref. CS 25.735 (l) Wheel brake temperature.

The use of fusible plugs in the wheels is not a complete safeguard against damage due to tyre burst. Where brake overheating could be damaging to the structure of, or equipment in, the wheel wells, an indication of brake temperature should be provided to warn the pilot.

[Amdt No: 25/2] [Amdt No: 25/8] [Amdt No: 25/12] [Amdt No: 25/14] [Amdt No: 25/18]

AMC 25.735(f) Brakes

ED Decision 2003/2/RM For determination of the design landing brake kinetic energy capacity rating, the initial condition of the brakes may be selected and can be any condition representative of service use, including new, and which satisfies the applicable ETSO or other acceptable brake qualification test standard.

CS 25.745 Nose - wheel steering

ED Decision 2016 / 010 /R (See AMC 25.745) (a) The nose - wheel steering system, unless it is restricted in use to low - speed manoeuvring, must be so designed that exceptional skill is not require d for its use during take - off and landing, including the case of cross - wind, and in the event of sudden power - unit failure at any stage during the take - off run. This must be shown by tests. (See AMC 25.745(a) .)

(b ) It must be shown that, in any practical circumstances, movement of the pilot’s steering control (including movement during retraction or extension or after retraction of the landing gear) cannot interfere with the correct retraction or extension of the l anding gear.

(c) Under failure conditions the system must comply with CS 25.1309(b) and (c) . The arrangement of the system must be such that no single failure will result in a nose - wheel position, which will lead to a Hazardous Effect. Where reliance is pl aced on nose - wheel steering in showing compliance with CS 25.233 , the nose - wheel steering system must be shown to comply with CS 25.1309 . (See AMC 25.745(c) .)

(d) The nose - wheel steering system, towing attachment(s), and associated elements must be designed or protected by appropriate means such that during ground manoeuvring operations effected by means independent of the aeroplane: (1) Damage affecting the safe operation of the nose - wheel steering system is precluded, or (2) A flight crew alert is provided, before the start of taxiing, if damage may have occurred (see AMC 25.1322 ).

(See AMC 25.745(d)) (e) Unless the nose - wheel, when lowered, is automatically in the fore - and - aft attitude successful landings must be demonstrated with the nose - wheel initially in all possible off - centre positions.

[Amdt 25/2] [Amdt 25/13] [Amdt 25/18] Powered by EASA eRules Page 444 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR

AMC 25.745(a) Nose - wheel s teering

ED Decision 2003/ 2/RM In a powered nose - wheel steering system the normal supply for steering should continue without interruption in the event of failure of any one power - unit. With the remaining power - units operating at ground idling condition, the power supply should be adequ ate – a. To complete an accelerate - stop manoeuvre following a power - unit failure which occurs during take - off, and b. To complete a landing manoeuvre following a power - unit failure which occurs during take - off or at any later stage of flight.

AMC 25.745 (c) Nose - wheel s teering

ED Decision 2003/ 2/RM 1 No failure or disconnection need be assumed in respect of parts of proven integrity e.g. a simple jack or manual selector valve, but slow leakage from pipe joints and fracture of pipes should be considered a s probable failures.

2 In assessing where the inadvertent application of steering torque as a result of a single failure would lead to danger, allowance may be made for the pilot’s instinctive reaction to the effects of the fault. However, dependent on th e urgency and rapidity of warning of the failure given to the pilot, allowance should be made for a reaction time before it is assumed that the pilot takes any corrective action.

AMC 25.745(d) Nose - wheel steering

ED Decision 2013/010/R CS 25.745(d) provides for the two following options: 1. A ‘no damage’ situation exists, because damage is precluded.

2. Damage can occur, but indication to the flight crew is provided.

(a) General consideration to CS 25.745(d)(1) and (2) Some damage may occur during ground manoeuvring activities that can be considered acceptable and judged to be normal wear and tear. It is not intended that such damage needs necessarily to be precluded or that it should initiate a flight crew alert.

(b) To comply with CS 25.745(d)(1) the following applies: The aeroplane may be designed in such a way that under all ground manoeuvring op erations by any towing means, no damage affecting the steering system can occur.

Examples are: — The steering system is designed sufficiently strong to resist any applied towing input.

— The steering system is designed to allow 360 degrees rotation.

— The st eering system is disconnected either automatically or by operational procedure.

— The steering system is protected by shear sections installed on the nose landing gear.

Powered by EASA eRules Page 445 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (c) To comply with CS 25.745(d)(2), the following applies: When protection is afforded by the flight crew alerting system, the damage detection means should be independent of the availability of aeroplane power supplies and should be active during ground manoeuvring operations effected by means independent of the aeroplane. If damage may have occurred, a latched signal should be provided to the flight crew alerting system.

(d) Alternative Acceptable Means of Compliance to CS 25.745(d)(1) and (2): In the case where the aeroplane design does not comply with CS 25. 745(d)(1) and (d)(2), the following apply: (1) The Aeroplane Flight Manual, in the Section Limitations, should include a statement that ‘Towbarless towing is prohibited’, or (2) The Aeroplane Flight Manual, in the Section Limitations, should include a statement that: ‘Towbarless towing is prohibited unless the towbarless towing operations are performed in compliance with the appropriate operational regulation using towbarless towing vehicles that are designed and operated to preclude damage to the aero plane nose wheel steering system, or which provide a reliable and unmistakable warning when damage to the steering system has occurred.

Towbarless towing vehicles that are specifically accepted for this type of aeroplane are listed in the [appropriate mai ntenance documentation] provided by the aeroplane manufacturer.’ ‘Appropriate maintenance documentation’ means Instructions for Continued Airworthiness as described in Appendix H, paragraph H25.3(a)(4) of CS - 25.

( 3) The acceptance by the aeroplane manufacturer of the applicable towbarless towing vehicles and its reliability of the oversteer protection and/or indication system as referred to in subparagraph ((d)(2)) above should be based on the following: (i) The aeroplane Nose Wheel Steering Failure Analysis should include the effects of possible damage caused by towbarless towing operations.

(ii) If the Nose Wheel Steering Failure Analysis shows that damage to the steering system by the use of towbarless towing may result in a Failure Condition that can be classified as Hazardo us or Catastrophic (refer to CS 25.1309), the acceptance of a towing vehicle oversteer protection and/or indication system should be based on an aeroplane safety analysis, encompassing the reliability of that vehicle system in order to meet the aeroplane safety objectives.

Powered by EASA eRules Page 446 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION LANDING GEAR (iii) If the Nose Wheel Steering Failure Analysis shows that damage to the steering system by the use of towbarless towing may result in a Failure Con dition that can be classified as Major or less severe, the aeroplane manufacturer can accept the design of the towing vehicle oversteer indication and/or protection system based on a ‘Declaration of Compliance’, issued by the towbarless towing vehicle manu facturer. This declaration will state that the vehicle design complies with the applicable standards (SAE ARPs, Aeroplane Towing Assessment Criteria Document) and that it is designed and built under ISO 9001 quality standards or equivalent.

Such a declara tion must be made regarding all Towbarless Towing Vehicles to be used for ground manoeuvring of CS - 25 certificated aeroplanes.

[Amdt 25/13] Powered by EASA eRules Page 447 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

PERSONNEL AND CARGO ACCOMMODATIONS

CS 25.771 Pilot compartment

ED Decision 2003/2/RM (a) Each pilot co mpartment and its equipment must allow the minimum flight crew (established under CS 25.1523 ) to perform their duties without unreasonable concentration or fatigue.

(b) The primary controls listed in CS 25.779(a) , excluding cables and control rods, must be located with respect to the propellers so that no member of the minimum flight crew (established under CS 25.1523 ), or part of the controls, lies in the region between th e plane of rotation of any inboard propeller and the surface generated by a line passing through the centre of the pro peller hub making an angle of 5 ° forward or aft of the plane of rotation of the propeller.

(c) If provision is made for a second pilot, t he aeroplane must be controllable with equal safety from either pilot seat.

(d) The pilot compartment must be constructed so that, when flying in rain or snow, it will not leak in a manner that will distract the crew or harm the structure.

(e) Vibration an d noise characteristics of cockpit equipment may not interfere with safe operation of the aeroplane.

CS 25.772 Pilot compartment doors

ED Decision 2003/2/RM For an aeroplane that has a lockable door installed between the pilot compartment a nd the passenger compartment: - (a) For aeroplanes with passenger seating configuration of 20 seats or more, the emergency exit configuration must be designed so that neither crewmembers nor passengers require use of the flight deck door in order to reach the eme rgency exits provided for them; and (b) Means must be provided to enable flight - crew members to directly enter the passenger compartment from the pilot compartment if the cockpit door becomes jammed.

(c) There must be an emergency means to enable a crewmem ber to enter the pilot compartment in the event that the flight crew becomes incapacitated.

CS 25.773 Pilot compartment view

ED Decision 2016 / 010 /R (See AMC 25.773 ) (a) Non - precipitation conditions. For non - preci pitation conditions, the following apply: (1) Each pilot compartment must be arranged to give the pilots a sufficiently extensive, clear, and undistorted view, to enable them to safely perform any manoeuvres within the operating limitations of the aeropla ne, including taxiing, take - off, approach and landing.

(2) Each pilot compartment must be free of glare and reflection that could interfere with the normal duties of the minimum flight crew (established under CS 25 .1523 ). This must be shown in day and night flight tests under non - precipitation conditions.

Powered by EASA eRules Page 448 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (b) Precipitation conditions . For precipitation conditions, the following apply: (1) The aeroplane must have a means to maintain a clear portion of the windshield during precipitation conditions, sufficient for both pilots to have a sufficiently extensive view along the flight path in normal flight attitudes of the aeroplane. This means must be designed to function, without continuous attention on the par t of the crew, in – (i) Heavy rain at speeds up to 1·5 V SR1 , with lift and drag devices retracted; and (ii) The icing conditions specified in Appendix C and the following icing conditions specified in Appendix O , if certification for flight in icing conditions is sought (See AMC 25.773(b)(1)(ii)) : (A) For aeroplanes certificated in accordance with CS 25.1420(a)(1) , the icing condit ions that the aeroplane is certified to safely exit following detection.

(B) For aeroplanes certificated in accordance with CS 25.1420(a)(2) , the icing conditions that the aeroplane is certified to safely operate in and the icing conditions that the aerop lane is certified to safely exit following detection.

(C) For aeroplanes certificated in accordance with CS 25.1420(a)(3) , all icing conditions.

(2) No single failure of the systems used to provide the view required by sub - paragraph (b)(1) of this paragrap h must cause the loss of that view by both pilots in the specified precipitation conditions.

(3) The first pilot must have a window that: (i) is openable under the conditions prescribed in sub - paragraph (b)(1) of this paragraph wh en the cabin is not pressurised; (ii) provides the view specified in (b)(1); and (ii) gives sufficient protection from the elements against impairment of the pilot’s vision (4) The openable window specified in sub - paragraph (b)(3) of this paragraph need not be provided if it is shown that an area of the transparent surface will remain clear sufficient for at least one pilot to land the aeroplane safely in the event of - (i) Any system failure or combination of failures, which is not, Extremely Improbable in acco rdance with CS 25.1309 , under the precipitation conditions specified in sub - paragraph (b)(1) of this paragraph.

(ii) An encounter with severe hail, birds, or insects. (See AMC 25.773(b)(4) ) (c) Internal windshield and window fogging . The aeroplane must have a means to prevent fogging to the internal portions of the windshield and window panels over an area which would provide the visibility specified in sub - paragraph (a) of this paragraph under all internal and external ambient conditions, including precipitation conditions, in which the aeroplane is intended to be operated. (See AMC 25.773(c) ) Powered by EASA eRules Page 449 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (d) Fixed markers or other guides must be installed at each pilot station to enable the pilots to position themselves in their seats for an optimum combination of outside visibility and instrument scan. If lighted markers or guides are used they must comply wi th the requirements specified in CS 25.1381 .

[Amdt No: 25/3] [Amdt No: 25/4] [Amdt No: 25/16] [Amdt No: 25/18]

AMC 25.773 Pilot compartment view

ED Decision 2015/008 /R The FAA Advisory Circular AC 25.7731: Pilot Co mpartment View Design Considerations (January 8, 1993), may be used to support the demonstration of compliance with CS 25.773 .

[Amdt 25/4] [Amdt 25/16]

AMC 25.773(b)(1)(ii) Pilot compartment view in icing conditions

ED Decision 2016/010 /R CS 25.773(b)(1)(ii) requires that the aeroplane have a means of maintaining a clear portion of windshield in the icing conditions defined in Appendix C and in certain Appendix O icing conditions (corresponding to the CS 25.1420 certification option selected).

The effectiveness of all cockpit windows and wind shield ice and precipitation protective systems should be established within relevant icing environment. Sufficient tests, including flight test in natural or simulated Appendix C icing conditions, should be performed to validate the performance prediction done by analysis.

When thermal ice protection systems are used (e.g. electrical heating system), a thermal analysis should be conducted to substantiate the selected nominal heated capacity. Past certification experience has shown that a nominal heating ca pacity of 70 W/dm provide adequate protection in icing conditions; such value, if selected, should anyway be substantiated by the thermal analysis. The applicant should conduct dry air flight tests to verify the thermal analysis. Measurements of both the inner and outer surface temperature of the protected windshield area may be needed to verify the thermal analysis. The thermal analysis should show that the windshield surface temperature is sufficient to maintain anti - icing capability without causing stru ctural damage to the windshield.

When anti - icing fluid systems are used, tests shall be performed to demonstrate that the fluid does not become opaque at low temperatures. The AFM should include information advising the flight crew how long it will take t o deplete the amount of fluid remaining in the reservoir.

An evaluation of visibility, including distortion effects through the protected area, should be made for both day and night operations. In addition, the size and location of the protected area should be reviewed to confirm that it provides adequate visibility for the flight crew, especially during the approach and landing phases of flight.

For showing compliance with the CS - 25 certification specifications relative to SLD icing conditions represe nted by Appendix O, the applicant may use a comparative analysis. AMC 25.1420(f) provides guidance for comparative analysis.

[Amdt 25/16] [Amdt 25/18] Powered by EASA eRules Page 450 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

AMC 25.773(b)(4) Pilot compartment non openable windows

ED Decision 2016/010 /R Total loss of external visibility is considered catastrophic. A sufficient field of view must exist to allow the pilot to safely operate the aeroplane during all operations, including taxi.

This field of view must remain clear in all operating conditions. Precipitation conditions such as outside ice, heavy rain, severe hail, as well as encounter with birds and insects must be considered.

This AMC material applies to conventional, multiple pane window systems, i.e. those which are composed of a main windsh ield and separate side panels assembled with structural posts. In the event a one piece ‘uni - body wraparound’ windshield is proposed, the applicant must meet the intent of the applicable rules, even though there are no separate side windows.

1. Ice and hea vy rain — Unless system failures leading to loss of a sufficient field of view for safe operation are shown to be extremely improbable, the following provides acceptable means to show compliance with CS 25.773(b)(4) : — Each main windshield should be equipped with an independent protection system. The systems should be designed so that no malfunction or failure of one system will adversely affect the other.

— For each forward side window it should be shown that any ice acc umulations ( Appendix C icing conditions and any applicable Appendix O icing conditions) will not degrade visibility, or the applicant should provide individual window ice p rotection system capability.

— The icing accretion limits should be determined by analysis and verified by test. The extent of icing of side windows should be verified during natural or simulated icing flight tests with window ice protection systems unpowered. A limited number of test p oints, sufficient to validate the analysis, are required within Appendix C or Appendix O .

— For the demonstration of compliance under Appendix O icing conditions, the applica nt may use a comparative analysis. AMC 25.1420(f) provides guidance for comparative analysis.

2. Hail, birds and insects It should be shown by flight tests that exceptional pilot skill is not required to land the aeroplane using the normal aeroplane instr uments and the view provided through the main or side windows having the degree of impairment to vision resulting from the encounter of severe hail, birds or insects. Appropriate test data should substantiate the estimated damage or contamination to the ma in or forward side windows during such an encounter.

It is unlikely that hail damage can be avoided. Rather than avoidance, the approach to ensure vision assuming hail strike has been to use damage assessment criteria contained in the ASTM International "S tandard Test Method for Hail Impact Resistance of Aerospace Transparent Enclosures," ANSI/ASTM F 320 - 10 or equivalent. For the test set up to determine hail damage or windshield resistance to hail, reference can be made to ANSI/ASTM F 320 - 10, and "Global C limatic Data f or Developing Military Products " MIL HDBK 310 (dated 23 June 1997).

For each impacted window, ANSI/ASTM 320 - 10 is used to characterize a damage pattern on a limited area of the window. For test purpose, the simulated damage patterns should b e applied Powered by EASA eRules Page 451 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS to the full impacted window surfaces in order to simulate in a conservative manner the visibility degradation through the windows.

The applicant should propose and substantiate the aircraft conditions when hail strike occurs.

In the absence of su ch substantiation, the conservative assumptions will be to consider the maximum aircraft nominal speed combined with the hailstone falling speed.

When the damages are such that there is no remaining visibility through the windshield after hail encounter, or when the ice protection system is no longer operating after the hail encounter, a typical test configuration would be to block visibility out of the forward main windows for the pilot flying, and use simulated damage (if any) and ice accretions (if appl icable) on the side window(s).

When conducting flight tests, adequate forward vision should be maintained for a safety pilot while providing appropriate forward view degradation for the test pilot.

Means of compliance to address birds and insects should b e proposed by the applicant. The Agency is not aware of any in - service occurrence involving a total loss of visibility through the windshield after birds or insects encounter.

[Amdt 25/16] [Amdt 25/18]

AMC 25.773(c) Internal windshield and window fogging

ED Decision 2015/008/R In absence of pilot compartment openable windows, if the failures of the means to prevent fogging cannot be shown to be extremely improbable, the applicant should show that a sufficient field of view is maintained to allow the pilot to safely operate the aeroplane during all operations, including taxi.

This should be accomplished by the following: — The extent of fogging should be established and verified during flight tests with the means to prevent fogging inoperative, — If it is proposed that the flight crew must take action to remove inside fogging, the effectiveness of the associated operational procedure should be demonstrated by flight test.

[Amdt 25/16]

CS 25.775 Windshields and windows

ED Decision 2016 / 010/R (See AMC 25.775) (a) Internal panes must be made of non - splintering material.

(b) Windshield panes directly in front of the pilots in the normal conduct of their duties, and the supporting structures for these panes, must withstand, without penetration, the bir d impact conditions specified in CS 25.631 .

Powered by EASA eRules Page 452 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (c) Unless it can be shown by analysis or tests that the probability of occurrence of a critical windshield fragmentation condition is of a low order, the aeroplane mus t have a means to minimise the danger to the pilots from flying windshield fragments due to bird impact. This must be shown for each transparent pane in the cockpit that – (1) Appears in the front view of the aeroplane; (2) Is inclined 15 ° or more to the l ongitudinal axis of the aeroplane; and (3) Has any part of the pane located where its fragmentation will constitute a hazard to the pilots.

(d) The design of windshields and windows in pressurised aeroplanes must be based on factors peculiar to high altit ude operation, including the effects of continuous and cyclic pressurisation loadings, the inherent characteristics of the material used, and the effects of temperatures and temperature differentials. The windshield and window panels must be capable of wit hstanding the maximum cabin pressure differential loads combined with critical aerodynamic pressure and temperature effects after any single failure in the installation or associated systems. It may be assumed that, after a single failure that is obvious t o the flight crew (established under CS 25.1523 ), the cabin pressure differential is reduced from the maximum, in accordance with appropriate operating limitations, to allow continued safe flight of the aeroplane w ith a cabin pressure alti tude of not more than 4572m (15 000 ft) (see AMC 25.775(d) ).

(e) The windshield panels in front of the pilots must be arranged so that, assuming the loss of vision through any one panel, on e or more panels remain available for use by a pilot seated at a pilot station to permit continued safe flight and landing.

[Amdt 25/18]

AMC 25.775(d) Windshields and w indows

ED Decision 2021/015/R 1. PURPOSE. This AMC sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of CS - 25 pertaining to the certification requirements for windshields, windows, and mounting structure. Guidance information is provid ed for showing compliance with CS 25.775(d) , relating to structural design of windshields and windows for aeroplanes with pressurised cabins.

2. RELATED CS PARAGRAPHS.

CS 25.775 Windshields and windows.

CS 25.365 Pressurised compartment loads.

CS 25.773(b)(3)(ii) Pilot compartment view.

CS 25. 571 Damage - tolerance and fatigue evaluation of structure 3. DEFINITIONS.

a. Annealed glass. Glass that has had the internal stresses reduced to low values by heat treatment to a suitable temperature and controlled cooling.

b. Chemically toughened glass . Annealed glass immersed in a bath of molten salt resulting in an ion exchange between the salt and the glass. The composition of the salt is such that this ion exchange causes the surface of the glass to be distorted (expansion), thus putting the surface in a state of compression.

Powered by EASA eRules Page 453 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS c. Creep. The change in dimension of a material under load over a period of time, not including the initial instantaneous elastic deformation. The time dependent part of strain resulting from an applied stress.

d. Cross - linkin g. The setting up of chemical links between molecular chains.

e. Modulus of Rupture (MOR). The maximum tensile or compressive longitudinal stress in a surface fibre of a beam loaded to failure in bending calculated from elastic theory.

f. Mounting. The structure that attaches the panel to the aircraft structure.

g. No tch sensitive. The extent to which the sensitivity of a material to fracture is increased by the presence of a surface non - homogeneity, such as a notch, a sudden change in cross section, a crack, or a scratch. Low notch sensitivity is usually associated wi th ductile materials, and high notch sensitivity is usually associated with brittle materials.

h. Pane/Ply. The pane/ply is a single sheet of transparent material.

i. Panel. The panel is the complete windshield or window excluding the mounting.

j. Therm ally toughened glass. Annealed glass heated to its softening temperature after which the outer surfaces are rapidly cooled in a quenching medium resulting in the outer surface being put into a state of compression with the core material in tension to maint ain equilibrium.

k. Toughened glass. Annealed glass placed into a state of compressive residual stress, with the internal bulk in a compensating tensile stress. Toughening may be achieved by either thermal or chemical processes.

4. BACKGROUND. Fail - safe designs have prevented depressurisations in a considerable number of windshield failure incidents. There are few transparent materials for aircraft windshield and window applications, and due to their inherent material characteristics, they are not as stru cturally versatile as metallic materials. Transparent materials commonly used in the construction of windshields and windows are glass, polymethyl - methacrylate (acrylic), polycarbonate, and interlayer materials. The characteristics of these materials requi re special engineering solutions for aircraft windshield and window panel designs.

a. Glass. In general, glass has good resistance to scratching and chemical attack, such as wiper action, solvents, and de - icing fluid. Windshield and window panel designs, however, should take into account its other unique properties, which are considerably different from metals.

(1) Glass exhibits no sharp change in physical properties when heated or cooled and has no definite melting point.

(2) Unlike metals, glass is a h ard brittle material that does not exhibit plastic deformation.

(3) Glass is much stronger in compression than in tension. Fracture will occur, under any form of loading, when the induced deformation causes the tensile stress to exceed the Modulus of Ruptu re (MOR).

(4) The strength of glass varies with the rate of loading; the faster the rate of loading the higher the strength, as is the case for bird impact loading. In addition, glass fracture stress for a load of short duration will substantially exceed t hat for a sustained load.

Powered by EASA eRules Page 454 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARG O ACCOMMODATIONS (5) The strength of glass, whether annealed or toughened, can be reduced by edge and surface damage such as scratches, chips, and gouges. Failure is usually initiated at some point of mechanical damage on the surface. However, the rmal or chemical toughening can considerably increase the fracture strength of annealed glass.

(6) Safety factors necessary on glass components. The safety factors necessary for glass components are significantly higher than for other materials used in air craft construction because of: the loss of strength with duration of load, the variability in strength inherent in glass, and the thickness tolerances and high notch sensitivity.

(7) There are generally two types of toughened glass: (a) Thermally toughened glass. The surface of annealed glass may be placed in a state of compression by heating the glass to its softening temperature after which the outer surfaces are rapidly cooled in a quenching medium. As mentioned, this results in the outer surfac e being put into a state of compression with the core material in tension to maintain equilibrium. The surface compressive layer in thermally toughened glass is approximately 18 percent of the total thickness of the glass. There are limitations on the mini mum thickness of glass that can be effectively toughened by thermal processing. Very thin glass can not be effectively toughened by these methods. In general, toughening can increase the MOR of a piece of glass by approximately 3.5 to 20 times. Thermally t oughened glass has significant stored energy within it. This energy is released to a certain extent when the glass fractures. Generally, the higher the stored energy the smaller particles are on fracture. Since thermal toughening leaves the glass with high compressive stresses in its surfaces, all cutting, grinding, or shaping must be done before toughening.

(b) Chemically toughened glass. Chemically toughening glass is achieved by immersion in a bath of molten salt of controlled composition. During the imm ersion process larger alkali ions in the salt replace smaller alkali ions in the surface of the glass. As a consequence of this unequal alkali ion exchange process, the structure of the surface of the glass is distorted by putting the surface in a state of compression similar to that of thermally toughened glass. Depending on the original glass composition and the bath processing, chemically toughened glass may have a compressive layer from 0.050 mm (0.002 inches) to over 0.50 mm (0.020 inches) regardless o f the total glass thickness. The compression stress of chemically toughened glass can be made much higher than it can using thermal toughening. As the compressive layer in chemically toughened glass is much smaller than in thermally toughened glass, the st ored energy within the glass does not cause the same visibility problems after failure. However, as with thermally toughened glass all cutting, grinding, and shaping must be done prior to toughening.

Powered by EASA eRules Page 455 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS b. Polymethyl - methacrylate (acrylic). The acrylic mate rials used for aircraft transparent structural panels are unplasticised methyl - methacrylate based polymers. There are two basic forms of acrylic materials used in aircraft windshield and window panels, as - cast and biaxially stretched (stretched from a cros s - linked base material).

(1) As - cast acrylic material: Forming acrylic material to a certain shape by pouring it into a mould and letting it harden without applying external pressure. Although not as notch sensitive as glass, unstretched acrylics have a n otch sensitivity. This unplasticised methyl - methacrylate base polymer has good forming characteristics, optical characteristics and outdoor weathering properties.

(2) Biaxially stretched acrylic material: Stretching acrylic material aligns the polymer chai ns to give a laminar structure parallel to the axis of stretch, which enhances resistance to crazing, reduces crack propagation rates, and improves tensile properties. Stretching acrylic material reduces the materials formability. In addition, stretched ac rylics have less notch sensitivity than unstretched acrylics.

(3) Properties. Compared with glass, these acrylics are soft and tough. In general, increasing the temperature causes a decrease in the mechanical properties of the material, increased temperatu re does not affect acrylic elongation and impact properties.

(4) Crazing. Both basic forms of acrylics used in aircraft transparencies are affected by crazing. Crazing is a network of fine cracks that extend over the surface of the plastic sheet (it is not confined to acrylic materials) and are often difficult to discern. These fine cracks tend to be perpendicular to the surface, very narrow, and are usually less than 0.025mm (.0010 inches) in depth. Crazing is induced by prolonged exposure to surface tensi le stresses above a critical level or by exposure to organic fluids and vapours.

(a) Stress crazing may be derived from: residual stresses caused by poor forming practice; residual surface stresses induced by machining, polishing, or gouging; and prolonged loading inducing relatively high tensile stresses at a surface.

(b) Stress crazing has a severe effect on the mechanical properties of acrylics; however, the effects are reduced in stretched materials.

(c) Stress crazing affects the transparency of acryli cs. Generally, stretched acrylic panels will be replaced due to loss of transparency from stress crazing before significant structural degradation occurs.

(5) Chemical resistance of acrylic materials. Typically, acrylic materials are resistant to inorganic chemicals and to some organic compounds, such as aliphatic (paraffin) hydrocarbons, hydrogenated aromatic compounds, fats, and oils.

(a) Acrylic materials are attacked and weakened by some organic compounds such as aromatic hydrocarbons (benzene), esters (generally in the form of solvents, and some de - icing fluids), ketones (acetone), and chlorinated hydrocarbons. Some hydraulic fluids are very detrimental to acrylic materials.

Powered by EASA eRules Page 456 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTI ON PERSONNEL AND CARGO ACCOMMODATIONS (b) Some detrimental compounds can induce crazing; others may dissolve the ac rylic or be absorbed in the material. Crazing induced by solvent and other organic compounds has more severe effects on the mechanical properties than stress crazing. Dissolution of the acrylic and chemical absorption into the acrylic degrades the mechanic al properties.

c. Polycarbonate. Polycarbonate is an amorphous thermoplastic with a glass transition temperature about 150°C, which shows large strain - to - break and high impact strength properties throughout the normal temperature range experienced by trans port aircraft.

Polycarbonate not only has significantly greater impact strength properties but also higher static strength properties when compared to acrylic materials.

(1) Polycarbonate exhibits very high deflections under impact conditions, which can r esult in higher loading into the aircraft structure, compared to glass or acrylic windshield and window panels.

(2) Polycarbonate polymer is very susceptible to degradation by the environment, due to moisture absorption and solvent stress cracking, as well as UV degradation. It is possible to prevent degradation by using good design and production practices and incorporating coatings and other forms of encapsulation. Polycarbonate also suffers from phenomena known as physical aging. This results in the chan ge from ductile properties to brittle properties that occur when polycarbonate is exposed to temperatures between 80°C and 130°C.

(3) Polycarbonate and stretched acrylic fatigue properties are similar to metals when working (design) stresses are used for o perating pressure loading design.

d. Interlayer Materials. Interlayer materials are transparent adhesive materials used to laminate glass and plastic structural plies for aircraft applications. Current choices are limited to plasticised polyvinyl butyral ( incompatible with polycarbonate), polyurethane, and silicone. The most commonly used are true thermoplastics, but some polyurethanes and all silicones contain some cross - linking.

(1) Interlayer materials are considered to be non - structural because they do not directly support aircraft loads. However, glass windshields are often attached to the airframe structure through metal inserts bonded to the interlayer. For such designs the residual strength of the windshield in a condition where all glass plies have failed may be dependent upon the strength of the interlayer. In addition, the shear coupling effectiveness of the interlayer has a great influence on the stiffness of the laminate.

(2) Most interlayer materials are susceptible to moisture ingress into the laminate and are protected by compatible sealants in aircraft service.

(3) Interlayer materials, like structural plies, have a useful service life that is controlled by the surface degradation and removal of the transparency for optical reasons.

5. INT RODUCTION. The recommended methods for showing compliance with CS 25.775(d) for typical designs of windshields and windows are given in paragraph 7, Test and Analysis. Typical designs of windshields and cockpit sid e windows are laminated multi - plied constructions, consisting of at least two structural plies, facing plies, adhesive interlayers, protective coatings, embedded electroconductive heater films or wires, and mounting structure. Typically the structural plie s are made from thermally or chemically toughened glass, or transparent polymeric materials such as polymethylmethacrylate (acrylic) and polycarbonate. These plies Powered by EASA eRules Page 457 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS may be protected from abrasion, mechanical, and environmental damage by use of facing plies and/or protective coatings. The facing and structural plies are laminated together with adhesive interlayer material of poly - vinyl butyral (PVB), polyurethane, or silicone. Cabin window designs are typically multi - paned construction consisting of two struc tural panes (a main load bearing pane and a fail - safe pane), inner facing panes, protective coatings, and mounting structure.

Generally, the two structural panes are made from polymethyl - methacrylate and separated by an air gap. However, there are some cab in window designs that have laminated structural panes. The designs with the structural panes separated by an air gap usually are such that the fail - safe pane is not loaded unless the main pane has failed.

6. GENERAL CONSIDERATIONS FOR DESIGN.

a. Items to be considered in designing the mounting for suitability over the ranges of loading and climatic conditions include but are not limited to: (1) Deflection of the panes and mounting under pressure, (2) Deflection of the mounting structure as a result of fuselage deflection, (3) Differential contraction and expansion between the panes and the mounting, (4) Deflection of the panel resulting from temperature gradient across the thickness of the panel, and (5) Long term deformation (creep) particularly of non - metallic parts.

b. Fatigue and stress crazing should be evaluated for assemblies using polymeric structural plies. One way to reduce the occurrence of fatigue and stress crazing is by limiting the maximum working stress level over the complete panel assem bly, making due allowance for expected in service deterioration resulting from weathering, minor damage, environmental attack, and the use of chemicals/cleaning fluids. This analysis should be based on: (1) The appropriate strength of the polymer as decla red by the material manufacturer under sustained loading, (2) The panel assembly maintained at its normal working temperature as given by the windshield/window heating system, if installed, and (3) The ambient temperature on the outside and the cabin temp erature on the inside.

The most adverse likely ambient temperature should be covered.

7. TESTS AND ANALYSIS. The windshield and window panels must be capable of withstanding the maximum cabin pressure differential loads combined with critical aerodynamic p ressure and temperature effects for intact and single failure conditions in the installation of associated systems. When substantiation is shown by test evidence, the test apparatus should closely simulate the structural behaviour (e.g., deformation under pressure loads) of the aircraft mounting structure up to the ultimate load conditions. Analysis may be used if previous testing can validate it. The effects of the following material characteristics should be evaluated and accounted for in the design and t est results: notch sensitivity, fatigue, crazing, aging effects, corrosion (degradation by fluids), temperature, UV degradation, material stability, creep, and the function and working life of the interlayer. An acceptable route for the strength substantia tion of a windshield or window panel is set out below.

Powered by EASA eRules Page 458 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – D ESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS a. Ultimate Static Strength.

(1) Conduct a detailed structural analysis using an appropriate structural analysis method to identify the highest stressed areas of the windshield or window panel.

Subs equently confirm the structural analysis by subjecting a representatively mounted and instrumented windshield or window panel to ultimate load conditions. The panel should be subjected to the most adverse combinations of pressure loading, including the max imum internal pressure, external aerodynamic pressure, temperature effects, and where appropriate, flight loads.

(2) Establish allowable strength values including allowance for material production variability, material characteristics, long term degradatio n, and environmental effects for each structural ply from relevant coupon or sub - component test evidence. Check the critical design case to ensure that the allowables are not exceeded by the design ultimate stresses.

(3) In lieu of 7.a.(2) above, perform a test above ultimate pressure load to account for material production variability, material characteristics, long term degradation, and environmental effects. In lieu of a rational analysis substantiating the degree of increased loading above ultimate, a f actor of 2.0 may be used (ultimate is defined as 1.5 times the pressure load defined in CS 25.365(d) ). A separate test fixture may be needed to preclude loading the airframe above ultimate capability.

b. Fatigue. Conventional windshield and window panel ma terials exhibit good intrinsic fatigue resistance properties, but the variability in fatigue life is greater than that in aircraft quality metals. Thus a conventional cyclic fatigue test, but of extended duration, may be used to cover this variability. Tes ting at an elevated stress level for one aircraft lifetime could also give the necessary assurance of reliability. These approaches require consideration of the endurance of the metal parts of the mounting structure. Another approach that may be used in li eu of testing is to maintain the maximum working stresses in the windshield and window panel below values at which fatigue will occur. The maximum working stress level over the complete panel assembly should be shown by supporting evidence not to exceed va lues consistent with the avoidance of fatigue and stress crazing, considering deterioration resulting from weathering, minor damage and scratching in service, and use of cleaner fluids, etc. Fatigue resistance of the mounting structure should be covered se parately as part of the fuselage fatigue substantiation.

c. Fail - Safe. Fail - safe strength capability of the windshield and window panels should be demonstrated after any single failure in the installation or associated systems. The demonstration should ac count for material characteristics and variability in service material degradation, critical temperature effects, maximum cabin differential pressure, and critical external aerodynamic pressure. The requirements of CS 25.571 for the windshield or window panels may be met by showing compliance with the fail - safe criteria in this AMC. Other single failures (besides the windshield and window panels) in the installation or associated systems should also be considered. A n acceptable approach for demonstrating compliance is defined by the following method: Powered by EASA eRules Page 459 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (1) Conduct an analysis to establish the critical main pressure bearing ply.

(2) To account for the dynamic effects of a ply failure, test the representatively mounted windshield and window panel by suddenly failing the critical ply under the maximum cabin differential pressure (maximum relief valve setting) combined with the critical external aerodynamic pressure with critical temperature effects included.

(a) For wind shield and window panel failures obvious to the flightcrew, the test pressure may be reduced after initial critical pane failure to account for crew action defined in the flight manual procedures. The failed windshield or window panel should withstand this reduced pressure for the period of time that would be required to complete the flight.

(b) For windshield and window panel failures, which would not be obvious to a flightcrew, the test pressure should be held for a time sufficient to account for the rema ining period of flight. During the period of time when the test pressure is held, the effects of creep (if creep could occur) should be considered.

(3) Check the fail - safe stresses in all intact structural plies determined in 7c(2) to ensure that they do n ot exceed the material allowables developed to account for material production variability, material characteristics, long term degradation, and environmental effects.

(4) In lieu of 7c(3) above, to account for material production variability, material characteristics, long term degradation, and environmental effects, additional fail - safe testing of the windshield and window panel to loads above the fail - safe loads following the procedures defined in 7c(2) above should be conducted. In lieu of a rational analysis substantiating the degree of increased loading, a factor may be used, as shown in the table below. The factored loads should be applied after the failure of the critical ply. A separate test fixture may be needed to preclude loading the airframe above ultimate capability. The panel tested in 7c(2) may be used for this test.

(5) Load Factors (applied after the failure of the critical ply): Material Factor Glass 2.0 Stretched Acrylic 2.0 Cast Acrylic 4.0 Polycarbonate 4.0 (6) Other single failures in the installation or the associated systems as they affect the transparency should also be addressed. Such failures include broken fasteners, cracked mounting components, and malfunctions in windshield heat systems.

Powered by EASA eRules Page 460 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS 8. OTHER FAILURE CONDITIONS THAT MAY HAVE STRUCTURAL EFFECTS AMC 25.1309 , point 10(c) ‘Considerations When Assessing Failure Condition Effects’, states that the applicant should evaluate the severity of failure conditions, considering the effects that potential or consequential effects on structural integrity may have on the aeroplane.

Therefore, the applicant should carefully consider the potential effects on the windshield structural integrity when assessing any failure co ndition in windshield - related systems (e.g. windshield heating systems).

Unless otherwise shown, the applicant should classify as at least hazardous a system failure condition that leads to a structural failure that could result in partial or complete loss of a windshield.

In addition, it is reminded that CS 25.365(e)(3) requires the applicant to consider the maximum compartment opening, caused by aeroplane or equipment failures (e.g. windshield failures), that is n ot shown to be extremely improbable.

Service experience has shown that failure or deterioration of windshield installation components (e.g.

a degraded seal), combined with environmental conditions (e.g. water accumulation or moisture ingress) or with manuf acturing/installation issues, may lead to failure of other components of windshield - related systems (e.g. degradation of, or damage to, the insulation of a heating - system wire). The combination of such failures may lead to a malfunction or failure of the r elated system, which may cause a structural failure that could result in the partial or complete loss of the windshield or the loss of transparency of the windshield.

Therefore, the applicant should pay attention to common causes of failures when installin g windshields and related systems or components, and to the contribution of such common causes to cascading failures. The applicant should identify through common cause analysis appropriate design, manufacturing, installation, and maintenance precautions t o mitigate the risk of any failure condition adversely affecting systems or components, which may directly or indirectly lead to a structural failure that could result in the partial or complete loss of the windshield or the loss of transparency of the win dshield (refer to AMC 25.1309 , Appendix 1 ).

[Amdt No: 25/27]

CS 25.777 Cockpit controls

ED Decision 2013/010/R (a) Each cockpit control must be located to provide convenie nt operation and to prevent confusion and inadvertent operation.

(b) The direction of movement of cockpit controls must meet the requirements of CS 25.779 .

Wherever practicable, the sense of motion involved in the operation of other controls must correspond to the sense of the effect of the operation upon the aeroplane or upon the part operated. Controls of a variable nature using a rotary motion must move clockwise from the off position, through an increasing range , to the full on position.

(c) The controls must be located and arranged, with respect to the pilots' seats, so that there is full and unrestricted movement of each control without interference from the cockpit structure or the clothing of the minimum flight crew (established under CS 25.1523 ) when any member of this flight crew from 1.58 m (5ft 2 inches) to 1·91 m (6ft 3 inches) in height, is seated with the seat belt and shoulder harness (if provided) fastened.

(d) Identical powerplant control s for each engine must be located to prevent confusion as to the engines they control.

Powered by EASA eRules Page 461 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (e) Wing - flap controls and other auxiliary lift device controls must be located on top of the pedestal, aft of the throttles, centrally or to the right of the pedestal c entre line, and not less than 25 cm (10 inches) aft of the landing gear control.

(f) The landing gear control must be located forward of the throttles and must be operable by each pilot when seated with seat belt and shoulder harness (if provided) fastened .

(g) Control knobs must be shaped in accordance with CS 25.781 . In addition, the knobs must be of the same colour and this colour must contrast with the colour of control knobs for other purposes and the surroundi ng cockpit.

(h) If a flight engineer is required as part of the minimum flight crew (established under CS 25.1523 ), the aeroplane must have a flight engineer station located and arranged so that the flight - crew members can perform their functions efficien tly and witho ut interfering with each other.

(i) Pitch and roll control forces and displacement sensitivity shall be compatible so that normal inputs on one control axis will not cause significant unintentional inputs on the other.

[Amdt 25/13]

AMC 25.777 (c) Full and unrestricted movement of cockpit controls

ED Decision 2019/013/R 9 /01 3 /R 1. General CS 25.777(c) requires cockpit controls to be located and arranged so that full and unrestricted movement of each control can be made by the minimum flight crew. The use of the controls shall be evaluated for pilots across the r ange of statures required by CS 25.777(c). This evaluation should take into account foreseeable normal and failure conditions.

2. Rudder and brake controls Particular attention should be paid to rudder and brake controls. The control movement of the rudder pedals and brake pedals should be evaluated in order to ensure that full use can be made of all the available controls in the event of an engine failure, including on take - off and including engine fa ilure at low speeds below V .

MCG The evaluation should ensure that each member of the fl ight crew is always able to apply full rudder and maximum brake pressure on the same side simultaneously (e.g. full right rudder with maximum right brake pressure, and vice versa). Furthermore, the ergonomics of the design should be such that: a) the fligh t crew members can, in each condition, continue to apply brake pre ssure on the opposite side; and b) inadvertent brake application on the opposite side is precluded.

This evaluation should ideally be performed in a representative simulator, but it may also be performed statically in a representative cockpit.

[Amdt No: 25/23] Powered by EASA eRules Page 462 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

CS 25.779 Motion and effect of cockpit controls

ED Decision 2003/ 2/RM Cockpit controls must be designed so that they operate in accordance with the following movement and actuation: ( a) Aerodynamic controls – (1) Primary.

Controls Motion and effect Aileron Right (clockwise) for right wing down Elevator Rearward for nose up Rudder Right pedal forward for nose right (2) Secondary.

Controls Motion and effect Flaps (or auxiliary lift devices) Forward for wing - flaps up; rearward for flaps down Trim tabs (or equivalent) Rotate to produce similar rotation of the aeroplane about an axis parallel to the axis of the control (b) Powerplant and auxiliary controls – (1) Powerplant.

Controls Motion and effect Power or thrust Forward to increase forward thrust and rearward to increase rearward thrust Propellers Forward to increase rpm (2) Auxiliary.

Controls Motion and effect Landing gear Down to extend Powered by EASA eRules Page 463 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

CS 25.781 Cockpit control knob shape

ED Decision 2003/ 2/RM Cockpit control knobs must conform to the general shapes (but not necessarily the exact sizes or specific proportions) in the following figure:

CS 25.783 Fuselage Doors

ED Decision 2016/010/R (See AMC 25.783 ) (a) General. This paragraph applies to fuselage doors, which includes all doors, hatches, openable windows, access panels, covers, etc., on the exterior of th e fuselage that do not require the use of tools to open or close. This also applies to each door or hatch through a pressure bulkhead, including any bulkhead that is specifically designed to function as a secondary bulkhead under the prescribed failure co nditions of CS - 25. These doors must meet the requirements of this paragraph, taking into account both pressurised and unpressurised flight, and must be designed as follows: (1) Each door must have means to safeguard against opening in flight as a result o f mechanical failure, or failure of any single structural element.

(2) Each door that could be a hazard if it unlatches must be designed so that unlatching during pressurised and unpressurised flight from the fully closed, latched, and locked cond ition is extremely improbable. This must be shown by safety analysis.

Powered by EASA eRules Page 464 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (3) Each element of each door operating system must be designed or, where impracticable, distinctively and permanently marked, to minimise the probability of incorrect assembly and adjustment that could result in a malfunction.

(4) All sources of power that could initiate unlocking or unlatching of any door must be automatically isolated from the latching and locking systems prior to flight and it must not be possible to restore powe r to the door during flight.

(5) Each removable bolt, screw, nut, pin, or other removable fastener must meet the locking requirements of CS 25.607 .

(6) Certain doors, as specified by CS 25.807(h) , must also meet the applicable requirements of CS 25.809 through CS 25.812 for emergency exits.

(b) Opening by persons. There must be a means to sa feguard each door against opening during flight due to inadvertent action by persons. In addition, for each door that could be a hazard, design precautions must be taken to minimise the possibility for a person to open the door intentionally during flight . If these precautions include the use of auxiliary devices, those devices and their controlling systems must be designed so that: (1) no single failure will prevent more than one exit from being opened, and (2) failures that would prevent opening of any exit after landing must not be more probable than remote.

(c) Pressurisation prevention means. There must be a provision to prevent pressurisation of the aeroplane to an unsafe level if any door subject to pressurisation is not fully closed, latched, and locked.

(1) The provision must be designed to function after any single failure, or after any combination of failures not shown to be extremely improbable.

(2) Doors that meet the conditions described in sub - paragraph (h) of this paragraph are not requi red to have a dedicated pressurisation prevention means if, from every possible position of the door, it will remain open to the extent that it prevents pressurisation or safely close and latch as pressurisation takes place. This must also be shown with a ny single failure and malfunction except that: (i) with failures or malfunctions in the latching mechanism, it need not latch after closing, and (ii) with jamming as a result of mechanical failure or blocking debris, the door need not close and latch if it can be shown that the pressurisation loads on the jammed door or mechanism would not result in an unsafe condition.

(d) Latching and locking. The latching and locking mechanisms must be designed as follows: (1) There must be a provision to lat ch each door.

(2) The latches and their operating mechanism must be designed so that, under all aeroplane flight and ground loading conditions, with the door latched, there is no force or torque tending to unlatch the latches. In addition, the latching sy stem must include a means to secure the latches in the latched position. This means must be independent of the locking system.

Powered by EASA eRules Page 465 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (3) Each door subject to pressurisation, and for which the initial opening movement is not inward, must: (i) have an individua l lock for each latch; (ii) have the lock located as close as practicable to the latch; and (iii) be designed so that, during pressurised flight, no single failure in the locking system would prevent the locks from restraining the latches necessary to secu re the door.

(4) Each door for which the initial opening movement is inward, and unlatching of the door could result in a hazard, must have a locking means to prevent the latches from becoming disengaged. The locking means must ensure sufficient latching to prevent opening of the door even with a single failure of the latching mechanism.

(5) It must not be possible to position the lock in the locked position if the latch and the latching mechanism are not in the latched position.

(6) It must not be possibl e to unlatch the latches with the locks in the locked position. Locks must be designed to withstand the limit loads resulting from: (i) the maximum operator effort when the latches are operated manually; (ii) the powered latch actuators, if installed; a nd (iii) the relative motion between the latch and the structural counterpart.

(7) Each door for which unlatching would not result in a hazard is not required to have a locking mechanism meeting the requirements of sub - paragraphs (d)(3) through (d)(6) of this paragraph.

(8) A door that could result in a hazard if not closed, must have means to prevent the latches from being moved to the latched position unless it can be shown that a door that is not closed would be clearly evident before flight.

(e) Warning, caution, and advisory indications. Doors must be provided with the following indications: (1) There must be a positive means to indicate at the door operator’s station that all required operations to close, latch, and lock the door(s) have bee n completed.

(2) There must be a positive means, clearly visible from each operator station for each door that could be a hazard if unlatched, to indicate if the door is not fully closed, latched, and locked.

(3) There must be a visual means on the flight deck to signal the pilots if any door is not fully closed, latched, and locked. The means must be designed such that any failure or combination of failures that would result in an erroneous closed, latched, and locked indication is remote for: (i) each do or that is subject to pressurisation and for which the initial opening movement is not inward; or (ii) each door that could be a hazard if unlatched.

Powered by EASA eRules Page 466 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (4) There must be an aural warning to the pilots prior to or during the initial portion of take - off roll if any door is not fully closed, latched, and locked, and its opening would prevent a safe take - off and return to landing.

(f) Visual inspection provision. Each door for which unlatching could be a hazard must have a provision for direct visual inspectio n to determine, without ambiguity, if the door is fully closed, latched, and locked. The provision must be permanent and discernible under operational lighting conditions, or by means of a flashlight or equivalent light source.

(g) Certain maintenance door s, removable emergency exits, and access panels. Some doors not normally opened except for maintenance purposes or emergency evacuation and some access panels need not comply with certain sub - paragraphs of this paragraph as follows: (1) Access panels that are not subject to cabin pressurisation and would not be a hazard if open during flight need not comply with sub - paragraphs (a) through (f) of this paragraph, but must have a means to prevent inadvertent opening during flight.

(2) Inward - opening removable emergency exits that are not normally removed, except for maintenance purposes or emergency evacuation, and flight deck - openable windows need not comply with sub - paragraphs (c) and (f) of this paragraph.

(3) Maintenance doors that meet the conditions of s ub - paragraph (h) of this paragraph, and for which a placard is provided limiting use to maintenance access, need not comply with sub - paragraphs (c) and (f) of this paragraph.

(h) Doors that are not a hazard. For the purposes of this paragraph, a door is c onsidered not to be a hazard in the unlatched condition during flight, provided it can be shown to meet all of the following conditions: (1) Doors in pressurised compartments would remain in the fully closed position if not restrained by the latches when s ubject to a pressure greater than 3.447 kPa (0.5 psi).

Opening by persons, either inadvertently or intentionally, need not be considered in making this determination.

(2) The door would remain inside the aeroplane or remain attached to the aeroplane if it opens either in pressurised or unpressurised portions of the flight. This determination must include the consideration of inadvertent and intentional opening by persons during either pressurised or unpressurised portions of the flight.

(3) The disengagemen t of the latches during flight would not allow depressurisation of the cabin to an unsafe level. This safety assessment must include the physiological effects on the occupants.

(4) The open door during flight would not create aerodynamic interference that could preclude safe flight and landing.

(5) The aeroplane would meet the structural design requirements with the door open. This assessment must include the aeroelastic stability requirements of CS 25.629 , as well as the strength requirements of Subpart C.

(6) The unlatching or opening of the door must not preclude safe flight and landing as a result of interaction wit h other systems or structures.

[Amdt 25/4] [Amdt 25/18] Powered by EASA eRules Page 467 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CA RGO ACCOMMODATIONS

AMC 25.783 Fuselage Doors

ED Decision 2011 / 004 /R 1. PURPOSE.

This Acceptable Means of Compliance, which is similar to the FAA Advisory Circular AC 25.783 - 1A describes an acceptable means for showing compliance with the requirements of CS - 25 dealing with the certification of fuselage external doors and hatches.

The means of compliance described in this document is intended to provide guidance to supplement the engineering and operational judgement that must form the basis of any compliance findings relative to the structural and funct ional safety standards for doors and their operating systems This document describes an acceptable means, but not the only means, for demonstrating compliance with the requirements. Terms such as “shall” and “must” are used only in the sense of ensuring a pplicability of this particular method of compliance when the acceptable method of compliance described in this document is used.

2. RELATED CS PARAGRAPHS.

The contents of this AMC are considered by the EASA in determining compliance of doors with the s afety requirements of CS 25.783 . Other related paragraphs are: CS 25.571 , “Damage - tolerance and fatigue evaluation of structure” CS 25.607 , “Fasteners” CS 25.703 , “Take - off warning system” CS 25.809 , “Emergency exit arrangement” 3. DEFINITIONS OF TERMS.

Inconsistent or inaccurate use of terms may lead to the installation of doors and hatches that do not fully meet the safety objectives of the regulations. To ensure that such installations fully comply with the regulations, the following definitions should be used when showing compliance with CS 25.783 : a. “Closed” means that the door has been placed within the door frame in such a position that the latches can be operated to the “latched” condition. “Fully closed” means that the door is placed within the do or frame in the position it will occupy when the latches are in the latched condition.

b. “Door” includes all doors, hatches, openable windows, access panels, covers, etc. on the exterior of the fuselage which do not require the use of tools to open or cl ose. This also includes each door or hatch through a pressure bulkhead including any bulkhead that is specifically designed to function as a secondary bulkhead under the prescribed failure conditions of CS - 25.

c. “Door operator’s station” means the locatio n(s) where the door closing, latching and locking operations are performed.

d. “Emergency exit” is an exit designated for use in an emergency evacuation.

e. “Exit” is a door designed to allow egress from the aeroplane.

f. “Flight” refers to that period of time from start of the take - off roll until the aeroplane comes to rest after landing.

Powered by EASA eRules Page 468 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS g. “Inadvertent action by persons” means an act committed without forethought, consideration or consultation.

h. “Initial inward opening movement”. In order for a do or design to be classified as having inward initial opening movement the design of its stops, guides and rollers and associated mechanism, should be such that positive pressurisation of the fuselage acting on the mean pressure plane of the fully closed doo r must always ensure a positive door closu re force. (See AMC 25.783 Paragraph 5, (d) (4)).

i. “Initial opening movement,” refers to that door movement caused by operation of a handle or other door control mechanism, which is required to place the door in a position free of structure that would interfere with continued opening of the door.

j. “Inward” means having a directional component of movement that is inward with respect to the mean (pressure) plane of the body cut - out.

k. “Latched” means the latch es are engaged with their structural counterparts and held in position by the latch operating mechanism.

l. “Latches” are movable mechanical elements that, when engaged, prevent the door from opening.

m. “Latching system” means the latch operating system and the latches.

n. “Locked” means the locks are engaged and held in position by the lock operating mechanism.

o. “Locking system” means the lock operating system and the locks.

p. “Locks” are mechanical elements in addition to the latch operating mechanism that monitor the latch positions, and when engaged, prevent latches from becoming disengaged.

q. “Stops” are fixed structural elements on the door and door frame that, when in contact with each other, limit the directions in which the door is free to move.

4. BACKGROUND.

4.1 History of incidents and accidents.

There is a history of incidents and accidents in which doors, fit ted in pressurised aeroplanes, have opened during pressurised and unpressurised flight. Some of these inadvertent openings have resulted in fatal crashes. After one fatal accident that occurred in 1974, the FAA and industry representatives formed a design review team to examine the current regulatory requirements for doors to determine if those regulations were adequate to ensure safety. The team’s review and eventual recommendations led to the FAA issuing Amendment 25 - 54 to 14 CFR part 25 in 1980, that wa s adopted by the JAA in JAR - 25 Change 10 in 1983, which significantly improved the safety standards for doors installed on large aeroplanes. Included as part of JAR - 25 Change 10 (Amendment 25 - 54) was JAR 25.783, “Doors,” which provides the airworthiness s tandards for doors installed on large aeroplanes.

Although there have been additional minor revisions to JAR 25.783 subsequent to the issuance of Change 10 (Amendment 25 - 54), the safety standards for doors have remained essentially the same since 1980.

Powered by EASA eRules Page 469 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUC TION PERSONNEL AND CARGO ACCOMMODATIONS 4 .2 Continuing safety problems.

In spite of the improved standards brought about in 1980, there have continued to be safety problems, especially with regard to cargo doors. Cargo doors are often operated by persons having little formal instruction in thei r operation. Sometimes the operator is required to carry out several actions in sequence to complete the door opening and closing operations. Failure to complete all sequences during closure can have serious consequences. Service history shows that severa l incidents of doors opening during flight have been attributed to the failure of the operator to complete the doo r closure and locking sequence. Other incidents have been attributable to incorrect adjustment of the door mechanism, or failure of a vital pa rt.

4.3 Indication to the flight crew.

Experience also has shown that, in some cases, the flight deck indication system has not been reliable. In other instances, the door indication system was verified to be indicating correctly, but the flight crew, f or unknown reasons, was not alerted to the unsafe condit ion. A reliable indication of door status on the flight deck is particularly important on aeroplanes used in operations where the flight crew does not have an independent means readily available to ve rify that the doors are properly secured.

4.4 Large cargo doors as basic airframe structure.

On some aeroplanes, large cargo doors form part of the basic fuselage structure, so that, unless the door is properly closed and latched, the basic airframe struc ture is unable to carry the design aerodynamic and inertial loads. Large cargo doors also have the potential for creating control problems when an open door acts as an aerodynamic surface. In such cases, failure to secure the door properly could have cat astrophic results, even when the aeroplane is unpressurised.

4.5 NTSB (USA) recommendations.

After two accidents occurred in 1989 due to the failure of cargo doors on transport category aeroplanes, the FAA chartered the Air Transport Association (ATA) of America to study the door design and operational issues again for the purpose of recommending improvements. The ATA concluded its study in 1991 and made recommendations to the FAA for improving the design standards of doors. Those recommendations together with additional recommendations from the National Transportation Safety Board (NTSB) were considered in the development of improved standards for doors adopted by Amendment 25 - 114.

5. DISCUSSION OF THE CURRENT REQUIREMENTS.

Service history has shown that to prevent doors from becoming a hazard by opening in flight, it is necessary to provide multiple layers of protection against failures, malfunctions, and human error. Paragraph 25.783 addresses these multiple layers of protection by requiring: — a latchin g system; — a locking system; — indication systems; — a pressure prevention means.

Powered by EASA eRules Page 470 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS These features provide a high degree of tolerance to failures, malfunctions, and human error.

Paragraph CS 25.783 intends that the latching system be designed so that it is inherently or specifically restrained fr om being back - driven from the latches; but even so, the latches are designed to eliminate, as much as possible, all forces from the latch side that would tend to unlatch the latches. In addition to these features that prevent the latches from inadvertentl y opening, a separate locking system is required for doors that could be a hazard if they become unlatched. Notwithstanding these safety features, it could still be possible for the door operator to make errors in closing the door, or for mechanical failu res to occur during or after closing; therefore, an indicating system is required that will signal to the flight crew if the door is not fully closed, latched, and locked. However, since it is still possible for the indication to be missed or unheeded, a separate system is required that prevents pressurisation of the aeroplane to an unsafe level if the door is not fully closed, latched, and locked.

The following material restates the requirements of CS 25.783 in italicised text and, immediately following, provides a discussion of acceptable compliance criteria .

CS 25.783(a) General Design Considerations This paragraph applies to fuselage doors, which includes all doors, hatches, openable windows, access panels, covers, etc., on the exterior of the fuselage that do not require the use of tools to open or close. This also applies to each door or hatch through a pressure bulkhead, including any bulkhead that is speci fically designed to function as a secondary bulkhead under the prescrib ed failure conditions of CS - 25. These doors must meet the requirements of this paragraph, taking into account both pressurised and unpressurised flight, and must be designed as follows: (a)(1) Each door must have means to safeguard against opening in flight as a result of mechanical failure, or failure of any single structural element.

Failures that should be considered when safeguarding the door against opening as a result of mechanic al failure or failure of any single structural element include those caused by: — wear; — excessive backlash; — excessive friction; — jamming; — incorrect assembly; — incorrect adjustment; — parts becoming loose, disconnected, or unfastened; — parts breaking, fractu ring, bending or flexing beyond the extent intended.

(a)(2) Each door that could be a hazard if it unlatches must be designed so that unlatching during pressurised and unpressurised flight from the fully closed, latched, and locked cond ition is extremely i mprobable. This m ust be shown by safety analysis .

All doors should incorporate features in the latching mechanism that provide a positive means to prevent the door from opening as a result of such things as: — vibrations; — structural loads and deflections; Powered by EASA eRules Page 471 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS — positive and negative pressure loads, positive and negative ‘g’ loads; — aerodynamic loads etc.

The means should be effective throughout the approved operating envelope of the aeroplane including the unpressurised portions of flight.

The safety assessment required by this regulation may be a qualitative or quantitative analysis, or a combination as appropriate to the design. In evaluating a failure condition that results in total failure or inadvertent opening of the door, all contributing events should b e considered, including: — failure of the door and door supporting structure; — flexibility in structures and linkages; — failure of the operating system; — erroneous signals from the door indication systems; — likely errors in operating and maintaining the door.

(a)(3) Each element of each door operating system must be designed or, where impracticable, distinctively and permanently marked, to minimise the probability of incorrect assembly and adjustment that could result in a malfunction.

Experience has sh own that the level of protection against mechanical failure can be significantly improved by careful attention to detail design. The following points should therefore be taken into account: (a) To minimise the risk of incorrect assembly and adjustment, pa rts should be designed to prevent incorrect assembly if, as a result of such incorrect assembly, door functioning would be adversely affected. “Adverse effects” could be such things as preventing or impeding the opening of the door during an emergency, or reducing the capability of the door to remain closed. If such designs are impracticable and marking is used instead, the marking should remain clearly identifiable during service. In this respect, markings could be made using material such as permanent ink, provided it is resistant to typical solvents, lubricants, and other materials used in normal maintenance operations.

(b) To minimise the risk of the door operating mechanism being incorrectly adjusted in service, adjustment points that are intended fo r “in - service” use only should be clearly identified, and limited to a minimum number consistent with adequate adjustment capability. Any points provided solely to facilitate adjustment at the initial build and not intended for subsequent use, should be m ade non - adjustable after initial build, or should be highlighted in the maintenance manual as a part of the door mechanism that is not intended to be adjusted.

(a)(4) All sources of power that could initiate unlocking or unlatching of each door must be aut omatically isolated from the latching and locking systems prior to flight and it must not be possible to restore power to them during flight.

For doors that use electrical, hydraulic, or pneumatic power to initiate unlocking or unlatching, those power so urces must be automatically isolated from the latching and locking systems before flight, and it should not be possible to restore power to them during flight. It is particularly important for doors with powered latches or locks to have all power removed that could power these systems or that could energise control circuits Powered by EASA eRules Page 472 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS to these systems in the event of electrical short circuit s. This does not include power to the door indicating system, auxiliary securing devices if installed, or other systems not rela ted to door operation. Power to those systems should not be sufficient to cause unlocking or unlatching unless each failure condition that could result in energising the latching and locking systems is extremely improbable.

(a)(5) Each removable bolt, scr ew, nut, pin, or other removable fastener must meet the locking requirements of CS 25.607 . [Fasteners] Refer to AMC 25.607 for guidance on complying with CS 25.607 .

(a)(6) Certain fuselage doors, as specified by 25.807(h), must also meet the applicable requirements of CS 25.809 through 25.812 for emergency exits.

CS 25.783(b) Opening by persons There must be means to safeguard each door against opening during flight due to inadvertent action by persons.

The d oor should have inherent design features that achieve this objective. It is not considered acceptable to rely solely on cabin pressure to prevent inadvertent opening of doors during flight, because there have been instances where doors have opened during unpressurised flight, such as during landing. Therefore all doors should incorporate features to prevent the door from being opened inadvertently by persons on board.

In addition, for each door that could be a hazard, design precautions must be taken to m inimise the possibility for a person to open a door intentionally during flight. If these precautions include the use of auxiliary devices, those devices and their controlling systems must be designed so that: (1) no single failure will prevent more than one exit from being opened, and (2) failures that would prevent opening of any exit after landing must not be more probable than remote.

The intentional opening of a door by persons on board while the aeroplane is in flight should be considered. This rul e is intended to protect the aircraft and passengers but not necessarily the person who intentionally tries to open the door. Suitable design precautions should therefore be taken; however, the precautions should not compromise the ability to open an emer gency exit in an emergency evacuation. The following precautions should be considered: (a) For doors in pressurised compartments: it should not normally be possible to open the door when the compartment differential pressure is above 13.8 kPa (2 psi).

Th e ability to open the door will depend on the door operating mechanism and the handle design, location and operating force. Operating forces in excess of 136 kg (300 pounds) should be considered sufficient to prevent the door from being opened. During ap proach, take - off and landing when the compartment differential pressure is lower, it is recognised that intentional opening may be possible; however, these phases are brief and all passengers are expected to be seated with seat belts fastened. Nevertheless flight experience has shown that cabin staff may cycle door handles during take - off in an attempt to ensure that the door is closed, resulting in door openings in flight. For hazardous doors CS 25.783(e)(2) intends to provide a positive means to indicate to the door operator after closure of the door on the ground, that the door is not properly closed, latched and locked. CS Powered by EASA eRules Page 473 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS 25.783(e)(2) will minimise, but can not prevent the deliberate cycling of the door handle by the cabin staff during take - off.

(b) Fo r doors that cannot meet the guidance of (a) above, and for doors in non - pressurised aeroplanes: The use of auxiliary devices (for example, a speed - activated or barometrically - activated means) to safeguard the door from opening in flight should be consider ed. The need for such auxiliary devices should depend upon the consequences to the aeroplane and other occupants if the door is opened in flight.

(c) Auxiliary devices installed on emergency exits: The failure of an auxiliary device should normally result in an unsecured position of the device. Failures of an auxiliary device that would prevent opening of the exit after landing should not be more probable than Remote (1x10 - 5/flight hour). Where auxiliary devices are controlled by a central system or other more complex systems, a single failure criterion for opening may not be sufficient. The criteria for failure of the auxiliary device to open after landing should include consideration of single failures and all failure conditions that are more probable t han remote. In the assessment of single failures, no credit should be given to dormant functions.

The opening of exits on the ground should also be considered in the design, relative to the effects of differential pressure. While it is desirable and requir ed to be able to open exits under normal residual differential pressure, opening of the exit with significant differential pressure can be a hazard to the person opening the exit. Clearly, emergency conditions may dictate that the exit be opened regardless of the differential pressure.

Devices that restrict opening of the door, or affect the pressurization system, can have failure modes that create other safety concerns. However, the manufacturer should consider this issue in the design of the door and prov ide warnings where necessary, if it is possible to open a door under differential pressure that may be hazardous to the exit operator.

CS 25.783(c) Pressurisation prevention means There must be a provision to prevent pressurisation of the aeroplane to an unsafe level if any door subject to pressurisation is not fully closed, latched, and locked.

(c)(1) The provision must be designed to function after any single failure, or after an y combination of failures not shown to be extremely improbable.

(a) The provisions for preventing pressurisation must monitor the closed, latched and locked condition of the door. If more than one lock system is used, each lock system must be monitored. Examples of such provisions are vent panels and pressurisation inhibiting circuits. Pressurisation to an unsafe level is considered to be prevented when the pressure is kept below 3.447 kPa (1/2 psi). These systems are not intended to function to depre ssurise the aeroplane once the fully closed latched and locked condition is established and pressurisation is initiated.

(b) If a vent panel is used, it should be designed so that, in normal operation or with a single failure in the operating linkage, the vent panel cannot be closed until the door is latched and locked. The vent panel linkage should monitor the locked condition of each door lock system.

(c) If automatic control of the cabin pressurisation system is used as a means to prevent pressurisation, the control system should monitor each lock. Because Powered by EASA eRules Page 474 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS inadvertent depressurisation at altitude can be hazardous to the occupants, this control system should be considered in showing compliance with the applicable pressurisation system relia bility requirements. Normally, such systems should be automatically disconnected from the aeroplane’s pressurisation system after the aeroplane is airborne, provided no prior unsafe condition was detected.

(d) It should not be possible to override the pre ssurisation prevention system unless a procedure is defined in the Master Minimum Equipment List (MMEL) that confirms a fully closed, latched and locked condition. In order to prevent the override procedure from becoming routine, the override condition sh ould not be achievable by actions solely on the flight deck and should be automatically reset at each door operational cycle.

(c)(2) Doors that meet the conditions described in sub - paragraph (h) of this paragraph are not required to have a dedicated pressu risation prevention means if, from every possible position of the door, it will remain open to the extent that it prevents pressurisation or safely close and latch as pressurisation takes place. This must also be shown with any single failure and malfunct ion except that: (i) with failures or malfunctions in the latching mechanism, it need not latch after closing, and (ii) with jamming as a result of mechanical failure or blocking debris, the door need not close and latch if it can be shown that the pres surisation loads on the jammed door or mechanism would not result in an unsafe condition.

As specified in CS 25.783(d)(7) , each door for which unlatching would not result in a hazard is not required to have a locking mechanism; those doors also may not be required to have a dedicated pressurisation prevention means. However, this should be determined by demonstrating that an unsafe level of pressurisation cannot be achieved for each position that the door may take during closure, including those positions that may result from single failures or jams.

— Excluding jamming and excluding failures and malfunctions in the latching system, for every possible position of the door, it must either remain open to the extent that it prevents pressurisation, or safely cl ose and latch as pressurisation takes place; — With single failures of the latching system or malfunctions in the latching system the door may not necessarily be capable of latching, but it should either remain open to the extent that it prevents pressurisat ion, or safely move to the closed position as pressurisation takes place; and — With jamming as a result of mechanical failure in the latching system or blocking debris, the pressurisation loads on the jammed door or mechanism may not result in damage to the door or airframe that could be detrimental to safe flight (both the immediate flight or future flights). In this regard, consideration should be given to jams or non - frangible debris that could hold the door open just enough to still allow pressurisation , and then break loose in flight after full pressurisation is reached.

Powered by EASA eRules Page 475 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS CS 25.783(d) Latching and locking The latching and locking mechanisms must be designed as follows: (d)(1) There must be a provision to latch each door.

(a) The definitions of latches and locks are redefined in Chapter 3 [Definitions of Terms], particularly in regard to mechanical and structural elements of inward - opening plug doors. In this regard, fixed stops are not considered latches. Th e movable elements that hold the door in position relative to the fixed stops are considered latches. These movable elements prevent the door from opening and will support some loads in certain flight conditions, particularly when the aeroplane is unpress urised.

(b) For all doors, sub - paragraph CS 25.783(d)(2) requires that the latching system employ a securing means other than the locking system. The separate locking system may not be necessary for certain doors with an initial inward movement (see CS 25.783(d)(4) ).

(d)(2) The latches and their operating mechanism must be designed so that, under all aeroplane flight and ground loading conditions, with the door latched, there is no force or torque tending to unlatch the latches. In addition, the latchin g system must include a means to secure the latches in the latched position. This means must be independent of the locking system.

The latches of doors for which the initial opening movement is outward are typically subject to vibrations; structural l oads and deflections; positive and negative pressure loads; positive and negative ‘g’ loads; aerodynamic loads; etc. The latches of doors for which the initial opening movement is inward typically share some of these same types of loads with fixed stops. D oors for which the initial opening movement is inward tend to be resistant to opening when the aircraft is pressurised since a component of the pressure load tends to hold the door closed.

(a) Latch design. The design of the latch should be such that with the latch disconnected from its operating mechanism, the net reaction forces on the latch should not tend to unlatch the latch during both pressurised and unpressurised flight throughout the approved flight envelope. The effects of possible friction in res isting the forces on the latch should be ignored when considering reaction forces tending to unlatch the door. The effects of distortion of the latch and corresponding structural attachments should be taken into account in this determination. Any latch e lement for which ‘g’ loads could result in an unlatching force should be designed to minimise such forces.

(b) Latch securing means. Even though the principal back - driving forces should be eliminated by design, it is recognised that there may still be ratc heting forces that could progressively move the latches to the unlatched position. Therefore, each latch should be positively secured in the latched position by its operating mechanism, which should be effective throughout the approved flight envelope.

T he location of the operating system securing means will depend on the rigidity of the system and the tendency for any forces (such as ratcheting, etc.) at one latch to unlatch other latches.

Powered by EASA eRules Page 476 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (c) Over - centre features in the latching mechanism are considered to be an acceptable securing means, provided that an effective retaining feature that functions automatically to prevent back - driving is incorporated. If the design of the latch is such that it could be subject to ratcheting loads which might tend to unlatch it, the securing means should be adequate to resist such loads.

(d) Back - driving effect of switches. In those designs that use the latch to operate an electrical switch, any back - driving e ffect of the switch on the latch is permissible, provided that the extent of any possible movement of the switch — is insufficient to unlatch it; and — will not result in the latch being subjected to any other force or torque tending to unlatch it.

(e) The la tch securing means must be independent of the locking means. However, the latching and locking functions may be fulfilled by a single operating means, provided that it is not possible to back - drive the locks via the latch mechanism when the door locks are engaged with the latch mechanism.

(d)(3) Each door subject to pressurisation, and for which the initial opening movement is not inward must: (i) have an individual lock for each latch; (ii) have the lock located as close as practicable to the latch; and (iii) be designed so that during pressurised flight, no single failure in the locking system would prevent the locks from restraining the latches necessary to secure the door.

(a) To safeguard doors subject to pressurisation and for which the in itial opening movement is not inward, each latch must have an individual lock.

The lock should directly lock the latch. In this regard, the lock should be located directly at the latch to ensure that, in the event of a single failure in the latch operati ng mechanism, the lock would continue to restrain the latch in the latched position. Even in those cases where the lock cannot be located directly at the latch, the same objective should be achieved. In some cases, a pair of integrally - connected latches may be treated as a single latch with respect to the requirement for a lock provided that: 1) the lock reliably monitors the position of at least one of the load carrying elements of the latch, and 2) with any one latch element missing, the aeroplane can m eet the full requirements of CS - 25 as they apply to the unfailed aeroplane, and 3) with the pair disengaged, the aeroplane can achieve safe flight and landing, and meet the damage tolerance requirements of CS 25.571 [Damage - tolerance and fatigue evaluation of structure].

(b) In some designs more latches are provided than necessary to meet th e minimum design requirements. The single failure requirement for the locking system is intended to ensure that the number and combination of latches necessary to secure the door will remain restra ined by the locking mechanism. Only those latches needed to meet the minimum design requirements need to remain restra ined after the single failure.

Powered by EASA eRules Page 477 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (c) In meeting this requirement, the indirect locking provided through the latc h system by the locks at other latches may be considered. In this case, the locking system and the latching system between the locked latch and the unlocked latch should be designed to withstand the maximum design loads discussed in sub - paragraph d.(6) of this AMC, below, as appropriate to pressurised flight.

(d)(4) Each door for which the initial opening movement is inward, and unlatching of the door could result in a hazard, must have a locking means to prevent the latches from becoming disengaged. The l ocking means must ensure sufficient latching to prevent opening of the door even with a single failure of the latching mechanism.

For a door to be classified as having Initial Inward Opening Movement before opening outwards, and thus be eligible for some r elief regarding the locks compared with other outward opening doors, the following conditions should be fulfilled: a) Loads on the door resulting from positive pressure differential of the fuselage should be reacted by fixed (non moveable) structural stops on the door and fuselage doorframe.

b) The stops must be designed so that, under all 1g aeroplane level flight conditions, the door to fuselage stop interfaces produce no net force tending to move the door in the opening direction.

c) If the stops are use d to provide the initial inward opening movement, the stops should be designed such that they cause the door to move inwards, typically at a minimum angle of 3° relative to the mean pressure plane, opposing any positive fuselage pressure differential: 1) u ntil the door is in a position where it is clear of the fixed stops and is free to open, or 2) until the loads required to overcome friction between the door and fuselage stops are sufficient to prevent the door moving in an opening direction when the door is subjected to loads of +/ - 0.5g, or 3) if neither of the above options are appropriate, based on justified engineering judgement and agreed with the Agency.

d) If guides or other mechanisms are used to position the door such that it can move clear of the fixed stops in an opening direction, the means used should, be designed such that it causes the door to move inwards, typically at a minimum angle of 3° relative to the mean pressure plane, opposing any positive fuselage pressure differential and be sufficiently robust to function without significant loss of effectiveness when the door is subject to a differential pressure of 13.8 kPa (2 psi): 1) until the door is in a position where it is clear of the fixed stops and is free to open, or 2) unt il the loads required to overcome friction are sufficient to prevent the door moving in an opening direction when the door is subjected to loads of +/ - 0.5g,or 3) if neither of the above options are appropriate, based on justified engineering judgement a nd agreed with the Agency.

Powered by EASA eRules Page 478 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS On these doors, the locking means should monitor the latch securing means, but need not directly monitor and lock each latch. Additionally, the locking means could be located such that all latches are locked by locking the latchi ng mechanism. With any single failure in the latching mechanism, the means must still lock a sufficient number of latches to ensure that the door remains safely latched.

(d)(5) It must not be possible to position the lock in the locked position if the lat ch and the latching mechanism are not in the latched position.

The lock should be an effective monitor of the position of the latch such that, if any latch is unlatched, the complete locking system cannot be moved to the locked position.

Although an ove r - centre feature may be an adequate means of securing the latching mechanism, it is not considered to be the locking means for the latches.

(d)(6) It must not be possible to unlatch the latches with the locks in the locked position. Locks must be desig ned to withstand the limit loads resulting from: (i) the maximum operator effort when the latches are operated manually; (ii) the powered latch actuators, if installed; and (iii) the relative motion between the latch and the structural counterpart.

Alth ough the locks are not the primary means of keeping the latches engaged, they must have sufficient strength to withstand any loads likely to be imposed during all approved modes of door operation. The operating handle loads on manually - operated doors shou ld be based on a rational human factors evaluation. However, the application of forces on the handle in excess of 136 kg (300 pounds) need not be considered. The loads imposed by the normal powered latch actuators are generally predictable; however, load s imposed by alternate drive systems are not. For this reason the locks should have sufficient strength to react the stall forces of the latch drive system. Load - limiting devices should be installed in any alternate drive system for the latches in order to protect the latches and the locks from overload conditions. If the design of the latch is such that it could be subject to ratcheting loads which might tend to unlatch it, the locks should be adequate to resist such loads with the latch operating syste m disconnected from the latch.

(d)(7) Each door for which unlatching would not result in a hazard is not required to have a locking mechanism meeting the requirements of sub - paragraph (d)(3) through (d)(6) of this paragraph.

See sub - paragraph CS 25.783(h) of this AMC, below, for a description of doors for which unlatching is considered not to result in a safety hazard.

(d)(8) A door that could result in a hazard if not closed, must have means to prevent the latches from being moved to the latched position unless it can be shown that a door that is not closed would be clearly evident before flight.

For door security, it is good basic design philosophy to provide independent integrity in the closing, latching, locking and indication functions. The integrity of the closing function in particular is vulnerable to human factors and experience has shown that human error can occur resulting in an unsafe condition.

Door designs should incorporate a feature that prevents the latches from moving to the latched posi tion if the door is not closed. The importance of such a feature is that it Powered by EASA eRules Page 479 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS prevents the latched and locked functions from being completed when the door is not closed.

If the feature is provided by electronic means, the probability of failure to prevent the - 5 initiation of the latching sequence should be no greater than remote (1x10 /flight hour).

To avoid the potential for an unsafe condition, the means provided to indicate the closed position of the door under sub - paragraph (e) should be totally independ ent of the feature preventing initiation of the latching sequence.

As an alternative to providing the feature described above, reliance can be placed on trained cabin crew or flight crew members to determine that certain doors are not fully closed. This a lternative is applicable only to doors that are normally operated by these crew members, and where it is visually clearly evident from within the aircraft without detailed inspection under all operational lighting conditions that the door is not fully clos ed.

CS 25.783(e) Warning, caution and advisory indications Doors must be provided with the following indications: (e)(1) There must be a positive means to indicate at each door operator’s station that all required operations to close, latch, and lock the door(s) have been completed.

In order to minimise the probability of incomplete door operations, it should be possible to perform all operations for each door at one station. If there is more than one operator’s station for a single door, appropriate indications should be provided at each station. The positive means to indicate at the door operator’s station that all required operations have been completed are such things as final handle positions or indicating lights. This requirement is not intended to preclude or require a single station for multiple doors.

(e)(2) There must be a positive means, clearly visible from each operator station for each door that could be a hazard if unlatched, to indicate if the doo r is not fully closed, latched, and locked.

A single indication that directly monitors the door in the closed, latched and locked conditions should be provided unless the door operator has a visual indication that the door is fully closed latched and locked. This indication should be obvious to the door operator. For example, a vent door or indicator light that monitors the door locks and is located at the operator’s station may be sufficient. In case of an indicator light, it should not be less relia ble than the visual means in the cockpit as required per CS 25.783(e)(3) .

The same sensors could be used for both indications in order to prevent any discrepancy between the indications.

(e)(3) There must be a visual means on the flight deck to signal the pilots if any door is not fully closed, latched, and locked. The means must be designed such that any failure or combination of failures that would result in an erroneous closed, latched, and locked indication is remote for: (i) each door that is subject to pressurisation and for which the initial opening movement is not inward, or (ii) each door that could be a hazard if unlatched.

Powered by EASA eRules Page 480 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS The visual means may be a simple amber light or it may need to be a red warning light tied to the master warning system dep ending on the criticality of the door. The door closed, latched and locked functions must be monitored, but only one indicator is needed to signal that the door is in the closed, latched and locked condition. Indications should be reliable to ensure they remain credible. The probability of erroneous closed, latched, - 5 and locked indication should be no greater than remote (1x10 /flight hour) for: — each door subject to pressurisation and for which the initial opening movement is not inward; and for — each doo r that could be a hazard if unlatched.

(e)(4) There must be an aural warning to the pilots prior to or during the initial portion of take - off roll if any door is not fully closed, latched, and locked and its opening would prevent a safe take - off and retu rn to landing.

Where an unlatched door could open and prevent a safe take - off and return to landing, a more conspicuous aural warning is needed. It is intended that this system should function in a manner similar to the take - off configuration warning syst ems of CS 25.703 [Take - off Warning system]. The visual display for these doors may be either a red light or a display on the master warning system. Examples of doors requiring these aural warnings are: — doors for which the structural integrity of the fus elage would be compromised if the door is not fully closed, latched and locked, or — doors that, if open, would prevent rotation or interfere with controllability to an unacceptable level.

CS 25.783(f) Visual inspection provision Each door for which unlatching could be a hazard, must have provisions for direct visual inspection to determine, without ambiguity, if the door is fully closed, latched, and locked. The provision must be permanent and discern ible under operational lighting conditions or by means of a flashlight or equivalent light source.

A provision is necessary for direct visual inspection of the closed position of the door and the status of each of the latches and locks, because dispatch of an aeroplane may be permitted in some circumstances when a flight deck or other remote indication of an unsafe door remains after all door closing, latching and locking operations have been completed. Because the visual indication is used in these circ umstances to determine whether to permit flight with a remote indication of an unsafe door, the visual indication should have a higher level of integrity than, and be independent of, the remote indication.

(a) The provisions should: 1) allow direct viewing of the position of the locking mechanism to show, without ambiguity, whether or not each latch is latched and each lock is locked. For doors which do not have a lock for each latch, direct viewing of the position of the latches and restraining mechanism may be necessary for determining that all the latches are latched. Indirect viewing, such as by optical devices or indicator flags, may be acceptable provided that there is no failure mode that could allow a false latched or locked indication.

Powered by EASA eRules Page 481 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS 2) preclude false indication of the status of the latches and locks as a result of changes in the viewing angle. The status should be obvious without the need for any deductive processes by the person making the assessment.

3) be of a robust design so that, followi ng correct rigging, no unscheduled adjustment is required. Furthermore, the design should be resistant to unauthorised adjustment.

4) preclude mis - assembly that could result in a false latched and locked indication.

(b) If markings are used to assist the identification of the status of the latches and locks, such markings must include permanent physical features to ensure that the markings will remain accurately positioned.

(c) Although the visual means should be unambiguous in itself, placards and instr uctions may be necessary to interpret the status of the latches and locks.

(d) If optical devices or windows are used to view the latches and locks, it should be demonstrated that they provide a clear view and are not subject to fogging, obstruction from dislodged material or giving a false indication of the position of each latch and lock.

Such optical devices and window materials should be resistant to scratching, crazing and any other damage from all materials and fluids commonly used in the operation and cleaning of aeroplanes.

CS 25.783(g) Certain maintenance doors, removable emergency exits, and access panels Some doors not normally opened except for maintenance purposes or emergency evacuation and some access panels need not comply with certain sub - paragraphs of this paragraph as follows: (1) Access panels that are not subject to cabin pressurisation and would not be a hazard if open during flight need not comply with sub - paragraphs (a) through (f) of this paragraph, but must have a means to prevent inadvertent opening during flight.

(2) Inward - opening removable emergency exits that are not normally removed, except for maintenance purposes or emergency evacuation, and flight deck - openable windows n eed not comply with sub - paragraphs (c) and (f) of this paragraph.

(3) Maintenance doors that meet the conditions of sub - paragraph (h) of this paragraph, and for which a placard is provided limiting use to maintenance access, need not comply with sub - paragr aphs (c) and (f) of this paragraph.

Some doors not normally opened except for maintenance purposes or emergency evacuation and some access panels are not required to comply with certain sub - paragraphs of CS 25.783 as described in CS 25.783(g) . This general ly pertains to access panels outside pressurised compartments whose opening is of little or no consequence to safety and doors that are not used in normal operation and so are less subject to human errors or operational damage.

CS 25.783(h) Doors that are not a hazard For the purpose of this paragraph, a door is considered not to be a hazard in the unlatched condition during flight, provided it can be shown to meet all of the conditions as mentioned in CS 25.783 (h).

CS 25.783 recognises four categories of doors: Powered by EASA eRules Page 482 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTR UCTION PERSONNEL AND CARGO ACCOMMODATIONS — Doors for which the initial opening is not inward, and are presumed to be hazardous if they become unlatched.

— Doors for which the initial opening is inward, and could be a hazard if they become unlatched .

— Doors for which the initial opening is inward, and would not be a hazard if they become unlatched.

— Small access panels outside pressurised compartments for which opening is of little or no consequence to safety.

— CS 25.783(h) describes those attributes that are essential before a door in the normal (unfailed) condition can be considered not to be a hazard during flight.

6. STRUCTURAL REQUIREMENTS.

In accordance with CS 25.571 , the door structure, inclu ding its mechanical features (such as hinges, stops, and latches), that can be subjected to airframe loading conditions, should be designed to be damage tolerant. In assessing the extent of damage under CS 25.571 a nd CS 25.783 consideration should be given to single element failures in the primary door structure, such as frames, stringers, intercostals, latches, hinges, stops and stop supports.

The skin panels on doors shoul d be designed to be damage tolerant with a high probability of detecting any crack before the crack causes door failure or cabin decompression.

Note: This paragraph applies only to aircraft with a certification basis including CS 25.571 or equivalent requirements for damage tolerance.

[Amdt 2 5/4] [Amdt 25/6] [Amdt 25/8] [Amdt 25/11]

CS 25.785 Seats, berths, safety belts and harnesses

ED Decision 20 17 / 015 /R (See AMC 25.785 ) (a) A seat (or berth for a non - ambulant person) must be provided for each occupant who has reached his or her second birthday.

(b) Each seat, berth, safety belt, harness, and adjacent part of the aeroplane at each station designated as occupiable d uring take - off and landing must be designed so that a person making proper use of these facilities will not suffer serious injury in an emergency landing as a result of the inertia forces specified in CS 25.561 and CS 25.562 . However, berths intended only for the carriage of medical patients (e.g. stretchers) need not comply with the requirements of CS 25.562 .

(c) Each seat or berth must be approved.

(d) Each occupant of a seat that makes more than an 18 - degree angle with the vertical plane containing the aeroplane centre line must be protected from head injury by a safety belt and an energy absorbing rest that will support the arms, shoulders, head and spine, or by a safety belt and shoulder harness that will prevent the head from contacting any injurious object. Each occupant of any other seat must be protected from head injury by a safety belt and, as Powered by EASA eRules Page 483 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS appropriate to the type, location, and angle of facing of each seat, by one or more of the following: (1) A shoulder harness that will prevent the head from contacting any injurious object.

(2) The elimination of any injurious object within striking radius of the head.

(3) An ene rgy absorbing rest that will support the arms, shoulders, head and spine.

(e) Each berth must be designed so that the forward part has a padded end board, canvas diaphragm, or equivalent means, that can withstand the static load reaction of the occupant wh en subjected to the forward inertia force specified in CS 25.561 . Berths must be free from corners and protuberances likely to cause injury to a person occupying the berth during emergency conditions.

(f) Each seat or berth, and its supporting structure, and each safety belt or harness and its anchorage must be designed for an occupant weight of 77 kg (170 pounds), considering the maximum load factors, inertia forces, and reactions among the occupant, seat, safety b elt, and harness for each relevant flight and ground load condition (including the emergency landing conditions prescribed in CS 25.561 ). In addition – (1) The structural analysis and testing of the seats, berths, and their supporting structures may be determined by assuming that the critical load in the forward, sideward, downward, upward, and rearward directions (as determined from the prescribed flight, ground, and emergency landing conditions) acts separately or using selected combinations of loads if the required strength in each specified direction is substantiated.

The forward load factor need not be applied to safety belts for berths.

(2) Each pilot seat must be designed for the reactions resulting from the a pplication of the pilot forces prescribed in CS 25.395 .

(3) For the determination of the strength of the local attachments of – (i) Each seat to the structure; and (ii) Each belt or harness to the seat or structure; a multiplication factor of 1·33 instead of the fitting factor as defined in CS 25.625 should be used for the inertia forces specified in CS 25.561 . (For the lateral forces according to CS 25.561(b)(3) 1·33 times 3·0 g should be used.)

(g) Each crewmember seat at a flight - deck station must have a shoulder harness. These seats must meet th e strength requirements of sub - paragraph (f) of this paragraph, except that where a seat forms part of the load path, the safety belt or shoulder harness attachments need only be proved to be not less strong than the actual strength of the seat. (See AMC 25.785(g) .)

(h) Each seat located in the passenger compartment and designated for use during take - off and landing by a cabin crewmember required by the Operating Rules must be: (1) Near a required floor level emerge ncy exit, except that another location is acceptable if the emergency egress of passengers would be enhanced with that location. A cabin crewmember seat must be located adjacent to each Type A or B emergency exit. Other cabin crewmember seats must be evenl y distributed among the required floor level emergency exits to the extent feasible.

(2) To the extent possible, without compromising proximity to a required floor level emergency exit, located to provide a direct view of the cabin area for which the cabin crewmember is responsible. (See AMC 25.785(h)(2) ) Powered by EASA eRules Page 484 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (3) Positioned so that the seat will not interfere with the use of a passageway or exit when the seat is not in use.

(4) Located to minimise the probability that o ccupants would suffer injury by being struck by items dislodged from service areas, stowage compartments, or service equipment.

(5) Either forward or rearward facing with an energy absorbing rest that is designed to support the arms, shoulders, head and sp ine.

(6) Equipped with a restraint system consisting of a combined safety belt and shoulder harness unit with a single point release. There must be means to secure each restraint system when not in use to prevent interference with rapid egress in an emerge ncy.

(i) Each safety belt must be equipped with a metal - to - metal latching device.

(j) If the seat backs do not provide a firm handhold, there must be a handgrip or rail along each aisle to enable persons to steady themselves while using the aisles in moder ately rough air.

(k) Each projecting object that would injure persons seated or moving about the aeroplane in normal flight must be padded.

(l) Each forward observer’s seat required by the operating rules must be shown to be suitable for use in conducting the necessary en - route inspections.

[Amdt 25/11] [Amdt 25/12] [Amdt 25/13] [Amdt 25/17] [Amdt 25/19]

AMC 25.785 Seats, Berths, Safety B elts and H arnesses

ED Decision 2020/024/R FAA Advisory Circular (AC) 25.785 - 1B, Flight Attendant Seat and Torso Restraint System Installations , dated 11.5.2010, and the relevant parts of FAA AC 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016, are accep ted by the Agency as providing an acceptable means of compliance with CS 25.785 .

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

Beds, berths, or divans convertible into a bed should be equipped with a restraint device (e.g. a belt) for use by the occupant(s) when sleeping. Beds, berths, etc. that may be occupied by more than one occupant may be equipped with a single belt.

[Amdt 25/17] [ Amdt 25/19] [Amdt 25/26]

AMC 25.785(g) Seats, berths, safety belts and h arnesses

ED Decision 2003/2/RM Where there is a risk that a safety belt or harness might, when not in use, foul the controls or impede the crew, suitable stowage should be provided, u nless it can be shown that the risk can be avoided by the appli cation of suitable crew drills.

Powered by EASA eRules Page 485 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

AMC 25.785(h)(2) Cabin Attendant Direct View

ED Decision 2017/015/R If the total number of passenger seats approved for occupancy during taxiing, take - off, and l anding is greater than the approved passenger seating configuration, the demonstration of compliance with the direct - view requirements should consider the most adverse combination of occupied seats, assuming the full passenger load on board.

[Amdt 25/19]

C S 25.787 Stowage compartments

ED Decision 2016 / 010/R (See AMC 25.787) (a) Each compartment for the stowage of cargo, baggage, carry - on articles and equipment (such as life rafts) and any other stowage compartment must be designed for its placarded maximum weight of contents and for the critical load distribution at the appropriate maximum load factors corresponding to the specified flight and ground load conditions and, where the breaking loose of the contents of such compartments could – (1) Cause direct i njury to occupants; (2) Penetrate fuel tanks or lines or cause fire or explosion hazard by damage to adjacent systems; or (3) Nullify any of the escape facilities provided for use after an emergency landing, to the emergency landing conditions of CS 25.561(b)(3) .

If the aeroplane has a passenger - seating configuration, excluding pilot seat s, of 10 seats or more, each stowage compartment in the passenger cabin, except for under seat and overhead compartments for passenger convenience, must be completely enclosed.

(b) There must be a means to prevent the contents in the compartments from becoming a hazard by shifting, under the loads specified in sub - paragraph (a) of this paragraph. (See AMC 25.787(b) ) (c) If cargo compartment lamps are installed, each lamp must be installed so as to prevent contact between lamp bulb and cargo.

[Amdt 25/18] Powered by EASA eRules Page 486 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

AMC 25.787(b) Stowage c ompartments

ED Decision 2017/015/R For stowage compartments in the passenger and crew compartments it must be shown by analysis and/or tests that under the load conditi ons as specified in CS 25.561(b)(3) , the retention items such as doors, swivels, latches etc., are still performing their retention function. In the analysis and/or tests the expected wear and deterioratio n should be taken into account.

Stowage Compartment Latching Mechanisms: (1) The following areas shall be considered in a special cabin interior for the purpose of designing latching mechanisms: — Cabin crew member areas: Cabin crew member areas are those areas in the passenger cabin where cabin crew members may be seated during taxiing, take - off, and landing (these are typically zones in proximity to floor level emergency exits, although other areas may exist).

To protect flight attendants from being struck by items dislodged from galley stowage compartments, it is common practice to install additional restraint devices (dual latching) to each stowage compartment located within a longitudinal distance equal to three rows of seats fore and aft of the cabin attend ant seats. However, the following additional considerations may be used: — A longitudinal distance of 2 metres (6.6 ft) may be used in case the ‘three rows’ criterion is difficult to assess due to widely spaced seating, — Underseat and overhead stowage bins do not need to be considered, and — A stowage compartment located in a closed unoccupied area during taxiing, take - off, and landing or behind a partition in the passenger cabin does not need to be considered.

— Passenger Areas: Passengers Areas are zones in which passenger seats designed for occupancy during taxiing, take - off, and landing are installed. In such cabin areas, if the means used to prevent the contents of the compartments from becoming a hazard by shifting is a latched door, the design should ta ke into consideration the wear and deterioration expected in service.

— Non TTOL Areas: Non - TTOL areas are zones, separated from the remainder of the cabin by means of a door during taxiing, take - off, and landing (TTOL), in which no seat is installed (pass enger or crew member) that may be occupied during taxiing, take - off, and landing, and which do not include any part of any possible egress route from the aeroplane (such areas may be for example lavatories, washrooms, bedrooms, closed galleys, etc.).

In such areas, a single latch mechanism for stowage compartments is acceptable, provided that the door separating this area from the rest of the cabin is shown to be capable of staying securely closed under the applicable emergency landing conditions of CS 25 .561 with an additional inertia load, uniformly distributed on the door, equating to the highest placarded allowable single compartment contents mass inside that area. Such single latch mechanisms do not need to be designed to account for the wear and dete rioration expected in service.

Powered by EASA eRules Page 487 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (2) The following is provided as a clarification of the considerations to be followed when designing latching mechanisms, as well as of the means by which wear and deterioration expected in service may be substantiated: — Single latch: A single latch is a latc hing mechanism capable of retaining a load derived from the specified maximum flight, ground and emergency landing load conditions.

— Dual latch: A dual latch is a latching mechanism composed of two independent single latching mechanisms each of which is c apable of retaining a load determined by the specified maximum flight, ground and emergency landing load conditions. It is acceptable that a single operating mechanism (e.g. handle) operates with two independent latching mechanisms at the same time.

— Latch fail indication Latch fail indication is any means that permits clear visual confirmation that a latch is not properly engaged. In the case of a dual latching system, a single indication may serve for the two latches if it is ensured that the failure of either latch to properly engage will result in latch fail indication. All latches, whether single or dual, should include a latch fail indication.

— Wear and Deterioration — Dual latching is a means of compliance to the wear and deterioration requirement. Wh ere dual latches are installed there is no need to further demonstrate wear and tear.

— Consideration of wear and deterioration for single latches should be substantiated by test evidence, or analysis based on test evidence, showing that latch operation as intended by the design will be maintained following a simulation of full service life, with an appropriate scatter factor. A design life of 20 000 latch cycles may be used except if EASA finds the expected use of the aeroplane justifies more endurance sub stantiation. Demonstration of a 20 000 cycle design life can be accomplished by submitting the latch to a 100 000 cycle test representative of operational use, and verifying after the test that the latch is still able to operate as intended and is capable of withstanding ultimate load without failure.

(3) The above considerations regarding latching mechanisms, do not apply to compartments not accessible in flight for which a special tool is needed to gain access to (e.g.

maintenance panel, access panels, etc.).

[Amdt 25/19] Powered by EASA eRules Page 488 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

CS 25.788 Passenger amenities

ED Decision 2017/015/R (See AMC 25.788) (a) Showers: If a shower cubicle is installed (See AMC 25.788(a) and AMC 25.1447(c)(3)): (1) audio and visual ‘Return to seat’ indications, readily audible and visi ble to a shower - cubicle occupant, and activated at the same time as the signs required by CS 25.791(b), must be provided; (2) audio and visual indications of the need for oxygen use, readily audible and visible to a shower - cubicle occupant, and activated i n the case of cabin depressurisation or deployment of the oxygen - dispensing units in the cabin, must be provided; (3) placards must be installed to indicate that the shower cubicle must not be used for the stowage of cargo or passenger baggage; (4) there m ust be means in the cubicle to steady oneself in moderately rough air; and (5) the shower cubicle must be designed in a way to preclude anyone from being trapped inside. If a locking mechanism is installed, it must be capable of being unlocked from the inside and the outside without the aid of any tool.

(b) Large display panels: Any large display panel installed in the passenger compartment must not be a source of danger to occupants when submitted to any of the following conditions (See AMC 25.788(b)): (1) each relevant flight and ground load conditions (including the emergency landing conditions prescribed in CS 25.561); (2) any load to be expected in service; and (3) a cabin depressurisation.

[Amdt 25/19]

AMC 25.788(a) Installation of Showers

ED Deci sion 2017/015/R The following should be considered in the design of a shower installation: (a) An analysis should be performed to identify possible failures leading to water leakage, and to show that appropriate mitigation features have been included in the design.

(b) The shower cubicle should be considered as a passenger compartment in terms of the need for ventilation. The applicant should justify that adequate ventilation is provided within the shower. The cabin air itself can be considered as a ‘fresh air’ source for the air supply of the shower.

(c) The shower cubicle air outflow should be directed into aeroplane areas that will not be adversely affected by the high water content of this air flow.

(d) A means to steady oneself could be either (a) firm handhold(s) specifically designed and provided for the purpose or an intrinsic design fea ture of the cubicle. For instance, if one or more of the cubicle wall - to - wall dimensions does not exceed 1 metre (3.3 feet), it may be assumed that an occupant can steady himself/herself by placing his/her hands on opposite wall surfaces.

Powered by EASA eRules Page 489 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (e) If electric al power outlets are installed in the room or area where the shower is present, all the following requirements should be fulfilled: (i) the shower cubicle should be enclosed up to the ceiling; (ii) there should be no electrical power outlet inside the shower cubicle; and (iii) no power outlet should be placed closer than 0,6m from any point on the surface of the closed shower door.

[Amdt 25/19]

AMC 25.788(b) Large Display Panels

ED Decision 2017/015/R 1. General This AMC does not apply to flight dec k display panels. A display panel should be considered large if its diagonal is greater than 51 cm (20 in.).

Any large display panel should be shown not to be a hazard during events such as emergency landing and cabin depressurisation. It should meet the following requirements: (a) the large display panel should withstand the differential pressures caused by a worst - case cabin depressurisation event without having any adverse effect (for instance no substances should be released through cracks or open ings, no sharp edges should be created); (b) the large display panel should be subjected to, and pass, abuse load testing (see paragraph 3 below); (c) the installation should withstand the inertia loads outlined in CS 25.561(b)(3) without any adverse e ffect; and (d) if the large display panel incorporates glass, it should be subjected to, and pass, ball impact testing (see paragraph 2 below).

With the exception of the ball impact testing, large display panels incorporating any glass element should wi thstand the above - defined loads with no more than minor cracks (i.e. no parts released nor the surface becoming a hazard) and without becoming dislodged from their mounts. Alternatively, the installation may still be found acceptable if some means, such as a protective cover, are provided to shield the passenger cabin from the glass monitor. The installation including its protective cover should meet all the relevant criteria identified in this AMC. Furthermore, the cover should not introduce additional haz ardous characteristics of its own and should comply with all pertinent aeroplane certification r equirements, e.g.

flammability.

Unless it has been shown that the display panel withstands all the mechanical tests in paragraphs 1.(a) to (d) above without any damage that would result in the release of chemical substances into the cabin, documentation should be provided from medical authorities which substantiates that the type and amount of chemical substances released into the cabin in case of fail ure would not result in adverse health effects on cabin occupants. The specific cabin volume may be considered. Alternatively, it is acceptable to show that each installed glass screen complies with A 4(1) of Directive 2002/95/EC ‘on the restriction of the use of certain hazardous substances in electrical and electronic equipment’ (RoHS).

Powered by EASA eRules Page 490 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS 2. Ball Impact Testing (only for display panels containing glass) The test procedure and pass/fail criteria of the Underwriters Laboratories standard UL 61965, Mechani cal safety for cathode ray tubes, Edition 2, 27 July 2004 or former UL 1418, Standard for safety cathode ray tubes, Edition 5, 31 December 1992, or other equivalent approved method, are the basis of the ball impact strength and no - hole tests described in t his paragraph.

The large display panel should be installed in a test fixture representative of the actual installation in the cabin.

2.1. Strength Test The large display panel should be subjected to a single impact applied in accordance with the test conditions of paragraph 2.3 below. The impact energy should be 7 J, caused by a 51 - mm diameter ball or, alternatively, 5.5 J, caused by a 40 - mm diameter ball, as specified in paragraph 2.3.2 below.

The test is passed if the expulsion of glass within a 1 - min period after the initial impact satisfies the following criteria: (a) there is no glass particle (a single piece of glass having a mass greater than 0.025 g) between the 0.90 and 1.50 - m barriers (see paragraph 2.3.1); (b) the total mass of all piec es of glass between the 0.90 and 1.50 - m barriers (see paragraph 2.3.1) does not exceed 0.1 g; and (c) there is no glass expelled beyond the 1.50 - m barrier (see paragraph 2.3.1).

2.2 No - Hole Test The large display panel should be subjected to a single impact applied in accordance with the test conditions of paragraph 2.3 below. The impact energy should be 3.5 J, caused by a 51 - mm diameter ball as specified in P 2.3.2 below.

The test is passed if the large display panel does not develop any opening that may allow a 3 - mm diameter rod to enter. Cracking of the panel is permitted.

Note: If the large display panel does not develop any opening that would allow a 3 - mm rod to enter when subjected to the strength test defined in paragraph 2.1 above, the no - hole test defined in this paragraph does not need to be performed.

2.3 Test Conditions 2.3.1 Test Apparatus and Setup The centre of the large glass item should be 1.00 ± 0.05 m above the floor.

For the strength test (see paragraph 2.1 above), two barrier s, each one made of material 10 – 20 mm thick, 250 mm high, and 2.00 m long, should be placed on the floor in front of the test item (or on both sides in case of a glass partition) at the specified location, measured horizontally from the front surface of th e large glass item to the near surface of the barrier. The barriers may be less than 2.00 m long, provided that they extend to the walls of the test room. A non - skid surface such as a blanket or rug may be placed on the floor.

A solid, smooth, steel ball of the size specified in paragraph 2.3.2 below should be suspended by suitable means such as a fine wire or chain and allowed to fall freely as a pendulum and strike the large glass item with the specified impact energy. The lar ge glass item should be placed in a way that its surface is vertical and in the same Powered by EASA eRules Page 491 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIO NS vertical plane as the suspension point of the pendulum. A single impact should be applied to any point on the surface of the large glass item at a distance of at least 25 mm from the edge of the surface.

2.3.2 Impact Objects The 51 - mm diameter steel ball used as an impact object should have a mass of approximately 0.5 kg and a minimum Scale C Rockwell Hardness of 60.

The 40 - mm diameter steel ball used as an impact objec t should have a mass of approximately 0.23 kg and a minimum Scale C Rockwell Hardness of 60.

3. Abuse Load Tests (all large display panels) Large display panels should withstand a 133 daN (300 lbf) static abuse load applied, in separate tests, in 5 diff erent locations: in the centre, at the opposite corners (two separate tests), along the perimeter, at the midpoints of the short and long sides (two separate tests), or at an equivalent set of locations acceptable to EASA (see Figure 2 below).

For all the tests to be performed, the display panels should be mounted in a test fixture representative of the actual installation in the cabin.

For the above - mentioned load applications, it is acceptable to use any loading pad with a shape and dimension s that fit into a 15.24 - cm (6 - in.) diameter circle.

The display panels should withstand the applied loads without any adverse effect (e.g. glass elements, if present, cracking or breaking, the unit becoming dislodged from its mounts, substances released t hrough cracks or openings, or sharp edges created).

During the test, it is acceptable for the display to suffer minor failures, such as minor cracks, provided that no parts are detached and the surface does not become a hazard to occupants.

Large display panel Area of load application 1 4 Figure 2 — Load Cases 1) centre loading; 2) corner loading; 3) opposite - corner loading; 4) short - side - midpoint perimeter loading; and 5) long - side - midpoint perimeter loading.

[Amdt 25/19] Powered by EASA eRules Page 492 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

CS 25.789 Retention of items of mass in passenger and crew

compartments and galleys

ED Decision 2003/2/RM (a) Means must be provided to prevent each item of mass (that is part of the aeroplane type design) in a passenger or crew compartment or galley from becoming a hazard by shifting under the appropriate maximum load factors corresponding to the specified flight and ground load conditions, and to the emerge ncy landing conditions of CS 25.561(b) .

(b) Each interphone restraint system must be designed so that when subjected to the load factors specified in CS 25.561(b)(3) , the interphone will remain in its stowed position.

CS 25.791 Passenger information signs and placards

ED Decision 2019/013/R (See AMC 25.791 ) (a) If smoking is to be prohibited, there must be at least one placard so stating that is legible to each person seated in the cabin. If smoking is to be allowed, and if the crew compartment is separated from the passenger compartment, there must be at least one sign notifying when smoking is prohibited. Signs, which notify when smoking is prohibited, must be installed so as to be operable from either pilot’s seat and, when illuminated, must be legible under all probable conditions of cabin illumination to each person seated in the cabin.

(b) Signs that notify when sea t belts should be fastened and that are installed to comply with the Operating Rules must be installed so as to be operable from either pilot’s seat and, when illuminated, must be legible under all probable conditions of cabin illumination to each person s eated in the cabin.

(c) A placard must be located on or adjacent to the door of each receptacle used for the disposal of flammable waste materials to indicate that use of the receptacle for disposal of cigarettes, etc., is prohibited.

(d) Lavatories must h ave ‘No Smoking’ or ‘No Smoking in Lavatory’ placards conspicuously located on or adjacent to each side of the entry door.

(e) Symbols that clearly express the intent of the sign or placard may be used in lieu of letters.

[Amdt No: 25/23]

AMC 25.791 Passen ger information signs and placards

ED Decision 2020/024/R The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016, are accepted by the Agency as providing acceptable m eans of compliance with CS 25.791 .

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

[Amdt 25/11] [Amdt 25/26] Powered by EASA eRules Page 493 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AN D CARGO ACCOMMODATIONS

CS 25.793 Floor surfaces

ED Decision 2015/019/R (See AMC to CS 25.793 and 25.810(c) ) The floor surface of all areas, which are likely to become wet in service, must have slip resistant properties.

[Amdt 25/17]

AMC 25.793 and 25.810(c) Floor surfaces

ED Decision 2020/024/R The slip - resistant properties of floor surface material should be tested wet with the type of slippery liquid expected during operation. In addition, dry testing should also be conducted to provide reference friction values. In all the test conditions, the dynamic coefficient of friction (DCOF) should be at least 0.45.

The following standard methods, using rubber and leather test devices, are acceptable (within their limitations) to conduct the testing: — Military Specifications MIL - W - 5044B (dated 24 February 1964) and MIL - W - 5044C (dated 25 August 1970), titled ‘Walkway Co mpound, Nonslip and Walkway Matting, Nonslip’, — DIN 51131:2014 - 02, titled ‘Testing of floor coverings - Determination of the anti - slip property - Method for measurement of the sliding friction coefficient’, — ISO 8295:1995, titled ‘Plastics - Film and sheetin g - Determination of coefficients of friction’, — EN 13893:2002, titled ‘Resilient, laminate and textile floor coverings - Measurement of dynamic coefficient of friction on dry floor surfaces’, ANSI/NFSI B101.3 - 2012, titled ‘Test Method for Measuring Wet DCO F of Common Hard - Surface Floor Materials’.

[Amdt 25/17] [Amdt 25/26]

CS 25.795 Security considerations

ED Decision 2016 / 010 /R (see AMC 25.795 ) (a) Protection of flightdeck. If a secure flightdeck door is required by operating rules, the bulkhead, door, and any other accessible boundary separating the flight crew compartment from occupied areas must be designed to : (1) Resist forcible intrusion by una uthoris ed persons and be capable of withstanding impacts of 300 Joules (221.3 footpounds) as well as a 1 113 Newton (250 pound) tensile load on accessible handholds, including the doorknob or handle (See AMC 25.795( a)(1) ); and (2) Resist penetration by small arms fire and fragmentation devices by meeting the following projectile definitions and projectile speeds .

(i) Demonstration Projectile #1. A 9 mm full metal jacket, round nose (FMJ RN) bullet with nominal mass of 8.0 g (124 grain) and reference velocity 436 m/s (1,430 ft/s) .

Powered by EASA eRules Page 494 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (ii) Demonstration Projectile #2. A .44 Magnum, jacketed hollow point (JHP) bullet with nominal mass of 15.6 g (240 grain) and reference velocity 436 m/s (1, 430 ft/s) .

(See AMC 25.795(a)(2) ) (b) Aeroplanes with a certificated passenger seating capacity of more than 60 persons or a maximum take - off weight of over 45 500 Kg (100 000 lb) must be designed to limit the effects of an explosive or incen diary device as follows: (1) Flight deck smoke protection. Means must be provided to limit entry of smoke, fumes, and noxious gases into the flight deck. (See AMC 25.795(b)(1) ) (2) Passenger cabin smoke protectio n. Except for aeroplanes intended to be used solely for the transport of cargo, means must be provided to prevent passenger incapacitation in the cabin resulting from smoke, fumes, and noxious gases as represented by the initial combined volumetric concent rations of 0.59% carbon monoxide and 1.23% carbon dioxide. (See AMC 25.795(b)(2) ) (3) Cargo compartment fire suppression. An extinguishing agent must be capable of suppressing a fire. All cargo - compartment fire suppression - system components must be designed to withstand the following effects, including support structure displacements or adjacent materials displacing against the distribution system: (i) Impact or damage from a 13 mm (0.5 - in ch) - diameter aluminium sphere travelling at 131 m/s (430 feet per second); (ii) A 103 kPa (15 psi) pressure load if the projected surface area of the component is greater than 0,4 square meter (4 square feet). Any single dimension greater than 1,2 meters (4 feet) may be assumed to be 1,2 meters (4 feet) in length; and (iii) A 15 cm (6 - inch) displacement, except where limited by the fuselage contour, from a single point force applied anywhere along the distribution system where relative movement between t he system and its attachment can occur.

(iv) Paragraphs (b)(3)(i) through (iii) of this paragraph do not apply to components that are redundant and separated in accordance with paragraph (c)(2) of this paragraph or are installed remotely from the cargo co mpartment. (See AMC 25.795(b)(3) ) (c) An aeroplane with a certificated passenger seating capacity of more than 60 persons or a maximum take - off weight of over 45 500 Kg (100,000 lbs) must comply with the following: (1) Least risk bomb location. Except for aeroplanes intended to be used solely for the transport of cargo, an aeroplane must be designed with a designated location where a bomb or other explosive device could be placed to best protect integrity of the st ructure and flight - critical systems from damage in the case of detonation. (See AMC 25.795(c)(1) ) (2) Survivability of systems.

(i) Except where impracticable, redundant aeroplane systems necessary for continued safe flight and landing must be physically separated, at a minimum, by an amount equal to a sphere of diameter Powered by EASA eRules Page 495 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONS TRUCTION PERSONNEL AND CARGO ACCOMMODATIONS ) / ( 2  H D = (where H is defined under paragraph 25.365(e)(2) and D need not exceed 1,54 meters (5.05 feet).

The sphere is applied everywhere within the fuselage - limited by the forward bulkhead and the aft bulkhead of the passenger cabin and cargo compartment beyond which only one - half the sphere is applied.

(ii) Where compliance with sub - paragraph (c)(2)(i) of this paragraph is imp racticable, other design precautions must be taken to maximise the survivability of those systems. (See AMC 25.795(c)(2) ) (3) Interior design to facilitate searches. Except for aeroplanes intended to be used solel y for the transport of cargo, design features must be incorporated that will deter concealment or promote discovery of weapons, explosives, or other objects from a simple inspection in the following areas of the aeroplane cabin: (i) Areas above the overhe ad bins must be designed to prevent objects from being hidden from view in a simple search from the aisle. Designs that prevent concealment of objects with volumes 0.33 cubic decimetre (20 cubic inches) and greater satisfy this requirement.

(ii) Toilets m ust be designed to prevent the passage of solid objects greater than 5 cm (2.0 inches) in diameter.

(iii) Life preservers or their storage locations must be designed so that tampering is evident. (See AMC 25.795(c )(3) ) (d) Each chemical oxygen generator or its installation must be designed to be secure from deliberate manipulation by one of the following: (1) By providing effective resistance to tampering; (2) By providing an effective combination of resistance to tampering and active tamper - evident features; (3) By installation in a location or manner whereby any attempt to access the generator would be immediately obvious; or (4) By a combination of approa ches specified in subparagraphs (d)(1), (d)(2) and (d)(3) of this paragraph. (See AMC 25.795(d) ) [Amdt 25/9] [Amdt 25/17] [Amdt 25/18]

AMC 25.795 Security considerations

ED Decision 2003/ 2/RM Referenced Documentati on: — FAA memorandum, Subject Information: Certification of strengthened Flight Deck Doors on Transport Category Airplanes, Or iginal release 6 November 2001.

Powered by EASA eRules Page 496 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

AMC 25.795(a)(1) Flightdeck intrusion resistance

ED Decision 2010 / 005/R Referenced Documentation: — Federal Aviation Administration Advisory Circular (AC) 25.795 - 1 A , Flightdeck Intrusion Resista nce, issue date 24 October 2008 .

[Amdt 25/9]

AMC 25.795(a)(2) Flightdeck penetration resistance

ED Decision 2010 / 005/R Referenced Documentation: — Federal Aviation Administration Advisory Circular (AC) 25.795 - 2 A , Flightdeck Penetration Resista nce, issue date 24 October 2008 .

— Level IIIA of the (US) National Institute of Justice, Ballistic Resistance of Personal Body Armor, N IJ Standard 0101.04, Office of Science and Technology, Washington, D.C. 20531, September 2000.

[Amdt 25/9]

AMC 25.795(b)(1) Flight deck smoke protection

ED Decision 2010/005/R Referenced Documentation: — Federal Aviation Administration Advisory Circular (AC) 25.795 - 3, Flight deck Protection (smoke and fumes), issue date 24 October 2008.

[Amdt 25/9]

AMC 25.795(b)(2) Passenger cabin smoke protection

ED Decision 2010/005/R Referenced Documentation: — Federal Aviation Administration Advisory Circular (AC) 25.795 - 4, Passenger Cabin Smoke Protection, issue date 24 October 2008.

[Amdt 25/9]

AMC 25.795(b)(3) Cargo compartment fire suppression

ED Decision 2010/005/R Referenced Documentation: — Federal Aviation Administration Advisory Circular (AC) 25.795 - 5, Cargo Compartment Fire Suppression, issue date 24 October 2008.

[Amdt 25/9] Powered by EASA eRules Page 497 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS

AMC 25.795(c)(1) Least risk bomb location

ED Decision 2010/005/R Referenced Documentation: — Federal Aviation Administration Advisory Circular (AC) 25.795 - 6, Least Risk Bo mb Location, issue date 24 October 2008.

[Amdt 25/9]

AMC 25.795(c)(2) Survivability of systems

ED Decision 2010/005/R Referenced Documentation: — Federal Aviation Administration Advisory Circular (AC) 25.795 - 7, Survivability of Systems, issue date 24 October 2008.

[Amdt 25/9]

AMC 25.795(c)(3) Interior design to facilitate searches

ED Decision 2010/005/R Referenced Documentation: — Federal Aviation Administration Advisory Circular (AC) 25.795 - 8, Interior design to facilitate searches, issue date 24 Octob er 2008.

[Amdt 25/9]

AMC 25.795(d) Security of chemical oxygen generators

ED Decision 2015/019/R 1. Purpose CS 25.795(d) requires each Chemical Oxygen Generator (COG) or its installation to be designed so that it meets one of several criteria. The means of compliance described in this AMC provides guidance to supplement the engineering and operational judgment that should f orm the basis of any compliance findings related to a COG installed on an aeroplane.

2. Definition of terms For this AMC, the following definitions apply: (a) Access: The ability to manipulate the COG with the intent of making alterations for a purpose f or which the COG was not originally designed. This includes gaining access to the area surrounding the COG.

(b) Activation: Release of the firing mechanism of the COG for the purpose of initiating the chemical reaction inside.

(c) Alteration : A change in the configuration of the COG once ‘access’ has been gained for the purpose of using the COG for a function other than the one it is intended for.

(d) Chemical Oxygen Generator (COG): A device that releases oxygen that is created from a chemical reaction .

Powered by EASA eRules Page 498 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS (e) Immediately obvious: Where an attempt to gain ‘access’ to the COG would be readily recognised as suspicious (prior to gaining ‘access’). This would only be in locations with ‘unrestricted access’ that are ‘observable’.

(f) Intervention : The actions crew members must take to prevent damage to the aeroplane once an alert is activated indicating that the COG is being tampered with. The time it takes to intervene when the lavatory is occupied has not been determined; however, it can be assumed that it will take several minutes to resolve the issue.

(g) Observable : A crew member is able to see if a person attempts to gain ‘access’ to a COG installation during the course of the crew member’s normal duties.

(h) Tamper - evident feature: A unique feature that provides an active and o bvious contemporaneous alert to crew members that someone is trying to gain ‘access’ to the COG and immediate crew ‘intervention’ is necessary.

(i) Tamper - resistance: The level of deterrence for gaining ‘access’ to the COG.

(j) Unrestricted access: An ar ea of the cabin passengers can enter without overcoming locks or other mechanical closure means.

3. Related Certification Specifications (CSs) CS 25.795 Security considerations CS 25.1301 Equipment — Function and installation CS 25.1309 Equipment, systems, and installations CS 25.1322 Flight crew alerting CS 25.1450 Chemical oxygen generators 4. Compliance with CS 25.795(d) (a) Acceptable means of determining if a COG or its installation is designed to be secure Several crit eria may be used for determining if a COG installation is secure or has a security vulnerability. COG installations with a security vulnerability must include design features to prevent potential misuse of the COG. Figure 1, Criteria for Assessing an Insta llation, includes assessment criteria that can be used for determining if a COG installation has a security vulnerability. Table 1 includes guidance to assist in answering the questions in Figure 1. For installations identified as having security vulnerabi lities, such as those for which the answers to the assessment statements in Figure 1 result in the answer to question number 4 being yes, the design should be changed. Alternatively, the COG can be replaced with an acceptable oxygen source that is not a se curity threat.

Powered by EASA eRules Page 499 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS Figure 1: Criteria for assessing an installation Powered by EASA eRules Page 500 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS Table 1: Assessment statement analysis Question Notes and questions to assist with the assessment statement analysis number 1. Review the instructions for continued airworthiness.

Review the drawing system.

Inspect the aeroplane’s configuration.

2. Can crew members observe the COG installation? Check the area where the COG is installed.

Isolated areas such as galleys, lavatories, crew rests, enclosed occupied compar tments, and lower lobe lavatory complexes are potential areas of concern and require further evaluation.

Are crew members close to the COG installation during their normal duties?

Are there physical barriers between the crew members and the area being eval uated?

Is there significant distance between the crew members and the area being observed?

How accessible is the COG?

Is the COG installation surrounded by curtains? Curtained areas are also considered potential areas of concern and may require further eva luation.

3. Are there locks on doors/access panels to prevent access?

Are there tamper - resistant fasteners on panels?

Are alarms or some other active alerting tamper indication method part of the installation’s design?

4. Check if the COG can be compromised in place.

Assess the vulnerability of the adjacent materials to contain the compromised device.

Assess the ability of the compartment to contain the event.

Check if the COG can be removed.

(b) Installation of tamper - resistant features Tamper - resistant design features can be used, in whole or in part, to make a COG installation secure. There are different types of tamper - resistant design features, and their functionality largely depends on the installation. The principal benefit of tamper - resistance is to delay exploitation of the COG as a weapon. However, it is not likely that an existing COG installation that can be accessed from within the lavatory could be modified with tamper - resistant design features sufficient to prevent a successful attack.

This is because typical measures of tamper - resistance, such as special tools and fasteners, could likely be overcome given enough time. These measures are normally used as one of several layers of security. Thus, the reliance on such me asures is only one element of the security system.

(1) A tamper - resistant installation employs multiple elements, which may include: (i) the COG’s location; (ii) the method of mounting; (iii) physical protection (through shielding or mechanical isolat ion of key components); and (iv) internal design.

(2) Eliminating access to the COG is the most straightforward way to make the COG tamper - resistant. Typically, this can be done by placing the COG in a location where significant disassembly of the cabin i nterior would be required to gain access. For example, the COG for a lavatory could be located so that the entire lavatory module Powered by EASA eRules Page 501 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS would have to be removed to access the COG. However, the installer should also consider the ramifications on maintenance when this approach is used.

(c) Installation of tamper - evident features (1) For COGs that can be accessed from isolated compartments, such as lavatories, some form of active tamper - evidence (for example, an alert) would be needed in addition to the installat ion of tamper - resistant features. This is necessary so that the time to intervene and stop the attack is less than the time required to carry out the attack. In this case, passive tamper - evident features, such as a tamper - evident seal, are not effective be cause they provide an after - the - fact notification of tampering. The effectiveness of a tamper - evident system depends on intervention; it cannot be assumed that the alarm by itself would inhibit the attack.

(2) Once an alert is activated indicating that th e COG is being tampered with, actions by crew members and other available, authorised responders are necessary to prevent catastrophic damage to the aeroplane. Therefore, there is a critical relationship between the tamper - evidence system and the training and capability of the crew to respond. To be most effective, crew training should be accomplished prior to the alarm feature being deployed into the fleet. The time needed to successfully respond to the alarm may be several minutes and depends on several f actors. The time available to respond to a threat and intervention times are functions of not only the design features but also of many complex and human factor - dependent variables that are difficult to define. These variables include but are not limited t o the individual capabilities and numbers of flight attendants/authorised responders relative to the terrorists/accomplices, as well as the extensiveness of the training received.

(3) In order to be effective, the alerting system must itself be resistant to tampering.

Otherwise, the entire concept of using the early notification to crew could be nullified and the COG accessed without impediment.

(d) System safety considerations The applicant should consult AMC 25.1309 for guidance on compliance with CS 25.1309 .

(e) Hazard classification. Failure of tamper - resistant or tamper - evident features should be considered major.

(f) S ystem performance when installed A tamper - evidence system installed for compliance with CS 25.795(d) is intended to notify crew members that someone is trying to gain access to a COG. The system should provide aur al and visual warnings to immediately notify crew members so that they can provide direct response in a timely manner. For example, visual indication should be provided so that crew members can identify which COG location is being tampered with while perfo rming their normal duties. Aural alerts should be distinct from other alerts and clearly audible to the crew members expected to respond to the alert. If an alert is provided to the flight crew, the alert should be presented in accordance with CS 25.1322 .

Powered by EASA eRules Page 502 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PERSONNEL AND CARGO ACCOMMODATIONS 5. Areas that are immediately obvious For COG installations located where any attempt to access would be immediately obvious, additional safety measures are not required. Immediately obvious areas include the main passenger cabin and other areas where occupants are always present. While some m easure of tamper - resistance is encouraged for these locations, none is required to meet CS 25.795(d) .

Private compartments (such as a lavatory) or visually divided sections of larger cabin areas are assessed indepe ndently. The ‘immediately obvious’ criterion applies to the specific location of each COG installation, not simply the general area in which it is located. In addition, the installation should be evaluated under all conditions that may exist during a fligh t. So, for example, if tampering would be immediately obvious except when a curtain is pulled to provide privacy, the installation should be evaluated based on the curtain being arranged in a way that most conceals the installation. As with tamper - evident designs, crews should be made aware that tampering with any COG is a safety risk, and any necessary information should be incorporated into the training programmes.

[Amdt 25/17] Powered by EASA eRules Page 503 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS

EMERGENCY PROVISIONS

CS 25.801 Ditching

ED Decision 2014/026/R ( a) If certification with ditching provisions is requested, the aeroplane must meet the requirements of this paragraph and CS 25.807(i) , 25.1411 and 25.1415(a) .

(b) Each practicable design measure, compatible with the general characteristics of the aeroplane, must be taken to minimise the probability that in a n emergency landing on water, the behaviour of the aeroplane would cause immediate injury to the occupants or would make it impossible for them to escape.

(c) The probable behaviour of the aeroplane in a water landing must be investigated by model tests or by comparison with aeroplanes of similar configuration for which the ditching characteristics are known. Scoops, wing - flaps, projections, and any other factor likely to affect the hydrodynamic characteristics of the aeroplane, must be considered.

(d) It m ust be shown that, under reasonably probable water conditions, the flotation time and trim of the aeroplane will allow the occupants to leave the aeroplane and enter the life rafts required by CS 25.1415 . If compli ance with this provision is shown by buoyancy and trim computations, appropriate allowances must be made for probable structural damage and leakage. If the aeroplane has fuel tanks (with fuel jettisoning provisions) that can reasonably be expected to withs tand a ditching without leakage, the jettisonable volume of fuel may be considered as buoyancy volume.

(e) Unless the effects of the collapse of external doors and windows are accounted for in the investigation of the probable behaviour of the aeroplane i n a water landing (as prescribed in sub - paragraphs (c) and (d) of this paragraph), the external doors and windows must be designed to withstand the probable maximum local pressures.

[Amdt 25/15]

AMC 25.801 Ditching

ED Decision 2021/015/R EASA accepts the relevant parts of Federal Aviation Administration (FAA) AC 25 - 17A ‘Transport Airplane Cabin Interiors Crashworthiness Handbook’, of 24 May 2016, as an acceptable means of compliance with CS 25.801(d) .

Note: ‘relevant parts’ means the AC 25 - 17A parts that address the applicable Federal Aviation Regulation (FAR)/CS - 25 paragraph(s).

[Amdt No: 25/27]

CS 25.803 Emergency evacuation

ED Decision 2003/ 2/RM (See AMC 25.803 ) (a) Each crew and passenger area must have emergency means to allow rapid evacuation in crash landings, with the landing gear extended as well as with the landing gear retracted, considering the possibility of the aeroplane being on fire.

Powered by EASA eRules Page 504 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (b) Reserved.

(c) For aeroplanes having a seating capacity of more than 44 passengers, it must be shown that the maximum seating capacity, including the number of crew members required by the operating rules for which certification is requested, can be evacuat ed from the aeroplane to the ground under simulated emergency conditions within 90 seconds. Compliance with this requirement must be shown by actual demonstration using the test criteria outlined in Appendix J of t his CS - 25 unless the Agency find that a combination of analysis and testing will provide data equivalent to that which would be obtained by actual demonstration.

AMC 25.803 Emergency evacuation

ED Decision 2020/024/R The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016 and AC 25.803 - 1A Emergency Evacuation Demonstrations , dated 3.12.2012 are accepted by the Agency as providing acc eptable means of compliance with CS 25.803 .

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

[Amdt 25/11] [Amdt 25/12] [Amdt 25/26]

CS 25.807 Emerg ency exits

ED Decision 2020/024/R (See AMC 25.807 ) (a) Type . For the purpose of this CS - 25, the types of exits are defined as follows: (1) Type I. This type is a floor level exit with a rectangular opening of not less than 61 cm (24 inches) wide by 121.9 cm (48 inches) high, with corner radii not greater than 20.3 cm (8 inches).

(2) Type II. This type is a rectangular opening of not less than 50.8 cm (20 inches) wide by 111.8 cm (44 inches) high, with corner radii not greater than 17.8 cm (7 inches). Type II exits must be floor - level exits unless located over the wing, in which case they must not have a step - up inside the aeroplane of more than 25.4 cm (10 inches) nor a step - down outside the aeroplane of more than 43.2 cm (17 inches).

(3) Type III. This ty pe is a rectangular opening of not less than 50.8 cm (20 inches) wide by 91.4 cm (36 inches) high, with corner radii not greater than 17.8 cm (7 inches), and with a step - up inside the aeroplane of not more than 50.8 cm (20 inches). If the exit is located o ver the wing, the step - down outside the aeroplane may not exceed 68.6 cm (27 inches).

(4) Type IV. This type is a rectangular opening of not less than 48.3 cm (19 inches) wide by 66.0 cm (26 inches) high, with corner radii not greater than 16.0 cm (6.3 inches), located over the wing, with a step - up inside the aeroplane of not more than 73.7 cm (29 inches) and a step - down outside the aeroplane of not more than 91.4 cm (36 inches).

Powered by EASA eRules Page 505 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (5) Ventral. This type is an exit from the passenger compartment through the pressure shell and the bottom fuselage skin. The dimensions and physical configuration of this type of exit must allow at least the same rate of egress as a Type I exit with the aeroplane in the normal ground attitude, with landing gear extended.

(6) T ail cone . This type is an aft exit from the passenger compartment through the pressure shell and through an openable cone of the fuselage aft of the pressure shell. The means of opening the tail cone must be simple and obvious and must employ a single oper ation.

(7) Type A. This type is a floor - level exit with a rectangular opening of not less than 106.7 cm (42 inches) wide by 182.9 cm (72 inches) high, with corner radii not greater than 17.8 cm (7 inches).

(8) Type B . This type is a floor - level exit with a rectangular opening of not less than 81.3 cm (32 inches) wide by 182.9 cm (72 inches) high, with corner radii not greater than 15.3 cm (6 inches).

(9) Type C . This type is a floor - level exit with a rectangular opening of not less than 76.2 cm (30 inches) wide by 121.9 cm (48 inches) high, with corner radii not greater than 25.4 cm (10 inches).

(b) Step down distance . Step down distance, as used in this paragraph, means the actual distance between the bottom of the required opening and a usable foot hold, e xtending out from the fuselage, that is large enough to be effective without searching by sight or feel.

(c) Over - sized exits . Openings larger than those specified in this paragraph, whether or not of rectangular shape, may be used if the specified rectangular opening can be inscribed within the opening and the base of the inscribed rectangular opening meets the specified step - up and step - down heights.

(d) Asymmetry. Exits of an exit pair need not be diametrically opposite each other nor of the same size; however, the number of passenger seats permitted under subparagraph (g) of this paragraph is based on the smaller of the two exits.

(e) Uniformity. Exits must be distributed as uniformly as practical, taking into account passenger seat dist ribution. (See AMC 25.807(e)) (f) Location. (See AMC 25.807(f)) (1) Each required passenger emergency exit must be accessible to the passengers and located where it will afford the most effective means of passenger evacuation.

(2) If only one floor - level e xit per side is prescribed, and the aeroplane does not have a tail cone or ventral emergency exit, the floor - level exits must be in the rearward part of the passenger compartment unless another location affords a more effective means of passenger evacuatio n.

(3) If more than one floor - level exit per side is prescribed, and the aeroplane does not have a combination cargo and passenger configuration, at least one floor - level exit must be located on each side near each end of the cabin.

(4) For an aeroplane th at is required to have more than one passenger emergency exits for each side of the fuselage, no passenger emergency exit shall be more than 18.3 m (60 feet) from any adjacent passenger emergency exit on the same side of the same deck of the fuselage, as m easured parallel to the aeroplane’s longitudinal axis between the nearest edges.

Powered by EASA eRules Page 506 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (g) Type and number required. The maximum number of passenger seats permitted depends on the type and number of exits installed on each side of the fuselage. Except as further restricted in subparagraphs (g)(1) through (g)(9) of this paragraph, the maximum number of passenger seats permitted for each exit of a specific type installed on each side of the fuselage is as follows: Type A 110 Type B 75 Type C 55 Type I 45 Type II 40 Type III 35 Type IV 9 (1) For a passenger seating configuration of 1 to 9 seats, there must be at least one Type IV or larger over - wing exit on each side of the fuselage or, if over - wing exits are not provided, at least one exit on each side that meets the minimum dimensions of a Type III exit.

(2) For a passenger seating configuration of more than 9 seats, each exit must be a Type III or larger exit.

(3) For a passenger seating configuration of 10 to 19 seats, there must be at least one Type III or larger exit on each side of the fuselage.

(4) For a passenger seating configuration of 20 to 40 seats, there must be at least two exits, one of which must be a Type II or larger exit, on each side of the fuselage.

(5) For a passenger seating co nfiguration of 41 to 110 seats, there must be at least two exits, one of which must be a Type I or larger exit, on each side of the fuselage.

(6) For a passenger seating configuration of more than 110 seats, the emergency exits on each side of the fuselage must include at least two Type I or larger exits.

(7) The combined maximum number of passenger seats permitted for all Type III exits is 70, and the combined maximum number of passenger seats permitted for two Type III exits on each side of the fuselage t hat are separated by fewer than three passenger seat rows is 65.

(8) If a Type A, Type B, or Type C exit is installed, there must be at least two Type C or larger exits on each side of the fuselage.

(9) If a passenger ventral or tail cone exit is installed and that exit provides at least the same rate of egress as a Type III exit with the aeroplane in the most adverse exit opening condition that would result from the collapse of one or more legs of the landing gear, an increase in the passenger seating conf iguration is permitted as follows: (i) For a ventral exit, 12 additional passenger seats.

(ii) For a tail cone exit incorporating a floor - level opening of not less than 50.8 cm (20 inches) wide by 152.4 cm (60 inches) high, with corner radii not greater th an 17.8 cm (7 inches), in the pressure shell and incorporating an approved assisting means in accordance with CS 25.810(a), 25 additional passenger seats.

(iii) For a tail cone exit incorporating an opening in the pressure shell which is at least equivalen t to a Type III emergency exit with respect to dimensions, step - up and step - down distance, and with the top of the opening not less than 142.2 cm (56 inches) from the passenger compartment floor, 15 additional passenger seats.

Powered by EASA eRules Page 507 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTI ON EMERGENCY PROVISIONS (h) Other exits. The followin g exits must also meet the applicable emergency exit requirements of CS 25.809 through 25.812 , and must be readily accessible: (1) Each emergency exit in the passenger compartment in excess of the minimum number of required emergency exits.

(2) Any other floor - level door or exit that is accessible from the passenger compartment and is as large or larger than a Type II exit, but less than 116.8 cm (46 in ches) wide.

(3) Any other ventral or tail cone passenger exit.

(i) Ditching emergency exits for passengers. Whether or not ditching certification is requested, ditching emergency exits must be provided in accordance with the following conditions, unless th e emergency exits required by subparagraph (g) of this paragraph already meet them: (1) For aeroplanes that have a passenger seating configuration of nine seats or less, excluding pilot seats, one exit above the waterline in each side of the aeroplane, mee ting at least the dimensions of a Type IV exit.

(2) For aeroplanes that have a passenger seating configuration of 10 seats or more, excluding pilot seats, one exit above the waterline in a side of the aeroplane, meeting at least the dimensions of a Type II I exit for each unit (or part of a unit) of 35 passenger seats, but no less than two such exits in the passenger cabin, with one on each side of the aeroplane.

The passenger seat/exit ratio may be increased through the use of larger exits, or other means, provided it is shown that the evacuation capability during ditching has been improved accordingly.

(3) If it is impractical to locate side exits above the waterline, the side exits must be replaced by an equal number of readily accessible overhead hatches of not less than the dimensions of a Type III exit, except that for aeroplanes with a passenger configuration of 35 seats or less, excluding pilot seats, the two required Type III side exits need to be replaced by only one overhead hatch.

(j) Flight crew e mergency exits. For aeroplanes in which the proximity of passenger emergency exits to the flight crew area does not offer a convenient and readily accessible means of evacuation of the flight crew, and for all aeroplanes having a passenger seating capacity greater than 20, flight crew exits must be located in the flight crew area. Such exits must be of sufficient size and so located as to permit rapid evacuation by the crew. One exit must be provided on each side of the aeroplane; or, alternatively, a top h atch must be provided. Each exit must encompass an unobstructed rectangular opening of at least 48.3 cm by 50.8 cm (19 by 20 inches) unless satisfactory exit utility can be demonstrated by a typical crew member.

[Amdt 25/4] [Amdt 25/5] [Amdt 25/6] [Amdt 25/12] [Amdt 25/18] [Amdt 25/19] [Amdt 25/26] Powered by EASA eRules Page 508 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS

AMC 25.807 Emergency exits

ED Decision 2020/024/R The term ‘unobstructed’ should be interpreted as referring to the space between the adjacent wall(s) and/or seat(s), the seatback(s) being in the mos t adverse position, in vertical projection from floor - level to at least the prescribed minimum height of the exit.

The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.20 16 are accepted by the Agency as providing acceptable means of compliance with CS 25.807 .

Note: ‘The relevant parts’ means ‘the parts of the AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

[Amdt 25/12] [Amdt 25/19] [Amdt 25/26]

AMC 25.807(f ) Passenger emergency e xits

ED Decision 20 12 / 008 /R The optimum fore and aft location of Types I, II and III exits should be agreed between the applicant and the Agency bearing in mind the relevant considerations, including – a. The varying likelihood of damage to different parts of the fuselage in emergen cy landing conditions, and b. The need to avoid the passengers having to evacuate the aeroplane where dangerous conditions (spilt fuel, hot engine parts, etc.) may exist.

[Amdt 25/11] [Amdt 25/12]

AMC 25.807(e) Emergency Exits Uniformity

ED Decision 2017 /015/R FAA Advisory Circular 25.807 - 1 ‘Uniform Distribution of Exits’, dated 08/13/90 is accepted by EASA as providing acceptable means of compliance with CS 25.807(e).

However, this Advisory Circular does not provide any guidance for those aeroplanes req uired to have no more than one pair of emergency exits. For those aeroplanes, ensuring that the seat - to - exit distance remains within acceptable limits as per the following criteria provides an acceptable means of compliance with CS 25.807(e).

Each passeng er seat approved for use during taxiing, take - off or landing should be located such that: (i) it is within 9.14 m (30 ft) from the nearest emergency exit on one side of the fuselage, and within 13.72 m (45 ft) from the nearest emergency exit on the other side of the fuselage; and (ii) the occupant of that seat has the possibility to move to an emergency exit, on the left side, or the right side of the fuselage, whilst at all points along the way remaining within 9.14 m (30 ft) from an emergency exit on one side of the fuselage and within 13.72 m (45 ft) from an emergency exit on the other side of the fuselage.

Powered by EASA eRules Page 509 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS When calculating the distance from a passenger seat, or from any point in the egress path of an occupant, to an emergency exit, this distance sh ould be taken as the total longitudinal distance (i.e.

as measured parallel to the aeroplane’s longitudinal axis) that the escapee should cover in order to get to the emergency exit in question (i.e. the distance calculated should take into account all req uired changes in direction of movement but measured only longitudinally). For the distance from a passenger seat, as the starting point, the front edge of the seat bottom cushion at the centreline, with the seat in the taxiing, take off, and landing positi on is to be taken for seats installed at any orientation.

The end point in each case is to be taken as the nearest edge of the emergency exit opening in the fuselage.

For aeroplanes with a passenger seating configuration of 19 or less, only one pair of em ergency exits is required. However, such aeroplanes may have additional exits installed, which must then comply with CS 25.807(h) but not with the 18.3 - m (60 - feet) rule of CS 25.807(f)(4). The distance between each passenger seat and the nearest available emergency exit may be determined considering all available emergency exits, including the ones addressed by CS 25.807(h).

[Amdt 25/19]

CS 25.809 Emergency exit arrangement

ED Decision 201 5 / 019 /R (See AMC 25.809 ) (a) (1) Each emergency exit, including a flight crew emergency exit, must be a movable door or hatch in the external walls of the fuselage, allowing unobstructed opening to the outside.

(2) Each emergency exit, including a flight crew emergency exit, must have means to permit viewing of the conditions outside the exit when the exit is closed, in all ambient lighting conditions with the landing gears extended or in any condition of collapse. The viewing mea ns may be on or adjacent to the exit provided no obstructions exist between the exit and the viewing means. (See AMC 25.809(a) ) (3) For non - over - wing passenger emergency exits, a means must also be provided to perm it viewing of the likely areas of evacuee ground contact when the exit is closed with the landing gears extended or in any condition of collapse. Furthermore, the likely areas of evacuee ground contact must be viewable with the exit closed during all ambie nt lighting conditions when all landing gears are extended.

(b) Each emergency exit must be openable from the inside and the outside except that sliding window emergency exits in the flight crew area need not be openable from the outside if other approved exits are convenient and readily acce ssible to the flight crew area. Inward opening doors may be used if there are means to prevent occupants from crowding against the door to an extent that would interfere with the opening of the door. Each emergency exit must be capable of being opened, when there is no fuselage deformation – (1) With the aeroplane in the normal ground attitude and in each of the attitudes corresponding to collapse of one or more legs of the landing gear; and (2) Within 10 seconds measure d from the time when the opening means is actuated to the time when the exit is fully opened.

(3) Even though persons may be crowded against the door on the inside of the aeroplane.

Powered by EASA eRules Page 510 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (c) The means of opening emergency exits must be simple and obvious and may not require exceptional effort; and must be arranged and marked so that it can be readily located and operated, even in darkness. Internal exit opening means involving sequence operations (such as operation of two handles or latches or the release of safety catches) may be used for flight crew emergency exits if it can be reasonably established that these means are simple and obvious to crewmembers trained in their use.

(d) If a single power - boost or single power - operated system is the prima ry system for operating more than one exit in an emergency, each exit must be capable of meeting the requirements of sub - paragraph (b) of this paragraph in the event of failure of the primary system. Manual operation of the exit (after failure of the prima ry system) is acceptable.

(e) Each emergency exit must be shown by tests, or by a combination of analysis and tests, to meet the requirements of sub - paragraphs (b) and (c) of this paragraph.

(f) Each door must be located where persons using them will not b e endangered by the propellers when appropriate operating procedures are used.

(g) There must be provisions to minimise the probability of jamming of the emergency exits resulting from fuselage deformation in a minor crash landing.

(h) [Reserved] (i) Each emergency exit must have a means to retain the exit in the open position, once the exit is opened in an emergency. The means must not require separate action to engage when the exit is opened, and must require positive action to disengage.

[Amdt 25/4] [Amd t 25/12] [Amdt 25/14] [Amdt 25/17]

AMC 25.809 Emergency exit arrangement

ED Decision 2020/024/R The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016, are accepted by the Agency as providing an acceptable means of compliance with CS 25.809 .

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

[Amdt 25/12] [Amdt 25/17] [Amdt 25/26]

AMC 25.809(a) Emergency exit outside viewing

ED Decision 2015/019/R The requirement to provide a view of the outside in all ambient lighting conditions suggests the use of externally mounted ligh ting (although other means may be acceptable). In the landing - gear - collapsed cases, the rolling and pitching effects on the fuselage may redirect a fixed lamp’s beam away from the area illuminated in the all - landing - gears - extended condition. Furthermore, i n the case of inflatable escape slides, the toe - end ground contact point will probably move in the opposite direction to that of the lamp beam.

Powered by EASA eRules Page 511 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS In recognition of these effects, and in order to maintain reasonable demands on the complexity and power of exte rnal lighting equipment, the rule does not require the entire viewable area to be visible in all ambient lighting conditions. The only specific illumination requirement is for the likely areas of evacuee ground contact, with all landing gears extended, for passenger exits.

However, it is recommended that as large a field of view as is practicable should be provided, taking into account aspects such as fuselage curvature and door/window/hatch location, in order to provide the best chance to identify external evacuation hazards before exits are opened.

In the case of a flight crew emergency exit, a flight deck window as conventionally configured, used in conjunction with a suitably accessible and powerful portable illumination device (e.g. flashlight) will pro vide an acceptable means for viewing the outside conditions.

Flight deck seats, consoles, etc., as conventionally configured, are not considered to be obstructions in the meaning of this term in CS 25.809(a)(2) in the case where flight deck windows are the viewing means and the exit is an overhead hatch. Furthermore, it is considered that the distance between flight deck windows, as conventionally configured, and an overhead hatch is such that the criterion for the viewing means to be adjacent to the exit is satisfied.

[Amdt 25/17]

AMC 25.809(a)(3) Emergency exit arrangement

ED Decision 2012/008/R A subjective outside viewing test can be conducted to determine if the exterior viewing means and lighting system provide an adequate view/illumination to allow identification of possible hazards in the evacuee ground contact area. For this test, the viewing/lighting system will be deemed acceptable if an object (e.g., a traffic cone) placed in the viewing area is visible t o the test witness looking through the emergency exit viewing means that is provided.

When a separate lighting system is installed that is only used to meet the requirements of CS 25.809(a) , that system should be designed to meet the requirements of CS 25.812(k) , for operation after having been subjected to the inertia forces listed in CS 25.561(b) , and CS 25.812(l)(3) , such that at least one exterior light on each side of the airplane remains operative after a single transverse separation.

[Amdt 25/12]

AMC 25.809(c) and (e) Testing of the opening of

passenger - operated exits

ED Decision 2020/024/R For emergency exits intended to be operated by passengers, such as non - floor - level overwing exits (e.g. Type III and IV exits), testing with naïve subjects should be performed in order to demonstrate that opening the emergen cy exits is simple and obvious and does not require exceptional effort.

The demonstration may be conducted either on the aeroplane or on a representative mock - up, and it should include all the relevant safety markings and exit opening instructions.

The opening of the emergency exit should be demonstrated by a sufficient number of naïve test subjects selected to be representative of the passenger population with respect to gender, age, size and handedness. Meeting the criteria of paragraph (h) of Appendix J to CS - 25 is an acceptable means to achieve a representative age and gender distribution of the participants in the test.

[Amdt 25/26] Powered by EASA eRules Page 512 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS

CS 25.810 Emergency egress assist ing means and escape route s

ED Decision 201 6 / 0 10 /R (See AMC 25.810 ) (a) Each non - over - wing Type A, Type B or Type C exit, and any other non - over - wing landplane emergency exit more than 1.8 m (6 feet) from the ground with the aeroplane on the ground and the landing gear extended must have an approved means to assist the occupants in descending to the ground.

(1) The assisting means for each passenger emergency exit must be a selfsupporting slide or equivalent; and, in the case of a Type A or Type B exit s , it must be capable of carrying simultaneously two parallel lines of evacuees. In addition, the assisting means must be designed to meet the following requirements.

(i) It must be automatically deployed and deployment must begin during the interval between the time the exit opening means is actuated from inside the aeroplane and the time the exit is fully opened. However, each passenger emergency exit which is also a passenger entrance door or a service door must be provided with means to prevent deployment of the assisting means when it is opened from either the inside or the outside under non - emergency conditions for normal use.

(ii) Except for assisting means installed at Type C exits, it must be automatically erected within 6 seconds after deployment is begun or within 10 seconds from the time the opening means of the exit is actuated. Assisting means installed at Type C exits must be automatically erected within 10 seconds from the time the opening means of the exit is actuate d.

(iii) It must be of such length after full deployment that the lower end is selfsupporting on the ground and provides safe evacuation of occupants to the ground after collapse of one or more legs of the landing gear.

(iv) It must have the capability, in 46 km/hr (25 - knot) winds directed from the most critical angle, simultaneously with any engine(s) running at ground idle, to deploy and, with the assistance of only one person, to remain usable after full deployment to evacuate occupants safely to the gro und. (See AMC 25.810(a)(1)(iv)) (v) For each system installation (mock - up or aeroplane installed), five consecutive deployment and inflation tests must be conducted (per exit) without failure, and at least three tests of each such five - test series must be conducted using a single representative sample of the device. The sample devices must be deployed and inflated by the system’s primary means after being subjected to the inertia forces specified in CS 25.561(b) . If any part of the system fails or does not function properly during the required tests, the cause of the failure or malfunction must be corrected by positive means and after that, the full series of five consecutive deployment and inflation tests must be co nducted without failure.

(2) The assisting means for flight crew emergency exits may be a rope or any other means demonstrated to be suitable for the purpose. If the assisting means is a rope, or an approved device equivalent to a rope, it must be – Powered by EASA eRules Page 513 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (i) Attached to the fuselage structure at or above the top of the emergency exit opening, or, for a device at a pilot’s emergency exit window, at another approved location if the stowed device, or its attachment, would reduce the pilot’s view in flight.

(i i) Able (with its attachment) to withstand a 1779 N (400 - lbf) static load.

(b) Assist ing means from the cabin to the wing are required for each Type A or Type B exit located above the wing and having a step - down unless the exit without an assist ing means can be shown to have a rate of passenger egress at least equal to that of the same type of non - over - wing exit.

If an assist ing means is required, it must be automatically deployed and automatically erected, concurrent with the opening of the exit. In the case of assisting means installed at Type C exits, it must be self - supporting within 10 seconds from the time the opening means of the exits is actuated. For all other exit types, it must be self - supporti ng 6 seconds after deployment has begun.

(c) An esca pe route must be established from each over - wing emergency exit, and (except for flap surfaces suitable as slides) covered with a slip resistant surface (See AMC to CS 25.793 and CS 25.810(c)). Except where a means for channelling the flow of evacuees is p rovided – (1) The escape route from each Type A or Type B emergency exit, or any common escape route from two Type III emergency exits, must be at least 1·07 m (42 inches) wide ; that from any other passenger emergency exit must be at least 61 cm (24 inch es ) wide ; and (2) The escape route surface must have a reflectance of at least 80%, and must be defined by markings with a surface - to - marking contrast ratio of at least 5:1. (See AMC 25.810(c)(2)) (d) Assisting means must be provided to enable evacuees to reach the ground for all Type C exits located over the wing and, if the place on the aeroplane structure at which the escape route required in subparagraph (c) of this paragraph terminates, is more than 1.8 m (6 feet) from the ground with the aeroplane on the ground and the landing gear extended, for all other exit types.

(1) If the escape route is over a flap, the height of the terminal edge must be measured with the flap in the take - off or landing position, whichever is higher from the ground.

(2) The assisting means must be usable and self - supporting with one or more landing gear legs collapsed and under a 46 km/hr (25 - knot) wind directed from the most critical angle.

(3) The assisting means provided for each escape route leading from a Type A or B eme rgency exit must be capable of carrying simultaneously two parallel lines of evacuees; and, the assisting means leading from any other exit type must be capable of carrying simultaneously as many parallel lines of evacuees as there are required escape rout es.

(4) The assisting means provided for each escape route leading from a Type C exit must be automatically erected within 10 seconds from the time the opening means of the exit is actuated, and that provided for the escape route leading from any other exi t type must be automatically erected within 10 seconds after actuation of the erection system.

Powered by EASA eRules Page 514 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUC TION EMERGENCY PROVISIONS (e) If an integral stair is installed in a passenger entry door that is qualified as a passenger emergency exit, the stair must be designed so that, under the following conditions, the effectiveness of passenger emergency egress will not be impaired: (1) The door, integral stair, and operating mechanism have been subjected to the inertia forces specified in CS 25.561(b)(3) , acting separately relative to the surrounding structure.

(2) The aeroplane is in the normal ground attitude and in each of the attitudes corresponding to collapse of one or more legs of the landing gear.

[Amdt 25/4] [Amdt 25/12] [Amdt 25/13] [Amdt 25/17] [Amdt 25/18]

AMC 25.810 Emergency egress assisting means and escape routes

ED Decision 2020/ 024/R The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016, are accepted by the Agency as providing an acceptable means of compliance with CS 25.810.

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

For emergency assisting means that are installed in non - pressurised compartments, the applicant should take into account the effects of exposure to very low temperature conditions during flight on the performance of the assisting means. The applicant should demonstrate that the assisting means functions properly when the cold soak effects associated with the exp ected flight durations and altitudes are combined with a 46 km/h (25 kt) wind directed from the most critical angle.

[Amdt 25/17] [Amdt 25/26]

AMC 25.810(a)(1)(iv) Capabi lity of assisting means in wind

conditions

ED Decision 2016/010/R The applicability of the combined effect of a 46 km/hr (25 - knot) wind and the engine(s) running at ground idle should be only to escape slides positioned forward of the engine(s) and in such proximity to the engine air intake(s) that the deployment of the escape slide could b e influenced.

[Amdt 25/18]

AMC 25.810(a)(1)(v) Deployment and inflation tests

ED Decision 2020/024/R For each exit, at least one of the (minimum) five consecutive deployment and inflation tests should be performed with an assisting means installed on the aeroplane.

[Amdt 25/26] Powered by EASA eRules Page 515 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS

AMC 25.810(c)(2) Emergency Evacuation

ED Decision 2020/024/R Acceptable methods of measurement of reflectance are given in AC 20 - 47, published by the Federal Aviation Administration.

[Amdt 25/26]

CS 25.811 Emergency exit marking

ED Decision 2017 / 015 /R (See AMC 25.811 ) (a) Each passenger emergency exit, its means of access, and its means of opening must be conspicuously marked.

(b) The identity and location of each passenger emergency exit must be recognisable from a distance equal to the width of the cabin.

(c) Means must be provided to assist the occupants in locating the exits in conditions of dense smoke.

(d) The location of each passenger emergency exit must be indicated by a sign visible to occupants approaching along the main passenger aisle (or aisles). There must be See AMC 25.811(d)): (1) A passenger emergency exit locator sign above the aisle (or aisles) near each passenger emergency exit, or at another ove rhead location if it is more practical because of low headroom, except that one sign may serve more than one exit if each exit can be seen readily from the sign; (2) A passenger emergency exit marking sign next to each passenger emergency exit, except that one sign may serve two such exits if they both can be seen readily from the sign; and (3) A sign on each bulkhead or divider that prevents fore and aft vision along the passenger cabin to indicate emergency exits beyond and obscured by the bulkhead or div ider, except that if this is not possible the sign may be placed at another appropriate location.

(e) The location of the operating handle and instructions for opening exits from the inside of the aeroplane must be shown in the following manner: (1) Each p assenger emergency exit must have, on or near the exit, a marking that is readable from a distance of 76 cm (30 inches).

(2) Each passenger emergency exit operating handle and the cover removal instructions, if the operating handle is covered, must – (i) B e self - illuminated with an initial brightness of at least 0.51 candela/m (160 microlamberts), or (ii) Be conspicuously located and well illuminated by the emergency lighting even in conditions of occupant crowding at the exit.

(3) Reserved (4) All Type II and larger passenger emergency exits with a locking mechanism released by motion of a handle, must be marked so as to its operation by an arrow wi th a shaft at least 19 mm (0.75 inches) wide, adjacent to the handle, that indicates the full exte nt and direction of the unlocking motion required. The word OPEN must be horizontally situated adjacent to the arrowhead and must be in red capital letters at least 25 mm (1 inch) high.

Powered by EASA eRules Page 516 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS The arrow and word OPEN must be located on a background, which provide s adequate contrast. (See AMC 25.811(e)(4) .)

(f) Each emergency exit that is required to be openable from the outside, and its means of opening, must be marked on the outside of the aeroplane. In addition, the foll owing apply: (1) The outside marking for each passenger emergency exit in the side of the fuselage must include a 51 mm (2 inch) coloured band outlining the exit.

(2) Each outside marking including the band must have colour contrast to be readily distingui shable from the surrounding fuselage surface. The contrast must be such that if the reflectance of the darker colour is 15% or less, the reflectance of the lighter colour must be at least 45%. ‘Reflectance’ is the ratio of the luminous flux reflected by a body to the luminous flux it receives. When the reflectance of the darker colour is greater than 15%, at least a 30% difference between its reflectance and the reflectance of the lighter colour must be provided.

(3) In the case of exits other than those in the side of the fuselage, such as ventral or tail cone exits, the external means of opening, including instructions if applicable, must be conspicuously marked in red, or bright chrome yellow if the background colour is such that red is inconspicuous. Whe n the opening means is located on only one side of the fuselage, a conspicuous marking to that effect must be provided on the other side.

(g) Each sign required by sub - paragraph (d) of this paragraph may use the word ‘exit’ in its legend in place of the te rm ‘emergency exit’ or a universal symbolic exit sign (See AMC 25.812(b)(1) , AMC 25.812(b)(2) and AMC 25.812(e)(2) ). The design of exit signs must be chosen to provide a consistent set throughout the cabin.

[Amdt 25/3] [Amdt 25/17] [Amdt 25/19]

AMC 25.811 Emergency exit marking

ED Decision 2020/024/R The relevant parts of FAA Advisory Circular (AC) AC 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016, are accepted by the Agency as providing an acceptable means of compliance with CS 25.811 .

Note: ‘The relevant parts’ means ‘the parts of AC25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

[Amdt 25/17] [Amdt 25/26]

AMC 25.811(d) Sign Combination

ED Decision 2020/024/R The signs required by CS 25.811 (d)(1) , (d)(2) and (d)(3) may be combined according to the applicable parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016.

[Amdt 25/19] [Amdt 25/ 26 ] Powered by EASA eRules Page 517 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS

AMC 25.811(e)(4) Emergency exit m arking

ED Decision 2017 / 015/R The indicating markings for all Type II and larger passenger emergency exit unlocking handle motions should conform to the general shapes and dimensions indicated by Figures 1 and 2.

The indicating markings (arrow and word OPEN) shoul d be consistent with the emergency exit signs chosen, i.e. red if letter emergency exit signs are installed, and green if symbolic emergency exit signs are installed.

NOTE: As far as is practicable the markings should be located to avoid obscuring viewing windows located on or alongside the exits, or coincidence with any other requ ired marking or safety feature.

EXAMPLE MARKING FOR INDI CATION OF LINEAR OPENING MOTION Where practical and unambiguous arrow point and base of arrow shaft to be within ±25 mm (1 inch) of fully unlocked and fully locked positions respectively DIMENSIONS A = 19 mm (0·75") minimum B = 2 x A C = B (recommended) D = Indicative of the full extent of handle travel (each installation to be individually assessed) FIGURE 1 EXAMPLE MARKING FOR INDICATION OF ROTARY OPENING MOTION Arrow point and base of arrow shaft to be within 25 mm (1 inch) of fully unlocked and fully locked positions respectively Powered by EASA eRules Page 518 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS DIMENSIONS A = 19 mm (0·75") minimum B = 2 x A C = B (recommended) D = Full extent of handle centreline travel E = Three quarters of handle length (where practicable) FIGURE 2 [Amdt 25/19]

CS 25.812 Emergency lighting

ED Decision 2017 / 015 /R (See AMC 25.812 ) (a) An emergency lighting system, independent of the main lighting system, must be installed.

However, the sources of general cabin illumination may be common to both the emergency and the main lighting systems if the power supply to the emergency lighting system is independent of the power supply to the main lig hting system. The emergency lighting system must include - (1) Illuminated emergency exit marking and locating signs, sources of general cabin illumination, interior lighting in emergency exit areas, and floor proximity escape path marking.

(2) Exterior em ergency lighting.

Powered by EASA eRules Page 519 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (b) Emergency exit signs – (1) For aeroplanes that have a passenger - seating configuration, excluding pilot seats, of 10 seats or more must meet the following requirements: (i) Each passenger emergency exit locator sign required by CS 25.811(d)(1) and each passenger emergency exit marking sign required by CS 25.811(d)(2) must have red letters on an illuminated white background or a universal symbol, of adequate size (See AMC 25.812(b)(1) ). These signs must be internally electrically illuminated with the brighter area having a brightness of at least 86 candela/m (25 foot lambert s) and a high - to - low contrast within the white background of a letter - based sign or green area of a universal symbol no greater than 3:1. These signs must also have a contrast between the brightest and darkest elements of at least 10:1.

(ii) Each passenger emergency exit sign required by CS 25.811(d)(3) must have red letters on a white background or a universal symbol, of adequate size (See AMC 25.812(b)(1) ). These signs must be internally electrically illuminated or selfilluminated by other tha n electrical means and must have an initial brightness of at least 1.27 candela/m (400 microlamberts). The colours may be reversed in the case of a sign that is self - illuminated by other than electrical means.

(2) For aeroplanes that have a passenger seat ing configuration, excluding pilot seats, of 9 seats or less, each sign required by CS 25.811(d)(1), (2), and (3) must have red letters on a white background or a universal symbol, of adequate size (See AMC 25.812( b)(2) ) .

These signs may be internally electrically illuminated, or self - illuminated by other than electrical means, with an initial brightness of at least 0.51 candela/m (160 microlamberts). The colours may be reversed in the case of a sign that is self - i lluminated by other than electrical means.

(c) General illumination in the passenger cabin must be provided so that when measured along the centreline of main passenger aisle(s), and cross aisle(s) between main aisles, at seat armrest height and at 1.02 m (40 - inch) intervals, the average illumination is not less than 0.5 lux (0.05 foot candle) and the illumination at each 1.02 m (40 - inch) interval is not less than 0.1 lux (0.01 foot candle). A main passenger aisle(s) is considered to extend along the fusela ge from the most forward passenger emergency exit or cabin occupant seat, whichever is farther forward, to the most rearward passenger emergency exit or cabin occupant seat, whichever is farther aft.

(d) The floor of the passageway leading to each floor - le vel passenger emergency exit, between the main aisles and the exit openings, must be provided with illumin ation that is not less than 0.2 lux (0.02 foot candle) measured along a line that is within 15 cm (6 inches) of and parallel to the floor and is centr ed on the passenger evacuation path.

(e) Floor proximity emergency escape path marking must provide emergency evacuation guidance for passengers when all sources of illumination more than 1.2 m (4 ft) above the cabin aisle floor are totally obscured. In t he dark of the night, the floor proximity emergency escape path marking must enable each passen ger to: (1) After leaving the passenger seat, visually identify the emergency escape path along the cabin aisle floor to the first exits or pair of exits forward and aft of the seat; (2) Readily identify each exit from the emergency escape path by reference only to ma rkings and visual features not more than 1.2 m (4 ft) above the cabin floor. (See AMC 25.812(e)(2) ); and Powered by EASA eRules Page 520 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (3) In the case of passengers seated in seats authorised for occupancy during taxiing, take - off, and landing, in a compartment that does not incorporate any part of the main cabin aisle, in lieu of CS 25.812(e)(1), egress this compartment and enter the main cabin aisle using only markings and visual features not more than 1.2 m (4 ft) above the cabin floo r, and proceed to the exits using the marking system necessary to complete the actions as described in CS 25.812(e)(1) and (e)(2) above.

(f) Except for sub - systems provided in accordance with sub - paragraph (h) of this paragraph that serve no more than one assist ing means, are independent of the aeroplane’s main emergency lighting system, and are automatically activated when the assist ing means is erected, the emergency lighting system must be designed as follows: (1) The lights must be operable manually fro m the flight crew station and from a point in the passenger compartment that is readily accessible to a normal cabin crewmember seat.

(2) There must be a flight crew warning light, which illuminates when power is on in the aeroplane and the emergency light ing control device is not armed.

(3) The cockpit control device must have an ‘on’, ‘off’ and ‘armed’ position so that when armed in the cockpit or turned on at either the cockpit or cabin crew member station the lights will either light or remain lighted u pon interruption (except an interruption caused by a transverse vertical separation of the fuselage during crash landing) of the aeroplane’s normal electric power. There must be a means to safeguard against inadvertent operation of the control device from the ‘armed’ or ‘on’ positions.

(g) Exterior emergency lighting must be provided as follows: (1) At each overwing emergency exit the illumination must be – (i) Not less than 0.3 lux (0.03 foot candle) (measured normal to the direction of the incident light) on a 0.186 m (two - square - foot) area where an evacuee is likely to make his first step outside the cabin; (ii) Not less than 0.5 lux (0.05 foot - candle) (measured normal to the direction of the incident light) for a minimum width of 1.07 m (42 inches) for a Type A over - wing exit and 61 cm (24 inches) for all other over - wing emergency exits along the 30 % of the slip - resistant portion of the escape route required in CS 25.810(c) that is farthest from the exit; and (iii) Not less than 0.3 lux (0.03 foot candl e) on the ground surface with the landing gear extended (measured normal to the direction of the incident light) where an evacuee using the established escape route would normally make first contact with the ground.

(2) At each non - overwing emergency exit not required by CS 25.810(a) to have descent assist ing means the illumination must be not less than 0.3 lux (0.03 foot candle) (measured normal to the direction of the incident light) on the ground surface with the landing gear extended where an evacuee is likely to make his first contact with the ground outside the cabin.

Powered by EASA eRules Page 521 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTR UCTION EMERGENCY PROVISIONS (h) The means required in CS 25.810(a)(1) and (d) to assist the occupants in descending to the ground must be illuminated so that the erected assist ing means is visible from the aeroplane.

In addition – (1) If the assist ing means is illuminated by exterior emergency lighting, it must provide illumination of not less than 0.3 lux (0.03 foot candle) (measured normal to the direction of the incident light) at the ground end of the erected assist ing means where an evacuee using the established escape route would normally make first contact with the ground, wi th the aeroplane in each of the attitudes corresponding to the collapse of one or more legs of the landing gear.

(2) If the emergency lighting sub - system illuminating the assist ing means serves no other assist means, is independent of the aeroplane’s main emergency lighting system, and is automatically activated when the assist ing means is erected, the lighting provisions – (i) May not be adversely affected by stowage; and (ii) Must provide illumination of not less than 0.3 lux (0.03 foot candle) (measured normal to the direction of the incident light) at the ground end of the erected assist ing means where an evacuee would normally make first contact with the ground, with the aeroplane in each of the attitudes corresponding to the collapse of one or more le gs of the landing gear.

(i) The energy supply to each emergency lighting unit must provide the required level of illumination for at least 10 minutes at the critical ambient conditions after emergency landing.

(j) If storage batteries are used as the energ y supply for the emergency lighting system, they may be recharged from the aeroplane’s main electric power system: Provided , that the charging circuit is designed to preclude inadvertent battery discharge into charging circuit faults.

(k) Components of th e emergency lighting system, including batteries, wiring relays, lamps, and switches must be capable of normal operation after having been subjected to the inertia forces listed in CS 25.561(b) .

(l) The emergency l ighting system must be designed so that after any single transverse vertical separation of the fuselage during crash landing: (1) the percentage of electrically illuminated emergency lights required by this paragraph which are rendered inoperative, in addi tion to the lights that are dir ectly damaged by the separation, does not exceed the values set in the following table (See AMC 25.812(l)(1) ): Maximum approved seating capacity of the type - certified aeroplane Percentage as indicated in the aeroplane’s type certificate data sheet (TCDS) More than 19 25 % 10 to 19 33.33 % (i.e. one third) Less than 10 50 % (2) Each electrically illuminated exit sign required under CS 25.811(d)(2) remains operative exclusive of those that are directly damaged by the separation; and (3) At least one required exterior emergency light for each side of the aeroplane remains operative exclusive of those that are directly damaged by the separation.

[Amdt 25/3] [Amdt 25/5] [Amdt 25/12] [Amdt 25/19] Powered by EASA eRules Page 522 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS

AMC 25.812 Emergency lighting

ED Decision 2020/024/R The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016 and AC 25.812 - 2 Floor Proximity Emergency Escape Path Marking Systems Incorporating Photoluminescent Elements , dated 24/7/97 are accepted by the Agency as providing acceptable means of compliance with CS 25.812 .

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

[Amdt 25/11] [Amdt 25/26]

AMC 25.812(b)(1) Emergency lighting

ED Decision 2017/015 /R General Require ments Emergency exit signs should consist of a consistent type throughout the aeroplane. They may be letter based or symbolic, as outlined below.

Letter based emergency exit signs should use letters with a height to stroke width ratio of not more than 7: 1 nor less than 6:1.

Symbolic emergency exit signs should be white and green in compliance with European Standard (EN) ISO 7010:2012, Graphical symbols, safety colours and safety signs, registered safety signs. The green area of the sign should constitute at least half of the total area of the sign.

In determining the area of an emergency exit sign, no part of the sign outside of the white background (text signs) or green element (symbolic signs), for instance a surrounding contrasting border, should be i ncluded.

Minimum size - emergency exit signs required by CS 25.811(d)(1) or (d)(3) For each emergency exit sign required by CS 25.811(d)(1), and for each emergency exit sign required on each bulkhead or divider by CS 25.811(d)(3), at each point along any possible aeroplane egress path, the next closest required emergency exit sign visible at each point along the egress path should be sized and located such that it is no farther away from the escapee than its maximum allowable viewing distance calculated a s below.

Egress paths to be assessed should be: (1) any possible path from a passenger seat that can be occupied during taxiing, take - off, and landing to any passenger emergency exit; and (2) any possible path from a point adjacent to any passenger eme rgency exit to any other passenger emergency exit.

Calculation of maximum viewing distance For an emergency exit sign required by CS 25.811(d)(1) and for an emergency exit sign required on each bulkhead or divider by CS 25.811(d)(3), the following formulae, as modified by the notes below, apply for calculating a maximum viewing distance. The maximum allowable viewing distance for a sign is in each case the lower of the two values D1 and D2: Powered by EASA eRules Page 523 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS Text based signs Symbolic signs D = 2. Z . h . D = 1.25 . Z . h .

1 letter 1 symbol D 2 = Z . √(x sign /2.5) D 2 = Z . √(x sign /2.5) where: 1. Z is the distance factor obtained from Table 1 below; 2. h is the overall height of each letter – which should be at least of 25 mm (1 inch) high; letter 3. h is the overall height of the white symbolic element incorporating the green ‘running man’ s ymbol – which should be at least 40 mm (1.6 inches) high; 4. x is the overall area of the sign; and sign 5. D 1 , D 2 , h letter and h symbol have the same units, and x sign is in the same squared units as D 1 , D 2 , h letter and h symbol.

Note 1: In the case of dual - language text based emergency exit signs, only the English text is to be considered when selecting h for use in the above formula . However, in determining the area of letter the sign (x ) for use in the above formula, the actual area may be used sign Examples of acceptable designs of symbolic exit signs CS 25.811(d)(1) (emergency exit locator sign) CS 25.811(d)(2) (emergency exit marking sign) CS 25.811(d)(3) (emergency exit sign on bulkhead or divider) Table 1: Z factor to be used for text based and symbolic emergency exit signs Mean luminance of white contrast Distance factor Z colour candela/m (ft - L)  1.27 candela/m (0.37 ft - L) 100  10 candela/m (2.92 ft - L)  30 candela/m (8.76 ft - L)  80 candela/m (23.35 ft - L)  200 candela/m (58.37 ft - L)  500 candela/m (145.93 ft - L) Powered by EASA eRules Page 524 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS Minimum size - emergency exit signs required by CS 25.811(d)(2) For an emergency exit sign required by CS 25.811(d)(2), any sign using English letters of at least 25 mm (1 inch) height, or a white symbolic element (i.e. that part incorporating the green ‘running man’) of at least 40 mm (1.6 inches), with an overall area of at least 64.5 cm (10 square inches) will be acceptable.

Supplementary directional arrows The inclusion of an arrow or arrows in any of the signs discussed above, in order to increase the comprehension of the sign, is encouraged. The possibility to improve comprehension and the appropriate orientation of the arrows will depend on the particular installation. If arrows indicate a movement other than straight ahead, in the case of a symbolic sign, the dep icted movement direction of the ‘running man’ (to the right/to the left) should be chosen to be compatible with the orientation of the arrow(s). There may be other reasons to choose a particular movement direction of the ‘running man’, for instance where a sign required by CS 25.811(d)(2) is placed to the left or right of the emergency exit. In this case, the ‘running man’ should not suggest movement away from the emergency exit.

In the case of symbolic signs, the arrows should be in accordance with the sty le defined in European Standard (EN) ISO 7010:2012, i.e. type D of ISO 3864 - 3. The ratio of overall length of an arrow to the width of its tail should be not more than 7:1 nor less than 5.5 :1.

[Amdt 25/3] [Amdt 25/19]

AMC 25.812(b)(2 ) Emergency lighting

ED Decision 2017/015 /R For an emergency exit sign required by CS 25.811(d)(1), (2) or (3), any sign meeting the overall appearance requirements of AMC 25.812(b)(1), using English letters of at least 25 mm (1 inch) height, or a white symbolic element incorpor ating the ‘running man’ of at least 40 mm (1.6 inches), with an overall area of at least 64.5 cm2 (10 square inches), will be acceptable.

The guidance of AMC 25.812(b)(1) regarding supplemental direction arrows is also applicable.

[Amdt 25/3] [Amdt 25/1 9]

AMC 25.812(e)(2) Emergency lighting

ED Decision 2017/015 /R If it is desired to identify each emergency exit by means of a symbolic sign, this sign should be white and green in compliance with European Standard (EN) ISO 7010:2012, Graphical symbols, safety colours and safety signs, registered safety signs.

Example of an acceptable design of symbolic sign to identify an exit CS 25.812(e) (exit identifier) The direction of the ‘running man’ (to the left/to the right) should not suggest movement away from the emergency exit.

Powered by EASA eRules Page 525 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS The type of signs used to identify an emergency exit (letter based, symbolic) should be chosen to be consistent with the emergency exit signs throughout the cabin.

[Amdt 25/3] [Amdt 25/19]

AMC 25.812(l)(1) Transverse Separation of the Fuselage

ED Decision 2017/015/R Within CS 25.812(l)(1), the phrase ‘in addition to the lights that are directly damaged by the separation’ means that when c alculating the percentage of electrically illuminated emergency lights rendered inoperative by the fuselage separation, the number of lights whose function is lost due to loss of power or loss of control input to the lights should be divided by the total n umber of electrically illuminated emergency lights installed. The lights that are directly damaged by the fuselage separation should not be included in the numerator of the calculation, but only those whose function is lost due to loss of power and/or cont rol. The denominator should be the total of all electrically illuminated emergency lights installed.

Applicable parts of FAA AC 25.812 - 1A, Floor proximity emergency escape path marking, 22 May 1989 may be used.

[Amdt 25/19]

CS 25.813 Emergency exit access and ease of operation

ED Decision 2017 / 015 /R (See AMC 25.813 ) (a) There must be a passageway leading from the nearest main aisle to each Type A, Type B, Type C, Type I, or Type II emergency exit and between individual passenger areas. Each passageway leading to a Type A or Type B exit must be unobstructed and at least 91 cm (36 inches) wide.

Passageways between individual passenger areas and those leading to Type I, Type II, or Type C emergency exits must be unobstructed and at least 51 cm (20 inches) wide. Unless there are two or more main aisles, each Type A or B exit must be located so that there is passenger flow along the main aisle to that exit from both the forward and aft directions. If two or more main aisles are provided, there must be unobstructed cross - aisles at least 51 cm (20 inches) wide between main aisles. There must be: (1) A cross - aisle which leads directly to each passageway between the nearest main aisle and a Type A or B exit; and (2) A cross - aisle which leads to the immediate vicinity of each passageway between the nearest main aisle and a Type C, Type I, Type II, or Type III exit; except that when two Type III exits are located within three passenger rows of each other, a single c ross - aisle may be used if it leads to the vicinity between the passageways from the nearest main aisle to each exit.

(b) Adequate space to allow crew - member(s) to assist in the evacuation of passengers must be provided as follows: (1) Each assist space mus t be a rectangle on the floor, of sufficient size to enable a crew member, standing erect, to effectively assist evacuees. The assist space must not reduce the unobstructed width of the passageway below that required for the exit.

Powered by EASA eRules Page 526 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (2) For each Type A or Ty pe B exit, assist space must be provided at each side of the exit regardless of whether an assisting means is required by CS 25.810(a) .

(3) For each Type C, I or II exit installed in an aeroplane with seating for more than 80 passengers, an assist space must be provided at one side of the passageway regardless of whether an assisting means is required by CS 25.810(a) .

(4) For each Type C, I or II exit, an assist space must be provided at one side of the passageway if an assisting means is required by CS 25.810(a) .

(5) For any tail cone exit that qualifies for 25 additional passenger seats under the provisions of CS 25.807(g)(9)(ii) , an assist space must be provided, if an assisting means is required by CS 25.810(a) .

(6) There must be a handle, or handles, at each assist space, located to enable the crew member to steady himself or herself: (i) While manu ally activating the assisting means (where applicable), and (ii) While assisting passengers during an evacuation.

(c) The following must be provided for each Type III or Type IV exit – (See AMC 25.813(c)) (1) There must be access from the nearest aisle to each exit.

(2) In addition, for each Type III exit in an aeroplane that has a passenger - seating configuration of 20 or more and which has only seats installed immediately to the forward and aft of the access route(s) - (i) Except as provided in sub - parag raph (c)(2)(ii) of this paragraph, the access must be provided by an unobstructed passageway that is at least 25.4 cm (10 inches) in width for interior arrangements in which the adjacent seat rows on the exit side of the aisle contain two seats, or 33 cm ( 13 inches) in width for interior arrangements in which those rows contain three seats. The width of the passageway must be measured with adjacent seats adjusted to their most adverse positions. At least 25.4 cm (10 inches) of the required passageway width must be within the required projected opening width of the exit.

(ii) In lieu of one 25.4 or 33 cm (10 or 13 inches) passageway, there may be two unobstructed passageways, that must be at least 15.2 cm (6 inches) in width and lead to an unobstructed spac e adjacent to each exit. Adjacent exits must not share a common passageway. The width of the passageways must be measured with adjacent seats adjusted to their most adverse positions. The unobstructed space adjacent to the exit must extend vertically from the floor to the ceiling (or to the bottom of upper side wall stowage bins), inboard from the exit for a distance not less than the width of the narrowest passenger seat installed on the aeroplane and from the forward edge of the forward passageway to the aft edge of the aft passageway. The exit opening must be totally within the fore and aft bounds of the unobstructed space.

(3) Each Type III exit in an aeroplane that has a passenger seating configuration of 20 or more and which has an access route bound ed by any item(s) other than only seats (e.g.

bulkhead/wall, class divider, curtain) to its forward and/or aft side, must be provided with an unobstructed passageway that is at least 50.8 cm (20 inches) in width. The width of the passageway must be measure d with any adjacent seats, or other movable features, adjusted to their most adverse positions.

Powered by EASA eRules Page 527 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (4) In addition to the access - (i) For aeroplanes that have a passenger seating configuration of 20 or more, the projected opening of the exit provided may n ot be obstructed and there must be no interference in opening the exit by seats, berths, or other protrusions (including adjacent seats adjusted to their most adverse positions) for a distance from that exit not less than the width of the narrowest passeng er seat installed on the aeroplane or 40 cm (15.75 inches), whichever is the least.

(ii) For aeroplanes that have a passenger seating configuration of 19 or less, there may be minor obstructions in this region, if there are compensating factors to maintain the effectiveness of the exit.

(5) For each Type III and Type IV exit there must be placards that – (i) are readable by each person seated adjacent to and facing a passageway to the exit, one in their normal field of view; and one adjacent to or on the exit; (ii) accurately state or illustrate the proper method of opening the exit, including the correct use of controls, handles, handholds etc.; (iii) if the exit is a removable hatch, state the weight of the hatch and indicate an appropriate location to place the hatch after removal.

(6) For aeroplanes with a passenger seating configuration of 41 or more, each Type III exit must be designed such that when operated to the fully open position, the hatch/door is automatically disposed so that it can neither reduce the size of the exit opening , the passageway(s) leading to the exit, nor the unobstructed space specified in sub - paragraph (c)(2)(ii) of this paragraph, to below the required minimum dimensions. In the fully open position it must also not obstruct egress from the exit via the escape route specified in CS 25.810(c) .

(7) The design of each seat, bulkhead/partition or other feature, bounding the passageway leading to each Type III or Type IV exit must be such that - (i) evacuees are hindered from climbing over in the course of evacuating.

(ii) any baggage stowage provisions (such as under seat stowage) would prevent baggage items entering the passageway under the inertia forces of CS 25.561(b )(3) unless placards are installed to indicate that no baggage shall be stowed under the seats bounding the passageway.

(iii) no protrusions (such as coat hooks) could impede evacuation.

(8) The design and arrangement of all seats bordering and facing a passageway to each Type III or Type IV exit, both with and without the bottom cushion in place, must be free from any gap, which might entrap a foot or other part of a person standing or kneeling on a seat or moving on or along the seat row.

(9) The latch design of deployable features (such as tables, video monitors, telephones, leg/foot rest) mounted on seats or bulkheads/partitions bordering and facing a passageway to a Type III or Type IV exit, must be such that inadvertent release by evacuating passeng ers will not occur. The latch design of deployable features must also be such that cabin crew can easily check that the items are fully latched in the stowed position. Placards indicating that each such item must be stowed for taxi, take - off and landing mu st be installed in the normal field of view of, and be readable by each person seated in each seat bordering and facing a passageway to a Type III or Type IV exit.

Powered by EASA eRules Page 528 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONS TRUCTION EMERGENCY PROVISIONS (d) If it is necessary to pass through a passageway between passenger compartments to reach any required emergency exit from any seat in the passenger cabin, the passageway must be unobstructed. However, curtains may be used if they allow free entry through the passageway.

(e) No door may be installed between any passenger seat that is occupiable for take - off and landing and any passenger emergency exit, such that the door crosses any egress path (including aisles, cross - aisles and passageways). (See AMC 25.813(e)) (f) If it is necessary to pass through a doorway separating any crew member seat (e xcept those seats on the flight deck), occupiable for take - off and landing, from any emergency exit, the door must have a means to latch it in the open position . The latching means must be able to withstand the loads imposed upon it when the door is subjec ted to the ultimate inertia forces, relative to the surrounding structure, listed in CS 25.561(b) .

[Amdt 25/9] [Amdt 25/12] [Amdt 25/18] [Amdt 25/19]

AMC 25.813 Emergency exit a ccess

ED Decision 2020/024/R The term ‘unobstructed’ should be interpreted as referring to the space between the adjacent wall(s) and/or seat(s), the seatback(s) being in the most adverse position, in vertical projection from floor - level to at least the prescribed minimum height of the e xit.

The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016, are accepted by the Agency as providing an acceptable means of compliance with CS 25.813 .

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

[Amdt 25/12] [Amdt 25/17] [Amdt 25/26]

AMC 25.813(c) Emergency Exit Access and Ease of Operation

ED Decision 2017/0 1 5/R 1 Post crash seat deformation The requirement for an “unobstructed” passageway is not intended to preclude some deformation of seat structure into the required minimum passageway dimension due to emergency landing dynamic loading.

Seat permanent deformation of up to 3 inches (as recorded in the tests required by CS 25.562 ) into the minimum passageway dimensions defined in CS 25.813(c) is acceptable, provided no part of the seat intrudes into the minimum required projected opening of the exit and provided the exit operating characteristics are not compromised. Relevant parts of FAA Advisory Circular 25.562 - 1B provide further details.

Powered by EASA eRules Page 529 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS 2 Deployable fe atures Features mounted on seats, bulkheads or other cabin features, under passenger control and which deploy into the required minimum passageway, may be accepted as not contravening the “unobstructed passageway” requirements of CS 25.813(c) provided they are easily and instinctively pushed out of the passageway by escapees in the event that they remain deployed prior to, or become deployed during, an evacuation. This may include, but not be limited to, items such as handsets, tray tables, in - armrest video monitors. Items such as footrests which would not be within easy reach of escapees’ hands and/or not easily visible during an evacuation will not be accepted as being easily and instinctively re - stowed.

Such designs will be assessed on their individual merits.

It must be noted that none of the above reduces the requirement to design latching means that will prevent inadvertent release by evacuating passengers. A “Lock out device” will not be acceptable as part of a means of compliance to the minimum unobstructed passageway dimensions. “Lock out device” means a mechanism actuated by a cabin crew member to prevent passengers deploying items into an access passageway during taxi, take - off and landing.

Features (e.g. seat recline, footrests, vide o screens, tables) may still be unsafe, even if they do not deploy into a defined minimum 15.2, 25.4 or 33 cm (6, 10 or 13 inches) passageway (as applicable). Deployable items may create snagging/tripping hazards and in the case where a wider passageway th an the minimum is provided, it cannot be assumed that escaping passengers will constrain themselves to passing along one side or the centre. Features which deploy into the actual passageway provided (in vertical projection from floor level to the upper cei ling/over head bin constraint) will be assessed in the same way as if they deployed into the minimum passageway, i.e. they can be accepted if they can be easily and instinctively pushed out of the passageway as described above.

3 Automatic disposal of hatc h/door The intent, in CS 25.813(c)(6) , of requiring “automatic” disposal of a Type III hatch/door on aeroplanes with passenger seating configurations of 41 or more is to remove the risk of passenger confusion, dif ficulty or error once the opening handle movement has been initiated.

In this context, “automatic” is intended to convey the requirement that this type of Type III exit should be by its design as simple, instinctive and easy to operate as any other type of exit.

Markings, controls and kinematics of the design should be so that with minimal instruction (i.e.

from a study of the placards required by CS 25.813(c)(5) a naïve subject, with the ranges of size th th and strengt h found in the 5 percentile female to the 95 percentile male, would be expected to be able to swiftly and correctly operate the exit to its fully open and secured position.

In this regard, the exit hatch/door should move from its closed to fully open p osition in one simple and continuous operator motion, e.g. avoiding discontinuities in required force/direction on the handle(s). The traditional practice of providing a removable hatch will not be accepted as meeting the requirements of CS 25.813(c)(6) .

I t is to be noted that the requirements of CS 25.809 , which defines emergency exit operating characteristics, testing requirements, etc. are applicable to all exit types, including Type III and IV.

Powered by EASA eRules Page 530 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS 4 Very large ex it access provision In most cases it is expected that the cabin arrangement adjacent to a Type III or IV exit will be such that access provision and unobstructed space for operation will be towards the minimum dimensions required. However, this might not a lways be the case.

Some of the testing performed to substantiate the required dimensions has revealed that competition between escaping passengers can reduce a Type III exit’s evacuation performance in cases where a large unobstructed passageway or adjacen t area is provided.

Dependent on the details of a specific cabin layout, additional substantiation may therefore be necessary for a design providing a substantially larger passageway and/or clear area adjacent to the exit than the minimum required. This wi ll also apply to Type IV exits.

5 “De - rated” and “oversized” exits Two cases can be identified where some additional considerations may be needed when considering the provisions of CS 25.813(c)(4)(i), namely: a. A larger exit type (e.g. Type II, I) which i s declared as a Type III in order to, for instance, place a seat partially overlapping the exit opening (i.e. “de - rating” the exit).

b. The exit opening provided by the design is larger than the minimum required (i.e. an “oversize exit”).

In such cases it may be acceptable that the exit opening provided is partially obstructed, at all times or perhaps when certain features are deployed, if the remaining exit aperture still provides the intended egress performance.

Each such case will be assessed on its ow n individual merits and, if accepted, would be so on the basis of Equivalent Safety.

6 Provisions to prevent escapees bypassing the intended evacuation route CS 25.813(c)(7) (i) is intended to prevent cabin installations which would permit escaping passengers bypassing the intended evacuation route to the exit by climbing over seat backs or any other feature that may bound the required access passageway.

In the case of seat backs, the surface over which an escapee may attempt to climb should remain e ssentially upright, i.e. not exceeding 20 degrees rearward and 10 degrees forward relative to a plane normal to the cabin floor, when a load of up to 668 N (150 lbf) is applied horizontally in a fore/aft direction at the structurally most critical point.

In the case of features other than seat backs, the obstacle to climbing over should be assessed with the aim that it be comparable to the seat back example above, i.e. the angle and height of the item/surface in question.

7 Placards The placards required b y CS 25.813(c)(5) must accurately illustrate the proper method of opening the exit. This will require different “handed” placards for installation on the left and right sides of the cabin. Precautions should be taken to minimise the risk of a placard being installed on the incorrect side of the cabin.

The particular method illustrated on a placard, e.g. placement of body, hands etc. should be substantiated as being that most likely to result in successful operation.

Powered by EASA eRules Page 531 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS 8. Entrapment The seat design should be free of any gaps into which it would be possible to place a foot, hand or arm in such a way as to delay or hamper free movement of passengers to the exit. Any opening/gap that is assessed as being positioned such that it poses a risk and which is more than 2.54 cm (one in ch) in width will need to be the subject of particular scrutiny before b eing found acceptable.

9 Minor obstructions An item may be acceptable as meeting the intent of a minor obstruction in accordance with CS 25.813(c)(4)(ii) provided that, as soon as an occupant begins to open the emergency exit using only the required and visible operating handle, the obstruction moves such that the occupant instinctively understands how to complete removal of the obstructive item. Examples of such items are unattached (or loosely attached) soft seat back cushions on side - facing divans, provided that the cushion may be readily moved away and the emergency exit then easily fully opened. Ease of opening from the outside should also be assessed with the minor obstruction in place. Neither the emergency exit sign nor the operating handle should be obscured at any point.

[Amdt 25/9] [Amdt 25/19]

AMC 25.813(e) Interior Doors

ED Decision 2017/015/R Doors separating occupiable areas of the aeroplane cabin that do not obstruct a p ossible passenger egress path when closed are not prohibited by CS 25 813(e).

Any such door should be openable from both sides without the use of any tool, which means without the need to use any item; it is not acceptable to require the use of even commo n items such as coins, credit cards, pens etc. (note: lavatory doors must comply with CS 25.820).

It is acceptable to have a door between a passenger compartment and a passenger emergency exit in contradiction with the prohibition of CS 25.813(e), provide d that this door is secured in the open position by means acceptable to EASA that cannot be overridden except by a maintenance action (i.e.

the necessary actions should be such that aeroplane occupants are unlikely to be equipped to perform them).

[Amdt 25 /19] Powered by EASA eRules Page 532 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS

CS 25.815 Width of aisle

ED Decision 2003/ 2/RM (See AMC 25.815 ) The passenger aisle width at any point between seats must equal or exceed the values in the following table: Passenger seating Minimum passenger aisle width (cm (inches)) capacity Less than 64 cm (25 inches) from floor 64 cm (25 inches) and more from floor 10 or less 30 (12)* 38 (15) 11 to 19 30 (12) 51 (20) 20 or more 38 (15) 51 (20) * A narrower width not less than 23 cm (9 inches) may be approved when substantiated by tests found necessary by the Agency.

AMC 25.815 Width of aisle

ED Decision 2020/024/R The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016, are accepted by the Agency as providing acceptable means of compliance with CS 25.815 .

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 para graph’.

[Amdt 25/11] [Amdt 25/26]

CS 25.817 Maximum number of seats abreast

ED Decision 2003/2/RM On aeroplanes having only one passenger aisle, no more than 3 seats abreast may be placed on each side of the aisle in any one row.

CS 25.819 Lower deck service compartments (including galleys)

ED Decision 2015 / 019/R (See AMC 25.819 ) For aeroplanes with a service compartment located below the main deck, which may be occupied during the taxi or flight but not during take - off or landing, the following apply: (a) There must be at least two emergency evacuation rout es, one at each end of each lower deck service compartment or two having sufficient separation within each compartment, which could be used by each occupant of the lower deck service compartment to rapidly evacuate to the main deck under normal and emergen cy lighting conditions. The routes must provide for the evacuation of incapacitated persons, with assistance. The use of the evacuation routes may not be dependent on any powered device. The routes must be designed to minimise the possibility of blockage, which might result from fire, mechanical or structural failure, or persons standing on top of or against the escape routes. In the event the aeroplane’s main power system or compartment main lighting system should fail, emergency illumination for each lowe r deck service compartment must be automatically provided.

Powered by EASA eRules Page 533 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION EMERGENCY PROVISIONS (b) There must be a means for two - way voice communication between the flight deck and each lower deck service compartment, which remains available following loss of normal electrical power generati ng system.

(c) There must be an aural emergency alarm system, audible during normal and emergency conditions, to enable crew members on the flight deck and at each required floor level emergency exit to alert occupants of each lower deck service compartmen t of an emergency situation.

(d) There must be a means, readily detectable by occupants of each lower deck service compartment that indicates when seat belts should be fastened.

(e) If a public address system is installed in the aeroplane, speakers must be provided in each lower deck service compartment.

(f) For each occupant permitted in a lower deck service compartment, there must be a forward or aft facing seat, which meets the requirements of CS 25.785(d) and must be able to withstand maximum flight loads when occupied.

(g) For each powered lift system installed between a lower deck service compartment and the main deck for the carriage of persons or equipment, or both, the system must meet the following r equirements: (1) Each lift control switch outside the lift, except emergency stop buttons, must be designed to prevent the activation of the lift if the lift door, or the hatch required by sub - paragraph (g) (3) of this paragraph, or both are open.

(2) An em ergency stop button, that when activated will immediately stop the lift, must be installed within the lift and at each entrance to the lift.

(3) There must be a hatch capable of being used for evacuating persons from the lift that is openable from inside a nd outside the lift without tools, with the lift in any position.

[Amdt 25/17]

AMC 25.819 Lower deck service compartments (including galleys)

ED Decision 2020/024/R The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabi n Interiors Crashworthiness Handbook , dated 24.5.2016, are accepted by the Agency as providing an acceptable means of compliance with CS 25.819 .

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 tha t address the applicable FAR/CS - 25 paragraph’.

[Amdt 25/17] [Amdt 25/26]

CS 25.820 Lavatory doors

ED Decision 2007/020/R All lavatory doors must be designed to preclude anyone from becoming trapped inside the lavatory.

If a locking mechanism is installed, it must be capable of being unlocked from the outside without the aid of special tools.

[Amdt 25/4] Powered by EASA eRules Page 534 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION VENTILATION AND HEATING

VENTILATION AND HEATING

CS 25.831 Ventilation

ED Decision 2019/013/R (See AMC 25.831) (a) Under normal operating conditions and in the event of any probable failure conditions of any system that would adversely affect the ventilating air, the ventilation system must be designed to provide a sufficient amount of uncontaminated air to enable the crew members to perform their duties w ithout undue discomfort or fatigue, and to provide reasonable passenger comfort.

For normal operating conditions, the ventilation system must be designed to provide each occupant with an airflow that contains at least 0.25 Kg (0.55 lb) of fresh air per min ute. (See AMC 25.831(a) .)

(b) Crew and passenger compartment air must be free from harmful or hazardous concentrations of gases or vapours. In meeting this requirement, the following apply: (1) Carbon monoxide concentrati ons in excess of one part in 20 000 parts of air are considered hazardous. For test purposes, any acceptable carbon monoxide detection method may be used.

(2) Carbon dioxide concentration during flight must be shown not to exceed 0·5% b y volume (sea level equivalent) in compartments normally occupied by passengers or crewmembers. For the purpose of this subparagraph, “sea level equivalent” refers to conditions of 25° C (77° F) and 1 013·2 hPa (760 millimetres of mercury) pressure.

(c) Th ere must be provisions made to ensure that the conditions prescribed in sub - paragraph (b) of this paragraph are met after reasonably probable failures or malfunctioning of the ventilating, heating, pressurisation or other systems and equipment. ( See AMC 25.831(c) .)

(d) If accumulation of hazardous quantities of smoke in the cockpit area is reasonably probable, smoke evacuation must be readily accomplished, starting with full pressurisation and without depressurising beyond safe limits.

(e) Except as provided in sub - paragraph (f) of this paragraph, means must be provided to enable the occupants of the following compartments and areas to control the temperature and quantity of ventilating air supplied to their compartm ent or area independently of the temperature and quantity of air supplied to other compartments and areas: (1) The flight - crew compartment.

(2) Crew - member compartments and areas other than the flight - crew compartment unless the crewmember compartment or a rea is ventilated by air interchange with other compartments or areas under all operating conditions.

(f) Means to enable the flight crew to control the temperature and quantity of ventilating air supplied to the flight - crew compartment independently of th e temperature and quantity of ventilating air supplied to other compartments are not required if all of the following conditions are met: (1) The total volume of the flight - crew and passenger compartments is 22.65m (800 cubic ft) or less.

Powered by EASA eRules Page 535 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESI GN AND (CS - 25) CONSTRUCTION VENTILATION AND HEATING (2) The air inle ts and passages for air to flow between flight - crew and passenger compartments are arrange to provide compartme nt temperatures within 2.8°C (5 ° F) of each other and adequate ventilation to occupants in both compartments.

(3) The temperature and ventilation controls are accessible to the flight crew.

[Amdt No: 25/18] [Amdt No: 25/23]

AMC 25.831(a) Ventilation

ED Decision 2020/024/R 1. General CS 25.831(a) specifies that the ventilation system must be design ed to provide a minimum of 0.25 kg (0.55 lb) of fresh air per minute per person (i.e. 10 cubic feet per minute of air at 8 000 feet pressure altitude and at a cabin temperature of 24°C (75°F)) for normal operations.

The applicant may demonstrate compliance with this specification by analysis, ground tests, and/or flight tests.

Because it is not practicable to measure the airflow at each occupant’s location, the fresh air supplied per minute per occupant m ay be determined by averaging the total cabin fresh air supply and cockpit fresh air supply for the number of occupants that each area can accommodate, assuming a uniform ventilation distribution in each area.

2. Low airflow capability during some flight p hases If an applicant proposes not to provide the minimum required fresh airflow during the phases of flight that use low power levels, the applicant must show that the cabin air quality is not compromised during those flight phases.

3. Operations with the air conditioning system ‘off’ The following provisions should be considered for the limited time periods, such as during take - off, during which the air conditioning system is ‘off’: a. There should be a means to annunciate to the flight crew that the air conditioning system is selected to ‘off’. When, in flight, after the end of the maximum allowed time period (e.g. typically after the take - off), the air conditioning system is still in the ‘off’ position, an alert should be triggered to inform the flight c rew of the status of the air conditioning system.

b. It should be demonstrated that the ventilation system continues to provide an acceptable environment in the passenger cabin and the cockpit for the brief period when the air conditioning system is not op erating.

c. Furthermore, the equipment environment should be evaluated during those periods to ensure that the reliability and performance of the equipment are not impaired. This evaluation should cover the extremes of ambient hot and cold air temperatures in which the aeroplane is expected to operate.

Powered by EASA eRules Page 536 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION VENTILATION AND HEATING d. In addition, it should be demonstrated that no unsafe condition will result from operation for a limited time with the air conditioning system ‘off’, if a fire occurs. When demonstrating compliance with CS 25.831(d) (cockpit smoke removal), CS 25.857 (occupied areas smoke penetration), and CS 25.858 (smoke detection), the following should be considered: i. During the operation of the aeroplane for any limited period of time with the air conditioning system ‘off’, the smoke detection systems should be effective.

ii. It should be possible for the air conditioning system to be turned ‘ on’ and returned to the approved air conditioning system ‘on’ configuration to extract any hazardous quantities of smoke.

e. Finally, the period during which the aeroplane is operated with the air conditioning system ‘off’ is intended to be of short durati on. Therefore, the maximum time period allowed for the operation of an aeroplane in this configuration should be defined by the applicant and specified in the appropriate operating manuals, along with any related operating procedures that are necessary to ensure that the above items are addressed.

4. Probable failure conditions For probable failure conditions, the ventilation system should be designed to provide enough fresh air to prevent the accumulation of odours and pollutants such as carbon dioxide. Un der these conditions, t he supply of fresh air should no t be less than 0.18 kg/min (0·4 lb/min) per person for any period exceeding five minutes. However, temporary reductions below this flow rate may be accepted provided that the compartment environment can be maintained at a level which is not hazardous to the occupant ; for this purpose, the applicant may refer to international cabin air quality standards.

[Amdt 25/23] [Amdt 25/26]

AMC 25.831(c) Ventilation

ED Decision 2003/ 2/RM 1 To avoid c ontamination the fresh air supply should be suitably ducted where it passes through any compartment inaccessible in flight.

2 Where the air supply is supplemented by a recirculating system, it should be possible to stop the recirculating system and – a. Still maintain the fresh air supply prescribed, and b. Still achieve 1.

Powered by EASA eRules Page 537 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION VENTI LATION AND HEATING

CS 25.832 Cabin ozone concentration

ED Decision 2003/ 2/RM (a) The aeroplane cabin ozone concentration during flight must be shown not to exceed – (1) 0·25 parts per million by vo lume, sea level equivalent, at any time above flight level 320; and (2) 0·1 parts per million by volume, sea level equivalent, time - weighted average during any 3 - hour interval above flight level 270.

(b) For the purpose of this paragraph, “sea level equiva lent” refers to conditions of 25° C (77° F) and 1 013·2 hPa (760 millimetres of mercury) pressure.

(c) Compliance with this paragraph must be shown by analysis or tests based on aeroplane operational procedures and performance limitations, that demonstrate d that either – (1) The aeroplane cannot be operated at an altitude which would result in cabin ozone concentrations exceeding the limits prescribed by sub - paragraph (a) of this paragraph; or (2) The aeroplane ventilation system, including any ozone contro l equipment, will maintain cabin ozone concentrations at or below the limits prescribed by sub - paragraph (a) of this paragraph.

CS 25.833 Combustion heating systems

ED Decision 2003/2/RM Combustion heaters must be approved.

Powered by EASA eRules Page 538 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PRESSURISATION

PRESSURISATION

CS 25.841 Pressurised cabins

ED Decision 2014 / 026/R (a) Pressurised cabins and compartments to be occupied must be equipped to provide a cabin pressure altitude of not more than 2438 m (8000 ft) at the maximum operating altitude of the aeroplane under normal operating conditions. If certificatio n for operation over 7620 m (25 000 ft) is requested, the aeroplane must be able to maintain a cabin pressure altitude of not more than 4572 m (1 5 000 ft) in the event of any reasonably probable failure or malfunction in the pressurisation system.

(b) Pressurised cabins must have at least the following valves, controls, and indicators for controlling cabin pressure: (1) Two pressure relief valves to automatically limit the positive pressure diffe rential to a predetermined value at the maximum rate of flow delivered by the pressure source. The combined capacity of the relief valves must be large enough so that the failure of any one valve would not cause an appreciable rise in the pressure differential. The pre ssure differential is positive when the internal pressure is greater than the external.

(2) Two reverse pressure differential relief valves (or their equivalents) to automatically prevent a negative pressure differential that would damage the structure. On e valve is enough, however, if it is of a design that reasonably precludes it’s malfunctioning.

(3) A means by which the pressure differential can be rapidly equalised.

(4) An automatic or manual regulator for controlling the intake or exhaust airflow, or both, for maintaining the required internal pressures and airflow rates.

(5) Instruments at the pilot or flight engineer station to show the pressure differential, the cabin pressure altitude, and the rate of change of the cabin pressure altitude.

(6) Warning indication at the pilot or flight engineer station to indicate when the safe or pre - set pressure differential and cabin pressure altitude limits are exceeded. Appropriate warning markings on the cabin pressure differential indicator meet the warnin g requirement for pressure differential limits and an aural or visual signal (in addition to cabin altitude indicating means) meets the warning requirement for cabin pressure altitude limits if it warns the flight crew when the cabin pressure altitude exce eds 3048 m (10 000 ft).

(7) A warning placard at the pilot or flight engineer station if the structure is not designed for pressure differentials up to the maximum relief valve setting in combination with landing loads.

(8) The pressure sensors necessary t o meet the requirements of sub - paragraphs (b)(5) and (b)(6) of this paragraph and CS 25.1447(c) , must be located and the sensing system designed so that, in the event of loss of cabin pressure in any passenger or c rew compartment (including upper and lower lobe galleys), the warning and automatic presentation devices, required by those provisions, will be actuated without any delay that would significantly increase the hazards resulting from decompression.

[Amdt 25/ 15] Powered by EASA eRules Page 539 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION PRESSURISATION

CS 25.843 Tests for pressurised cabins

ED Decision 2003/ 2/RM (a) Strength test. The complete pressurised cabin, including doors, windows, and valves, must be tested as a pressure vessel for the pressure differential specified in CS 25.365(d) .

(b) Functional tests . The following functional tests must be performed: (1) Tests of the functioning and capacity of the positive and negative pressure differential valves, and of the emergency release valve, to simulate the effects of closed regulator valves.

(2) Tests of the pressurisation system to show proper functioning under each possible condition of pressure, temperature, and moisture, up to the maximum altitude for which certification is requested.

(3) Flight test s, to show the performance of the pressure supply, pressure and flow regulators, indicators, and warning signals, in steady and stepped climbs and descents at rates corresponding to the maximum attainable within the operating limitations of the aeroplane, up to the maximum altitude for which certification is requested.

(4) Tests of each door and emergency exit, to show that they operate properly after being subjected to the flight tests prescribed in sub - paragraph (b)(3) of this paragraph.

Powered by EASA eRules Page 540 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION

FIR E PROTECTION

CS 25.851 Fire extinguishers

ED Decision 2016 / 010 /R (See AMC 25.851) (a) Hand fire extinguishers . (See AMC 25.851(a) .)

(1) The following minimum number of hand fire extinguishers must be conveniently located and evenly distributed in passenger compartments. (See AMC 25.851(a)(1) .): Passenger capacity Number of extinguishers 7 to 30 1 31 to 60 2 61 to 200 3 201 to 300 4 301 to 400 5 401 to 500 6 501 to 600 7 601 to 700 8 (2) At least one hand fire extinguisher must be conveniently located in the pilot compartment (see AMC 25.851(a)(2) ).

(3) At least one readily accessible hand fire extinguisher must be available for use in each Class A or Class B cargo or baggage compartment and in each Class E or Class F cargo or baggage compartment that is accessible to crewmembers in flight.

(4) At least one hand fire extinguisher must be located in, or readily accessible for use in, each galley loca ted above or below the passenger compartment.

(5) Each hand fire extinguisher must be approved.

(6) The required fire extinguishers located in the passenger compartment must contain an accepted extinguishing agent that is appropriate for the kinds and clas ses of fires likely to occur where used.

(7) The quantity of extinguishing agent used in each extinguisher required by this paragraph must be appropriate for the kinds of fires likely to occur where used.

(8) Each extinguisher intended for use in a personn el compartment must be designed to minimise the hazard of toxic gas concentration.

(b) Built - in fire extinguishers . If a built - in fire extinguisher is provided – (1) Each built - in fire extinguishing system must be installed so that – (i) No extinguishing agent likely to enter personnel compartments will be hazardous to the occupants; and (ii) No discharge of the extinguisher can cause structural damage.

(2) The capacity of each required built - in fire extinguishing system must be adequate for any fire likely to occur anywhere in the compartment where used, considering the volume of the compa rtment and the ventilation rate. (see AMC 25.851(b) ).

Powered by EASA eRules Page 541 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION (c) Fire - extinguishing agents (See AMC 25.851(c) ) (1) Fire classes against which fire - extinguishing agents may be employed are: — Class A: Fires involving ordinary combustible materials, such as wood, cloth, paper, rubber and plastics; — Class B: Fires involving flammable liqui ds, petroleum oils, greases, tars, oil base paints, lacquers, solvents, alcohols and flammable gases; — Class C: Fires involving energised electrical equipment where the use of an extinguishing agent that is electrically non - conductive is important.

[Amdt 25 /4] [Amdt 25/8] [Amdt 25/12] [Amdt 25/18]

AMC 25.851(a) Hand f ire e xtinguishers

ED Decision 2012 / 008/R 1 Each extinguisher should be readily accessible and mounted so as to facilitate quick removal from its mounting bracket.

2 Unless an extinguisher is clearly visible, its location should be indicated by a placard or sign having letters of at least 9.5 mm (0 ·375) inches in height on a contrasting background.

Appropriate symbols may be used to sup plement such a placard or sign.

[Amdt 25/12]

AMC 25.851(a)(1) Hand f ire extinguishers

ED Decision 2012 / 008 /RM 1 The number and location of hand fire extinguishers sh ould be such as to provide adequate availability for use, account being taken of the number and size of the passenger compartments and the location of toilets, galleys, etc. These considerations may result in the number being greater than the minimum presc ribed.

2 Where only one hand extinguisher is required it should be located at the cabin crew member station, where provided, otherwise near the main entrance door.

3 Where two or more hand extinguishers are required and their location is not otherwise dictated by consideration of paragraph 1 above, an extinguisher should be located at each end of the cabin and the remainder distributed throughout the cab in as evenly as is practicable.

[Amdt 25/12]

AMC 25.851(a)(2) Hand f ire extinguishers

ED De cision 2012/008/R There should be at least one fire extinguisher suitable for Class B and C fires installed in each pilot’s compartment. Additional extinguishers may be required for the protection of other compartments accessible to the crew in flight (e. g. electrical equipment bays) or from consideration of CS 25.851(a)(2) .

Powered by EASA eRules Page 542 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTI ON Based on EU legislation , for new installations of hand fire extinguishers for which the certification application is submitted after 31 December 2014, Halon 1211, 1301 and Halon 2402 are unacceptable extinguishing agents.

The hand fire extinguishers and related agents listed in the FAA Advisory Circular AC 20 - 42D are considered acceptable by the Agency. See AMC 25.851(c) for more information on Halon alternatives.

NOTE: Dry chemical fire extinguishers should not be used in pilot compartments because of the adverse effects on vision during discharge and, if non - conductive, interference with electrica l con tacts by the chemical residues.

[Amdt 25/12]

AMC 25.851(b) Built - in Fire Extinguishers for Cargo Compartments

ED Decision 2012/008 /R 1. PURPOSE .

This AMC sets forth acceptable means, but not the only means, of demonstrating compliance with the provi sions of CS - 25 related to the built - in fire suppression systems when required for cargo compartments of large aeroplanes. The guidance provided within this AMC has been found acceptable for showing compliance with the provisions of CS 25.855 and 25.857 for built - in fire - extinguishing systems. As with all AMC material, it is not mandatory and does not constitute a regulation. For application to the product, alternate methods may be elected to be followed, provided that these methods are also found by the EASA to be an acceptable means of complying with the requirements of CS - 25.

2. RELATED CS PARAGRAPHS .

CS 25.851 "Fire extinguishe rs" CS 25.855 "Cargo or baggage compartments" CS 25.857 "Cargo compartment classification” CS 25.858 "Cargo compartment fire detection systems” 3. BAN ON HALON 1301.

Halon 1301 is no longer an acceptable extinguishing agent, based on EU Legislation , for cargo compartment fire extinction systems to be i nstalled on aircraft types, for which type certification is requested after 31 December 2018. See AMC 25.851(c) for more information on Halon alternatives.

4. BACKGROUND O N CONCENTRATION OF HALON 1301.

Minimal written guidance is available for use in certifying cargo compartment fire - extinguishing or suppression systems. Testing at the FAA Technical Center and other data from standardised fire - extinguishing evaluation tests indicates that the use of aver aging techniques may not substantiate that there are adequate concentration levels of fire - extinguishing agent throughout the compartment to effe ctively suppress a cargo fire.

Cargo fire - extinguishing systems installed in aeroplanes have primarily used Hal on 1301 as the fire suppression agent. One widely used method to certify Halon 1301 cargo fire suppression Commission Regulation (EU) No 744/2010 of 18 August 2010 amending Regulation (EC) No 1005/2009 of the European Parliament and of the Council on substances that deplete the ozone layer, with regard to the critical uses of halon (OJ L 218, 19.8.2010, p. 2).

Commission Regulation (EU) No 744/2010 of 18 August 2010 amending Regulation (EC) No 1005/2009 of the European Parliament and of the Council on substances that deplete the ozone layer, with regard to the critical uses of halon (OJ L 218, 19.8.2010, p. 2).

Powered by EASA eRules Page 543 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION systems requires an initial concentration of five percent by volume in order to knock down a cargo fire. Subsequent concentration levels should not d rop below three percent by volume for the remainder of the flight in order to suppress a cargo fire until it can be completely extinguished by ground personn el following a safe landing.

Since Halon 1301 is approximately five times heavier than air, it tend s to stratify and settle after it is released into the cargo compartment. Also, due to temperature differences and ventilation patterns, in a ventilated compartment, Halon 1301 will start to stratify shortly after discharge and the concentration level will decay faster in the upper locations of the compartment than in the lower locations. Halon 1301 will also have a tendency to move aft due to any upward pitch or forward in any downward pitch of the aeroplane in flight. For some products the concentration l evels of Halon 1301 have been measured at various locations throughout the cargo compartment and used an arithmetic average of the individual sampling locations to determine an overall concentration level for the cargo compartment. This averaging technique may allow the concentration level to drop below three percent by volume at individual sampling locations near the top of the cargo compartment.

Testing at the FAA Technical Center and other data from standardised fire - extinguishing evaluation tests indica tes that the use of averaging techniques may not substantiate that there are adequate concentration levels of fire - extinguishing agent throughout the compartment to effectively suppress a cargo fire. If a cargo fire occurred, and was subsequently suppresse d by Halon 1301, the core of the fire could remain hot for a period of time. If the local concentration of Halon 1301 in the vicinity of the fire core dropped below three percent by volume and sufficient oxygen is available, re - ignition could occur. The FA A tests have shown that when the Halon 1301 concentration level drops below three percent by volume and the cargo fire re - ignites, the convective stirring caused by the heat of the fire may be insufficient to raise the local concentration of Halon in the v icinity of the fire. Therefore, compliance testing will require the use of point - concentration data from each sensor and that the probes closest to the cargo compartment ceiling must be at least at the highest level that cargo and baggage can be loaded as specified by the manufacturer and certified by the appropriate airworthiness authority. In addition, certification test data acquisition must include analysis and/or data taken after landing at a time increment which represents t he completion of an evacuat ion.

5. COMPARTMENT CLASSIFICATION.

All cargo compartments must be properly classified in accordance with CS 25.857 and meet the requirements of CS 25.857 pertaining to the particular class involved. In order to establish appropriate requirements for fire protection, a system for classification of cargo or baggage compartments was developed and adopted for large aeroplanes. Classes A, B, and C were initially established; Classes D and E were added later.

a. A Cla ss A compartment is one that is located so close to the station of a crewmember that the crewmember would discover the presence of a fire immediately. In addition, each part of the compartment is easily accessible so that the crewmember could quickly extin guish a fire with a portable fire extinguisher. A Class A compartment is not required to have a liner.

(1) Typically, a Class A compartment is a small open compartment in the cockpit area used for storage of crew luggage. A Class A compartment is not, ho wever, limited to such use; it may be located in the passenger cabin and used for other purposes provided it is located adjacent to a crewmember's station and crewmember remains present during all times when it is used for storage.

Powered by EASA eRules Page 544 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION (2) Because a Class A compartment does not have a liner, it is absolutely essential that the compartment be small and located close enough to a crewmember that any fire that might occur could be discovered and extinguished immediately. Without a liner to contain it, an undetect ed or uncontrolled fire could quickly become catastrophic by burning out of the compartment and spreading throughout the aeroplane. All portions of the compartment must be within arms length of the crewmember in order for any fire to be detected immediatel y and extinguished in a timely manner. Although there may be some exceptions, such as a 'U - Shaped' compartment for example, a Class A compartment greater than 1.42 cubic metres (50 cubic feet) in volume would not typically have the accessibility required b y CS 25.857(a)(2) for fighting a fire.

b. A Class B compartment is one that is more remote than a Class A compartment and must, therefore, incorporate a fire or smoke detection system to give warning at the pilot or flight engineer station. Because a fire could not be detected and extinguished as quickly, a Class B compartment must have a liner in accordance with CS 25.855. A Class B cargo or baggage compartment has sufficient access in flight to enable a crewmember to reach all parts of the compartment wit h the content s of a hand fire extinguisher. There are means to ensure that, while the access provisions are being used, no hazardous quantity of smoke, flames, or extinguishing agent will enter areas occupied by the crew or passengers.

c. A Class C compart ment differs from a Class B compartment in that it is not required to be accessible in flight and must, therefore, have a built - in fire - extinguishing system to suppress or control any fire occurring therein. A Class C compartment must have a liner and a f ire or smoke detection system in accordance with CS 25.855 and 25.857. There must also be a means to control ventilation and drafts within the compartment and a means to exclude hazardous quantities of smoke, flames, or extinguishing agent from occupied ar eas.

d. FAR Amendment 25 - 93 removed the Class D cargo compartment classification for new aeroplanes effective March 19, 1998.

e. A Class E compartment is particular to an all - cargo aeroplane. Typically, a Class E compartment is the entire cabin of an all - cargo aeroplane; however, other compartments of such aeroplanes may be classified as Class E compartments. A fire in a Class E compartment is controlled by shutting off the ventilating airflow to or within the compartment. Additionally, most cargo aeroplan es have smoke/fire procedures that recommend that the crew turn off the ventilating air, don their oxygen equipment, and gradually raise the cabin altitude, between 6096 m (20,000 feet) and 7620 m (25,000 feet), to limit the oxygen supply and help control a fire until the aeroplane can descend to land. A Class E compartment must have a liner and a fire or smoke detection system installed in accordance with CS 25.855; however, it is not required to have a built - in fire suppression system.

6. FIRE EXTINGU ISHING OR SUPPRESSION SYSTEMS .

The terms “extinguishing system” and “suppression system” will be use d interchangeably in this AMC. The system is not required to extinguish a fire in its entirety. The system is intended, instead, to suppress a fire until it can be completely extinguished by ground personnel following a safe landing.

Powered by EASA eRules Page 545 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBP ART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION 7. TESTING VO LUMETRIC CONCENTRATION LEVELS.

For the product it should be demonstrated that the cargo fire extinguishing system provides adequate concentration levels o f extinguishing agent to combat a fire anywhere where baggage and cargo is placed within the cargo compartment for the time duration required to la nd and evacuate the aeroplane. A combination of flight - testing and analysis may be used to comply with this r equirement. If Halon 1301 is used, an initial minimum concentration of five percent by volume is requir ed to knock down a cargo fire. Subsequent gaseous extinguishing agent should, if required for the duration of the flight, be introduced via a metering or other appropriate system to ensure that point concentration levels do not drop below three percent by volume fo r the remainder of the flight. The duration of agent application should be determined from route analysis (i.e. the time to travel from the fart hest distance expected in route to the nearest adequate airport for landing per applicable operational rules. For Extended Operation with Two - Engine Aeroplanes (ETOPS) AMC 20 - 6 specify that an analysis or tests should be conducted to show, considering app roved maximum diversion in still air (including an allowance for 15 - minute holding and/or approach and land), that the ability of the system to suppress or extinguish fires is adequate to ensure safe flight and landing at a suitable airport.

The minimum ex tinguishing agent concentration levels are to be maintained for the required duration throughout the cargo compartment where cargo will be carried, including side to side, end to end, and top to bottom. However, flight test measurements do not have to be made in compartment areas that are designated empty and will not contain cargo.

The fire extinguishing agent concentration levels should be measured at sufficient vertical , horizontal, and longitudinal locations to ensure that sufficient resolution exists to define the variations in fire extinguishing agent concentration levels throughout the carg o compartment in these planes. No averaging techniques are permitted in compliance demonstrati ons for CS 25.851(b)(2 ). Th e only exception to this will be in the event of a sensor failure where interpolation of sensor data from other nearby probes to yield an estimate of missing agent concentration data may be allowed by the Agency. In the event such interpolation is necessa ry, then a linear interpolation of the data will provide an acceptable means of ap proximating the missing data.

Sampling locations should also be placed as close as practical to potential leakage or ventilation flow areas (e.g., door seals, vents, etc.) wh ich can disrupt the local concentration levels.

The concentration levels should not be less than the minimum established for that fire extinguishing agent at any point within the compartment. Arithmetic averaging of individual sampling locations to determi ne the concentration levels is not acceptable. The use of averaged concentration data will no longer be accepted, except in well - defined cases (i.e., during certification tests) where a sensor probe failure occurs and the use of interpolation from adjacent sensor probes is warranted. Compliance with CS 25.851(b) will require the use of point - concentration data from each sensor and that the probes closest to the cargo compartment ceiling must be at least at the highest level that cargo and baggage can be lo aded as specified by the manufacture r and certified by the Agency. Other placement of concentration sensor probes within the cargo compartment should be sufficient to substantiate that there are adequate concentration levels of fire extinguishing agent thr oughout the compartment to effectively control a cargo compartment fire. The sampling rate should be sufficient to establish a concentration level versus time decay curve. In the event that a single sensor displays a suspect time history, the use of an in terpolated time averaged value may be acceptable to the Agency. If fire extinguishing agent concentration levels at a probe drop below the minimum requirement, it should be a temporary anomaly of short duration and not observed in adjacent Powered by EASA eRules Page 546 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION probes. If it could be demonstrated that the temporary anomaly is associated with aeroplane manoeuvres, then the data may be acceptable to the Ag ency.

Typically there are two type of extinguishing agent dispensing systems, a flood or dump (high rate discharg e) system an d a metered system. The flood or dump system dispenses the agent with the activation of the system and a selected amount of agent is injected into the co mpartment to suppress the fire. Once the agent concentration level approaches the minimum sustaining le vel, i.e., 3%, a second and subsequent discharge of agent takes place to assure the 3% concentration level is maintained for the time necessa ry to divert to a safe landing. The metered systems usually discharge agent into the compartment for fire suppressi on (5%) and then adds agent in a prescribed amount to the compartment to maint ain the 3% concentration level.

Certification flight test demonstration is required for a “dump” system for the duration of t he intended diversion profile. If a metering system i s proposed, the system’s acceptability may be demonstrated through a limited flight test, in which a portion of the system is actually tested, and the full capability of the system is demonstrated via analysis. It is recognised that issues such as what co mpartment size should be tested (smallest or largest), the test duration in flight, and whether reliable analytical methods are available to predict concentration levels for various locations and heights in a given cargo compartment will have an impact on certification tests.

EASA concurrence must be obtained for this type of testing and analysis of the product. A sufficient portion of the metering system capability should be demonstrated to provide enough data to establish fire extinguishing agent concent ration and behaviour for the remaining flight.

It is recognised that aeroplane climb flight phase and the descent flight phase represent dynamic environments and no data need be acquired during these transient flight phases were cabin altitude changes wou ld preclude accurate data acquisition. However, certification data must include analysis and/or data taken after landing at a time increment representative of the completion of an evacuation of all occupants.

Acceptable extinguishing agents, alternative t o Halon and based on internationally recognised Minimum Performance Standards (MPS), like e.g. Report No. DOT/FAA/AR - 00 - 28, Development of a Minimum Performance Standard for Aircraft Cargo Compartment Gaseous Fire Suppression Systems, dated September 2000, may be accepted by the Agency. In the absence of internationally accepted concentration levels, the Agency will initiate a Certification Review Item addressing the use of an alternate fire - extinguishing agent.

8. AEROPLANE TEST CONDITIONS FOR USE OF HALON 1301 IN CARGO COMPARTMENTS .

Flight tests are required to demonstrate function and dissipation of the fire extinguishing agent or si mulant in a cargo compartment. For certification tests, the aeroplane and relevant systems should be in the type design configuration.

The cargo compartment shoul d be empty for the above test. However, as shown in Figure 8 - 1, a compartment with cargo may be more time critical than an empty compartment for minimum fire extinguishi ng agent concentration level s. The time critical nature depends on se veral factors. Even with a pure “dump” system, having cargo does not necessarily mean a marginally performing system during an empty cargo compartment test will result in a “bad” system with cargo. Also, metering sy stems, if designed properly, are relatively insensitive to the cargo load factor .

Powered by EASA eRules Page 547 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION Figure 8 - 1. Effect of Cargo Load on Halon 1301 Concentration Levels A specific example of the effect of cargo compartment loading is shown in Figure 8 - 2, using the Appendix 1 simulation. If the volume of the compartment is decreased to represent increasing cargo load percentages and the leakage rate and initial Halon quantity are kept constant, then the initial Halon concentrati ons increase and the concentration decay rates also increase. Using this approach, the concentration in an empty compartment will decay to 3% faster than a loaded compartment up to a load percentage of about 65.6%. With compartments loaded to a higher perc entage than 65.6%, the concentration will fall below 3% faster than an empty compartment.

This simulation of cargo loading assumes that the Halon concentration is homogeneous throughout the compartment and that the volume taken up by the loaded cargo is u niformly distributed throughout the compartment. Note: Both of these assumptions are not true in an actual loaded compartment so caution should be exercised to relate the measurements taken in an actual loaded compartment in flight.

Powered by EASA eRules Page 548 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION Figure 8 - 2 Analysis should be provided to ensure that the suppression agent concentration levels will not fall below the minimum requirement with a cargo load factor as follows: a. For cargo compartments using only standard cargo containers, the maximum possible volume occup ied by containerised cargo should be determined for the product and this value be used as the cargo load factor. This maximum volume becomes an aeroplane limitation.

b. For all other configurations, a minimum cargo load factor of 75% by volume should be u sed for the product.” Appendix 1 to this AMC provides guidance on analysing Halon 1301 concentration levels.

The suppression system certification test should be conducted, as a minimum, during steady - state cruise w ith a maximum cabin - to - ambient pre ssure differential. The ventilation system should be configured per the aeroplane flight manual (AFM) procedure s for a cargo compartment fire. The system should also be demonstrated acceptable for unpressurised flight cond itions unless there is a restriction on unpressurised flight for the aeroplane.

It should be noted that cargo compartment leakage rates would vary between aeroplanes. This is especially significant for changes introduced by supplemental type certificate ( STC) modifying aeroplanes that have been in service. Some preliminary testing should be done to determine the maximum leakage rates seen/expected in service. For new type designs the issue of wear and tear on the compartment should also be addressed when establishing the decay rate in a bran d new aircraft at the factory.

Powered by EASA eRules Page 549 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION 9 . USE OF SIMULANTS FOR CERTIFICATION TESTING The aviation industry may continue to use Halon in cargo fire suppression applications in relation to new application for type certificate, until the end of 2018..

The EPA/EU are allowing the aviation industry to use Halon to demonstrate system functionality as long as a simulant or alternate extinguishing agent or alternate fire - extinguishing system cannot be used in place of the Halon during system or equipment testing for technical reasons.

It should be noted, however, that certain states cont inue to ban the release of Halon for testing.

The FAA Technical Center and the International Aircraft Systems Fire Protection Working Group are concentrating efforts on evaluating alternative fire - extinguishing agents and the use of simulants during certif ication testing. The EASA plans to approve a simulant which can be used in place of Halon 1301 during certification tests of aircraft fire - extinguishing systems to predict actual Halon 1301 volumetric concentration levels. When approved, the use of a simul ant will be the preferred method for demonstrating compliance.

As of the date of this AMC, no suitable simulant for cargo compartment gaseous fire extinguishing systems has been identified. However, should the EASA be approac hed with the intent of utilise for the product a simulant in lieu of a Halon 1301 system or other gaseous fire extinguishing system then the recommended approach would be to perform testing which meets the Minimum Performance Standards for that application as developed by the Internatio nal Aircraft Systems Fire Protection Working Group. To ensure acceptable successful means of compliance the same information as outlined above in paragraph 7 should be provided.

A simulant is defined in this AMC as a chemical agent that adequately imitates the discharge and distribution characteristics of a given extinguishing agent. It need not be an actual fire suppressant. For certain cases due to cost of the extinguishing agent, problems with supply of the extinguishing agent, etc; it may be more appro priate for the application to utilise a simulant.

The Agency would require adequate analysis and testing be accomplished to establish the validity of the simulant. As a minimum, corroborating information would need to be provided as to the detailed chemic al analysis of the simulant and evaluation testing of the fire extinguishing system operated with the simulant which demonstrates the equivalent behaviour.

To ensure acceptable means of compliance, the following must be provided: (1) The test data and dis tribution profiles using the simulant which meet the certification criteria as expressed below and in the Minimum Performance Standards as developed by FAA Technical Center as part of the International Aircraft Systems Fire Protection Working Group. (See P aragraph 15 for the listing of the references.)

(2) A system description document that includes a description of the distribution of the simulant under the test conditions in the cargo compartment.

(3) A detailed test plan.

(4) Chemical data which descri bes the simulant and any toxicity data.

For the application the distribution of the simulant must be described as compared with Halon 1301 under the following conditions: a. Given the same filling conditions, the simulant is loaded into the fire extinguish er bottle based on an equivalent liquid fraction to the Halon 1301 charge weight required. This is an equivalent statement to the mass of the simulant being a specific percentage of the Halon 1301 charge weight required.

Powered by EASA eRules Page 550 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESI GN AND (CS - 25) CONSTRUCTION FIRE PROTECTION b. The fire extinguisher bottle c ontaining the simulant is pressurised with nitrogen in an identical manner required by the Halon 1301 charge weight.

c. The simulant is discharged into the test environment, i.e. cargo compartment.

9 .1 Pre - Test Considerations: a. An EASA accepted analy ser (for example, Statham - derivative analyser) capable of measuring the simulant distribution profile in the form of volumetric concentration is required.

b. An EASA accepted analyser (for example, Statham - derivative analyser) and associated hardware are configured for the particular application.

c. The fire suppression system should be completely conformed for Halon 1301.

d. The fire extinguisher bottle(s) should be serviced and prepared for the prescribed test(s).

9 .2 Test Procedures: a. Perform the prescribed distribution test in accordance with the EASA approved test plan. See Paragraph 7 for guidance on probe placement.

b. An EASA accepted analyser (for example, Statham - derivative analyser) should record the distribution profile as volumetric conc entration for the simulant.

9 .3 Test Result Evaluation: a. Produce the data from the EASA accepted analyser (for example, Statham - derivative analyser) in graphical format. This format should be the volumetric concentration of the simulant versus time. A specific percent volumetric initial concentration and a specific percent volumetric metered concentration for the length of the test duration as determined by previous testing conducted per the established minimum performance standards is required for airw orthiness approval of cargo compartment systems.

b. Using the Halon 1301 certification criteria, evaluate the distribution profile of the simulant for acceptable performance. The acceptability of the test data would be dependent upon the distribution pro file and duration exhibited by each probe (See above and Paragraph 7 for cargo compartment fire extinguishing systems).

10 . ESTABLISHING DURATION FOR THE SUPPRESSION SYSTEM.

The adequacy of the capacity of the “built - in system” is understood to mean, that there is sufficient quantity of agent to combat the fire anywhere where baggage and cargo is placed within the cargo compartment for the time duration required to la nd and evacuate the aeroplane. Current built - in cargo fire extinguishing systems utilise H alon 1301 as the fire extinguishing agent. Protection is afforded as long as the minimum concentration levels in the cargo compartment do not drop below three percent by volume. The time for which a suppression system will maintain the minimum required co ncentration levels should be identified as a certificate limitation.

The designer of the product should work with the aircraft owner and the competent authority providing operational approval to ensure that the cargo fire extinguishing system provides the required protection time (i.e., proper sizing of the cargo fire extinguishing system) for the specific route structure. The competent authority may insist on some holding time to allow for Powered by EASA eRules Page 551 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION weather and other possible delays, and may specify the speeds and altitudes used to calculate aeroplane diversion times based on one - engine - out considerations.

The competent authority providing operational approval for the aeroplane determines the maximum allowable time, following the discovery of a fire or other emerge ncy situation, required to divert the aeroplan e to an alternate landing site. In the past, for some cases, the maximum allowable time was calculated by adding a 15 minute allowance for holding and/or approach and landing to the actual time required to reac h the alternate landing site under specific operating conditions. With the issuance of this AMC, an allowance of 15 minute for approach and landing must be considered and certification data must include analysis and/or data taken after landing at a time i ncrement which represents the completion of an evacuation of all occupants.

AMC 20 - 6 “Extended Range Operation with Two - Engine Aeroplanes (ETOPS),” provides acceptable means for obtaining approval under applicable operational rules for two - engine aeroplanes operating over a route that contains a point farther than one hour’s flying time at the normal one - engine inoperative cruise speed (in still air) from an adequate airport. It includes specific criteria for deviations of 75 minutes, 120 minutes, and 180 minutes from an adequate airport plus an allowance for 15 - minute holding and/or approach and land.

Certification flight tests, supplemented by analysis for cargo load factors and additional metering system bottles as applicable, determines the max imum protection time provided by the cargo fire extinguishing system. This maximum protection time may not be the same as the maximum allowable time req uired to divert the aeroplane. The certificate limitation for total time, including the 15 minute allow ance for holding and/or approach and landing as applicable, should never be greater than the maximum protection time provided by the cargo fire extinguishing system.

The following examples illustrate these issues: Example 1 Maximum protection time provided By cargo fire extinguishing system = 127 minutes Maximum diversion time = 112 minutes + 15 minutes (Note - in this example, the civil aviation authority required an allowance of 15 minutes for holding and/or approach and landing) Certificate lim itation for total time = 127 minutes Example 2 Maximum protection time provided By cargo fire extinguishing system = 68 minutes Maximum diversion time = 60 minutes (Note - in this example, the civil aviation authority did not require the 15 minutes allow ance for holdin g and/or approach and landing. With the issuance of this AMC, the approach indicated in example 2 above is no longer considered an acceptable means of compliance.)

Certificate limitation for total time = 60 minutes” Powered by EASA eRules Page 552 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION 11 . MANUAL CONSIDERAT IONS.

To ensure fire protection/fire suppression system effectiveness and safe continuation of flight and landing, the applicable aeroplane manuals should contain appropriate directives, for example: a. Any procedures related to fighting a cargo compartmen t fire should be clearly defined in the Aeroplane Flight Manual (AFM).

b. Aeroplane Flight Manuals should contain instructions to land at the nearest adequate airport (or suitable airport for ETOPS ) following detection of a cargo fire.

c. Cargo loading restrictions (certified type of loading per compartment, limits for loading heights and width, etc.) should be clearly described in the Weight & Balance Manual or any other appropriate aeroplane manual.

d. Where the use of aeroplane manuals is considered to be impractical during cargo loading activities, all necessary information may be introduced into crew operating manuals or part of dedicated instructions for cargo loading personnel.

12 . PLACARDS AND MARKINGS IN CARGO COMPARTMENTS Experience has show n that under certain circumstances and despite clear instructions in the applicable aircraft documentation, cargo loading personnel may not obey loading restrictions.

Especially pallets may be loaded higher than certified or bulk cargo may be stowed up to the ceiling, adversely affecting smoke detection and fire protection/fire suppression system effectiveness.

To visually indicate the applicable loading restrictions to each person being responsible for cargo loading activities in a compartment, placards an d markings for certified type of cargo, maximum loading height and widths may need to be installed in that compartment.

For the design of these indications (i.e., for shape, size, colour and brightness), illumination conditions in the compartment should b e considered. Markings and placards should not be easily erased, disfigured or obscured. Further guidance may be derived from compliance demonstrations for CS paragraphs regulating other internal markings and placards, for example in the cockpit or passeng er compartment.

[Amdt 25/4] [Amdt 25/12] Powered by EASA eRules Page 553 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION

Appendix 1: Analytical methods for determining Halon 1301

concentration levels

ED Decision 2007/020/R 1. PURPOSE. This appendix contains analytical methods for determining Halon 1301 fire extinguishing agent concentration levels in empty or loaded cargo compartments as a func tion of time.

2. EXPLANATION OF TERMS AND SYMBOLS.

TABLE 2 - 1. TERMS AND SYMBOLS SYMBOL DESCRIPTION UNITS CONSISTENT WITH EQUATIONS C(t) Halon 1301 concentration by volume at time “t.” Dimensionless = V Halon 1301 / V V Volume of Halon 1301 in cargo compartment. Cubic metre - m Halon 1301 (Cubic feet - ft ) V C argo compartment free volume (i.e., volume not Cubic metre - m occupied by cargo). (Cubic feet - ft ) = 1 - ( V / V ) cargo empty V cargo Cargo volume. Cubic metre - m (Cubic feet - ft ) V empty Empty cargo compartment volume. Cubic metre - m (Cubic feet - ft ) T Time. Minutes – Min E Cargo compartment leakage rate. Cubic metre per minute - m /min (Cubic feet per minute - ft /min) S Specific volume of Halon 1301. Cubic metre per kilogram m /kg (cubic feet per pounds(mass) ft /lbm) R Halon 1301 flow rate. Kilogram per minute kg/min (pounds(mass) per minute lbm/min) 3. HALON 1 301 CONCENTRATION LEVEL MODEL.

Cargo compartment fire extinguishing systems generally use a combination of one or two types of Halon 1301 discharge methods. One type rapidly releases all of the fire extinguishing agent from one or more pressur ised bottles into the cargo compartment. This type of discharge method is commonly known as a high rate discharge or ‘dump’ system.

Powered by EASA eRules Page 554 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION FIGURE 3 - 1. EXAMPLE - HALON 1301 MODEL The second type of Halon 1301 discharge method slowly releases the fire extinguishing agent from one or more pressurised bottles in to the cargo compartment. This type of discharge method is commonly known as a metering system.

The following list provides some examples, not all - inclusive, of different combinations of thes e Halo n 1301 discharge methods.

a. One high rate discharge.

b. One high rate discharge followed by a second high rate discharge at a specif ied later time.

c. One high rate discharge followed by a metered disch arge at a specified later time.

d. Simultaneous high rate and metered discharges.

The Halon 1301 fire extinguishing system described in paragraph 3.c. above utilises both types of discharge methods an d is illustrated in Figure 3 - 1.

Prior to Phase I - Initial High Rate Discharge of Halon 1301 This portion of the extinguishing process illustrates the high rate discharge method of releasing all of the fire extinguishing agent from one or more pressurised bott les into the cargo compartment.

Phase I - Exponential “Decay” of Halon 1301 The beginning of Phase I repr esents the initial concentration of Halon 1301 used to knock down a cargo fire. Since no more Halon 1301 is introduced into the cargo compartment during Phase I, the concentration of Halon 1301 undergoes an e xponential “decay” versus time.

Powered by EASA eRules Page 555 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONST RUCTION FIRE PROTECTION The governing eq uation for exponential “decay” d uring Phase I is the following: - E t /V C(t) = C(0) e NOTE - C(0) is the initial concentration of Halon 1301 used to knock down a cargo fire at the beginning of Phase I and t is the time elapsed since the beginning of Phase I.

Phase II - Metered Discharge of Halon 1301 The metered discharge of Halon 1301 starts at the beginning of Phase II. The example in Figure 3 - 1 shows that the metering rate is set to release Halon 1301 into the cargo compartment at a rate which is slight ly greater than the rate Halon 1301 is lost through cargo compartment leakage.

The governing equation for metering during Phase II is the following: - E t / V C(t) = [ C(0) - { R S / E } ] e + { R S / E } NOTE - C(0) is the concentration of Halon 1301 at the end of Phase I and t is the time elapsed since the end of Phase I.

Phase III - Exponential “Decay” of Halon 1301 The beginning of Phase III marks the end of Halon 1301 metering. As in Phase I, since no more Halon 1301 is introduced into the cargo compartment, the concentration of Halon 1301 undergoes an e xponential “decay” versus time.

The governing equation for exponential “decay” during Phase III is the same as during Phase I with one exception; C(0) is the concentration of Halon 1301 at the end of Phase II and t is the time since the end of Phase II.” [Amdt 25/4]

AMC 25.851(c) Alternative fire - extinguishing agents

ED Decision 2012/008/R 1. General The Montreal Protocol, in existence since 1987, is an international agreement to phase out producti on and use of ozone - depleting substances, including halogenated hydrocarbons also known as Halon. The Montreal Protocol prohibits the manufacture or import of new Halon in all developed countries as of 1 January, 1994. The US Environmental Protection Agenc y (EPA) has released a regulation banning the intentional release of Halons during repair, testing, and disposal of equipment containing Halons and during technician training. However, the EPA has provided the aviation industry an exemption from their ban on the intentional release of Halon in determining compliance with airworthiness st andards. A European regulation governing substances that deplete the ozone layer was also published, containing initial provisions for Halon phase - out, but also exemptions for critical uses of Halon, including fire - extinguishing in aviation. It should be noted that the exemptions were predicated on the basis that there were, at that time, no suitable alternate agents or systems available for use on commercial transport cate gory aeroplanes.

Regulation (EC) No 2037/2000 of the European Parliament and of the Council of 29 June 2000 on substances that deplete the ozone layer.

Powered by EASA eRules Page 556 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION ‘Cut - off’ dates (i.e. Halon no longer acceptable in new applications for type certification) and ‘end’ dates (i.e. Halon no longer acceptable for use in aircraft) have been subsequently establis hed by a new regulation in 2010 , as presen ted in Table 4.1 below: Table 4.1: ‘Cut - off’ and ‘end’ dates Dates Aircraft Type of Type of Halon compartment extinguisher Cut - off End Inerting of fuel tanks Fixed 1301 31 December 31 December 2402 2011 2040 Lavatory waste Built - in 1301 31 December 31 December receptacles 1211 2011 2020 Dry bays Fixed 1301 31 December 31 December 1211 2011 2040 Cabins and crew Hand 1211 31 December 31 December compartments (portable) 2402 2014 2025 Propulsion systems Built - in 1301 31 December 31 December and Auxiliary Power 1211 2014 2040 Units 2402 Normally unoccupied Built - in 1301 31 December 31 December cargo compartments 1211 2018 2040 2 Lavatory extinguishing systems and agents Historically, Halon 1301 has been the most widespread agent used in lavatory extinguishing (lavex) systems, to be used in the event of a Class A fire. Any alternative acceptable fire - extinguishing agent meeting the Minimum Performance Standards (MPS) laid down in Appendix D to Report DOT/FAA/A R - 96/122 of February 1997, which includes the ability to extinguish a Class A fire and, in case of discharge, does not create an environment that exceeds the chemical agent’s ‘No Observable Adverse Effect Level’ (NOAEL) will be acceptable. Research and tes ting have shown that there are suitable alternatives to Halon for built - in fire extinguishers in aircraft lavatories meeting the MPS for effectiveness, volume, weight and toxicology. Currently HFC - 227ea or HFC - 236fa are widely used on large aeroplanes and usually considered acceptable by EASA.

3 Hand fire extinguishers and agents Historically, Halon 1211 has been the most widespread agent in handheld (portable) fire extinguishers to be used in aircraft compartments and cabins. Minimum Performance Standard s (MPS) for the agents are laid down in Appendix A to Report DOT/FAA/AR - 01/37 of August 2002, while acceptable criteria to select the fire extinguishers containing said agents are laid down in the FAA Advisory Circular AC 20 - 42C. Version D of the same AC ( published in 2011) would be preferred when the needed supporting guidance material has been released. Three agent alternatives to Halon are presently known meeting the MPS: HFC - 227ea, HFC - 236fa and HFC Blend B. However, these agents are significantly heavi er and occupy a greater volume than Halon 1211. This may indirectly (i.e. additional weight of the fire extinguisher and additional weight of the structures supporting it) increase CO2 emissions. Furthermore, some of these Commission Regulation (EU) No 744/2010 of 18 August 2010 amending Regulation (EC) No 1005/2009 of the European Parliament and of the Council on substances that deplete the ozone layer, with regard to the critical uses of halon (OJ L 218, 19.8.2010, p. 2).

Powered by EASA eRules Page 557 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION agents have also been identified as having a global warming potential much higher than Halon.

Therefore, further research is underway to develop additional alternatives to Halon 1211 for hand fire extingu ishers.

Should an applicant wish to propose, even before the end of 2014, any alterna tive agent for hand fire extinguishers meeting the mentioned MPS, the EASA will initiate a Certification Review Item addressing the use of such an alternate fire - extinguishing agent.

4 Fire protection of propulsion systems and APU Historically, Halon 1301 has been the most widespread agent used in engine nacelles and APU installations to protect against Class B fires. The MPS for agents to be used in these compartments are particularly demanding because of the presence of fuel and o ther volatile fluids in close proximity to high temperature surfaces, not to mention the complex air flows and the extremely low temperatures and pressures surrounding the nacelles. Various alternatives are being developed (e.g. FK - 5 - 1 - 12). The FAA has iss ued “Minimum Performance Standards (MPS) for Halon replacement in fire - extinguishing agents/systems of civil aircraft engine and APU compartments (MPSHRe rev03)” and intends to issue rev04.

Should an applicant wish to propose, even before the end of 2014, any alternative agent for Class B fire extinction in engine or APU compartments, even in the absence of a published MPS, the EASA will initiate a Certification Review Item addressing the use of such an alternate fire - extinguishing agent.

5 Fire protection of cargo compartments — Gaseous agents MPS for cargo compartment fire suppression systems have already been published in the Report DOT/FAA/AR - 00/28 of September 2000. However, to date there are no known and sufficiently developed alternatives to Halon 13 01.

Should the EASA be approached with the intent to utilise for the product an alternate agent or alternate gaseous fire - extinguishing system in lieu of a Halon 1301 system, then the recommended approach would be to perform testing on the product which me ets the Minimum Performance Standards for that application as developed by the International Halon Replacement Working Group. The International Halon Replacement Working Group was established in October 1993. This group was tasked to work towards the devel opment of minimum performance standards and test methodologies for non - Halon aircraft fire suppression agents/systems in cargo compartments, engine nacelles, handheld extinguishers, and lavatory waste receptacles. The International Halon Replacement Workin g Group has been expanded to include all system fire protection R&D for aircraft and now carries the name ‘International Aircraft Systems Fire Protection Working Group’.

To ensure acceptable means of compliance, the following must be provided: a. The test data and gaseous agent distribution profiles which meet the certification criteria as expressed below and in the Minimum Performance Standards as developed by the FAA Technical Center as part of the International Halon Replacement programme. (See paragrap h 7 for the listing of the references.)

b. A system description document that includes a description of the distribution of the gaseous agent under test conditions in the cargo compartment.

c. A detailed test plan.

d. Chemical data which describes the a gent and any toxicity data.

Powered by EASA eRules Page 558 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION 5.1 Pre - test considerations: a. An EASA accepted analyser (for example, Statham - derivative analyser) capable of measuring the agent distribution profile in the form of volumetric concentration is required.

b. An EASA accept ed analyser (for example, Statham - derivative analyser) and associated hardware are configured for the particular application.

c. The fire suppression system should be completely conformed prior to the test.

d. The fire extinguisher bottle(s) should be se rviced and prepared for the prescribed test(s).

5.2 Test procedures: a. Perform the prescribed distribution test in accordance with the test plan approved by the Agency. (See Paragraph 7 in AMC 25.851(b) for guidance on probe placement.)

b. An EASA acce pted analyser (for example, Statham - derivative analyser) should record the distribution profile as volumetric concentration for the agent.

5.3 Test result evaluation: a. Produce the data from the EASA accepted analyser (for example, Statham - derivative an alyser) in graphical format. This format should be the volumetric concentration of the agent versus time. A specific percentage of volumetric initial concentration and a specific percentage of volumetric metered concentration for the length of the test dur ation as determined by previous testing conducted per the established Minimum Performance Standards are required for airworthiness approval of cargo compartment systems.

b. Using the appropriate MPS evaluation criteria, evaluate the distribution profile of the agent for acceptable performance. The acceptability of the test data would be dependent upon the distribution profile and duration exhibited by each probe per (1) above and Paragraph 7 for cargo compartment fire - extinguishing systems.

6. EVALUATION OF ALTERNATE LIQUID AGENT AND FIRE EXTINGUISHING/SUPPRESSION SYSTEMS The FAA Technical Center has released a Technical Note (ref. f in paragraph 7 below) that represents the latest Minimum Performance Standards (MPS) for a water spray system.

Ho wever, as mentioned within the body of the report, additional developmental testing would be needed for the product and the FAA to be approached regarding certification of such a system. Additional testing would be required to demonstrate compliance with a n aerosol spray.

The Technical Center continues to perform research towards identifying alternate liquid and other fire - extinguishing/suppression systems. Acceptable means of compliance for these immature systems are beyond the scope of this AMC. Future re visions of this AMC will be accomplished as soon as suitable standards are developed for these systems.

If it is proposed to use a liquid fire - extinguishing agent or system for the product, the EASA should be contacted. The EASA will initiate a Certificati on Review Item addressing the use of an alternate fire - extinguishing agent or system.

Powered by EASA eRules Page 559 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION 7. REFERENCES a. Report No FAA - RD - 71 - 68, Fire Extinguishing Methods for New Passenger Cargo Aircraft, dated November 1971.

b. UK Civil Aviation Authority (CAA) Paper 91003, Cargo Bay Fire Suppression, dated March 1991.

c. Report No DOT/FAA/AR - 96/5, Evaluation of Large Class B Cargo Compartment’s Fire Protection, dated June 1996.

d. Report No DOT/FAA/AR - 96/122, Development of a Minimum Performance Standard for L avatory Trash Receptacle Automatic Fire Extinguishers, dated February 1997.

e. Report No DOT/FAA/AR - 00 - 28, Development of a Minimum Performance Standard for Aircraft Cargo Compartment Gaseous Fire Suppression Systems, dated September 2000.

f. Report No D OT/FAA/AR - TN01/1, Water Spray as a Fire Suppression Agent for Aircraft Cargo Compartment Fires, dated March 2001.

g. Report No DOT/FAA/AR - 01/37, Development of a Minimum Performance Standard for Hand - Held Fire Extinguishers as a Replacement for Halon 1211 on Civilian Transport Category Aircraft, dated August 2002.

h. 2010 Report of the UN Halons Technical Options Committee – 2010 Assessment i. FAA Advisory Circular AC 20 - 42C, Hand Fire Extinguishers for use in Aircraft, dated 07 March 1984.

j. FAA Advis ory Circular AC 20 - 42D, Hand Fire Extinguishers for use in Aircraft, dated 14 January 2011.

[Amdt 25/12]

CS 25.853 Compartment interiors

ED Decision 2019/013/R (See AMC 25.853 ) For each compartment occupied by the crew or passengers, the following apply: (a) Materials (including finishes or decorative surfaces applied to the materials) must meet the applicable test criteria prescribed in Part I of Appendix F or other ap proved equivalent methods, regardless of the passenger capacity of the aeroplane.

(b) Reserved (c) In addition to meeting the requirements of sub - paragraph (a) of this paragraph, seat cushions, except those on flight crewmember seats, must meet the test requirements of part II of appendix F, or other equivalent methods, regardless of the passenger capacity of the aeroplane.

(d) Except as provided in sub - paragraph (e) of this paragraph, the following interior components of aeroplanes with passenger capacities of 20 or more must also meet the test requirements of parts IV and V of appendix F, or other approved equivalent method, in addition to the flammability requirements prescribed in sub - paragraph (a) of this paragraph: (1) Interi or ceiling and wall panels, other than lighting lenses and windows; (2) Partitions, other than transparent panels needed to enhance cabin safety; Powered by EASA eRules Page 560 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION (3) Galley structure, including exposed surfaces of stowed carts and standard containers and the cavity walls that are exposed when a full complement of such carts or containers is not carried; and (4) Large cabinets and cabin stowage compartments, other than underseat stowage compartments for stowing small items such as magazines and maps.

(e) The interiors of co mpartments, such as pilot compartments, galleys, lavatories, crew rest quarters, cabinets and stowage compartments, need not meet the standards of sub - paragraph (d) of this paragraph, provided the interiors of such compartments are isolated from the main p assenger cabin by doors or equivalent means that would normally be closed during an emergency landing condition.

(f) Smoking is not allowed in lavatories. If smoking is allowed in any area occupied by the crew or passengers, an adequate number of self - contained, removable ashtrays must be provided in designated smoking sections for all seated occupants.

(g) Regardless of whether smoking is allowed in any other part of the aeroplane, lavatories must have self - contained removable ashtrays located con spicuously on or near the entry side of each lavatory door, except that one ashtray may serve more than one lavatory door if the ashtray can be seen readily from the cabin side of each lavatory served.

(h) Each receptacle used for the disposal of flammable waste material must be fully enclosed, constructed of at least fire resistant materials, and must contain fires likely to occur in it under normal use. The ability of the receptacle to contain those fires under all probable conditions of wear, misalignmen t, and ventilation expected in service must be demonstrated by test.

[Amdt No: 25/12] [Amdt No: 25/23]

AMC 25.853 Compartment interiors

ED Decision 2020/024/R The relevant parts of FAA Advisory Circular (AC) 25 - 17A Change 1, Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016, AC 25.853 - 1 Flammability Requirements for Aircraft Seat Cushions , dated 17.9.1986, and AC 25 - 18, Transport Categ ory Airplanes Modified for Cargo Service , dated 6.1.1994, and AC 20 - 178, Flammability Testing of Aircraft Cabin Interior Panels After Alterations , dated 4.6.2012, are accepted by the Agency as providing the acceptable means of compliance with CS 25.853 .

Note: ‘The relevant parts’ means ‘the parts of AC 25 - 17A Change 1 that address the applicable FAR/CS - 25 paragraph’.

[Amdt 25/11] [Amdt 25/17] [Amdt 25/26] Powered by EASA eRules Page 561 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION

CS 25.854 Lavatory fire protection

ED Decision 2017/015/R (See AMC 25.854) For aeroplanes with a pas senger capacity of 20 or more, or with a cabin length of 18.29 m (60 ft) or mor e: (a) Each lavatory must be equipped with a smoke detector system or equivalent that provides a warning light in the cockpit, or provi des a warning light or audible warning in the passenger cabin that would be readily detected by a cabin crew member; and (b) Each lavatory must be equipped with a built - in fire extinguisher for each disposal receptacle for towels, paper, or waste, located within the lavatory. The extinguisher must be designed to discharge automatically into each disposal receptacle upon occurrence of a fire in that receptacle.

[Amdt 25/19]

AMC 25.854 Lavatory Fire Protection

ED Decision 2017/015/R The cabin length should be measured parallel to the aeroplane centre line from the most forward to the most aft point accessible to passengers or crew.

However, points within in - flight accessible cargo compartments, approved as meeting one of the classifi cations of CS 25.857, do not need to be considered.

On the flight deck, the most forward seat reference point (SRP) of the pilots’ seats (with the seats adjusted to the most forward possible positions) should be used as the most forward point.

[Amdt 25/19 ]

CS 25.855 Cargo or baggage compartments

ED Decision 2013 / 010 /R (See AMC 25.855 and 25.857 ) For each cargo or baggage compartment , the following apply: (a) The compartment must meet one of the class requirements of CS 25.857 .

(b) The following cargo or baggage compartments, as defined in CS 25.857, must have a liner that is separate from, but may be attached to, the aeroplane structure: (1) Class B through Class E cargo or baggage compartments; and (2) Class F cargo or baggage compartments, unless other means of containing the fire and protecting critical systems and structure are provided.

(c) (1) Ceiling and sidewall liner panels of Class C cargo or baggage compa rtments, and ceiling and sidewall liner panels in Class F cargo or baggage compartments, if installed to meet the requirements of sub - paragraph (b)(2) of this paragraph, must meet the test requirements of Part III of Appendix F or other approved equivalent methods.

Powered by EASA eRules Page 562 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION (2) Cockpit voice and flight data recorder systems, windows and systems or equipment within, or in the vicinity of, Class E cargo compartments shown to be essential for continued safe flight and landin g according to CS 25.1309 must be adequately protected against fire. If protective covers are used, they must meet the requirements of Appendix F, Part III (d) All other ma terials used in the construction of the cargo or baggage compartment must meet the applicable test criteria prescribed in Part I of Appendix F, or other approved equivalent methods.

(e) No compartment may contain a ny controls , lines, equipment, or accessories whose damage or failure would affect safe operation, unless those items are protected so that – (1) They cannot be damaged by the movement of cargo in the compartment; and (2) Their breakage or failure will not create a fire hazard.

(f) There must be means to prevent cargo or baggage from interfering with the functioning of the fire protective features of the compartment.

(g) Sources of heat within the compartment must be shielded and insulated to prevent igniti ng the cargo or baggage.

(h) Flight tests must be conducted to show compliance with the provisions of CS 25.857 concerning – (1) Compartment accessibility; (2) The entry of hazardous quantities of smoke or extinguishing agent into compartments occupied by the crew or passengers; and (3) The dissipation of the extinguishi ng agent in Class C compartment or, if applicable, in Class F compartment .

(i) During the above tests, it must be shown that no inadvertent operation of smoke or fire detectors in any compartment would occur as a result of fire contained in any other compartment, either during or after extinguishment, unless the extinguishing system floods each such compartment simultaneously.

(j) Cargo or bag gage compartment electrical wiring interconnection system components must meet the requirements of CS 25.1721 .

[Amdt 25/3] [Amdt 25/5] [Amdt 25/8] [Amdt 25/12] [Amdt 25/13] Powered by EASA eRules Page 563 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION

CS 25.856 Thermal/acoustic insulation materials

ED Decision 2016 /010/R (See AMC 25.856(a) ) (a) Thermal/acoustic insulation material installed in the fuselage must meet the flame propagation test requirements of Part VI of Appendix F to CS - 25, or other approved equivalent test requirements. This requirement does not apply to “small parts”, as defined in Part I of Appendix F to CS - 25. (See AMC 25.856(a)) (b) For aeroplanes with a passenger capacity of 20 or greater, thermal/acoustic insulation materials (including the means of fastening the materials to the fuselage) installed in the lower half of the aeroplane fuselage must meet the flame pene tration resistance test requirements of Part VII of Appendix F to CS - 25, or other approved equivalent test requirements. This requirement does not apply to thermal/acoustic insulation installations that the Agency finds would not contribute to fire penetration resistance. (See AMC 25.856(b) ) [Amdt 25/6] [Amdt 25/18]

AMC 25.856(a) Thermal/acoustic insulation materials: Flame

propagation resistance

ED Decision 2009/010/R FAA Advisory Circular 25.856 - 1 Thermal/Acoustic Insulation Flame Propagation Test Method Details, dated 24/06/2005, is accepted by the Agency as providing acceptable means of compliance with CS 25.856(a) and Part VI of Appendix F to CS - 25.

[Amdt 25/6]

AMC 25.856(b) Thermal/acoustic insulation materials: Flame

penetration (Burnthrough) resistance

ED Decision 2009/010/R FAA Advisory Circular 25.856 - 2A Installation of Thermal/Acoustic Insulation for Burnthrough Protection, dated 29/07/2008, is accepted by the Agency as providing acceptable means of compliance with CS 25.856(b) and Part VII of Appendix F to CS - 25.

[Amdt 25/6]

CS 25.857 Cargo compartment classification

ED Decision 200 9 / 01 7 /R (See AMC 25.855 and 25.857 ) (a) Class A. A Class A cargo or baggage compartment is one in which – (1) The presence of a fire would be easily discovered by a crew member while at his station; and (2) Each part of the compartment is easily accessible in flight.

Powered by EASA eRules Page 564 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION (b) Class B . A Class B cargo or b aggage compartment is one in which – (1) There is sufficient access in flight to enable a crewmember standing at any one access point and without stepping into the compartment, to extinguish a fire occurring in any part of the compartment using a hand fir e extinguisher; (2) When the access provisions are being used no hazardous quantity of smoke, flames or extinguishing agent will enter any compartment occupied by the crew or passengers; and (3) There is a separate approved smoke detector or fire detector system to give warning to the pilot or flight engineer station.

(c) Class C . A Class C cargo or baggage compartment is one not meeting the requirements for either a Class A or B compartment but in which – (1) There is a separate approved smoke detector or fire detector system to give warning at the pilot or flight engineer station; (2) There is an approved built - in fire - extinguishing or suppression system controllable from the cockpit.

(3) There are means to exclude hazardous quantities of smoke, flames, o r extinguishing agent, from any compartment occupied by the crew or passengers; and (4) There are means to control ventilation and draughts within the compartment so that the extinguishing agent used can control any fire that may start within the compartme nt.

(d) Reserved .

(e) Class E. A Class E cargo compartment is one on aeroplanes used only for the c arriage of cargo and in which – (1) Reserved.

(2) There is a separate approved smoke or fire detector system to give warning at the pilot or flight engineer station; (3) There are means to shut off the ventilating airflow to, or within, the compartment, and the controls for these means are accessible to the flight crew in the crew compartment; (4) There are means to exclude hazardous quantities of smoke, flames, or noxious gases, from the flight - crew compartment; and (5) The required crew emergency exits are accessible under any cargo loading condition.

(f) Class F. A Class F cargo or baggage compartment is one in which - (1) There is a separate approved smoke detector or fire detector system to give warning at the pilot or flight engineer station; (2) There are means to extinguish or control a fire without requiring a crewmember to enter the compartment; and (3) There are means to exclude hazardous quantities of smoke, flames, or extinguishing agent from any compartment occupied by the crew or passengers.

[Amdt 25/3] [Amdt 25/8] Powered by EASA eRules Page 565 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION

AMC 25.855 and 25.857 Cargo or baggage compartments

ED Decision 2020/024/R 1. PURPOSE This Acceptab le Means of Compliance (AMC) sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of the airworthiness standards for Class B and Class F cargo compartments for large aeroplanes. This AMC provides a rationa l method for demonstrating that the requirements of the related paragraphs of CS - 25 are met and that fires occurring in the compartments can be controlled to ensure that they do not present a hazard to the aeroplane or its occupants. Like all AMC material, this AMC is not, in itself, mandatory and does not constitute a requirement. Terms used in this AMC, such as “shall” and “must,” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of com pliance described herein is used.

2. RELATED DOCUMENTS a. Certification Specifications.

CS 25.851 Fire extinguishers CS 25.855 Cargo or baggage compartments CS 25.857 Cargo compartment classification CS 25.858 Cargo compartment fire detecti on systems b. FAA Advisory Circulars (AC).

The following FAA Advisory Circulars are accepted by the Agency as providing acceptable means of compliance with CS 25.857: AC 25 - 17A Change 1, Transport Airplane Cabin In teriors Crashworthiness Handbook (the relevant parts addressing the applicable FAR Part 25/CS - 25 paragraphs) AC 25 - 9A Smoke Detection, Penetration, and Evacuation Tests and Related Flight Manual Emergency Procedures, AC 25 - 18 Transport Category Airplanes Modified for Cargo Servic e AC 20 - 42D, Hand Fire Extinguishers for use in Aircraft AC 25 - 22, Certification of Transport Airplane Mechanical Systems FAA Order 8150.4, Certification of Cargo Containers with Self - Contained Temperature Control Systems (Active ULDs) 3. BACKGROUND CS 25.857(b) and 25.857(f) provide standards for certification of two classes of cargo compartments, Class B and Class F.

A Clas s B cargo compartment is configured in a manner that allows a crewmember to extinguish or control any fire likely to occur in the compartment using a hand fire extinguisher. While the person combating the fire must have access to the compartment, it must not be necessary for that person to physically enter the compartment to extinguish the fire (see CS 25.857(b)(1) ).

The contents of the compartment may be reached by hand or with the contents of a hand extinguisher while standing in the entry door.

A Class F cargo compartment is similar to a Class C compartment in that there are means to extinguish or control the fire without any requirement to enter the compartment.

Powered by EASA eRules Page 566 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION Both Class B and Class F cargo compartments have f ire or smoke detection systems to alert the crew to the presence of the fire.

4. COMPARTMENT CLASSIFICATION All cargo compartments must be properly classified in accordance with CS 25.857 and meet the requirements of CS 25.857 pertaining to the particular class involved (see CS 25.855 (a)).

In order to establish appropriate requirements for fire protection, a system for classification of cargo or baggage compartments was dev eloped and adopted for large aeroplanes.

Classes A, B, and C were initially established; Classes D, E, and F were added later. Class D has been eliminated from the CS - 25 specifications (by Amdt 3). The classification is based on the means by which a fire c an be detected and the means available to control the fire.

a. A Class A compartment (see CS 25.857(a) ) is one that is located so close to the station of a crewmember that the crewmember would discover the presence of a fire immediately.

In addition, each part of the compartment is easily accessible so that the crewmember could quickly extinguish a fire with a portable fire extinguisher. A Class A compartment is not required to have a liner.

b. A Class B compartment (see CS 25.857(b) ) is one that is more remote than a Class A compartment and must, therefore, incorporate a fire or smoke detection system to give warning at the pilot or flight engineer station. Because a fire wo uld not be detected and extinguished as quickly as in a Class A compartment, a Class B compartment must have a liner in accordance with CS 25.855(b) . In flight, a crewmember must have sufficient access to a Class B compartment to reach any part of the compartment by hand or with the contents of a hand extinguisher when standing at any one access point, without stepping into the compartment. There are means to ensure that, while the access provisions are being used, no hazardous quantity of smoke, flames, or extinguishing agent will enter areas occupied by the crew or passengers.

c. A Class C compartment (see CS 25.857(c) ) differs from a Class B compartment in that it is not required to be accessible in flight and must, therefore, have a built - in fire extinguishing system to suppress or control any fire. A Class C compartment must have a liner and a fire or smoke detection system in accordance with CS 25.855(b) and CS 25.857(c)(1) . There must also be means to exclude hazardous quantities of extinguishant and products of combustion from occup ied areas (see CS 25.857(c)(3) ).

d. A Class E compartment (see CS 25.857(e) ) is found on an all - cargo aeroplane. Typically, a Class E compartment is the entire cabin of an all - cargo aeroplane; however, other compartments of such aeroplanes may be also classified as Class E compartments.

Shutting off the ventilating airflow to or within the compartment controls a fire in a Class E compartment. A Class E compartment must have a liner (see CS 25.855(b) ) and a fire or smoke detection system installed in accordance with CS 25.857(e)(2) . It is not required to have a built - in fire suppression system.

e. A Class F compartment (see CS 25.857(f) ) is one in which there are means to control or extinguish a fire without requiring a crewmember to enter the compartment. Allowing access by a crewmember in the presence of a fire warning is not envisioned. Class F compartments that include a built - in fire extinguisher/suppression system or require the use of acceptable fire containment covers (FCCs) would meet these requirements. The Class F compartment must have a fire o r smoke detection system installed in accordance with CS 25.857(f)(1) . Unless there are other means of containing the fire and protecting critical systems and structure, a Class F compartment must have a liner meet ing the Powered by EASA eRules Page 567 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION require ments of part III of Appendix F , or other approved eq uivalent methods (see CS 25.855 (b)).

It is not envisaged that lower deck cargo compartments be approved as Class F cargo compartments. The Class F cargo compartment was introduced as a p racticable and safe alternative to the previous practice of providing large Class B cargo compartments. These latter compartments were limited to the main deck for accessibility reasons. Lower deck cargo compartments in aircraft carrying passengers need to comply with the Class C cargo compartment requirements of CS25.857(c).

5. FIRE PROTECTION FEATURES Based on the class of the compartment, fire protection features must be provided. The fire protection features mus t be shown to meet the standards established by the original type certification basis for the aeroplane or later CS - 25 standards. These features may include liners, fire or smoke detection systems, hand fire extinguishers, and built - in fire suppression sys tems.

a. Liners The primary purpose of a liner is to prevent a fire originating in a cargo compartment from spreading to other parts of the aeroplane before it can be brought under control.

For Class B compartments, it is assumed that the fire will be qui ckly extinguished.

Therefore, the liner does not need to be qualified to the requirements of Part III of Appendix F. For Class F cargo compartments, the fire might have grown larger prior to being suppressed, and therefore, better protection is needed to p revent damage to surrounding systems and structure. However, the liner does not need to serve as the compartment seal. It should be noted, however, that the liner is frequently used to perform the secondary functions of containing discharged extinguishing agent and controlling the flow of oxygen into the compartment. If other means, such as compartment walls, are not capable of performing those functions, the liner must be sufficiently airtight to perform them.

The liner must have sufficient fire integrity to prevent flames from burning through the liner before the fire can be brought under control and the heat from the fire is sufficiently dissipated. As stated in Part III of Appendix F, in addition to the basic liner material, the term "liner" includes an y design feature, such as a joint or fastener that would affect the capability of the liner to safely contain a fire.

b. Access (1) Class B. Class B compartments must provide sufficient accessibility to enable a crewmember to reach any part of the compartm ent by hand or with the contents of a hand extinguisher without physically entering the compartment. This requirement, by its nature, tends to limit the size and shape of the compartment.

Additionally, the access provisions should be sufficiently large to enable the crewmember to determine visually that a fire has been extinguished. Access is also a function of how the compartment is configured rather than just dimension and/or volume. In determining access, it would not be acceptable for there to be a nee d to pull baggage or cargo on to the floor of the passenger compartment to gain access to the seat of the fire. Such action may introduce a safety hazard to the passengers.

"To reach any part of the compartment" means that the crewmember should be able to open the door or hatch and, standing in the opening, reach by hand anywhere in the compartment where cargo or baggage can be located. The Powered by EASA eRules Page 568 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION extension of the crewmember's reach through the use of fire extinguisher wands, etc., should not be considered in determining reach.

Based on the estimated reach of a 95 percentile male, the outline of any compartment, viewed from above, should fit within a vertical cylinder of radius 132 c m (52 inches) measured from the centreline of the access door or hatch (see Figure 1). This dimension assumes the above male can reach a one foot square box located anywhere within the compartment. Access by a smaller crewmember to reach the same area with in the compartment could require that the crewmember move laterally within the access door or hatch opening, while not physically entering the compartment.

Figure 1 Example of possible cargo compartment shapes within 132 cm (52 inches) reach from access point centreline.

(2) Class F. In the case of a Class F compartment, a means should be provided to control or extinguish a fire without a crewmember entering the compartment.

One means is to design the compartment to Class C requ irements but not include a built - in fire suppression system. One suppression method might be to utilize a plumbing and nozzle distribution system within the compartment that would provide acceptable suppression capability throughout the volume of the compa rtment. The source for such a system could be hand fire extinguishers, which interface with the distribution system through a suitable interface nozzle. This reduces the complexity and costs associated with a built - in suppression system and could be suitab le for smaller compartments. For certification purposes, the extinguishing agent concentration should be measured in flight, following aeroplane flight manual (AFM) procedures, and the length of protection time afforded by the system should be recorded. Th is time of protection should be used to establish AFM limitations for cargo or baggage compartment fire protection times. The operator, for route planning, could then use these times. For Halon 1301 fire extinguishing agent, a minimum five percent concentr ation by volume at all points in the compartment is considered adequate for initial knock - down of a fire, and a three percent concentration by volume at all points in the compartment is considered the minimum for controlling a fire after it is knocked down . This option requires the use of a liner as stated in CS 25.855(b) .

Another means of providing fire protection in a Class F compartment might be the use of cargo containers or fire containment covers (FCCs) shown to be capable of Powered by EASA eRules Page 569 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION containing a fire. Some FCCs have already been developed and are typically constructed of woven fibreglass - based materials that will pass the oil burner test requirement s of Part III of Appendix F.

This is in line with the revised CS 25.855 which for a Class F cargo or baggage compartment not using FCCs requires a ceiling and sidewall liner constructed of materials that meet the requirements of Part III of Appendix F and be separated from the aeropl ane structure (except for attachments), while the floor panels must comply with Part I of Appendix F.

Similarly, if FCCs are proposed as a means of compliance for the new Class F compartment, it is likely that in order to meet the intent they must also mee t these standards (i.e. Part III of Appendix F for the sides and top and Part I of Appendix F for the bottom). However, based on full scale qualification testing there is evidence that alternative materials, not fully in compliance with Part III of Appendi x F, might also be acceptable for FCC side and top portions, as long as they are successfully tested and meet the intent of the rule.

It is recommended that the Agency be contacted for concurrence when FCC or Container qualification is envisaged in order t o address the relevant test method.

Unless evidence can be presented to support a different design, if FCCs are used as a means of compliance, they should completely surround all cargo, including underneath the cargo, except for obviously non - flammable ite ms, such as metal stock, machinery, and non flammable fluids without flammable packaging. Because the fire is controlled or extinguished within the isolated compartment, but is separated from the actual cargo compartment boundaries, the cargo compartment l iner requirements of CS 25.855(c) would not apply. However, the effects of the heat generated by the contained/covered fire should be evaluated to ensure that adjacent systems and structure are not adversely affect ed. For certification purposes, test data with the actual design configuration and possible fire sources would have to be provided. The temperature and heat load time history measurements at various locations above, around and below the FCC are needed to ensure the continued safe function of adjacent systems and structure. The time history data should be used to establish the length of protection time afforded by the system and subsequent AFM limitations for cargo or baggage compartment fire protection tim es. The operator would then use these times for route planning purposes.

Class F cargo compartment designs which rely on fire containment, e.g. fire hardened containers/pallets and/or FCCs (placed over palletised loads or non - fire hardened containers) shou ld be considered in regards to the possibility of incorrect usage.

All practicable means to prevent the carriage of cargo in standard containers or pallets (if special pallets are required) and/or the omission of FCCs should be incorporated. Means may incl ude, but not be limited to, physical features at the container/pallet to cargo compartment floor interface or operational procedures such as requiring aircraft crew verification of cargo loading before every flight or a suitable detection system that would warn the crew in the event a non authorized cargo configuration has been loaded.

Powered by EASA eRules Page 570 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION c. Extinguishing Agent.

In order to effectively extinguish or control a fire in a Class B or F cargo or baggage compartment, sufficient fire extinguishing agent must be all ocated. Guidance on this topic is contained in FAA AC 20 - 42 D . This guidance material is accepted by the Agency as addressing how to implement the provisions of CS 25.851(a) that require that at least one hand fire extinguisher be located in the pilot comp artment, at least one readily accessible hand fire extinguisher be available for use in each Class A or Class B cargo/baggage compartment and in each accessible Class E or Class F cargo/baggage compartment, and one or more hand fire extinguishers be locate d in the passenger compartment for aeroplanes with a passenger seating capacity of 7 or more.

d. Fire Control.

"To control a fire" ( CS 25.857(f)(2) ) implies that the fire does not grow to a state where damage to the aeroplane or harm to the passengers or crew occurs during the time for which the fire protection system is demonstrated to be effective (ie, from the time a fire is detected to the time when an emergency evacuation from the aeroplane can be completed). This in turn implies that critical aeroplane systems and structure are not adversely affected and the temperature and air contaminants in areas occupied by passengers and crew do not reach hazardous levels.

(1) Adequate protection should be provided for c ockpit voice and flight data recorder and wiring, windows, primary flight controls (unless it can be shown that a fire cannot cause jamming or loss of control), and other systems and equipment within the compartment that are required for safe flight and la nding.

(2) Regardless of a compartment’s classification, it must be demonstrated that hazardous quantities of smoke, flames, extinguishing agent, or noxious gases do not enter any compartment occupied by passengers or crewmembers. FAA Advisory Circular 25 - 9A, Smoke Detection, Penetration, and Evacuation Tests and Related Flight Manual Emergency Procedures, provides guidance concerning smoke penetration testing.

(3) If an aeroplane has one or more Class B cargo compartments, portable protective breathing equ ipment must be provided for the appropriate crewmembers in accordance with CS 25.1439 .

(4) Additional protective breathing equipment or breathing gas supply, and additional fire extinguishers, may be required for C lass B cargo compartment operation to ensure that the fire can be controlled for the time the aeroplane is expected to be in the air after onset of a fire.

6. PROCEDURES AND LIMITATIONS a. To ensure that the contents of Class B and F compartments are either accessible or located such as to allow firefighting, any cargo or baggage loading limitations and any operational limitations or procedures provided must be identified with placards in the compartment. The loading and operational li mitations must also be addressed in the appropriate weight and balance or loading document.

b. Any operational limitations or procedures necessary to ensure the effectiveness of the fire protection system for Class B and Class F cargo and baggage compartme nts should be clearly defined in the AFM. This should include such items as any changes to the ventilation system to prevent the entrance of smoke or gases into occupied areas, use of Powered by EASA eRules Page 571 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION hand fire extinguishers, use of protective breathing equipment, use of p rotective clothing, and use of the FCCs. The certification engineers should work closely with the Agency to ensure that additional training necessary for crewmembers assigned to combat fires is adequately addressed.

c. Any time limit for a cargo or baggage compartment fire protection system, or other conditions or procedures related to combating a fire in a compartment, should be clearly defined in the AFM.

7. AFM CONSIDERATIONS.

a. Crewmember(s) designated to combat a fire in a Class B compartment will nee d special training. Fires occurring in luggage are difficult to extinguish completely and rekindling may occur. Crewmembers designated to combat fires in Class B compartments should be trained to check periodically to ensure that a fire has not grown back to hazardous proportions.

b. Aeroplane flight manuals should contain instructions to land at the nearest suitable airport following smoke/fire detection, unless it can be positively determined that the fire is extinguished.

c. Any limitations regarding occ upancy of Class B and Class F compartments during flight, or during takeoff and landing, should be defined in the AFM.

d. Any loading restrictions associated with access to cargo or baggage or special containers should be clearly identified in the AFM. Thi s would include, but not be limited to, placement of luggage in a Class B compartment or identification of special containers or covers associated with fire protection in a Class F compartment. If covers are used in conjunction with a Class F cargo compar tment, they should be easy to install and sufficiently durable to withstand in - service conditions.

[Amdt 25/8] [Amdt 25/11] [Amdt 25/12] [Amdt 25/26]

CS 25.858 Cargo or baggage compartment smoke or fire detection

systems

ED Decision 200 7 / 010 /R If certific ation with cargo or baggage compartment smoke or fire detection provisions is requested, the following must be met for each cargo or baggage compartment with those provisions: (a) The detection system must provide a visual indication to the flight crew wi thin one minute after the start of a fire.

(b) The system must be capable of detecting a fire at a temperature significantly below that at which the structural integrity of the aeroplane is substantially decreased.

(c) There must be means to allow the crew to check in flight, the functioning of each smoke or fire detector circuit.

(d) The effectiveness of the detection system must be shown for all approved operating configurations and conditions.

[Amdt 25/3] Powered by EASA eRules Page 572 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION

CS 25.859 Combustion heater fire protection

ED Decision 2003/ 2/RM (a) Combustion heater fire zones. The following combustion heater fire zones must be protected from fire in accordance with the applicable provisions of CS 25.1181 to 25.1191 and 25.1195 to 25.1203 : (1) The region surrounding the heater, if this region contains any flammable fluid system components (excludin g the heater fuel system) that could – (i) Be damaged by heater malfunctioning; or (ii) Allow flammable fluids or vapours to reach the heater in case of leakage.

(2) The region surrounding the heater, if the heater fuel system has fittings that, if they leaked, would allow fuel or vapours to enter this region.

(3) The part of the ventilating air passage that surrounds the combustion chamber. However, no fire extinguishment is required in cabin ventilating air passages.

(b) Ventilating air ducts. Each ventilating air duct passing through any fire zone must be fireproof.

In addition – (1) Unless isolation is provided by fireproof valves or by equally effective means, the ventilating air duct downstream of each heater must be fireproof for a distance gr eat enough to ensure that any fire originating in the heater can be contained in the duct; and (2) Each part of any ventilating duct passing through any region having a flammable fluid system must be constructed or isolated from that system so that the mal functioning of any component of that system cannot introduce flammable fluids or vapours into the ventilating airstream.

(c) Combustion air ducts . Each combustion air duct must be fireproof for a distance great enough to prevent damage from backfiring or r everse flame propagation. In addition – (1) No combustion air duct may have a common opening with the ventilating airstream unless flames from backfires or reverse burning cannot enter the ventilating airstream under any operating condition, including rev erse flow or malfunctioning of the heater or its associated components; and (2) No combustion air duct may restrict the prompt relief of any backfire that, if so restricted, could cause heater failure.

(d) Heater controls; general . Provision must be made t o prevent the hazardous accumulation of water or ice on or in any heater control component, control system tubing, or safety control.

(e) Heater safety controls. For each combustion heater there must be the following safety control means: (1) Means indep endent of the components provided for the normal continuous control of air temperature, airflow, and fuel flow must be provided, for each heater, to automatically shut off the ignition and fuel supply to that heater at a point remote from that heater when any of the following occurs: (i) The heat exchanger temperature exceeds safe limits.

(ii) The ventilating air temperature exceeds safe limits.

Powered by EASA eRules Page 573 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN A ND (CS - 25) CONSTRUCTION FIRE PROTECTION (iii) The combustion airflow becomes inadequate for safe operation.

(iv) The ventilating airflow becomes inadeq uate for safe operation.

(2) The means of complying with sub - paragraph (e) (1) of this paragraph for any individual heater must – (i) Be independent of components serving any other heater whose heat output is essential for safe operation; and (ii) Keep the heater off until restarted by the crew.

(3) There must be means to warn the crew when any heater whose heat output is essential for safe operation has been shut off by the automatic means presc ribed in sub - paragraph (e) (1) of this paragraph.

(f) Air in takes . Each combustion and ventilating air intake must be located so that no flammable fluids or vapours can enter the heater system under any operating condition – (1) During normal operation; or (2) As a result of the malfunctioning of any other compo nent.

(g) Heater exhaust . Heater exhaust systems must meet the provisions of CS 25.1121 and 25.1123 .

In addition, there must be provisions in the design of the heater exhau st system to safely expel the products of combustion to prevent the occurrence of – (1) Fuel leakage from the exhaust to surrounding compartments; (2) Exhaust gas impingement on surrounding equipment or structure; (3) Ignition of flammable fluids by the exhaust, if the exhaust is in a compartment containing flammable fluid lines; and (4) Restriction by the exhaust of the prompt relief of backfires that, if so restricted, could cause heater failure.

(h) Heater fuel systems . Each heater fuel system must meet each powerplant fuel system requirement affecting safe heater operation. Each heater fuel system component within the ventilating airstream must be protected by shrouds so that no leakage from those components can enter the ventilating airstream.

(i ) Drains . There must be means to safely drain fuel that might accumulate within the combustion chamber or the heater exchanger. In addition – (1) Each part of any drain that operates at high temperatures must be protected in the same manner as heater exha usts; and (2) Each drain must be protected from hazardous ice accumulation under any operating conditions.

Powered by EASA eRules Page 574 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION

CS 25.863 Flammable fluid fire protection

ED Decision 2016 / 010/R (See AMC 25.863) (a) In each area where flammable fluids or vapours might escape by leakage of a fluid system, there must be means to minimise the probability of ignition of the fluids and vapours, and the resultant hazards if ignition does occur. (See AMC 25.863(a) .)

(b) Compliance with sub - paragraph (a) of this paragraph must be shown by analysis or tests, and the following factors must be considered.

(1) Possible sources and paths of fluid leakage, and means of detecting leakage.

(2) Flammability characteristics of fluids, including eff ects of any combustible or absorbing materials.

(3) Possible ignition sources, including electrical faults, overheating of equipment, and malfunctioning of protective devices.

(4) Means available for controlling or extinguishing a fire, such as stopping fl ow of fluids, shutting down equipment, fireproof containment, or use of extinguishing agents.

(5) Ability of aeroplane components that are critical to safety of flight to withstand fire and heat.

(c) If action by the flight crew is required to prevent or c ounteract a fluid fire (e.g. equipment shutdown or actuation of a fire extinguisher) quick acting means must be provided to alert the crew.

(d) Each area where flammable fluids or vapours might escape by leakage of a fluid system must be identified and def ined.

[Amdt 25/18]

AMC 25.863(a) Flammable fluid fire protection

ED Decision 2003/2/RM The cooling air supply for any electrical or electronic equipment should be conveyed and discharged so as not to create a hazard following failure of the equipment.

NOTE: Where necessary the co oling duct should be fireproof.

Zones with surfaces which may be exposed to flammable fluids or vapours should be ventilated if the temperature of the surfaces may exceed (under normal or failure conditions) a dangerous value wi th regard to these fluids or vapours. Unless a higher value can be substantiated, a temperature exceeding 200°C is considered dangerous.

CS 25.865 Fire protection of flight controls, engine mounts, and

other flight structure

ED Decision 2003/ 2/RM Essentia l flight controls, engine mounts, and other flight structures located in designated fire zones or in adjacent areas which would be subjected to the effects of fire in the fire zone must be constructed of fireproof material or shielded so that they are capa ble of withstanding the effects of fire.

Powered by EASA eRules Page 575 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION

CS 25.867 Fire protection: other components

ED Decision 2003/2/RM (a) Surfaces to the rear of the nacelles, within one nacelle diameter of the nacelle centreline, must be constructed of materials at least equivale nt in resistance to fire as aluminium alloy in dimensions appropriate for the purpose for which they are used.

(b) Sub - paragraph (a) of this paragraph does not apply to tail surfaces to the rear of the nacelles that could not be readily affected by heat, f lames, or sparks coming from a designated fire zone or engine compartment of any nacelle.

CS 25.869 Fire protection: systems

ED Decision 2016 / 010 /R (See AMC 25.869) (a) Electrical system components: (1) Components of the electrical system must meet the app licable fire and smoke protection requirements of CS 25.831(c) and CS 25.863 . (See AMC 25.863(a) .)

(2) E quipment in designated fire zones, that is used during emergency procedures, must be at least fire resistant.

(3) Electrical Wiring Interconnection System components must meet the requirements of CS 25.1713 .

(b) Each vacuum air system line and fitting on the discharge side of the pump that might contain flammable vapours or fluids must meet the requirements of CS 25.1183 if the line or fitting is in a designated fire zone. Other vacuu m air systems components in designated fire zones must be at least fire resistant.

(c) (See AMC 25.869(c) .) Oxygen equipment and lines must – (1) Not be located in any designated fire zone.

(2) Be protected from he at that may be generated in, or escape from, any designated fire zone, and (3) Be installed so that escaping oxygen cannot cause ignition of grease, fluid, or vapour accumulations that are present in normal operation or as a result of failure or malfunctio n of any system.

[Amdt 25/5] [Amdt 25/18]

AMC 25.869(a)(1) Electrical System Fire and Smoke Protection

ED Decision 2003/ 2/RM These requirements, and those of CS 25.863 applicable to electrical equipment, may be s atisfied by the following: 1 Electrical components in regions immediately behind firewalls and in engine pod attachment structures should be of such materials and at such a distance from the firewall that they will not suffer damage that could hazard the aeroplane if the surface of th e firewall adjacent to the fire is heated to 1100°C for 15 minutes.

Powered by EASA eRules Page 576 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION FIRE PROTECTION 2 Electrical equipment should be so constructed and/or installed that in the event of failure, no hazardous quantities of toxic or noxious (e.g. smoke) products will be distributed in the crew or passenger compartments.

3 Electrical equipment, which may come into contact with flammable vapours should be so designed and installed as to minimise the risk of the vapours exploding under both normal and fault conditions. This can be satisfied by meeting the Explosion Proofness Standards of RTCA DO - 160/EUROCAE ED - 14.

AMC 25.869(c) Fire Protection for Oxygen Equipment

ED Decision 2003/ 2/RM 1 High - pressure shut - off valves should be designed to provide effective slow opening and closing , so as to avoid the possible risk of fire or explosion.

2 Re - charging systems, if installed, should be provided with means to prevent excessive rates of charging which could result in dangerously high temperatures within the system. The charging system s hould also provide protection from contamination.

3 The compartments in which high - pressure system components, including source(s) are located should have adequate ventilation to ensure the rapid dilution of leaked oxygen. Such compartments should also pr ovide adequate protection against contamination by liquids and other products which could result in the risk of fire.

4 Where in - situ charging facilities are provided, the compartments in which they are located should be accessible from outside the aircra ft and as remote as possible from other service points and equipment. Placards should be provided, located adjacent to the servicing point, with adequate instructions covering the precautions to be observed when the system is being charged.

5 The installa tion of the system should be such that components and pipe lines – a. Are adequately separated from electrical and fluid systems, b. Are routed so as to minimise joints and sharp bends, c. Are clear of moving controls and other mechanisms, d. Are prote cted against grease or other lubricants, and are protected against the effects of vibration.

In addition, joints should where possible, be assembled dry, but where compounds are used for sealing they should be approved for that purpose.

6 Where the oxygen is supplied from chemical generators, the effects of heat emission, during both normal and inadvertent operation, on both the installation and other adjacent equipment, should be taken into account.

Powered by EASA eRules Page 577 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION MISCELLANEOUS

MISCELLANEOUS

CS 25.871 Levelling means

ED Decision 2003/2/RM There must be means for determining when the aeroplane is in a level position on the ground.

CS 25.875 Reinforcement near propellers

ED Decision 2003/2/RM (a) Each part of the aeroplane near the propeller tips must be strong and st iff enough to withstand the effects of the induced vibration and of ice thrown from the propeller.

(b) No window may be near the propeller tips unless it can withstand the most severe ice impact likely to occur.

CS 25.899 Electrical bonding and protection against static electricity

ED Decision 2003/ 2/RM (See AMC 25.899 ) (a) Electrical bonding and protection against static electricity must be designed to minimise accumulation of electrostatic charge, which would cause: (1) Human injury from electrical shock, (2) Ignition of flammable vapours, or (3) Interference with installed electrical / electronic equipment.

(b) Compliance with sub - paragraph (a) of this paragraph may be shown by (1) Bonding the components properly to the airframe or (2) Incorporating other acceptable means to dissipate the static charge so as not to endanger the aeroplane, personnel or operation of the installed electrical/electronic systems.

AMC 25.899 Electrical bonding and protection ag ainst static

e lectricity

ED Decision 2020/024/R 1 Protection against Lightning Discharges.

Refer to CS 25.581 ; 25.954 ; 25.1316 a nd associated Acceptable Means of Compliance.

2 Characteristics of Lightning Discharges.

Industry standards.

Refer to EUROCAE document ED - 84 (including Amendment N°1 dated 06/09/99) titled: Aircraft Lightning Environment and Related Test Waveforms; or the equivalent SAE ARP5412 document.

The following documents may be used when showing compliance with CS 25.899 : — EUROCAE document ED - 84A dated July 2013 (Aircraft Lightning Environment and Related Tes t Waveforms) or the equivalent SAE ARP5412B.

Powered by EASA eRules Page 578 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION MIS CELLANEOUS — EUROCAE document ED - 91A (Aircraft Lightning Zoning) or the equivalent SAE ARP5414B.

— EUROCAE document ED - 105A (Aircraft Lightning Test Methods) or the equivalent SAE ARP 5416A.

— EUROCAE document ED - 113 (Aircraft L ightning Direct Effects Certification) or the equivalent SAE ARP 5577.

3 Protection against the Accumulation of Static Charges 3.1 General . All items, which by the accumulation and discharge of static charges may cause a danger of electrical shock, ignitio n of flammable vapours or interference with essential equipment (e.g. radio communications and navigational aids) should be adequately bonded to the main earth systems.

3.2 Intermittent Contact. The design should be such as to ensure that no fortuitous int ermittent contact can occur between metallic and/or metallized parts.

3.3 High Pressure Refuelling and Fuel Transfer. Where provision is made for high pressure refuelling and/or for high rates of fuel transfer it should be established, by test, or by consultation with the appropriate fuel manufacturers, that dangerously high voltages will not be induced within the fuel s ystem. If compliance with this requirement involves any restriction on the types of fuel to be used or on the use of additives, this should be established.

3.3.1 With standard refuelling equipment and standard aircraft turbine fuels, voltages high enough t o cause sparking may be induced between the surface of the fuel and the metal parts of the tank at refuelling flow v elocities above approximately 7 meters/second (23 feet/second). These induced voltages may be increased by the presence of additives and con taminants (e.g. anti - corrosion inhibitors, lubricating oil, free water), and by splashing or spraying of the fuel in the tank.

3.3.2 The static charge can be reduced as follows: a. By means taken in the refuelling equipment such as increasing the diameter of refuelling lines and designing filters to give the minimum of electrostatic charging, or b. By changing the electrical properties of the fuel by the use of anti - static additives and thus reducing the accumulation of static charge in the tank to negligib le amount.

3.3.3 The critical refuelling rates are related to the aeroplane refuelling installations, and the designer should seek the advice of fuel suppliers on this problem.

4 Primary and Secondary Bonding Paths.

(Reference : CS 25.581 ; 25.899 , 25.954 ; 25.1316 ; 25.1353 ; 25.1360 .)

4.1 Primary bonding paths are those paths which are required to carry lightning discharge currents. These paths should be of as low an electrical impedance as is practicable.

Secondary bonding paths are thos e paths provided for other forms of bonding.

4.2 Where additional conductors are required to provide or supplement the inherent primary bonding paths provided by the structure or equipment, then the cross - sectional area of such primary conductors made from copper should be not less than 3 mm except that, where a single conductor is likely to carry the whole discharge from an isolated section, Powered by EASA eRules Page 579 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION MISCELLANEOUS the cross - sectional area would be not less than 6 mm . Aluminium primary conductors should have a cross - sectional a rea giving an equivalent surge carrying capacity.

4.3 Primary bonding paths should be used for – a. Connecting together the main earths of separable major components which may carry lightning discharges, b. Connecting engines to the main earth, c. Connect ing to the main earth all metal parts presenting a surface on or outside of the external surface of the aeroplane, and d. Conductors on external non - metallic parts.

4.4 Where additional conductors are required to provide or supplement the inherent seconda ry bonding paths provided by the structure or equipment then the cross - sectional area of such secondary conductors made from copper should be not less than 1 mm . Where a single wire is used its size should be not less than 1·2 mm diameter.

5 Resistance an d Continuity Measurements . Measurements should be made to determine the efficacy of the bonding and connection between at least the following: 5.1 Primary Bonding Paths 5.1.1 The extremities of the fixed portions of the aeroplane and such fixed external panels and components where the method of construction and/or assembly leads to doubt as to the repeatability of the bond, e.g. removable panels.

5.1.2 The engines and the main aeroplane earth.

5.1.3 External movable metal surfaces or components a nd the main aeroplane earth.

5.1.4 The bonding conductors of external non - metallic parts and the main aeroplane earth.

5.1.5 Internal components for which a primary bond is specified and the main aeroplane earth.

5.2 Secondary Bonding Paths 5.2.1 Metallic parts, normally in contact with flammable fluids, and the main aeroplane earth.

5.2.2 Isolated conducting parts subject to appreciable electrostatic charging and the main aeroplane earth.

5.2.3 Electrical panels and other equipment accessible to the occupants of the aeroplane and the main aeroplane earth.

5.2.4 Earth connections, which normally carry the main electrical supply and the main aeroplane earth. The test on these connections should be such as to ensure that the connections can carry, withou t risk of fire or damage to the bond, or excessive volt drop, such continuous normal currents and intermittent fault currents as are applicable.

5.2.5 Electrical and electronic equipment and the aeroplane main earth, where applicable, and as specified by t he aeroplane constructor.

5.2.6 Static discharger wicks and the main aeroplane structure.

Powered by EASA eRules Page 580 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART D – DESIGN AND (CS - 25) CONSTRUCTION MISCELLANEOUS 6 Electrical Properties of Composite Structure 6.1 In the case of lightning protection, for the partial conductors the method of surface protection will vary with t he criticality of the structure in question. Deterioration of the means of protection or possible hidden damage to the material which may affect its structural integrity, need to be considered. While such materials provide a measure of electro - magnetic scr eening, the need for additional measures will be a function of the location of the material in relation to critical equipment and wiring in the aircraft.

Particular attention will also have to be given to the protection required near fuel systems – e.g. fu el tanks.

For non - conducting materials which have no intrinsic lightning protection or screening properties, the measures taken will again depend on the relative locations of the material and critical systems or fuel and the possible loss of the components due to internal air pressures in the event of a strike.

6.2 The partial conducting materials should present no problem in dissipating P - static but problems can arise with the non - conductors. Depending upon the location of the material, protection may be r equired.

6.3 Electrical currents, other than lightning, can flow in some partial conducting materials and means may be required to limit this by provision of alternative current paths if the effect of large voltage drop is important or if such currents can damage the material.

6.4 Particular care has to be taken that all joints, permanent and temporary, are capable of carrying any currents which may flow particularly those resulting from lightning strikes.

Structural damage and loss of screening capabilities may occur if these are not adequately controlled.

6.5 The adequacy of the material in supplying a ground plane for antenna may have to be considered. Again it will vary with the material and the radio frequency of the system.

[Am dt 25/26] Powered by EASA eRules Page 581 of 1495 | Jan 2023

Next: SUBPART E – POWERPLANT →

SUBPART E – POWERPLANT

Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GEN ERAL

SUBPART E – POWERPLANT

GENERAL

CS 25.901 Installation

ED Decision 2016 / 01 0 /R (a) For the purpose of this CS - 25 the aeroplane powerplant installation includes each component that – (1) Is necessary for propulsion; (2) Affects the control of the ma jor propulsive units; or (3) Affects the safety of the major propulsive units between normal inspections or overhauls.

(b) For each powerplant – (1) The installation must comply with – (i) The installation instructions provi d ed under CS - E 20 (d) and (e); and (ii) The applicable provisions of this Subpart (see also AMC 20 - 1).

(2) The components of the installation must be constructed, arranged, and installed so as to ensure their continued safe operation between normal inspections or overhauls. (See AMC 25.901(b)(2) .)

(3) The installation m ust be accessible for necessary inspections and maintenance; and (4) The major components of the installation must be electrically bonded to the other parts of the aeroplane. (See AMC 25.901(b)(4) .)

(c) The powerp lant installation must comply with CS 25.1309 , except that the effects of the following need not comply with CS 25.1309(b) : (1) Engine case burn through or rupture; (2) Uncontained engine rotor failure; and (3) Pro peller debris release.

(See AMC 25.901(c) Safety Assessment of Powerplant Installations and AMC 25 - 24 : Sustained Engine Imbalance) [Amdt 25/1] [Amdt 25/3] [Amdt 25/8] [Amdt 25/18]

AMC 25.901(b)(2) Assembly of Components

ED Decision 2003/2/RM The objectives of CS 25.671(b) should be satisfied with respect to powerplant systems, where the safety of the aeroplane could otherwise b e jeopardised.

Powered by EASA eRules Page 582 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL

AMC 25.901(b)(4) Electrical Bonding

ED Decision 2003/2/RM Where the engine is not in direct electrical contact with its mounting, the engine should be electrically connected to the main earth system by at least two removable primary conduc tors, one on each side of the engine.

AMC 25.901(c) Safety Assessment of Powerplant Installations

ED Decision 2005/006/R 1. PURPOSE . This Acceptable Means of Compliance (AMC) describes an acceptable means for showing compliance with the requirements of CS 25.901(c) . This document describes a method of conducting a “System Safety Assessment” of the powerplant installation as a means for demonstrating compliance. This guidance is intended to supplement the engineering and operational judgement that must form the basis of any compliance findings. The guidance provided in this document is meant for aeroplane manufacturers, modifiers, foreign regulatory authorities, and EASA Large Aeroplane type certification engineers. Like all AMC material, this AMC is not, in itself, mandatory, and does not constitute a requirement. It is issued to describe an acc eptable means, but not the only means, for demonstrating compliance with the powerplant installation requirements for Large Aeroplanes. Terms such as “shall” and “must” are used only in the sense of ensuring applicability of this particular method of compl iance when the acceptable method of compliance described in this document is used.

2. RELATED CERTIFICATION SPECIFICATIONS . CS 25.571 , CS 25.901 , CS 25.903 , CS 25.933 , CS 25.1309 , and CS 25.1529 ; CS E - 50 and E - 510, CS P - 150 and P - 230.

3. APPLICABILITY . The guidance provided in this document applies to powerplant installations on Large Aeroplanes that are subject to the requirements of CS 25.901 . This guidance specifically concerns demonstrating compliance with the requirements of CS 25.901(c) , which states: “(c) The powerplant installation must comply with CS 25.1309 , except that the effects of the following need not comply with CS 25.1309(b) : (1) Engine case burn through or rupture; (2) Uncontained engine rotor failure; and (3) Propeller debris release.” CS 25.901(c) is intended to provide an overall safety assessmen t of the powerplant installation that is consistent with the requirements of CS 25.1309 , while accommodating unique powerplant installation compliance policies. It is intended to augment rather than replace other a pplicable CS - 25 design and performance standards for Large Aeroplanes.

In accommodating unique policies related to powerplant compliance, EASA has determined that specific guidance relative to demonstrating compliance with CS 25.1309(b) is needed; such gui dance is contained in this AMC. (No unique compliance requirements for CS 25.1309(a) and (c) are required for powerplant installations.)

Wherever this AMC indicates that compliance with other applicable requirements has been accepted as also meeting the in tent of CS 25.901(c) for a specific failure condition, no additional dedicated safety analys is is required. Where this AMC may conflict with AMC 25.1309 (“System Design and Analysis”), this AMC shall take precedenc e for providing guidance in demonstrating compliance with CS 25.901(c) .

Powered by EASA eRules Page 583 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL When assessing the potential hazards to the aircraft caused by the powerplant installation, the effects of an engine case rupture, uncontained engine rotor failure, engine case burn - th rough, and propeller debris release are excluded from CS 25.901(c) / CS 25.1309 . The effects and rates of these failures are minimised by compliance with CS - E, Engines; CS - P, Propellers; CS 25.903(d)(1) , CS 25.905(d) , and CS 25.1193 .

Furthermore, the effects of encountering environmental threats or other operating conditions more severe than those for which the aircraft is ce rtified (such as volcanic ash or operation above placard speeds) need not be considered in the CS 25.901(c) / CS 25.1309 compliance process. However, if a failure or malfunction can affect the subsequent environmental qualification or other operational capab ility of the installation, this effect should be accounted for in the CS 25.901(c) / CS 25.1309 a ssessment.

The terms used in this AMC are intended to be identical to those used in AMC 25.1309 .

4. BACKGROUND .

JAR - 25 was the Joint Aviation Authorities Airwort hin ess Code for Large Aeroplanes. It was developed from the U.S. Federal Aviation Regulations Part 25 (FAR 25) during the 1970s. Early versions (Changes) of JAR - 25 consisted of only the differences from FAR 25.

In 1976, JAR - 25 Change 3 was published and in troduced, for the first time, requirement JAR 25.1309 and ACJ Nos. 1 to 7 to JAR 25.1309. Requirement JAR 25.1309 was almost the same as the (then) existing FAR regulation (Amdt. 25 - 37), but the advisory material given in the ACJ provided interpretation of and acceptable means of compliance with, the requirement. Specific advice was given on how to show that the inverse relationship existed between the criticality of the Failure Condition and its probability of occurrence.

JAR - 25, Change 3, did not includ e any specific JAR - 25 requirement for powerplant installation safety assessment and so FAR 25.901( c) was also valid for JAR - 25. FAR 25.901(c) text (Amdt. 25 - 23, Effective 8 May 1970) stated: “25.901 Installation (c) The powerplant installation must comply with § 25.1309”.

At Change 4 of JAR - 25, effective 19 July 1978, JAR 25.901(c) was introduced using the same FAR 25 words as shown above (viz.): “JAR 25.901 Installation (c) The power - plant installation must comply with JAR 25.1309.” However, at about that time, the FAA had been reviewing a proposal to revise FAR 25.901(c), to introduce the wording “… no single failure or probable combination …”. This revised text was introduced at Amdt. 25 - 40, effective 2 May 1977.

The revisions introduced by Amdt. 25 - 40 were reviewed by the JAR - 25 Study Groups and in two letters (Refs.: JAR/JET/2416/BT dated 21 July 1977 and JAR/JET/2467/BT dated 21 October 1977), the JAR - 25 Powerplant Study Group recommended that, for JAR 25.901(c), the text should remain the same as the pre - Amdt. 25 - 40 version of FAR 25.901(c).

Since that time, JAR 25.901(c) and CS 25.901(c) have continued to refer to JAR / CS 25.1309 and for EASA/JAA, powerplant installations have been treated in the same way as for other aircraft systems when assess ing the effects of failures and malfunctions.

One traditional exception to this has been the assessment of hazards resulting from an engine rotor failure. Previous ACJ No. 1 to JAR 25.1309 allowed for an explicit exception to the Powered by EASA eRules Page 584 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL quantitative objective for a given catastrophic failure condition, for cases where the state of the art does not permit it to be achieved. This is the case for engine rotor failure and the ‘minimisation of hazard’ requirement of CS 25.903(d )(1) has been used instead of CS 25.1309 to cover this risk.

5. GENERAL SYSTEM SAFETY ASSESSMENT GUIDANCE .

Compliance with CS 25.901(c) / CS 25.1309 may be shown by a System Safety Assessment (SSA) substantiated by appropriate testing and/or comparable servi ce experience. Such an assessment may range from a simple report that offers descriptive details associated with a failure condition, interprets test results, compares two similar systems, or offers other qualitative information; to a detailed failure anal ysis that may include estimated numerical probabilities.

The depth and scope of an acceptable SSA depend on: — the complexity and criticality of the functions performed by the system(s) under consideration, — the severity of related failure conditions, — the uniqueness of the design and extent of relevant service experience, — the number and complexity of the identifi ed causal failure scenarios, and — the detectability of contributing failures.

The SSA criteria, process, analysis methods, validation and documentation should be consistent with the guidance material contained in AMC 25.1309 . Wherever there is unique guidance specifically for powerplant installations, this is delineated in Section 6, below.

In carrying out the SSA for the powerplant installation for CS 25.901(c) / CS 25.1309 , the results of the engine (and propeller) failure analyses (reference CS P - 150 and CS E - 510) should be used as inputs for those powerplant failure effects that can have an impact on the aircraft. However, the SSA undertaken in response to CS - E and CS - P m ay not address all the potential effects that an engine and propeller as installed may have on the aircraft.

For those failure conditions covered by analysis under CS - E and CS - P, and for which the installation has no effect on the conclusions derived from these analyses, no additional analyses will be required to demonstrate compliance to CS 25.901(c) / CS 25.1309 .

The effects of structural failures on the powerplant installation, and vice versa, should be carefully considered when conducting system safety as sessments: a. Effects of structural failures on powerplant installation. The powerplant installation must be shown to comply with CS 25.901(c) following structural failures that are anticipated to occur within the fleet life of the aeroplane type. This sh ould be part of the assessment of powerplant installation failure condition causes.

Examples of structural failures that have been of concern in previous powerplant installations are: (1) Thrust reverser restraining load path failure that may cause a catas trophic inadvertent deployment.

(2) Throttle quadrant framing or mounting failure that causes loss of control of multiple engines.

(3) Structural failures in an avionics rack or related mounting that cause loss of multiple, otherwise independent, powerplan t functions/components/systems.

Powered by EASA eRules Page 585 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL b. Effects of powerplant installation failures on structural elements. Any effect of powerplant installation failures that could influence the suitability of affected structures, should be identified during the CS 25.901(c) assessment and accounted for when demonstrating compliance with the requirements of CS - 25, Subpart C (“Structure”) and D (“Design and Construction”). This should be part of the assessment of powerplant installation failure condition effects.

Some examples of historical interdependencies between powerplant installations and structures include: (1) Fuel system failures that cause excessive fuel load imbalance.

(2) Fuel vent, refuelling, or feed system failures that cause abnormal internal fuel tank pressures .

(3) Engine failures that cause excessive loads/vibration.

(4) Powerplant installation failures that expose structures to extreme temperatures or corrosive material.

6. SPECIFIC CS 25.901(c) SYSTEM SAFETY ASSESSMENT GUIDANCE .

This section provides compli ance guidance unique to powerplant installations.

a. Undetected Thrust Loss. The SSA discussed in Section 5 should consider undetected thrust loss and its effect on aircraft safety. The assessment should include an evaluation of the failure of components a nd systems that could cause an undetected thrust loss, except those already accounted for by the approved average - to - minimum engine assessment.

(1) In determining the criticality of undetected thrust losses from a system design and installation perspective , the following should be considered: (i) Magnitude of the thrust loss,* (ii) Direction of thrust, (iii) Phase of flight, and (iv) Impact of the thrust loss on aircraft safety.

(*Although it is common for safety analyses to consider the total loss of one engine's thrust, a small undetected thrust loss that persists from the point of take - off power set could have a more significant impact on the accelerate/stop distances and take - off flight path/obstacle clearance capability than a detectable single eng ine total loss of thrust failure condition at V1) (2) In addition, the level at which any thrust loss becomes detectable should be validated. This validation is typically influenced by: (i) Impact on aircraft performance and handling, (ii) Resultant changes in powerplant indications, (iii) Instrument accuracy and visibility, (iv) Environmental and operating conditions, (v) Relevant crew procedures and capabilities, etc.

(3) Reserved.

Powered by EASA eRules Page 586 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL b. Detected Thrust Loss. While detectable engine thrust losses can range in magnitude from a few percent to 100% of total aircraft thrust, the total loss of useful thrust (in - flight shutdown/IFSD) of one or more engines usually has the largest impact on aircraft capabilitie s and engine - dependent systems. Furth ermore, single and multiple engine IFSD’s tend to be the dominant thrust loss - related failure conditions for most powerplant installations. In light of this, the guidance in this AMC focuses on the IFSD failure conditions. The applicant must consider othe r engine thrust loss failure conditions, as well, if they are anticipated to occur more often than the IFSD failure condition, or if they are more severe than the related IFSD failure condition.

(1) Single Engine IFSD. The effects of any single engine thru st loss failure condition, including IFSD, on aircraft performance, controllability, manoeuvrability, and crew workload are accepted as meeting the intent of CS 25.901(c) if compliance is also demonstrated with: — CS 25.111 (“Take - off path”), — CS 25.121 (“Climb: one - engine - inoperative”), and — CS 25.143 (“Controllability and Manoeuvrability -- General”).

(i) Nevertheless, the effects of an IFSD on other aircraft systems or in combination with other conditions also must be assessed as part of showing complianc e with CS 25.901(c) / CS 25.1309 . In this case, it should be noted that a single engine IFSD can result from any number of single fai lures, and - 4 - 5 that the rate of IFSD’s range from approximately 1x10 to 1x10 per engine flight hour. This rate includes all failures within a typical powerplant installation that affect one -- and only one -- engine. Those failures within a typical powerpl ant that can affect more than one engine are described in Section 6.b.(2), below.

(ii) If an estimate of the IFSD rate is required for a specific turbine engine installation, any one of the following methods is suitable for the purposes of complying with C S 25.901(c) / CS 25.1309(b) : (A) Estimate the IFSD rate based on service experience of similar powerplant installations; (B) Perform a bottom - up reliability analysis using service, test, and any other relevant experience with similar components and/or technologies to predict component failure modes and rates; or - 4 (C) Use a conservative value of 1x10 per flight hour.

(iii) If an estimate of the percentage of these IFSD’s for which the engine is restartable is required, the estimate should be based on r elevant service experience.

(iv) The use of the default value delineated in paragraph 6.b.(1)(ii)(C) is limited to traditional turbine engine installations. However, the other methods (listed in 6.b.(1)(ii)(A) and (B), above) are acceptable for estimating the IFSD rates and restartability for other types of engines, such as some totally new type of engine or unusual powerplant installation with features such as a novel fuel feed system. In the case of new or novel components, significant non - service exper ience may be required to validat e the reliability Powered by EASA eRules Page 587 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL predictions. This is typically attained through test and/or technology transfer analysis.

(v) Related issues that should be noted here are: (A) CS 25.901(b)(2) sets an additional standard for installed engine reliability. This requirement is intended to ensure that all technologically feasible and economically practical means are used to assure the continued safe operation of the powerplant installation between inspections and overhauls.

(B) The effectiveness of compliance with CS 25.111 , CS 25.121 and CS 25.143 in meeting the intent of C S 25.901(c) for single engine thrust loss is dependent on the accuracy of the human factors assessment of the crew’s ability to take appropriate corrective action.

For the purposes of compliance with CS 25.901(c) in this area, it may be assumed that the crew will take the corrective actions called for in the aeroplane flight manual procedures and associated approved training.

(2) Multiple Engine IFSD. Typical engine IFSD rates may not meet the AC 25.1309 - 1B - 9 guidan ce that calls for 1 x 10 per hour for a catastrophic multiple engine IFSD.

However, engine IFSD rates been part of the historically - accepted service experience upon which that guidance was based, and these IFSD rates are continuously improving. Consequen tly: (i) Current typical turbine engine IFSD rates, and the resulting possibility of multiple independent IFSD’s leading to a critical power loss, are considered inherently acceptable for compliance with CS 25.901(c) w ithout the need for quantitative asses sment.

(ii) Nevertheless, some combinations of failures within aircraft systems common to multiple engines may cause a catastrophi c multiple engine thrust loss. These should be assessed to ensure that they meet the extremely improbable criteria . Systems to be considered include: — fuel system, — air data system, — electrical power system, — throttle assembly, — engine indication systems, etc.

(iii) The means of compliance described above is only valid for turbine engines, and for engines that can demonstrate equi valent reliability to turbine engines, using the means outline d in Section 6.a. of this AMC. The approach to demonstrating equivalent reliability should be discussed early in the program with the Agency on a case - by - case basis.

c. Automatic Take - off Thrust Control System. CS - 25, Appendix I [“Automatic Take - off Thrust Control System (ATTCS)”], specifies the minimum reliability levels for these automatic systems. In addition to showing compliance with these reliabilit y levels for certain combinations of failures, other failure conditions that can arise as a result of introducing such a system must be shown to comply with CS 25.901(c) / CS 25.1309 .

Powered by EASA eRules Page 588 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL d. Thrust Management Systems. A System Safety Assessment is essential for any aeroplane system that aids the crew in managing engine thrust (i.e., computing target engine ratings, commanding engine thrust levels, etc.). As a minimum, the criticality and failure hazard classification must be ass essed. The system criticality will depend on: — the range of thrust management errors it could cause, — the likelihood that the crew will detect these errors and take appropriate corrective action, and — the severity of the effects of these errors with and without crew intervention.

The hazard classification will depend on the most severe effect s anticipated from any system. The need for more in - depth analysis will depend upon the systems complexity, novelty, initial failure hazard classification, relationship to other aircraft systems, etc.

(1 ) Automated thrust management features, such as autothrottles and target rating displays, traditionally have been certified on the basis that they are only conveniences to reduce crew workload and do not relieve the crew of any responsibility for assuring proper thrust management. In some cases, malfunctions of these systems can be considered to be minor, at most. However, for this to be valid, even when the crew is no longer directly involved in performing a given thrust management function, the crew mus t be provided with information concerning unsafe system operating conditions to enable them to take appropriate corrective action.

(2) Consequently, when demonstrating compliance with CS 25.901(c) / CS 25.1309 , failures within any automated thrust management feature which, if not detected and properly accommodated by crew action, could create a catastrophe should be either: (i) considered a catastrophic failure condition when demonstrating compliance with CS 25.901(c) / CS 25.1309(b) ; or (ii) consider ed an unsafe system operating condition when demonstrating compliance with the warning requirements of CS 25.1309(c) .

e. Thrust Reverser. Compliance with CS 25.933(a) (“Reversing systems”) provides demonstration of compliance with CS 25.901(c) / CS 25.1309 for the thrust reverser in - flight deployment failure conditions. A standard CS 25.901(c) / CS 25.1309 System Safety Assessment should be performed for any other thrust reverser - related failure conditions.

7. TYPICAL F AILURE CONDITIONS FOR POWERPLANT SYSTEM INSTALLATIONS.

The purpose of this section is to provide a list of typical failure conditions that may be applicable to a p owerplant system installation. This list is by no means all - encompassing, but it captures some failure conditions that have been of concern in previous powerplant system installations.

The specific failure conditions identified during the preliminary SSA for the installation should be reviewed against this list to assist in ensuring t hat all failure conditions have been identified and properly addre ssed.

Powered by EASA eRules Page 589 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL As stated previously in this AMC, the assessment of these failure conditions may range from a simple report that offers descriptive details associated with a failure condition, inter prets test results, compares two similar systems, or offers other qualitative information; to a detailed failure analysis that may include estimated numerical probabilities. The assessment criteria, process, analysis methods, validation, and documentation should be consistent with the guidance material contained in AMC 25.1309 .

a. Fire Protection System - Failure Conditions: (1) Loss of detection in the presence of a fire.

(2) Loss of extinguishing in the presence of a fire.

(3) Loss of fire zone integrity in the presence of a fire.

(4) Loss of flammable fluid shut - off or drainage capability in the presence of a fire.

(5) Creation of an ignition source outside a fire zone but in the presence of flammable fl uids.

b. Fuel System -- Failure Conditions: (1) Loss of fuel feed/fuel supply.

(2) Inability to control lateral and longitudinal balance.

(3) Hazardously misleading fuel indications.

(4) Loss of fuel tank integrity.

(5) Loss of fuel jettison.

(6) Uncommand ed fuel jettison.

c. Powerplant Ice Protection - Failure Conditions: (1) Loss of propeller, inlet, engine, or other powerplant ice protection on multiple powerplants when required.

(2) Loss of engine/powerplant ice detection.

(3) Activation of engine inlet ice protection above limit temperatures.

d. Propeller Control - Failure Conditions: (1) Inadvertent fine pitch (overspeed, excessive drag).

(2) Inadvertent coarse pitch (over - torque, thrust asymmetry) (3) Uncommanded propeller feathering.

(4) Failure to f eather.

(5) Inadvertent application of propeller brake in flight.

(6) Unwanted reverse thrust (pitch).

e. Engine Control and Indication -- Failure Conditions: (1) Loss of thrust.

(2) Loss of thrust control, including asymmetric thrust, thrust increases, thrust decreases, thrust fail fixed, and unpredictable engine operation.

(3) Hazardously misleading display of powerplant parameter(s).

Powered by EASA eRules Page 590 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POW ERPLANT (CS - 25) GENERAL f. Thrust Reverser - Failure Conditions: (1) Inadvertent deployment of one or more reversers.

(2) Failure of one or more reversers to deploy when commanded.

(3) Failure of reverser component restraints (i.e., opening of D - ducts in flight, release of cascades dur ing reverser operation, etc.).

[Amdt No: 25/1]

CS 25.903 Engines

ED Decision 2016 / 016 /R (See AMC 25.903) (a) Engine type certification.

(1) reserved (2) An y engine not certificated to CS - E must be shown to comply with CS - E 790 and CS - E 800 or be shown to have a foreign object ingestion service history in similar installation locations which has not r esulted in any unsafe condition.

(3) Any engine not certificated to CS – E must be shown to comply with CS – E 780 or be shown to have an ice accumulation service history in similar installation locations which has not resulted in any unsafe conditions.

(b) E ngine isolation . The powerplants must be arranged and isolated from each other to allow operation, in at least one configuration, so that the failure or malfunction of any engine, or of any system that can affect the engine, will not – (1) Prevent the con tinued safe operation of the remaining engines; or (2) Require immediate action by any crew member for continued safe operation.

(c) Control of engine rotation . There must be means for stopping the rotation of any engine individually in flight, except that , for turbine engine installations, the means for stopping the rotation of any engine need be provided only where continued rotation could jeopardise the safety of the aeroplane. Each component of the stopping system on the engine side of the firewall that might be exposed to fire must be at least fire resistant. If hydraulic propeller feathering systems are used for this purpose, the feathering lines must be at least fire - resistant under the operating conditions that may be expected to exist during feather ing.

(d) Turbine engine installations . For turbine engine installations – (1) Design precautions must be taken to minimise the hazards to the aeroplane in the event of an engine rotor failure or of a fire originating within the engine which burns through the engine case. (See AMC 25.903(d)(1) and AMC 20 - 128A.)

(2) The powerplant systems associated with engine control devices, systems, and instrumentation, must be designed to give reasonable assurance that those en gine operating limitations that adversely affect turbine rotor structural integrity will not be exceeded in service.

Powered by EASA eRules Page 591 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL (e) Restart capability.

(1) Means to restart any engine in flight must be provided.

(2) An altitude and airspeed envelope must be established for in - flight engine restarting, and each engine must have a restart capability within that envelope. (See AMC 25.903(e)(2) .)

(3) For turbine engine powered aer oplanes, if the minimum windmilling speed of the engines, following the in - flight shutdown of all engines, is insufficient to provide the necessary electrical power for engine ignition, a power source independent of the engine - driven electrical power gener ating system must be provided to permit in - flight engine ignition for restarting.

[Amdt 25/16] [Amdt 25/18]

AMC 25.903 (d)(1) Torching Flames

ED Decision 2003/2/RM Where design precautions to minimise the hazard in the event of a combustion chamber burnthrough involve the use of torching flame resistant components and/or materials, satisfaction of the standards prescribed in British Standards Institution Specificatio n 3G100: Part 2: Section 3: Sub - section 3.13, dated December 1973, is acceptable.

AMC 25.903(e)(2) Engines

ED Decision 2003/ 2/RM 1 General 1.1 In general the relight envelope required in CS 25.903(e)(2) may con sist of two zones – a. One zone where the engine is rotated by windmilling at or beyond the minimum rpm to effect a satisfactory relight, and b. Another zone where the engine is rotated with assistance of the starter at or beyond the minimum rpm to effec t a satisfactory relight.

1.2 The minimum acceptable relight envelope is defined in paragraph 2.

2 Envelope of Altitude and Airspeed 2.1 Sufficient flight tests should be made over the range of conditions detailed in 2.2 and 2.3, to establish the envel ope of altitude and airspeed for reliable engine restarts, taking into account the results of restart tests completed by the engine constructor on the same type of engine in an altitude test facility or flying test bed, if available, and the experience acc umulated in other aircraft with the same engine. The effect of engine deterioration in service should be taken into account.

2.2 Altitude and Configuration. From sea - level to the maximum declared restarting altitude in all appropriate configurations likel y to affect restarting, including the emergency descent configuration.

2.3 Airspeed. From the minimum to the maximum declared airspeed at all altitudes up to the maximum declared engine restarting altitude. The airspeed range of the declared relight envel ope should cover at least 30 kt.

Powered by EASA eRules Page 592 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL 2.4 Delay Tests. The tests referred to in paragraph 2.2 should include the effect on engine restarting performance of delay periods between engine shut - down and restarting of – a. Up to two minutes, and b. At least fifteen minutes or until the engine oil temperatures are stabilised at their cold soak value.

CS 25.904 Automatic Takeoff Thrust Control System (ATTCS)

ED Decision 2003/ 2/RM Aeroplanes equipped with an engine power control system that automatica lly resets the power or thrust on the operating engine(s) when any engine fails during the takeoff must comply with the requirements of Appendix I .

CS 25.905 Propellers

ED Decision 2016 / 010 /R (See AMC 25.905) (a) reserved (b) Engine power and propeller shaft rotational speed may not exceed the limits for which the propeller is certificated. (See CS - P 5 0.)

(c) Each component of the propeller blade pitch control system m ust meet the requirements of CS - P 4 2 0.

(d) Design precautions must be taken to minimise the hazards to the aeroplane in the event a propeller blade fails or is released by a hub failure. The hazards which must be considered include damage to structure and critical systems due to impact of a failed or released blade and the unbalance created by such failure or release. (See AMC 25.905(d) .)

[Amdt 25/3] [Amdt 25/18]

AMC 25.905(d) Release of Propeller Debris

ED Decision 2003/ 2/RM 1 Propeller Installatio n . Design features of the propeller installation, including its control system, which are considered to influence the occurrence of propeller debris release and/or mode of such a failure should be taken into account when assessing the aeroplane against CS 25.905(d) .

2 Aeroplane Design Conditions 2.1 Impact Damage Zone . All practical precautions should be taken in the aeroplane design to minimise, on the basis of good engineering judgement, the risk of Catastrophi c Effects due to the release of part of, or a complete propeller blade. These precautions should be taken within an impact zone defined by the region between the surfaces generated by lines passing through the centre of the propeller hub making angles of a t least five degrees forward and aft of the plane of rotation of each propeller. Within this zone at least the following should be considered.

a. The vulnerability of critical components and systems (e.g. location, duplication, separation, protection); an d Powered by EASA eRules Page 593 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL b. The fire risk in the event of flammable fluid release in association with potential ignition sources (e.g. location, protection, shut - off means).

2.2 Other Considerations . Consideration should be given to the effects on the aeroplane resulting from – a. The likely out of balance forces due to the release of part of, or a complete propeller blade; and b. Loss of a complete propeller.

CS 25.907 Propeller vibration

ED Decision 200 7 / 010 /R (See CS - P 530 and CS - P 550 .)

(a) The magnitude of the propeller blade vibration stresses under any normal condition of operation must be determined by actual measurement or by comparison with similar installations for which these measurements have been made.

(b) The determined vibration stresses may not excee d values that have been shown to be safe for continuous operation.

[Amdt 25/3]

AMC 25.907 Propeller vibration

ED Decision 2021/015/R EASA accepts Federal Aviation Administration (FAA) Advisory Circular (AC) 20 - 66B ‘Propeller Vibration and Fatigue’, of 24 March 2011, as an acceptable means of compliance with CS 25.907 regarding the evaluation of vibratory stresses on propellers. The applicant should use in that evaluation fatigue and structural data that is obtaine d in accordance with the Certification Specifications and Acceptable Means of Compliance for Propellers (CS - P).

When investigating the actual vibration behaviour of each propeller, the applicant should include the operating conditions that correspond to de scent with the power levers at flight idle position and with speeds around maximum operating limit speed (V ). Experience has shown that such conditions may MO cause cyclic loads and vibrations that may exert excessive stress on some parts of the propeller. As aerodynamic loads differ depending on the position of the engine - propeller assembly on the aeroplane, the applicant should investigate the propellers’ vibration behaviour at all engine - propeller assembly positions.

[Amdt No: 25/27]

CS 25.925 Propeller c learance

ED Decision 2016 / 010/R Unless smaller clearances are substantiated, propeller clearances with the aeroplane at maximum weight, with the most adverse centre of gravity, and with the propeller in the most adverse pitch position, may not be less than the following: (a) Ground clea rance . There must be a clearance of at least 18 cm (7 inches) (for each aeroplane with nose wheel landing gear) or (23 cm 9 inches (for each aeroplane with tail - wheel landing gear) between each propeller and the ground with the landing gear statically defl ected and in the level take - off, or taxying attitude, whichever is most critical. In addition, there must be Powered by EASA eRules Page 594 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL positive clearance between the propeller and the ground when in the level take - off attitude with the critical tyre(s) completely deflated and the c orrespondi ng landing gear strut bottomed.

(b) Reserved .

(c) Structural clearance . There must be – (1) At least 25 mm (1·0 inche s ) radial clearance between the blade tips and the aeroplane structure, plus any additional radial clearance necessary to preve nt harmful vibration; (2) At least 13 mm (0·5 inches) longitudinal clearance between propeller blades or cuffs and stationary parts of the aeroplane; and (3) Positive clearance between other rotating parts of the propeller or spinner and stationary parts of the aeroplane.

[Amdt 25/18]

CS 25.929 Propeller de - icing

ED Decision 2016/010 /R (See AMC 25.929) (a) If certification for flight in ici ng conditions is sought , there must be a means to prevent or remove hazardous ice accumulations that could form in t he icing conditions defined in Appendices C and O on propellers or on accessories where ice accumulation would jeopardise engine performance (see AMC 25.929(a) ).

(b) If combustible fluid is used for propeller de - icing, CS 25.1181 to CS 25.1185 and CS 25.1189 apply.

[Amdt 25/16] [Amdt 25/18]

AMC 25.929(a) Propeller d e - icing

ED Decision 20 16/010 /R 1. Analysis.

The applicant should perform an analysis that: (1) substantiates ice protection coverage in relation to chord length and span.

(2) substantiates the ice protection system power d ensity.

(3) consider the effect of intercycle ice accretions and potential for propeller efficiency degradation for all flight phases.

(4) assess the different propeller Ice Protection System failure modes which are not extremely improbable and leading to the: (i) highest propeller performance level degradation, and (ii) highest propeller vibration levels taking also into account possible ice shedding.

(5) assess the impact of ice released by the propeller on the vibration levels, the adjacent components (i f any) and the aircraft structure, both for normal operation and in the different propeller de - icing system failure modes.

Powered by EASA eRules Page 595 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL Similarity to prior designs with successful service histories in icing may be used to show compliance. A demonstration of similarit y requires an evaluation of both system and installation differences. The applicant should show specific similarities in the areas of physical, functional, thermodynamic, pneumatic, and aerodynamic characteristics as well as in environmental exposure. The analysis should show that propeller installation, operation, and effect on the aeroplane’s performance and handling are equivalent to that of the same or similar propeller in the previously approved configuration. Differences should be evaluated for their effect on IPS functionality and on safe flight in icing. If there is uncertainty about the effects of the differences, the applicant should conduct additional tests and/or analysis as necessary and appropriate to resolve the open issues.

For showing compl iance with the CS - 25 certification specifications relative to SLD icing conditions represented by Appendix O, the applicant may use a comparative analysis. AMC 25.1420(f) provides guidance for comparative analysis.

2. Compliance Tests.

2.1 Surface tempera ture measurements should be made and monitored in dry air flight testing. These measurements are useful for correlating analytically predicted dry air temperatures with actual temperatures, and as a general indicator that the system is functioning and that each de - icer is heating. It is suggested that system current, brush block voltage (i.e., between each input brush and the ground brush) and system duty cycles be monitored to ensure that adequate power is applied to the de - icers.

2.2 System operation sho uld be checked throughout the full rotation speed range. and propeller cyclic pitch range expected during flight in icing. Additionally, if the propeller Ice Protection System is regulated based on different outside parameters such as temperature, then sys tem operation should also be checked against those parameters.

All significant vibrations should be investigated.

2.3 The analysis assessing the effect of intercycle ice accretions and potential for propeller efficiency degradation should be adequately va lidated by tests.

2.4 The Ice Protection System failure modes determined in 1.4 above should be adequately validated by tests.

2.5 The applicant should consider the maximum temperatures a composite propeller blade may be subjected to when de - icers are ener gized. It may be useful to monitor de - icer bond - side temperatures. When performing this evaluation, the most critical conditions should be investigated (e.g., aeroplane on the ground; propellers not rotating) on a hot day with the system inadvertently ener gized.

2.6 Shedding procedures and post failure procedures mentioned in the AFM should be demonstrated by test.

3. Runback Ice.

Water not evaporated by thermal ice protection systems and unfrozen water in near - freezing conditions (or in conditions when the freezing fraction is less than one) may run aft and form runback ice. This runback ice can then accumulate additional mass from direct impingement.

Computer codes may be unable to estimate the characteristics of the runback water or resultant ice shapes (rivulets or thin layers), but some codes may be able to estimate the mass of the runback ice. Thus runback ice should be determi ned experimentally, or the mass determined by computer codes with assumptions about runback extent and thickness similar to those used successfully with prior models. The runback ice should be determined both for normal Powered by EASA eRules Page 596 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL operation and for propeller Ice Prot ection System failure modes when not operating in the predefined cycles.

The applicant should consider potential hazards resulting from the loss of propeller performance, the increased vibration level and the runback ice shedding.

[Amdt 25/16] [Amdt 25/18 ]

CS 25.933 Reversing systems

ED Decision 2020/001/R (See AMC 25.93 3 ) (a) For turbojet reversing systems : (1) Each system intended for ground operation only must be designed so that either: (i) The aeroplane can be shown to be capable of continued safe flight and landing during and after any thrust reversal in flight; or (ii) It can be demonstrated that any in - flight thrust reversal complies with CS 25.1309(b ).

(See AMC 25.933(a)(1) ) (2) Each system intended for inflight use must be designed so that no unsafe condition will result during normal operation of the system, or from any failure (or reasonably likely combinat ion of failures) of the reversing system, under any anticipated condition of operation of the aeroplane including ground operation. Failure of structural elements need not be considered if the probability of this kind of failure is extremely remote.

(3) Ea ch system must have means to prevent the engine from producing more than idle thrust when the reversing system malfunctions, except that it may produce any greater forward thrust that is shown to allow directional control to be maintained, with aerodynamic means alone, under the most critical reversing condition expected in operation.

(b) For propeller reversing systems : (1) Each system intended for ground operation only must be designed so that no single failure (or reasonably likely combination of failure s) or malfunction of the system will result in unwanted reverse thrust under any expected operating condition. Failure of structural elements need not be considered if this kind of failure is extremely remote.

(2) Compliance with this paragraph may be show n by failure analysis or testing, or both, for propeller systems that allow propeller blades to move from the flight low - pitch position to a position that is substantially less than that at the normal flight low - pitch position.

The analysis may include or be supported by the analysis made to show compliance with the requirements of CS - P 70 for the propeller and associated installation components.

[Amdt 25/1] [Amdt 25/18] [Amdt 25/24] Powered by EASA eRules Page 597 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL

AMC 25.933(a)(1) Unwanted in - flight thrust reversal of turbojet

thrust reversers

ED Decision 2020/001/R 1. PURPOSE .

This Acceptable Means of Compliance (AMC) describes various acceptable means, for showing compliance with the requirements of CS 25.933(a)(1), "Reversing systems", of CS - 25. These means are intended to provide guidance to supplement the engineering and operational judgement that must form the basis of any compliance findings relative to in - flight thrust reversal of turbojet thrust reversers.

2. RELATED CERTIFICATION SPECIFICATIONS .

CS 25.111 , CS 25.143 , CS 25.251 , CS 25.571 , CS 25.901 , CS 25.903 , CS 25.1155 , CS 25.1305 , CS 25.1309 , CS 25.1322 and CS 25.1529 3. APPLICABILITY .

The requirements of CS 25.933 apply to turbojet thrust reverser systems. CS 25.933(a) specifically applies to reversers intended for ground operation only, while CS 25.933(b) applies to reversers intended for both ground and in - flight use.

This AMC applies onl y to unwanted thrust reversal in flight phases when the landing gear is not in contact with the ground; other phases (i.e., ground operation) are addressed by CS 25.901(c) and CS 25.1309 .

4. BACKGROUND .

4.a. General. Most thrust reversers are intended for ground operation only. Consequently, thrust reverser systems are generally sized and developed to provide high deceleration forces while avoiding foreign object debris (FOD) ingestion, aeroplane surface efflu x impingement, and aeroplane handling d ifficulty during landing roll. Likewise, aircraft flight systems are generally sized and developed to provide lateral and directional controllability margins adequate for handling qualities, manoeuvrability requiremen ts, and engine - out VMC lateral drift conditions.

In early turbojet aeroplane designs, the combination of control system design and thrust reverser characteristics resulted in control margins that were capable of recovering from unwanted in - flight thrust re versal even on ground - use - only reversers; this was required by the previous versions of CS 25.933 .

As the predominant large aeroplane configuration has developed into the high bypass ratio twin engine - powered model , control margins for the in - flight thrust reversal case have decreased. Clearly, whenever and wherever thrust reversal is intended, the focus must remain on limiting any adverse effects of thrust reversal. However, when demonstrating compliance with CS 25.933(a) or CS 25.933(b) , the Authority has accepted that applicants may either provide assurance that the aeroplane is controllable after an in - f light thrust reversal event or that the unwanted in - flight thrust reversal event will not occur.

Different hi storical forms of the rule have attempted to limit either the effect or the likelihood of unwanted thrust reversal during flight. However, experience has demonstrated that neither method is always both practical and effective. The current rule, and this related advisory material, are intended to allow either of these assurance Powered by EASA eRules Page 598 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL methods to be applied in a manner which recognises the limitations of each, thereby maximising both the design flexibility and safety provided by compliance with the rule.

4.b. Mini mising Adverse Effects. The primary purpose of reversing systems, especially those intended for ground operation only, is to assist in decelerating the aeroplane during landing and during an aborted take - off. As such, the reverser must be rapid - acting and must be effective in produc ing sufficient reverse thrust. These requirements result in design characteristics (actuator sizing, efflux characteristics, reverse thrust levels, etc.)

that, in the event of thrust during flight, could cause significant adverse effects on aeroplane controllability and performance.

If the effect of the thrust reversal occurring in flight produces an unacceptable risk to continued safe flight and landing, then the reverser operation and de - activation system must be designed to pr event unwanted thrust reversal. Alternatively, for certain aeroplane configurations, it may be possible to limit the adverse impacts of unwanted thrust reversal on aeroplane controllability and performance such that the risk to continued safe flight and l anding is acceptable (discussed later in this AMC).

For reversing systems intended for operation in flight, the reverser system must be designed to adequately protect against unwanted in - flight thrust reversal.

CS 25.1309 and CS 25.901(c) and the associate d AMC ( AMC 25.1309 and AMC 25.901(c) provide guidance for developing and assessing the safety of systems at the design stage.

This methodology should be applied to the total reverser system, which includes: — the reverser; — the engine (if it can contribute to thrust reversal); — the reverser mot ive power source; — the reverser control system; — the reverser command system in the cockpit; and — the wiring, cable, or linkage system between the cockpit and engine.

Approved removal, deactivation, reinstallation, and repair procedures for any element in th e reverser or related systems should result in a safety level equivalent to the certified baseline system configuration.

Qualitative assessments should be done, taking into account potential human errors (maintenance, aeroplane operation).

Data required to determine the level of the hazard to the aeroplane in case of in - flight thrust reversal and, conversely, data necessary to define changes to the reverser or the aeroplane to eliminate the hazard, can be obtained from service experience, test, a nd/or analysis. These data also can be used to define the envelope for continued safe flight.

There are many opportunities during the design of an aeroplane to minimise both the likelihood and severity of unwanted in - flight thrust reversal. These opportu nities include design features of both the aeroplane and the engine/reverser system. During the design process, consideration should be given to the existing stability and control design features, while preserving the intended function of the thrust rever ser system.

Some design considerations, which may help reduce the risk from in - flight thrust reversal, include: Powered by EASA eRules Page 599 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPA RT E – POWERPLANT (CS - 25) GENERAL 4.b.(1) Engine location to: (i) Reduce sensitivity to efflux impingement.

(ii) Reduce effective reverse thrust moment arms 4.b.(2) Engine/Re verser System design to: (i) Optimise engine/reverser system integrity and reliability.

(ii) Rapidly reduce engine airflow (i.e. auto - idle) in the event of an unwanted thrust reversal. Generally, such a feature is considered a beneficial safety item. In this case, the probability and effect of any unwanted idle command or failure to provide adequate reverse thrust when selected should be verified to be consistent with AMC 25.1309 and AMC 25.901(c) .

(iii) Give consideration to the aeroplane pitch, yaw, and roll characteristics.

(iv) Consider effective efflux diameter.

(v) Consider efflux area.

(vi) Direct reverser efflux away from critical areas of the aeroplane.

(vii) Expe dite detection of unwanted thrust reversal, and provide for rapid compensating action within the reversing system.

(viii) Optimise positive aerodynamic stowing forces.

(ix) Inhibit in - flight thrust reversal of ground - use - only reversers, even if commanded b y the flight crew.

(x) Consider incorporation of a restow capability for unwanted thrust reversal.

4.b.(3) Airframe/System design to: (i) Maximise aerodynamic control capability.

(ii) Expedite detection of thrust reversal, and provide for rapid compensating action through other airframe systems.

(iii) Consider crew procedures and responses.

The use of formal «lessons learned» - based reviews early and often during design development may help avoid repeating previous errors and take advantage of pre vious successes.

5. DEFINITIONS .

The following definitions ap ply for the purpose of this AMC : a. Catastrophic: see AMC 25.1309 b. Cont inued Safe Flight and Landing: The capability for continued controlled flight and safe landing at an airport, possibly using emergency procedures, but without requiring except ional pilot skill or strength. Some aeroplane damage may be associated with a failure condition, during flight or upon landing.

c. Controllab le Flight Envelope and Procedure: An area of the Normal Flight Envelope where, given an appropriate procedure, the aeroplane is capable of continued safe flight and landing following an in - flight thrust reversal.

Powered by EASA eRules Page 600 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL d. Deactivated Reverser: Any thrust rever ser that has been deliberately inhibited such that it is precluded from performing a normal deploy/stow cycle, even if commanded to do so.

e. Exceptional Piloting Skill and/or Strength: Refer to CS 25.143(c) (c) («C ontrollability and Manoeuvrability — General»).

f. Extremely Improbable: see AMC 25.1309 g. Extremely Remote: see AMC 25.1309 h. Failure: see AMC 25.1309 i. Failure Situation: All failures that result in the malfunction of one independent command and/or res traint feature that directly contributes to the top level Fault Tree Analysis event (i.e., unwant ed in - flight thrust reversal). For the purpose of illustration, Figure 1, below, provides a fault tree example for a scenario of three «failure situations» lea ding to unwanted in - flight thrust reversal.

Figure 1: TOP EVENT Reverser System with three independent command/restraint features shown for reference only.

j. Hazardous: see AMC 25.1309 k. In - flight: that part of aeroplane operation beginning when the wheels are no longer in contact with the ground during the take - off and ending when the wheels again contact the ground during landing.

Powered by EASA eRules Page 601 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL l. Light Crosswind: For purposes of this AMC, a light crosswind is a 19 km/h (10 Kt). wind at right angles to the direction of take - off or landing which is assumed to occur on every flight.

m. Light Turbulence: Turbulence that momentarily causes slight, erra tic changes in altitude and/or attitude (pitch, roll, and/or yaw), which is assumed to occur on every flight.

n. Major: see AMC 25.1309 o. Maximum exposure time: The longest anticipated period between the occurrence and elimination of the failure.

p. Norm al Flight Envelope: An established boundary of parameters (velocity, altitude, angle of attack, attitude) associated with the practical and routine operation of a specific aeroplane that is likely to be encountered on a typical flight and in combination w ith prescribed conditions of light turbulence and light crosswind.

q. Pre - existing failure: Failure that can be present for more than one flight.

r. Thrust Reversal: A movement of all or part of the thrust reverser from the forward thrust position to a pos ition that spoils or redirects the engine airflow.

s. Thrust Reverser System: Those components that spoil or redirect the engine thrust to decelerate the aeroplane. The components include: — the engine - mounted hardware, — the reverser control system, — indication and actuation systems, and — any other aeroplane systems that have an effect on the thrust reverser operation.

t. Turbojet thrust reversing system: Any device that redirects the airflow momentum from a turbojet engin e so as to create reverse thrust. Systems may include: — cascade - type reversers, — target or clamshell - type reversers, — pivoted - door petal - type reversers, — deflectors articulated off either the engine cowling or aeroplane structure, — targetable thrust nozzle s, or — a propulsive fan stage with reversing pitch.

u. Turbojet (or turbofan): A gas turbine engine in which propulsive thrust is developed by the reaction of gases being directed through a nozzle.

6. DEMONSTRATING COMPLIANCE WITH CS 25.933(a) .

The following Sections 7 through 10 of this AMC provide guidance on specific aspects of compliance with CS 25.933(a) , according to four different means or methods: — Contro llability (Section 7), — Reliability (Section 8), — Mixed controllability / reliability (Section 9), — Deactivated reverser (Section 10).

Powered by EASA eRules Page 602 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL 7. «CONTROLLABILITY OPTION»: PROVIDE CONTINUED SAFE FLIGHT AND LANDING FOLLOWING ANY IN - FLIGHT THRUST REVERSAL .

The followin g paragraphs provide guidance regarding an acceptable means of demonstrating compliance with CS 25.933(a)(1) .

7.a. General. For compliance to be established with CS 25.933(a) by demonstrating that the aeroplane is capable of continued safe flight and landing following any in - flight thrust reversal (the «controllability option» provided for under CS 25.933(a)(1) ), the aspects of structural integrity, performance, and handling qualities must be taken into account. Th e level of accountability should be appropriate to the probability of in - flight thrust reversal, in accordance with the following sections.

To identify the corresponding failure conditions and determine the probability of their occurrence, a safety analysi s should be carried out, using the method ology described in CS 25.1309 . The reliability of design features, such as auto - idle and automatic control configurations critical to meeting the following controllability criteria, also should be considered in the safety analysis.

Appropriate alerts and/or other indications should be provided to the crew, as required by CS 25.1309(c) (Ref. AMC 25.1309 ).

The inhibition of alerts relating to the thrust reverser system during critical phases of flight should be evaluat ed in relation to the total effect on flight safety (Ref. AMC 25.1309 ).

Thrust reversal of a cyclic or erratic nature (e.g., repeated deploy/stow movement of the thrust reverser) should be considered in the safety analysis and in the design of the alerting /indication systems.

Input from the flight crew and human factors specialists should be considered in the design of the alerting and/or indication provisions.

The controllability compliance analysis should include the relevant thrust reversal scenario that could be induced by a rotorburst event.

When demonstrating compliance using this «controllability option» approach, if the aeroplane might experience an in - flight thrust reversal outside the «controllable flight envelope» anytime during the e ntire operational life of all aeroplanes of this type, then further compliance considerations as described in Section 9 («MIXED CONTROLLABILITY / RELIABILITY OPTION») of this AMC, below, should be taken into account.

7.b. Structural Integrity. For the «con trollability option,» the aeroplane must be capable of successfully completing a flight during which an unwanted in - flight thrust reversal occurs.

An assessment of the integrity of the aeroplane structure is necessary, including an assessment of the struct ure of the deployed thrust reverser and its attachments to the aeroplane.

In conducting this assessment, the normal structural loads, as well as those induced by failures and forced vibration (including buffeting), both at the time of the event and for co ntinuation of the flight, must be shown to be within the structural capability of the aeroplane.

At the time of occurrence, starting from 1 - g level flight conditions, at speeds up to V C , a realistic scenario, including pilot corrective actions, should be established to determine the loads occurring at the time of the event and during the recovery manoeuvre. The aeroplane should be able to withstand these loads multiplied by an appropriate factor of Powered by EASA eRules Page 603 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL safety that is related to the probability of unwanted in - f light thrust reversal. The factor of safety is defined in Figure 2, below. Conditions with high lift devices deployed also should be considered at speeds up to the appropriate flap limitation speed.

Figure 2: Factor of safety at the time of occurrence For continuation of the flight following in - flight thrust reversal, considering any appropriate reconfiguration and flight limitations, the following apply: 7.b.(1) Static strength should be determined for loads derived from the following conditions at spe eds up to V , or the speed limitation prescribed for the remainder C of the flight: (i) 70% of the limit flight manoeuvre loads; and separately (ii) the discrete gust conditions specified in CS 25.341(a) (but using 40% of the gust velocities specified for V ).

C 7.b.(2) For the aeroplane with high lift devices deployed, static strength should be determined for loads derived from the following conditions at speeds up the appropriate flap design speed, or any lower flap speed limitation prescribed for the remainder of the flight: (i) A balanced manoeuvre at a positive limit load factor of 1.4; and separately (ii) the discrete gust conditions specified in CS 25.345(a)(2) (but using 40% of the gust velocities specified).

7.b.(3) For static strength substantiation, each part of the structure must be able to withstand the loads specified in sub - paragraph 7.b.(1) and 7.b.(2) of this paragraph, multiplied by a factor of safety depending on the probability of being in this fail ure state. The factor of safety is defined in Figure 3, below.

Powered by EASA eRules Page 604 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL Figure 3: Factor of safety for continuation of flight Qj = is the probability of being in the configuration with the unwanted in - flight thrust reversal Qj = (Tj)(Pj) where: Tj = average time spent with unwanted in - flight thrust reversal (in hours) Pj = probability of occurrence of unwanted in - flight thrust reversal (per hour) If the thrust reverser system is capable of being restowed following a thrust reversal, only those loads associated with t he interval of thrust reversal need to be considered. Historically, thrust reversers have often been damaged as a result of unwanted thrust reversal during flight. Consequently, any c laim that the thrust reverser is capable of being restowed must be adequately substantiated, taking into account this adverse service history.

7.c. Performance 7.c.(1) General Considerations: Most failure conditions that have an effect on performance are a dequately accounted for by the requirements addressing a «regular» engine failure (i.e., involving only loss of thrust and not expe riencing any reverser anomaly). This is unlikely to be the case for failures involving an unwanted in - flight thrust reversal, which can be expected to have a more adverse impact on thrust and drag than a regular engine failure. Such unwanted in - flight thrust reversals, therefore, should be accounted for specifically, to a level commensurate with their probability of occurrence.

The performance accountability that should be provided is defined in Sections 7.c.(2) and 7.c.(3) as a function of the probability of the unwa nted in - flight thrust reversal. Obviously, for unwanted in - flight thrust reversals less probable than - 9 1x10 /fh, certification may be based on reliability alone, as described in Section 8 («REL IABILITY OPTION») of this AMC. Furthermore, for any failure conditions where unwanted in - flight thrust reversal would impact safety, the aeroplane must meet the safety/reliabi lity criteria delineated in CS 25.1309 .

Powered by EASA eRules Page 605 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL - 7 7.c.(2) Probability of unwanted in - flight thrust reversal greater than 1x10 /fh: Full performance accountability must be provided for the more critical of a regular engine failure and an unwanted in - flight thrust reversal.

To determine if the unwanted in - flight thrust reversal is more critical than a regular engine failure, the normal application of the performance requirements described in CS - 25, Subpart B, as well as the applicable operating requ irements, should be compared to the application of the following criteria, which replace the accountability for a critical engine failure with that of a critical unwanted in - flight thrust reversal: — CS 25.111 , «Take - off path»: The takeoff path should be determined with the critical unwanted thrust reversal occurring at V instead of the c ritical LOF engine failure at V . No change to the state of the engine with the thrust EF reversal that requires action by the pilot ma y be made until the aircraft is 122 m (400 ft) above the takeoff surface.

— CS 25.121 , «Climb: one - engine - inoperative»: Compliance with the one - engine - inoperative climb gradients should be shown with the critical unw anted in - flight thrust reversal rather than the critical engine inoperative.

— CS 25.123 , «En - route flight p aths»: The en - route flight paths should be determined following occurrence of the critical unwanted in - fligh t thrust reversal(s) instead of the critical engine failure(s), and allowing for the execution of appropriate crew procedures. For compliance with the applicable operating rules, an unwanted in - flight thrust reversal(s) at the most critical point en - route should be substituted for the engine failure at the most critical point en - route.

Performance data determined in accordance with these provisions, where critical, should be furnished in the Aeroplane Flight Manual as operating limitations.

Operational data and advisory data related to fuel consumption and range should be provided for the critical unwanted in - flight thrust reversal to assist the crew in decision making. These data may be supplied as simple factors or additives to apply to normal all - engines - operating fuel consumption and range data. For approvals to conduct extended range operations with two - engine aeroplanes (ETOPS), the critical unwanted in - flight thrust reversal should be considered in the critical fuel scenario (paragraph 10d(4)(iii ) of Information Leaflet no. 20 : ETOPS).

In addition to requiring full performance accountability as it relates to the specific aeroplane performance requirements of Subpart B, all other aspects of the aeroplane’s performance following a non - restowable in - flig ht thrust reversal (e.g.

capability to climb and maintain 305m (1000 feet) AGL) must be found adequate to comply with the intent of CS 25.933(a)(1)(ii) .

- 7 7.c.(3) Probability of unwanted in - flight thrust reversal equal to or less than 1x10 /fh, but - 9 greater than 1x10 /fh: With the exception of the takeoff phase of flight, which needs not account for unwanted in - flight thrust reversal, the same criteria should be applied as in Section 7.c.(2), above, for the purposes of providing advisory data and procedures to the flight crew. Such performance data, however, need not be applie d as operating limitations. The takeoff data addressed by Section 7.c.(2), above (takeoff speeds, if limited by V , takeoff path, and takeoff climb gradients), MC does not need to be provided, as it would be of only limited usefulness if not applied as a dispatch limitation.

Powered by EASA eRules Page 606 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL However, the takeoff data should be determined and applied as operating limitations if the unwanted in - flight thrust reversal during the take - off phase is the resu lt of a single failure.

As part of this assessment, the effect of an unwanted in - flight thrust reversal on approach climb performance, and the ability to execute a go - around manoeuvre should be determined and used to specify crew procedures for an approach and landing following a thrust reversal. For example, the procedures may specify the use of a flap setting less than that specified for landing, or an airspeed greater than the stabilised final approach airspeed, until the flight crew is satisfied that a landing is assured and a go - around capability need no longer be maintaine d. Allowance may be assumed for execution of appropriate crew procedures subsequent to the unwanted thrust reversal having occurred. Where a number of thrust reversal states may occu r, these procedures for approach and landing may, at the option of the applicant, be determined either for the critical thrust reversal state or for each thrust reversal state that is clearly distinguishable by the flight crew.

Operational data and advice related to fuel consumption and range should be provided for the critical unwanted in - flight thrust reversal to assis t the crew in decision - making. These data may be supplied as simple factors or additives to apply to normal all - engines - operating fuel cons umption and range data.

The aeroplane performance capabilities following a non - restowable in - flight thrust reversal must be such that the probability of preventing continued safe flight (e.g.

capability to climb and maintain 305m (1000 feet) AGL) and landi ng at an airport (i.e. either destination or diversion) is extremely improbable.

7 .d. Handling Qualities - 7 7.d.(1) Probability of unwanted in - flight thrust reversal greater than 1x10 /fh: The more critical of an engine failure (or flight with engine(s) ino perative), and an unwanted in - flight thrust reversal, should be used to show compliance with the controllability and trim req uirements of CS - 25, Subpart B. In addition, the criteria defined in Section 7.d.(2), below, also should be applied. To determine if the unwanted in - flight thrust reversal is more critical than an engine failure, the normal application of the CS - 25, Subpart B, controllability and trim requirements should be compared to the application of the following criteria, which replace the accoun tability for a critical engine failure with that of a critical unwanted in - flight thrust reversal: — CS 25.143 , «Controllability and Manoeuvrability - General» : the effect of a sudden unwanted in - flight thrust revers al of the critical engine, rather than the sudden failure of the critical engine, should be evaluated in accordance with CS 25.143 (b)(1) and the associated guidance material.

Control forces associated with the failure should comply with CS 25.143 (c) .

— CS 25.147 , «Directional and lateral co ntrol»: the requirements of CS 25.147(a), (b), (c), and (d) should be complied with following critical unwanted in - flight thrust reversal(s) rather than with one or more engines inoperative.

— CS 25.149 , «Minimum control speed» : the values of V and V should be MC MCL determined with a sudden unwanted in - flight thrust reversal of the critical eng ine rather than a sudden failure of the critical engine.

Powered by EASA eRules Page 607 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL — CS 25.161 , «Trim» the trim requirements of CS 25.161(d) and (e) should be complied with following critical unwanted in - flight thrust reversal(s), rather than with one or more engines inoperative.

Compliance with these requirements should be demonstrated by flight test.

Simulation or analysis will not normally be an acceptable means of compliance for such probab le failures.

- 7 7.d.(2) Probability of unwanted thrust reversal equal to or less than 1x10 /fh, but greater - 9 - 7 than 1x10 /fh: failure conditions with a probability equal to or less than 1x10 /fh are not normally evaluated against the specific controllability and trim re quirements of CS - 25, Subpart B. Instead, the effects of unwanted in - flight thrust reversal should be evaluated on the basis of maintaining the capability for continued safe flight and landing, taking into account pilot recognition and reaction t ime. One exception is that the minimum control speed requirement of CS 25.149 should be evaluated to the extent necessary to support the performance criteria specified in Section 7.c.(3), above, related to approach , landing, and go - around.

Recognition of the failure may be through the behaviour of the aircraft or an appropriate failure alerting system, and the recognition time should not be less than one second. Following recognition, additional pilot reaction time s should be taken into account, prior to any corrective pilot actions, as follows: — Landing: no additional delay — Approach: 1 second — Climb, cruise, and descent: 3 seconds; except when in auto - pilot engaged manoeuvring flight, or in manual flight, when 1 second should apply.

Both auto - pilot engaged and manual flight should be considered.

The unwanted in - flight thrust reversal should not result in any of the following: — exceedance of an airspeed halfway between V and V , or Mach Number MO DF halfway between M and M MO DF — a stall — a normal acceleration less than a value of 0g — bank angles of more than 60° en - route, or more than 30° below a height of 305m (1000 ft) — degradation of flying qualities assessed as greater than Major for unwanted - 7 in - flight thrust reversal mo re probable than 1x10 /fh; or assessed as greater - 7 than Hazardous for failures with a probability equal to or less than 1x10 /fh, - 9 but greater 1x10 /fh — the roll control forces specified in CS 25.143 (c) , except that the long term roll control force should not exceed 10 lb — structural loads in excess of those specified in Section 7.b., above.

Demonstrations of compliance may be by flight test, by simulation, or by analysis suitably validated by flight test or other data.

- 9 7.d.(3) Probability of in - flight thrus t reversal less than 1x10 /fh: Certification can be based on reliability alone as described in Section 8, below.

Powered by EASA eRules Page 608 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL 8. ‘ RELIABILITY OPTION ’ : PROVIDE CONTINUED SAFE FLIGHT AND LANDING BY PREVENTING ANY IN - FLIGHT THRUST REVERSAL The following paragraphs provid e guidance regarding an acceptable means of demonstrating compliance with CS 25.933(a)(1)(ii) .

8.a. General. For compliance to be established with CS 25.933(a) by demonstrating that unwanted in - flight thrust reversal is not anticipated to occur (the «relia bility option» provided for under CS 25.933(a)(1)(ii) ), the aspects of system reliability, maintainability, a nd fault tolerance; structural integrity; and protection against zonal threats such as uncontained engine rotor failure or fire must be taken into account.

8.b. S ystem Safety Assessment (SSA): Any demonstration of compliance should include an assessment of the thrust reverser control, indication and actuation system(s), including all interfacing power - plant and aeroplane systems (such as electri cal supply, hydraulic supply, flight/ground status signals, thrust lever position signals, etc.) and maintenance.

The reliability assessment should include: — the possible modes of normal operation and of failure; — the resulting effect on the aeroplane consi dering the phase of flight and operating conditions; — the crew awareness of the failure conditions and the corrective action required; — failure detection capabilities and maintenance procedures, etc.; and — the likelihood of the failure c ondition.

Consideration should be given to failure conditions being accompanied or caused by external events or errors.

The SSA should be used to identify critical failure paths for the purpose of conducting in - depth validation of their supporting failure mode, failure rates, exposure time, reliance on redundant subsystems, and assumptions, if any. In addition, the SSA can be used to determine acceptable ti me intervals for any required maintenance intervals (ref. AMC 25.1309 and AMC 25.19).

The primary intent of this approach to compliance is to improve safety by promoting more reliable designs and better maintenance, including minimising pre - existing faults .

Latent failures involved in unwanted in - flight thrust reversal should be avoided whenever practical. The design configurations in paragraphs 8.b.(2) and 8.b.(3) have traditionally been considered to be practical and considered to be acceptable to EASA.

8 .b.(1) The thrust reverser system should be designed so that any in - flight thrust reversal that is not shown to be controllable in accordance with Section 7,above, is extremely improbable (i.e., average probability per hour of flight of the order of - 9 1x10 /fh. or less) and does not result from a single failure or malfunction. And 8.b.(2) For configurations in which combinations of two - failure situations (ref. Section 5, above) result in in - flight thrust reversal, the following apply: Neither failure may b e pre - existing (i.e., neither failure situation can be undetected or exist for more than one flight); the means of failure detection must be appropriate in consideration of the monitoring device reliability, inspection intervals, and procedures.

Powered by EASA eRules Page 609 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL The occurr ence of either failure should result in appropriate cockpit indication or be self - evident to the crew to enable the crew to take necessary actions such as discontinuing a take - off, going to a controllable flight envelope en - route, diverting to a suitable a irport, or reconfiguring the system in order to recover single failure tolerance, etc. And 8.b.(3) For configurations in which combinations of three or more failure situations result in in - flight thrust reversal, the following applies: In order to limit the exposure to pre - existing failure situations, the maximum time each pre - existing failure situation is expected to be present should be related to the frequency with which the failure situation is anticipated to occur, such that - 3 their product is 1×10 o r less.

The time each failure situation is expected to be present should take into account the expected delays in detection, isolation, and repair of the causal failures.

8 .c. Structural Aspects: For the «reliability option,» those structural load paths t hat affect thrust reversal should be shown to comply with the static strength, fatigue, damage tolerance, and defo rmation requirements of CS - 25. This will ensure that unwanted in - flight thrust reversal is not anticipated to occur due to failure of a struct ural load path, or due to loss of retention under ultimate load throughout the operational life of the aeroplane.

8 .d. Uncontained Rotor Failure: In case of rotor failure, compliance with CS 25.903(d)(1) should be shown, using advisory materials (AC, user manual, etc.) supplemented b y the methods described below. The effects of associated loads and vibration on the reverser system should be considered in all of the following methods of minimising hazards: 8.d.(1) Show that engine spool - down characteristics or potential reverser damage are such that compliance with Section 7, above, can be shown.

8.d.(2) Show that forces that keep the thrust reverser in stable stowed position during and after the rotor burst event are adequate.

8.d.(3) Locate the thrust reverser outside the rotor burst zone.

8.d.(4) Protection of thrust reverser restraint devices: The following guidance material describes methods of minimising the hazard to thrust reverser stow position restr aint devices lo cated within rotorburst zones. The following guidance material has been developed on the basis of all of the data available to date and engineering judgement.

8.d.(4)(i) Fragment Hazard Model: (A) Large Fragments — Ring Disks (see Figure 4. a.) - Compressor drum rotors or spools with ring disks have typically failed in a rim peeling mode when failure origins are in the rim area. This type of failure typically produces uncontained fragment energies, which are mitigated by a single layer of co nventional aluminium honeycomb structure. (Note: This guidance material is based upon field experience and, as such, its application should be limited to aluminium sheet and honeycomb fan reverser construction.

Typical construction consists of 12.7 mm (a half inch) thickness of .003 - .004” aluminium foil honeycomb with .030" thick Powered by EASA eRules Page 610 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL aluminium facing sheets. Alternative materials and methods of construction should have at least equivalent impact energy absorption characteristics). Failures with the origins in the bore of these same drum sections have resulted in fragments which can be characterised as a single 1/3 disk fragment and multiple smaller fragments. The 1/3 disk fragment may or may not be contained by the thrust reverser structure. The remaining int ermediate and small disk fragments, while escaping the engine case, have been contained by the thrust reverser structure.

— Deep Bore Disks (see Figure 4.b.) and Single Disks (see Figure 4.c.) - For compressor drum rotors or spools with deep bore disks, and single compressor and turbine disks, the experience, while limited, indicates either a 1/3 and a 2/3 fragment, or a 1/3 fragment and multiple intermediate and small discrete f ragments should be considered. These fragments can be randomly released within an impact ar ea that ranges * 5 degrees from the plane of rotation.

(B) Small Fragments (Debris) Consider small fragments (reference AMC 20 - 128A, paragraph 9.d.)

that could impact the thrust reverser at * 15 degrees axial spread angle.

8 .d.(4)(ii) Minimisation: Minimisation guidance provided below is for fragments from axial flow rotors surrounded by fan flow thrust reversers located over the intermediate or high - pressure core rotors.

NOTE: See attached Figure 5: Typical High Bypass Turbofan Low an d High Pressure Compressor with Fan Thrust Reverser Cross Section (A) Large Fragments For the large fragments defined in Section 8.d.(4)(i)(A), above, the thrust reverser retention systems should be redundant and separated as follows: — Ring Disks Compress or Spools: Retention systems located in the outer barrel section of the thrust reverser should be separated circumferentially (circumferential distance greater than the 1/3 disk fragment model as described in AMC20 128A) or axially (outside the * 5 degree impact area) so that a 1/3 disk segment can not damage all redundant retention elements and allow thrust reversal (i.e., deployment of a door or tran slating reverser sleeve half).

Retention systems located between the inner fan flow path wall and the engin e casing should be located axially outside the + 5 degree impact area.

— Deep - bore Disk Spools and Single Disks: Powered by EASA eRules Page 611 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL Retention systems should be separated axially with at least one retention element located outside the * 5 degree impact area.

(B) Small Fragmen ts For the small fragments defined in Section 8.d.(4)(i)(B), above, thrust reverser retention systems should be provided with either: — At least one retention element shielded in accordance with AMC 20 - 128A, paragraph 7(c), or capable of maintaining its re tention capabilities after impact; or — One retention element located outside the * 15 degree impact area.

9. «MIXED CONTROLLABILITY / RELIABILITY» OPTION .

If the aeroplane might experience an unwanted in - flight thrust reversal outside the «controllable flig ht envelope» anytime during the entire operational life of all aeroplanes of this type, then outside the controllable envelope reliability compliance must be shown, taking into account associated risk exposure time and the other considerations described in Section 8, above.

Conversely, if reliability compliance is selected to be shown within a given limited flight envelope with associated risk exposure time, then outside this envelope controllability must be demonstrated taking into account the consideratio ns described in Section 7, above.

Mixed controllability/reliability compliance should be shown in accordance with guidance developed in Sections 7 and 8, above, respectively.

10. DEACTIVATED REVERSER .

The thrust reverser system deactivation design should f ollow the same «fail - safe» principles as the actuation system design, insofar as failure and systems/hardware integrity. The effects of thrust reverser system deactivation on other aeroplane systems, and on the new configuration of the thrust reverser sys tem itself, should be evaluated according to Section 8.a., above. The location and load capability of the mechanical lock - out system (thrust reverser structure and lock - out device) should be evaluated according to Sections 8.b. and 8.d., above. The evaluat ion should show that the level of safety associated with the deactivated thrust reverser system is equivalent to or better than that associated with the active system.

11. CS 25.933(b) COMPLIANCE .

For thrust reversing systems intended for in - flight use, compliance with CS 25.933(b) may be shown for unwanted in - flight thrust reversal, as appropriate, using the methods specified in Sections 7 through 10, above.

12. CONTINUED AIRWORTHINESS .

12.a. Manufacturing/Quality: Due to the criticality of the thrust reverser, manufacturing and quality assurance processes should be assessed and implemented, as appropriate, to ensure the design integrity of the critical components.

12.b. Reliability Monitoring : An appropriate system should be implemented for the purpose of periodic monitoring and reporting of in - service reliability performance. The system should also include reporting of in - service concerns related to design, quality, or maintenance that have the potential of affecting the reliability of the thrust reverser.

Powered by EASA eRules Page 612 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPL ANT (CS - 25) GENERAL 12.c. Maintenance and Alterations: The following material provides guidance for maintenance designs and activity to assist in demonstrating compliance with Sections 7 through 10, above (a lso reference CS 25.901(b)(2) and CS 25.1529/Appendix H ). The criticality of the thrust reverser and its control system requires that maintenance and maintainability be emphasised in the design process and derivat ion of the maintenance control program, as well as subsequent field maintenance, repairs, or alterations.

12.c.(1) Design: Design aspects for providing adequate maintainability should address : 12.c.(1)(i) Ease of maintenance. The following items should be taken into consideration: — It should be possible to operate the thrust reverser for ground testing/trouble shooting without the engine operating.

— Lock - out procedures (deactivation for flight) of the thrust reverser system should be simple, and clearly desc ribed in the maintenance manual. Additionally, a placard describing the procedure may be installed in a conspicuous place on the nacelle.

— Provisions should be made in system design to allow easy and safe access to the components for fault isolation, replac ement, inspection, lubrication, etc. This is particularly important where inspections are required to detect latent failures. Providing safe access should include consideration of risks both to the mechanic and to any critical design elements that might b e inadvertently damaged during maintenance.

— Provisions should be provided for easy rigging of the thrust reverser and adjustment of latches, switches, actuators, etc.

12.c.(1)(ii) Fault identification and elimination: — System design should allow simple, acc urate fault isolation and repair.

— System design personnel should be actively involved in the development, documentation, and validation of the troubleshooting/fault isolation manual and o ther maintenance publications. The systems design personnel should ve rify that maintenance assumptions critical to any SSA conclusion are supported by these publications (e.g., perform fault insertion testing to verify that the published means of detecting, isolating, and eliminating the fault are effective).

— Thrust reverse r unstowed and unlocked indications should be easily discernible during pre - flight inspections.

— If the aeroplane has onboard maintenance monitoring and recording systems, the system should have provisions for storing all fault indications. This would be of significant help to maintenance personnel in locating the source of intermittent faults.

12.c.(1)(iii) Minimisation of errors: Minimisation of errors during maintenance activity should be addressed during the design process. Examples include physical desi gn features, installation orientation markings, dissimilar connections, etc. The use of a formal «lessons learned» - based review early and often during design development may help avoid repeating previous errors.

Powered by EASA eRules Page 613 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL 12.c.(1)(iv) System Reliability: The design process should, where appropriate, use previous field reliability data for specific and similar components to ensure system design reliability.

12.c.(2) Maintenance Control: 12.c.(2)(i) Maintenance Program: The development of the initial maintenance plan for the aeroplane, including the thrust reverser, should consider, as necessary, the following: — Involvement of the manufacturers of the aeroplane, engine, and thrust reverser.

— The compatibility of the SSA information and the Maintenance Review Board Report, Maintenance Planning Document, Master Minimum Equipment List, etc. (ref AMC 25.19 ).

— Identification by the manufacturer of all mainte nance tasks critical to continued safe flight. The operator should consider these tasks when identifying and documenting Required Inspection Items.

— The complexity of lock - out procedures and appropriate verification.

— Appropriate tests, including an operati onal tests, of the thrust reverser to verify correct system operation after the performance of any procedure that would require removal, installation, or adjustment of a component; or disconnection of a tube, hose, or electrical harness of the entire thrus t reverser actuation control system.

12.c.(2)(ii) Training: The following considerations should be taken into account when developing training documentation: — The reason and the significance of accomplishing critical tasks as prescribed. This would clarify why a particular task needs to be performed in a certain manner.

— Instructions or references as to what to do if the results of a check or operational test do not agree with those given in the Aerop lane Maintenance Manual (AMM). The manual should recommend some corrective action if a system fails a test or check. This would help ensure that the critical components are not overlooked in the trouble shooting process.

— Emphasis on the total system train ing by a single training source (prefer ably the aeroplane manufacturer ) to preclude fragmented information without a clear system understanding. This training concept should be used in the initial training and subsequent retraining.

— Inclusion of fault iso lation and troubleshooting using the material furnished for the respective manuals.

— Evaluation of the training materials to assure consistency between the training material and the maintenance and troubleshooting manuals.

Powered by EASA eRules Page 614 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL 12.c.(2)( iii) Repairs and Alter ations: The Instructions for Continued Airworthiness essential to ensure that subsequent repairs or alterations do not unintentionally violate the integrity of the original thrust reverser system type design approval should be provided by the o riginal airf rame manufacturer. Additionally, the original airframe manufacturer should define a method of ensuring that this essential information will be evident to those that may perform and approve such repairs and alterations. One example would be maintaining the wire separation between relevant thrust revers er control electrical circuits. This sensitivity could be communicated by statements in appropriate manuals such as the Wiring Diagram Manual, and by decals or placards placed on visible areas of the thrust re verser and/or aeroplane structure.

12.c.(2)(iv) F eedback of Service Experience: The maintenance process should initiate the feedback of service experience that will allow the monitoring of system reliability performance and improvements in system design an d maintenance practices. Additionally, this service experience should be used to assure the most current and effective formal «lessons learned» design review process possible.

(A) Reliability Performance: (Operators and Manufacturers should collaborate o n these items:) — Accurate reporting of functional discrepancies.

— Service investigation of hardware by manufacturer to confirm and determine failure modes and corrective actions if required.

— Update of failure rate data. (This will require co - ordination betwe en the manufacturers and airlines.)

(B) Improvements suggested by maintenance experience: (This will provide data to effectively update these items:) — Manuals — Troubleshooting — Removal/replacement procedures.

12.c.(2)(v) Publications/Procedures: The followin g considerations should be addressed in the preparation and revisions of the publications and procedures to support the thrust reverser in the field in conjunction with CS 25.901(b)(2) and CS 25.1529(Appendix H) .

(A) Documentation should be provided that describes a rigging check, if required after adjustment of any thrust reverser actuator drive system component.

(B) Documentation should be provided t hat describes powered cycling of the thrust reverser to verify system integrity whenever maintenance is performed. This could also apply to any manual actuation of the reverser.

(C) The reasons and the significance of accomplishing critical tasks should b e included in the AMM.

Powered by EASA eRules Page 615 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL (D) The AMM should include instructions or references as to what to do if the results of a check or operational test do not agree with those given in the AMM.

(E) Provisions should be made to address inefficiencies and errors in the publications: — Identified in the validation process of both critical and troubleshooting procedures.

— Input from field.

— Operators conferences.

(F) Development of the publications should be a co - ordinated effort between the thrust reverser, engine, aeroplane manufacturers and airline customers especially in the areas of: — AMM — Troubleshooting — Fault isolation — Maintenance data computer output — Procedure Validation — Master Minimum Equipment List (G) Initial issue of the publication should include the requir ed serviceable limits for the complete thrust reverser system.

1 3. FLIGHT CREW TRAINING .

In the case of compliance with the «controllability option,» and when the nature of the in - flight thrust reversal is judged as unusual (compared to expected consequenc es on the aeroplane of other failures, both basic and recurrent), flight crew training should be considered on a training simulator representative of the aeroplane, that is equipped with thrust reverser in - flight modelisation to avoid flight crew misunders tandings: 13.a. Transient manoeuvre: Recovery from the unwanted in - flight thrust reversal.

13.b Continued flight and landing: Manoeuvring appropriate to the recommended procedure (included trim and unattended operation) and precision tracking (ILS guide s lope tracking, speed/altitude tracking, etc.).

Powered by EASA eRules Page 616 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL Figure 4 - Generic Disk and Rotor terminology used in interim thrust reverser guidance material for minimizing the hazard from engine rotor burst Powered by EASA eRules Page 617 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL Powered by EASA eRules Page 618 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL [Amdt No: 25/1] [Amdt No: 25/24]

CS 25.934 Turbo - jet engine thrust reverser system tests

ED Decision 2003/2/RM Thrust reversers installed on turbo - jet engines m ust meet the requirements of CS - E 890.

CS 25.937 Turbo - propeller - drag limiting systems

ED Decision 2003/2/RM Turbo - propeller powered aer oplane propeller - drag limiting systems must be designed so that no single failure or malfunction of any of the systems during normal or emergency operation results in propeller drag in excess of that for which the aeroplane was designed under CS 25.367 . Failure of structural elements of the drag limiting systems need not be considered if the probability of this kind of failure is extremely remote.

CS 25.939 Turbine engine operating characteristics

ED Decision 2003/ 2/RM (See AMC 25.939 ) (a) Turbine engine operating characteristics must be investigated in flight to determine that no adverse characteristics (such as stall, surge, or flame - out) are present, to a h azardous degree, during normal and emergency operation within the range of operation limitations of the aeroplane and of the engine. (See AMC 25.939(a) .)

(b) Reserved.

(c) The turbine engine air inlet system may n ot, as a result of air flow distortion during normal operation, cause vibration harmful to the engine. (See AMC 25.939(c) .)

AMC 25.939(a) Turbine engine operating characteristics

ED Decision 2003/ 2/RM The wording ‘in flight’ should be interpreted to cover all operating conditions from engine start until shut - down.

AMC 25.939(c) Turbine engine operating characteristics

ED Decision 2003/ 2/RM 1 The investigation should cover the complete range, for which certificatio n is required, of aeroplane speeds, attitudes, altitudes and engine operating conditions including reverse thrust, and of steady and transient conditions on the ground and in flight, including crosswinds, rotation, yaw and stall. Non - critical conditions of operation which need not be considered should be agreed with the Agency.

2 If the airflow conditions at the engine air intake can be affected by the operating conditions of an adjacent engine, the investigation should include an exploration of the effect s of running the adjacent engine at the same and at different conditions over the whole range of engine operating conditions, including reverse thrust. An investigation of the effect of malfunctioning of an adjacent engine should also be included.

Powered by EASA eRules Page 619 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL 3 Compl iance with the requirement may include any suitable one or combination of the following methods; as agreed with the Agency.

a. Demonstration that the variations in engine inlet airflow distortion over the range defined in 1 are within the limits establish ed for the particular engine type.

b. An investigation of blade vibration characteristics by the method a nd of the scope indicated in CS - E 650 and AMC E 650 (except that Maximum Take - off rpm need not be exceeded) carried out on – i A representative inst allation on the ground using test equipment where the actual conditions of operation in the aeroplane are reproduced, or ii A representative aeroplane on the ground and in flight as appropriate to the conditions being investigated.

c. The completion of sufficient flying with representative installations prior to certification such as to demonstrate that the vibration levels ar e satisfactory.

d. Any other method acceptable to the Agency.

AMC 25.939 Turbine engine operating characteristics

ED Decision 2003/2/RM FAA Advisory Circular 25.939 - 1 Evaluating Turbine Engine Operating Characteristics, date 19/03/86, is accepted by the Agency as providing acceptable means of compliance with CS 25.939 .

CS 25.941 Inlet, engine, and exhaust compatibility

ED Decision 200 7 / 010 /R For aeroplanes using variable inlet or exhaust system geometry, or both – (a) The system comprised of the inlet, engine (including thrust augmentation systems, if incorporated), and exhaust must be shown to f unction properly under all operating conditions for which approval is sought, including all engine rotating speeds and power settings, and engine inlet and exhaust configurations; (b) The dynamic effects of the operation of these (including consideration o f probable malfunctions) upon the aerodynamic control of the aeroplane may not result in any condition that would require exceptional skill, alertness, or strength on the part of the pilot to avoid exceeding an operational or structural limitation of the a eroplane; and (c) In showing compliance with sub - paragraph (b) of this paragraph, the pilot strength required may not exceed the limits set forth in CS 25.1 43(d ) subject to the condition s set forth in sub - paragraph s (e ) and ( f ) of CS 25.143.

[Amdt 25/3]

CS 25.943 Negative acceleration

ED Decision 2003/2/RM No hazardous malfunction of an engine or any component or system associated with the powerplant may occur when the aeroplane is operated at the negative accelerations within the flight envelopes prescribed in CS 25 .333 . This must be shown for the greatest duration expected for the acceleration.

(See also CS 25.1315 .)

Powered by EASA eRules Page 620 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) GENERAL

CS 25.945 Thrust or power augmentation system

ED Decision 2003/ 2/RM (a) General . Each fluid injection syste m must provide a flow of fluid at the rate and pressure established for proper engine functioning under each intended operating condition. If the fluid can freeze, fluid freezing may not damage the aeroplane or adversely affect aeroplane performance.

(b) Fluid tanks. Each augmentation system fluid tank must meet the following requirements: (1) Each tank must be able to withstand without failure the vibration, inertia, fluid, and structural loads that it may be subjected to in operation.

(2) The tanks as m ounted in the aeroplane must be able to withstand without failure or leakage an internal pressure 1·5 times the maximum operating pressure.

(3) If a vent is provided, the venting must be effective under all normal flight conditions.

(4) Reserved.

(5) Each tank must have an expansion space of not less than 2% of the tank capacity. It must be impossible to fill the expansion space inadvertently with the aeroplane in the normal ground attitude.

(c) Augmentation system drains must be designed and located in acc ordance with CS 25.1455 if – (1) The augmentation system fluid is subject to freezing; and (2) The fluid may be drained in flight or during ground operation.

(d) The augmentation liquid tank capacity available for the use of each engine must be large enough to allow operation of the aeroplane under the approved procedures for the use of liquidaugmented power. The computation of liquid consumption must be based on the maximum approved rate appropriate f or the desired engine output and must include the effect of temperature on engine performance as well as any other factors that might vary the amount of liquid required.

Powered by EASA eRules Page 621 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPA RT E – POWERPLANT (CS - 25) FUEL SYSTEM

FUEL SYSTEM

CS 25.951 General

ED Decision 2013 / 010 /R (a) Each fuel system must be constructed and arranged to ensure a flow of fuel at a rate and pressure established for proper engine functioning under each likely operating condition, including any manoeuvre for which certification is requested and during which the engine is permitted to be in operation.

(b) Each fuel system must be arranged so that any air which is introduced into the system will not result in – (1) Reserved.

(2) Flameout.

(c) Each fuel system must be capable of sustained operation throughout its flow and pressure ran ge with fuel initial ly saturated with water at 26. 7 ° C (80 ° F) and having 0.20 cm of free water per litre ( 0.75 cm per US gallon) added and cooled to the most critical condition for icing likely to be encountered in operation.

[Amdt 25/12] [Amdt 25/13]

CS 25.952 Fuel system analysis and test

ED Decision 2003/2/RM (a) Proper fuel system functioning under all probable operating conditions must be shown by analysis and those tests found necessary by the Agency. Tests, if required, must be made using the aeroplane fuel system or a test article that reproduces the operating characteristics of the portion of the fuel system to be tested.

(b) The likely failure of any heat exchanger using fuel as one of its fluids may not result in a hazardous condition.

CS 25.953 Fuel system independence

ED Decision 2003/ 2/RM Each fuel system must meet the requirements of CS 25.903(b) by – (a) Allowing the supply of fuel to each engine through a system independent of each part of the system supplying fuel to any other engine; or (b) Any other acceptable method.

CS 25.954 Fuel system lightning protection

ED Decision 2020/024/R (See AMC 25.954) (a) For the purposes of this paragraph — (1) A critical lightning strike is a lightn ing strike that attaches to the aeroplane in a location that, when combined with the failure of any design feature or structure, could create an ignition source.

Powered by EASA eRules Page 622 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM (2) A fuel system includes any component within either the fuel tank structure or the fuel tan k systems, and any aeroplane structure or system components that penetrate, connect to, or are located within a fuel tank.

(b) The design and installation of a fuel system must prevent catastrophic fuel vapour ignition due to lightning and its effects, inc luding: (1) Direct lightning strikes to areas having a high probability of stroke attachment; (2) Swept lightning strokes to areas where swept strokes are highly probable; and (3) Lightning - induced or conducted electrical transients.

(c) To comply with subparagraph (b) of this paragraph, catastrophic fuel vapour ignition must be extremely improbable, taking into account the flammability, critical lightning strikes, and failures within the fuel system.

(d) To protect design features that prevent catastrop hic fuel vapour ignition caused by lightning, the type design must include critical design configuration control limitations (CDCCLs) identifying those features and providing information to protect them. To ensure the continued effectiveness of those desig n features, the type design must also include inspection and test procedures, intervals between repetitive inspections and tests, and mandatory replacement times for those design features used in demonstrating compliance with subparagraph (b) of this parag raph. The applicant must include the information required by this subparagraph in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness required by CS 25.1529.

[Amdt 25/18] [Amdt 25/26]

AMC 25.954 Fuel system lightning p rote ction

ED Decision 2020/024/R TABLE OF CONTENT 1 PURPOSE 2 APPROACH TO COMPLIANCE 2.1 Summary 2.2 Compliance tasks 2.3 Identify the design features and elements of the fuel system that require lightning assessment 2.4 Determine the lightning strike zones 2.5 Establish the aeroplane lightning environment 2.6 Develop a lightning protection approach and design lightning protection features 2.7 Identify potential failures of the design and protection features 2.8 Identify potential ignition sources associated with the design features and potential failures 2.9 Perform a safety assessment to determine fault tolerance and non - fault tolerance 3 PROVIDE RELIABLE FAULT - TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES Powered by EASA eRules Page 623 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 3.1 Provide fault - tolerant lightning protection 3.2 Demonstrate effective fault - tolerance 3.3 Demonstrate protection reliability 3.4 Demonstrate compliance with the ‘extremely improbable’ requirement 4 ASSESS NON - FAULT - TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES 4.1 Overview 4.2 Qualitative assessment of non - fault - tolerant conditions 4.3 Quantitative assessment of non - fault - tolerant conditions 4.4 Evaluating non - fault - tolerance for systems 5 ESTABLISH AIRWORTHINESS LIMITATIONS Appendix A. Definitions Appendix B. Section 4 examples 1 PURPOSE This AMC describes the tasks that should be accomplished to show compliance with CS 25.954 for lightning protection of the aeroplane fuel system. These tasks may be accomplished in a different order than that listed below, and some tasks may require iterations.

This AMC also provides a method of compliance appropriate for reliable fault - toleran t and non - fault - tolerant protection for lightning ignition sources. Any non - fault - tolerant lightning protection in an aeroplane fuel system will, in order to comply with the method of compliance set forth in this AMC, need a thorough assessment for the lik elihood of failures, lightning strikes and attachment locations, and fuel tank flammability.

2 APPROACH TO COMPLIANCE 2.1 Summary The method in this AMC divides the design features for fuel system lightning protection into three categories: intrinsically s afe, fault tolerant, and non - fault tolerant. It also describes how applicants should develop material for the Airworthiness Limitations Section of the ICA.

2.1.1 Guidance for incorporating intrinsically safe design features into the fuel tank system is pro vided in paragraph 2.9.4.1.

2.1.2 Section 3 provides guidance on compliance with CS 25.954(b) for fault - tolerant lightning protection designs.

2.1.3 Section 4 provides guidance on compliance with CS 25.954(b) for non - fault - tolerant lightning protection designs.

2.1.4 Section 5 provides guidance on developing CDCCLs and other tasks that must be placed in the Airworthiness Limitation Section of the ICA.

Powered by EASA eRules Page 624 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 2.2 Compliance tasks The applicant should accomplish the following tasks to comply with CS 25.954 : — Identify the design features and elements of the fuel system that require lightning assessment (paragraph 2.3); — Determine the lightning strike zones (paragraph 2.4); — Establish the aeroplane lightning environment (paragraph 2.5); — Develop a lightning protection approach and design lightning protection features (paragraph 2.6); — Identify the potential failures of the design and protection feat ures (paragraph 2.7); — Identify the potential ignition sources associated with the design features and potential failures (paragraph 2.8); — Perform a safety assessment to determine fault tolerance and non - fault tolerance (paragraph 2.9); — Provide reliable fault - tolerant protection for lightning ignition sources (paragraph 3); — Assess non - fault - tolerant protection for lightning ignition sources (paragraph 4); and — Establish the Airworthiness Limitations (paragraph 5).

2.3 Identify the design features and elements of the fuel system that require lightning assessment To comply with CS 25.954(b) , the applicant should identify the fuel system design features and elements for the fuel tank structure, system componen ts, and equipment that require lightning assessment to show that the ignition of fuel vapour within the systems due to lightning and its effects is prevented. The design features and elements may be categorised into design groups that share characteristics that have similar lightning protection performance. The applicant should provide a detailed description of the fuel system, including: — structural members and fasteners exposed to direct and swept lightning attachment; — structural joints and fasteners expos ed to conducted - lightning current resulting from lightning attachment; — access doors, vents, drain valves, fuel filler ports, and other parts and components of the fuel system exposed to direct lightning attachment or conducted lightning currents; and — elect rical, mechanical, hydraulic, and fuel plumbing system installations within the fuel tank or connected to the fuel tanks exposed to direct lightning attachment or conducted lightning current.

Powered by EASA eRules Page 625 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 2.4 Determine the lightning strike zones Lightning strike zone s define locations on the aeroplane where lightning is likely to attach and structures that will conduct lightning current between lightning attachment points.

The applicant should determine the lightning strike zones for the aeroplane configuration, since the zones will be dependent upon the aeroplane geometry and operational factors. Lightning strike zones often vary from one aeroplane type to another.

EUROCAE document ED - 91A, ‘Aircraft Lightning Zoning’, dated January 2019 and the equivalent SAE ARP5414B dated December 2018, are acceptable standards providing guidelines on determining the lightning strike zones for the aeroplane, the areas of direct lightning strikes, areas of swept lightning strokes, and areas of conducted electrical transients. When det ermining the probability of lightning attachment to certain regions of the aeroplane, applicants should use data from similar aeroplane configurations to substantiate any assumed strike attachment rate for the region.

2.5 Establish the aeroplane lightning environment The fuel tank structure, system components, and equipment that are located in lightning zones 1 and 2 should be designed for lightning direct - attachment waveforms. EUROCAE document ED - 84A, ‘Aircraft Lightning Environment and Related Test Wavefo rms’, dated July 2013, and the equivalent SAE ARP5412B dated January 2013, are acceptable standards providing guidelines on acceptable lightning current and voltage waveforms for lightning zones 1 and 2. The fuel tank structure, system components, and equi pment that are exposed to conducted currents should be assessed to determine the appropriate lightning current and voltage waveforms and amplitudes, using the conducted current waveforms for zone 3 in EUROCAE ED - 84A/SAE ARP5412B. The applicant may use anal yses or tests to assess the conducted currents and voltages for the structure, system components, and equipment. Margins should account for any uncertainty of the analysis or test. Simple analyses of the lightning currents and voltages should incorporate l arger margins than the lightning currents and voltages that were calculated using detailed computational models that have been validated by tests.

2.6 Develop a lightning protection approach and design lightning protection features The applicant should dev elop the lightning protection approach and design lightning protection features required to provide effective lightning protection for all the fuel system design features and elements identified in paragraph 2.3 of this AMC. See paragraphs 3.2 and 4.1.2 fo r further guidelines on how to demonstrate an effective protection. The lightning protection features can include specific installation requirements, such as hole - size tolerance for fasteners or surface cleaning for sealant application. Other lightning pro tection features can include specific protection components, such as metal mesh incorporated into the outer surface of composite structures. The design should provide reliable lightning protection that prevents lightning – related ignition sources if a poten tial failure occurs in the lightning protection features. When possible, the design should place fuel system components — such as fuel tank vents, drain valves, jettison tubes, filler ports, and access doors — in lightning attachment zone 3, so they are le ss likely to be exposed to direct lightning attachment.

Powered by EASA eRules Page 626 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 2.7 Identify potential failures of the design and protection features 2.7.1 The applicant should: — identify the potential failures, due to causes that include manufacturing escapes*, operational deterioration**, and accidental damage***, that may lead to the loss or degradation of lightning protection; — identify, by analysis or test, the design elements that could degrade the effectiveness of lightning protection; — identify failures thro ugh a detailed review of manufacturing processes, material properties, structural design, systems design, and reliability and maintainability processes; — use the available manufacturing discrepancy reports, in - service failure reports, and developmental test s to identify potential failures; and — account for failures such as structural cracking, corroded or failed electrical bonding features, and mis - installed electrical bonding features that occur during manufacturing or maintenance.

* Manufacturing escapes for fuel tank structure include fastener selection issues (incorrect fastener sizes, types, finishes, or coatings), fastener assembly issues (misalignment, incorrect torque, hole size or quality, missing or extra washers), and install ation issues (inadequate or improperly adhered sealant, missing cap seals, incorrectly installed electrical bonds). Manufacturing escapes for fuel system components and equipment include design configuration issues (incorrect fasteners, wrong or missing cl amps or brackets, inadequate or improperly adhered sealant, missing or incorrect finishes), bonding issues (a missing or improperly installed electrical bond or wiring shield), and clearance issues (insufficient tube or wiring clearance to adjacent systems or structure).

** Structural failures due to operational deterioration during intended operation include broken or cracked elements (fasteners or washers), corrosion, degradation of applied materials (sealants, fastener head coating, edge glow protection, or bonded joints), and fatigue issues (loose fasteners or structural cracks). System failures due to operational deterioration include failures of support features (loss of fasteners, brackets, or clamps that support tubes, EWIS or components) and degradat ion of electrical bonds, wire insulation or shielding due to corrosion, ageing, or wear.

*** Structure or system failures due to accidental damage include impact from foreign object debris (FOD) or inadvertent damage incurred during alterations, repairs, or inspections.

2.7.2 The severity or types of failures should be defined and can be based on service history, where appropriate, and laboratory test data. The severity of the failure should be consistent with or bounded by the assumptions made for the struc tural and systems certification analyses. The severity or types of failures due to manufacturing escapes should be based on manufacturing discrepancy reports, such as rejection tags, manufacturing process escape assessments, and assessments of process impr ovements.

Powered by EASA eRules Page 627 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 2.7.3 Manufacturing variability and environmental conditions should be considered in conjunction with failures. Combining worst - case conditions for all manufacturing variabilities and environmental conditions is overly conservative and not nece ssary. Failures due to operating or environmental conditions other than those required for certification do not need to be considered. Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition (i.e., a common cause or cascading failure).

2.8 Identify potential ignition sources associated with the design features and potential failures.

2.8.1 Fuel system fasteners, structures, equipment, and components that are exposed to direct lightn ing attachment in lightning zones 1 and 2 should be assessed using the lightning waveforms identified in paragraph 2.5 of this AMC. Fuel system fasteners, structures, equipment, and components should also be assessed for conducted lightning currents. If th e aeroplane uses novel or unusual materials, structures, or configurations, the applicant should evaluate the fuel system fasteners, structures, equipment, and components on the outside surface of the aeroplane located in lightning zone 3 using the nominal zone 3 direct lightning attachment waveforms defined in EUROCAE ED - 84A/SAE ARP5412B. The use of materials that are not highly conductive for the structure of fuel tanks is considered unusual. Lightning attachment in zone 3 is defined as unlikely in EUROCA E document ED - 91A, ‘Aircraft Lightning Zoning’, dated January 2019, and the equivalent SAE ARP5414B dated December 2018, so the evaluation does not need to consider failures in combination with such an attachment, but should demonstrate that no catastrophi c effect will occur when no failures are present.

2.8.2 The following paragraphs list ignition source types and examples of how ignition sources might occur: 2.8.2.1 Voltage sparks are the result of the electrical breakdown of a dielectric between two sepa rated conductors. Voltage sparking might occur, for example, between the fastener and its hole or through an insulation layer between the base of a nut and a conductive surface. A voltage spark could occur between a fuel tube and the adjacent structure if the separation is insufficient or the bonding to minimise the voltage potential has failed. If this spark is exposed to fuel vapour, an ignition may result. Laboratory tests have shown that the minimum ignition energy in a voltage spark required to ignite hydrocarbon fuel vapour is 200 microjoules*.

* The 200 - microjoule level comes from various sources. The most quoted is from Lewis and von Elbe’s book, Combustion, Flames and Explosions of Gases (Florida: Academic Press, Inc., 1987; (orig. publ. 1938)). It h as a set of curves for minimum ignition energy for the various hydrocarbon compounds in jet fuel, and they all have similar minimum ignition energy levels of greater than 200 microjoules.

2.8.2.2 Thermal sparks are the result of burning particles emitted b y the rapid melting and vaporisation of conductive materials carrying current through a point contact. Thermal sparks can occur when there is a small contact area between a fastener and the hole material, or between a fastener collar and the underlying str ucture. Thermal sparks can occur at a point contact between a fuel tube and the adjacent structure if the contact point conducts Powered by EASA eRules Page 628 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM a high current. When sealant or caps are used to contain sparks, failures could result in the internal pressures from the heat of thermal sparks that force hot particles past the sealant or cap, resulting in sparks in the fuel vapour area.

2.8.2.3 Analyses and tests indicate that a small piece of steel wool will ignite a flammable mixture when a transient current of approximately 100 milliamperes (mA) peak is applied to the steel wool*.

* This data was from testing performed by the FAA Technical Center, Report DOT/FAA/AR - TN05/37, Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics. Applicants may conduct testin g to substantiate alternate values.

2.8.2.4 Edge glow includes voltage or thermal sparks that occur at the edges of carbon - fibre composite material when lightning current and voltage cause a breakdown of the resin between fibres. Failures of the protection features to prevent edge glow should be identified.

2.8.2.5 Fuel vapour ignition due to lightning near fuel vent outlets can result in flame propagation into the fuel system. When lightning attaches near fuel vent outlets, the ignition of fuel vapour results in a high - speed pressure wave that can travel through the flame arrestor without sufficient time for the flame arrestor to quench the flame front. The vent outlets should be located outside the lightning direct - attachment zones of the aeropl ane. If the vent outlets are located in lightning direct - attachment zones, flame arrestors have been used to prevent lightning - ignited fuel vapour from propagating into the fuel system. Specific lightning tests and unique design features are typically need ed to demonstrate the effectiveness of the lightning - protection for these installations. (Lightning effects are not addressed in the fuel tank vent fire protection requirements of CS 25.975(a)(7) .

2.9 Perform a safety assessment to determine fault - tolerance and non - fault - tolerance 2.9.1 The applicant should perform a safety assessment to determine whether the fuel system design provides acceptable fuel system lightning protection based on the design features and potential ignition sources due to failures of the design features identified in the previous steps. The applicant may perform the safety assessment on groups of fuel system design elements and lightning protection features with similar physical and electri cal characteristics. For non - fault - tolerant features, an assessment must show, per CS 25.954(c) , that the sum of the probability of failures from potential ignition sources in combination with the probability of a critical lightning strike and the fuel tank being flammable does not exceed extremely improbable. The applicant should provide its rationale for assigning design elements and lightning protection into groups.

2.9.2 The safety assessment should address all the fuel system design elements identified in paragraph 2.3 of this AMC, the lightning environment at the locations for those elements identified in paragraphs 2.4 and 2.5 of this AMC, and the failures identified in paragraph 2.7 of this AMC. The applicant should also use the safety assessment to identify where analyses or tests are necessary to demonstrate the prevention of fuel system ignition sources.

Powered by EASA eRules Page 629 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 2.9.3 The applicant should use a rigorous and structured safety assessment approach.

The structured safe ty assessment and associated fault - tolerance assessment and test reports should be part of the substantiating data. Failure modes and effects analyses are acceptable structured safety assessment tools, particularly for non - fault tolerant lightning protecti on features. All the failure modes and effects analyses (FMEAs) and fault tree analyses (FTAs) should be included and thoroughly annotated. The applicant should substantiate and document all the assumptions used in performing the safety assessment.

2.9.4 T he safety assessment should divide all the lightning protection features of the fuel system into the following three categories: 2.9.4.1 Intrinsically safe lightning protection Some fuel system design elements provide effective lightning protection with no foreseeable failure modes that would render them ineffective.

These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in tha t specific location. The applicant should identify any intrinsically safe fuel system design elements. An example of an intrinsically safe design element would be highly conductive fuel tank skins with sufficient thickness to ensure that lightning attachme nt to the skin will not result in hot - spot or melt - through ignition sources in the tank. Another example would be a structural element designed with sufficient margins that fatigue cracking is not foreseeable. A third example could be fasteners or joints l ocated in the fuel tank structure where the lightning current density is so low that an ignition source will not result even when failure conditions are present.

2.9.4.2 Fault - tolerant lightning protection Fuel system design elements that are not intrinsic ally safe and require design features to provide lightning protection should be designed so that a failure associated with these elements or features will not result in an ignition source. Reliable fault - tolerant prevention of lightning ignition sources, i n combination with the control of fuel tank flammability required by CS 25.981 and the statistics of lightning strikes to aeroplanes, is acceptable for showing compliance with CS 25.954(c) . Detailed guidance for showing compliance for reliable fault - tolerant lightning protection is provided in Section 3 of this AMC.

2.9.4.3 Non - fault - tolerant lightning protection Experience has shown that it is impractical to provide fault - t olerant features, or indications of failures, for some failures that occur in the aeroplane structure. Certain fuel system design elements and lightning protection features could have conditions where a single failure of these elements or features results in an ignition source when combined with a critical lightning strike. These fuel system design elements, lightning protection features, and failures require detailed and thorough safety assessment to determine whether the fuel system design complies with CS 25.954(b) . It is likely that the aeroplane fuel system design and lightning protection can have only a very small number of these non - fault - tolerant lightning protection conditions and still show that the risk of a catastrophic event is extremely Powered by EASA eRules Page 630 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM improbable to comply with CS 25.954(c) . Section 4 of this AMC provides more detailed guidelines for showing compliance for non - fault - tolerant lightning protection.

3 PROVIDE RELIA BLE FAULT - TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES 3.1 Provide fault - tolerant lightning protection Fault - tolerant lightning protection for ignition sources on fuel tank structure and systems has been shown to be generally practical and achievable. Compliance with CS 25.954(b) for most fuel system elements (equip ment, components, and structures) that are not intrinsically safe should be demonstrated by showing that the lightning protection is effective, reliable, and fault tolerant.

3.2 Demonstrate effective fault tolerance 3.2.1 The substantiation process should involve tests or analyses on the fuel system design elements and features on which faults are induced. These tests and analyses should address both lightning direct attachment to the fuel system design elements and features, and conducted lightning current s on them, as applicable.

Where tests are performed, the following steps outline an approach to reduce the number of tests by grouping the design elements and features and the associated failures. In each step, the assumptions should be documented.

3.2.2 T he test process can be summarised in four steps: 1. Select the test articles that will be used for assessing fault tolerance. A design review may be used to develop groups, or for classification of the fuel system design elements and features. For example, fasteners could be grouped by the types of fasteners (such as rivets, bolts, and collars). The groups could be differentiated by the materials (such as aluminium, steel, titanium, stainless steel, etc.), or by the manufacturing processes (such as interfer ence fit holes, cap seals, insulating laminate plies, material thicknesses, etc.).

2. Assess the faults (including ageing, corrosion, wear, manufacturing escapes, and any foreseeable in - service damage) to determine the worst - case failures that could render the fault tolerance ineffective. Determination of the worst - case failures should be justified with engineering tests, previous certification tests, analyses, service experience, or published data.

3. Determine the lightning current amplitudes and waveform s in the fuel system design elements and features due to direct lightning attachment and conducted lightning currents, as applicable. The lightning environments were previously identified in the hazard assessment above.

4. Conduct tests using the current a mplitudes and waveforms derived from step 3 and the faults defined in step 2 to demonstrate that the design prevents ignition sources when a fault occurs.

3.2.3 Assessment of system failure conditions generally involves first assessing the result of the failure condition. For example, the loss of a means of electrical bonding at a penetration of a fuel system tank may cause higher currents or voltages on component s located within the fuel tank. The loss of a wire bundle shield or a shield termination may also cause higher voltages in the fuel systems. Assessment of these effects may involve analyses, tests, or a combination of test and analysis.

Scaling based on th e relative distances from the attachment locations, distances Powered by EASA eRules Page 631 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM for structural conductors, lengths of system elements, etc., may all be necessary to establish the worst - case threats.

3.2.4 Computational analyses or tests of representative tank sections may b e used to determine the lightning current and voltage amplitudes and waveforms within the fuel system. The applicant should determine the currents, voltages, and associated waveforms that are expected on each feature or element of the fuel system, and use these current and voltage waveforms for tests on representative fuel system parts, panels, or assemblies. Analyses should be validated by comparisons of the analysis results with test results from fuel system configurations that are similar to the fuel sys tem to be certified. The applicant should apply appropriate margins based on the validation results.

3.2.5 The applicant should conduct lightning tests using test articles that acceptably represent the relevant aspects of the proposed aeroplane fuel system features and elements. The test articles should incorporate the identified failures needed to demonstrate fault - tolerant lightning protection. When performing these tests, the configuration of the design and protection features and elements should address the effects of ageing, corrosion, wear, manufacturing escapes, and likely damage.

The possibility of cascading failure effects on redundant features (e.g., fasteners fracturing and compromising sealant directly or over time) should also be considered as p art of the assessment when determining what level of fault insertion testing is needed. Guidelines for lightning test methods are provided by EUROCAE ED - 105A ‘Aircraft Lightning Test Methods’, dated July 2013, and the equivalent SAE ARP5416A dated January 2013. Lightning tests are typically needed to demonstrate that fuel tank vent flame arrestors prevent fuel ignition from propagating into the fuel system if the vent outlets are located in lightning direct - attachment zones. The tests and analyses should be documented as part of the substantiating data.

3.3 Demonstrate protection reliability 3.3.1 The applicant should identify the protection features, and qualitatively establish their reliability, using the service experience of similar protection features o r other means proposed to, and accepted by, EASA. For example, the interference fit of a fastener in a hole may be established as a reliable protection feature based on service experience that interference fit fasteners do not loosen appreciably over the l ife of the aeroplane. Likewise, dielectric or physical separation of systems from structures may be established as a reliable protection feature, provided that similar dielectric material or support installations have been shown in service or by tests to p erform their function adequately for the life of the aeroplane. Where the reliability of a fault - tolerant feature cannot be established to typically exceed the life of the aeroplane, then the appropriate replacement time, inspection interval, and related i nspection and test procedure must be included in the Airworthiness Limitations Section of the ICA to ensure the effectiveness of the protection, in accordance with CS 25.954(d) . Airworthiness Limitation requirement s are discussed in Section 5 of this AMC.

3.3.2 The applicant should address failures that can occur in service due to ageing and wear, and failures that can escape the manufacturing processes. For example, the anticipated escapes should include past manuf acturing escapes. Any process changes that are implemented to preclude a specific type of escape may be considered if they preclude future escapes. The applicant should consider training Powered by EASA eRules Page 632 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM to ensure the compliance with the manufacturing process, implement de signs that preclude escapes, automate reliable and repeatable drilling and assembly, and monitor process errors.

3.4 Demonstrate compliance with the ‘extremely improbable’ requirement 3.4.1 The characteristics of lightning, the frequency of aeroplane light ning strikes, and the fuel tank flammability exposure are factors that affect the likelihood of lightning causing a catastrophic fuel vapour ignition. CS 25.981(b) limits the fuel tank fleet average flammability ex posure to three per cent of the flammability exposure evaluation time, or that of a conventional unheated aluminium wing tank. The worldwide transport aeroplane lightning strike rate is of the order of once in several thousand flight hours.

3.4.2 The standard lightning waveforms in the EUROCAE/SAE standards are based on the combinations of severe lightning characteristics using a current amplitude, energy, rise time, and pulse repetition that conservatively exceed the majority of recorded values. Most aeroplane lightning strikes have significantly lower current values of amplitude, duration, energy transfer, rise time, and pulse repetition than the severe characteristics in EUROCAE ED - 84A/SAE ARP5412B. This reduces the likelihood of a lightning - related ignition source even when the fuel system lightning protection effectiveness has degraded from what is demonstrated using the standard lightning waveforms in EUROCAE ED - 84A/SAE ARP5412B.

3.4.3 The probability of occurrence of a lightning strike attaching t o, or conducting currents through, the fuel system during flammable conditions, at a sufficiently severe level represented by the test levels of EUROCAE ED - 84A/SAE ARP5412B, is remote by itself. Remote failure conditions are defined in AMC 25.1309 (Qualitative Probability Terms).

3.4.4 If shown to be effective and reliable, fault - tolerant lightning protection complies with CS 25.954(c) without further analysing the probabili ty of the failures, taking into account the remote probability of the environmental conditions discussed above. The applicant should show that the fault - tolerant lightning protection features are designed and installed to be effective over their life or th e life of the aeroplane or with appropriate inspections and maintenance. Lightning protection features and elements that have shown their reliability in service by adequate documented service history data on previous similar designs may be incorporated int o the fault - tolerant design.

4 ASSESS NON - FAULT - TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES 4.1 Overview 4.1.1 Fuel system configurations and failure conditions that result in non - fault - tolerant ignition sources should be minimised and precluded whe re practical. If the design is identified to be non - fault - tolerant, the design should be re - evaluated to determine whether practical measures could be implemented to make it fault tolerant. Wherever practical, fault - tolerant design protection features and elements should be implemented and assessed. ‘Practicality’ is defined as a balance of the available means, economic viability, and proportional benefit to safety. A means to provide fault tolerance that is possible with little economic impact is practical even if an event is not anticipated to occur in the life of an aeroplane without it. If the applicant determines that the fault - tolerant prevention of ignition sources is impractical for a specific design feature or failure, the Powered by EASA eRules Page 633 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM applicant should review th is determination of impracticality for concurrence with EASA.

4.1.2 For design features and elements that have failures where the fault - tolerant prevention of ignition sources is impractical, the applicant should assess these non - fault - tolerant design feat ures and elements to demonstrate that, taken together, the likelihood of a catastrophic fuel vapour ignition resulting from a lightning strike and flammable fuel tank conditions is extremely improbable. To successfully demonstrate this, it will likely be n ecessary to show that the probability of occurrence of such a fault is extremely remote and limited to a very small number of design features and elements. To support the results of the assessment, maintenance considerations have to be identified in order to maintain the aeroplane in this state during the life of the aeroplane. Analysis and similarity can be used, but similarity should include the similarity of the design, similarity of the current density at the design feature, and similarity of the produc tion and maintenance conditions. Agreement with the authorities on the use of similarity should be achieved before this approach is used. In many instances, a specific manufacturer’s limited experience may not be representative of the overall transport fle et experience.

4.1.2.1 See Appendix B, paragraph B.1 of this AMC for examples of design elements or features where providing fault - tolerant prevention of lightning ignition sources should be practical.

4.1.2.2 See Appendix B, paragraph B.2 of this AMC for examples of design features or failures where providing fault - tolerant prevention of lightning ignition sources could be impractical.

4.1.2.3 See Appendix B, paragraph B.3 of this AMC for examples of design, manufacturing, and maintenance processes that ma y be useful in establishing compliance.

4.1.3 Applicants should identify all the potential non - fault - tolerant design and protection features early in their design process. All practical measures to provide intrinsically safe protection and fault - tolerant p revention of ignition sources should be incorporated, which is more easily accomplished early in the design process.

4.1.4 Applicants should establish the probabilities of the flammable conditions within the fuel system where non - fault - tolerant features ar e present.

4.1.5 Once the probabilities of flammable conditions and the probabilities of critical lightning strikes occurring within the fuel system are defined, an evaluation of the potential for the occurrence of a structural discrepancy within the fuel system can be performed. When the probability of lightning attachment to certain regions of the aeroplane is included in the compliance approach, applicants should use data from similar aeroplane configurations to substantiate any assumed strike attachment rate.

4.1.6 Regardless of whether it is practical to provide fault - tolerant prevention of fuel system lightning ignition sources, compliance must demonstrate that the combined risk of catastrophic fuel vapour ignition due to lightning is extremely improba ble. The assessment can be a qualitative analysis, a quantitative analysis, or a combination of both. The applicant should use the method that is most appropriate for the specific design. Where the protection means are reliable, the potential failure modes are rare, and limited service data is available to accurately Powered by EASA eRules Page 634 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM determine the failure rates, a qualitative assessment is most appropriate. If the failure rates are available and a numerical assessment could be reasonably accurate, a quantitative assessment may be appropriate. If the potential failures are so common that the rates are well established, it is unlikely that a non - fault - tolerant design could be shown to be compliant without frequent maintenance checks. Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition (i.e., a common cause or cascading failure). Combinations of independent failure modes that are expected to occur need to be considered.

4.2 Qualitative assessment of non - fault - tolerant conditions 4.2.1 The qualitative assessment must demonstrate that fuel vapour ignition due to lightning is extremely improbable, including the contribution of non - fault - tolerant features and elements. One means of assessing the risk of a catastrophic event due to failures of non - fault - tolerant features is to demonstrate that the potential ignition sources due to the failure conditions are also remote (per the AMC 25.1309 definition) for designs where fault - tolerant protectio n features are impractical.

4.2.2 Remote failure condition is defined in AMC 25.1309 .

4.2.3 The qualitative assessment should account for the design features to limit failures, the conditions necessary for a failure to result in an ignition source, and any means used to limit the occurrence or latency of a failure. The applicant should evaluate the design’s ability to safely conduct the lightning current densities and to prevent the lightning current flow.

4.2 .4 A qualitative non - fault - tolerance assessment should show that combinations of service conditions, such as vibration, humidity, temperature changes, and maintenance activities, cannot produce an ignition source when exposed to voltages or currents result ing from lightning strikes to the aeroplane.

4.2.5 The following paragraphs (4.2.5.1 to 4.2.5.4) identify the areas that should be addressed for structural discrepancies within a fuel system.

4.2.5.1 Evaluation of non - fault tolerance should include conside ration of structural discrepancies resulting from overstress, ageing, fatigue, wear, manufacturing defects, and accidental and environmental damage. Damage includes conditions that could be reasonably anticipated to occur in the life of an individual aerop lane due to operation and scheduled and unscheduled maintenance. In addition, probable manufacturing escapes in the production process should be considered as probable failures.

4.2.5.2 The determination of the potential for a non - fault - tolerant condition resulting in a lightning - related ignition source should be based on appropriate assessments. The objective of these assessments is to demonstrate that, for the combination of all the discrepant conditions in a fuel tank vapour zone (i.e. ullage), the expos ure time of the non - fault - tolerant feature to a lightning - induced electrical current density of sufficient magnitude to become an ignition source will be minimised to such a degree that a catastrophic failure due to a lightning strike is not anticipated du ring the entire operational life of all the aeroplanes of that type. In performing the assessments to determine the potential for a non - fault - tolerant condition to result in a lightning - related fuel vapour Powered by EASA eRules Page 635 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM ignition, the following factors should be collecti vely considered, addressed, and documented: 4.2.5.2.1 Analysis of the electrical current densities within the fuel tank structure considering its material properties and configuration; 4.2.5.2.2 Analysis and test data necessary to support the likelihood of occurrence of a critical lightning strike at a particular location on the aeroplane where a discrepancy exists; 4.2.5.2.3 Analysis and test data necessary to support any conclusion that the electrical current density generated by a lightning strike in the specific vicinity of a structural crack or broken fastener in the fuel tank will not be of sufficient amplitude to cause sparking; 4.2.5.2.4 Analysis and test data necessary to support the likelihood of the fuel tank being flammable; and 4.2.5.2.5 Evaluat ion of the fuel tank structure in all areas of the fuel tank that may be susceptible to a fuel vapour condition and at electrical current densities that can result in a lightning - related ignition. This should include assessing the structure’s: 1. Susceptib ility to failure (such as cracking, delamination, fastener failures, failed fastener cap seals, failed sealant, etc.); 2. Inspectability (determining whether discrepant structure could be reliably inspected such that the exposure time of the failure to a c ritical lightning strike will be reduced to a level that supports the safety objective); 3. Service data (reports of failed structures such as cracks, delamination, failed fasteners, failed fastener cap seals, or sealant that could become an ignition sourc e); 4. Maintenance inspection programs (determining whether inspections will reliably detect failures and discrepancies such that their exposure times will be reduced to a level that supports the safety objective). This includes mandated inspections (e.g., the Airworthiness Limitations Section of the ICA required by Section H25.4 of Appendix H to CS - 25 and CS 25.1529 ); and 5. Fatigue and damage - tolerance evaluation of the crack initiation/propagation rate, crack characteristics (e.g., crack width versus crack length or edge crack versus crack at or near a fastener hole), the detectable crack size, probability of detection, inspection threshold, and inspection interval.

4.2. 5.3 See Appendix B of this AMC for an example of an assessment process addressing the potential for fuel tank structural cracking.

4.2.5.4 The qualitative assessment should consider any means used to ensure that the probability of a combination of faults w ill be remote. However, it cannot include the likelihood of lightning attaching to the aeroplane, or the flammability of the fuel tanks.

Powered by EASA eRules Page 636 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 4.2.5.5 Figure 1 of this AMC provides a guide to the qualitative assessment process.

Each of the activities in the qual itative assessment process, shown in Figure 1, is discussed in the paragraphs that follow.

Figure 1. Assessing the Combined Risk of All Non - Fault - Tolerant Failures 4.2.5.6 Figure 1, Item (1).

The first step is to determine whether there are design featur es or elements that do not provide fault - tolerant lightning protection, as described in paragraph 2.9.4.3.

Powered by EASA eRules Page 637 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 4.2.5.6.1 When a failure is considered possible, qualitatively assess with supporting test data and fleet experience to determine whether the condition is likely to occur in the life of the aeroplane fleet. This supporting data may include: — Lightning testing relevant to specific or similar design features (see paragraph 2.3 of this AMC); — Dielectric strength testing of insulating materials and st ructures such as brackets, clamp cushions, air gaps, and wire harness insulation; — Field service reports or databases related to the non - fault - tolerant condition being assessed; — Engineering tests to determine the durability of features, such as fatigue test s, thermal cycling tests, or corrosion tests; — Fleet experience may also be used to estimate the likelihood of failures. The determinations should be based on conservative assumptions; — Service experience records of manufacturing or maintenance escapes, if a vailable; and — Manufacturing records for defects found.

4.2.5.6.2 It may be possible to demonstrate that a design feature or element will perform similarly to a previously certificated design or design feature under foreseeable lightning threats. If applica ble, provide a comparative analysis of similar design features and details on a previously certified aeroplane. The comparative analysis would include a detailed assessment of the design features and details that affect susceptibility to failure, exposure time to lightning environment, service experience, and any applicable analyses and test data.

4.2.5.7 Figure 1, Item (2).

Assess the probability of the failure condition occurring. If this failure is latent for a long time, or the failure could occur at ma ny locations that are exposed to conducted lightning currents, the likelihood of that failure resulting in an ignition source could be significant.

4.2.5.8 Figure 1, Item (3).

Evaluate the likelihood of lightning attaching in the vicinity of non - fault - tolerant features and resulting in a current of sufficient amplitude to cause an ignition source at those features. Appropriate factors to consider include: 1. The possibility of lightning attachment to locations on the surface of the aeroplane near the fa iled non - fault - tolerant features.

2. The lightning - related ignition source threshold current for each of the failed non - fault - tolerant features. This is the lightning current amplitude that would result in an ignition source at the failed non - fault - toleran t feature.

Powered by EASA eRules Page 638 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 3. The amplitude of the lightning current that would be necessary to produce a conducted current that would exceed the ignition source threshold.

4.2.5.8.1 Failed features within fuel systems will usually tolerate some lightning current without producing an ignition source. Above this threshold, an ignition source can occur. The lightning current amplitude, charge transfer, and action integral that result in an ignition source can be determined by tests on parts and panels that incorporate the st ructural features in a defined fault condition.

4.2.5.9 Figure 1, Item (4).

Consider any factors that may be used to ensure the integrity of the installations. A specified inspection interval can be proposed to detect the failure. Additional manufacturing controls may be implemented to minimise the occurrence of defects and escapes during production.

4.2.5.10 Figure 1, Item (5).

The qualitative assessment should consider all the potential non - fault - tolerant features and determine whether the probability of a combination of the potential for ignition sources due to failures of these features is remote. Broken fasteners and structural cracks are two failures where the applicant may find it impractical to demonstrate fault - tolerant protection. The applicant is responsible for demonstrating that ignition sources created by the combination of a non - fault - tolerant failure, a flammable environment, and a lightning strike of sufficient amplitude to result in an ignition source will be extremely improbable.

4.3 Quantitative assessment of Non - fault - tolerant conditions 4.3.1 Quantitative assessment of non - fault - tolerant features can be used. The quantitative assessment must demonstrate that fuel vapour ignition due to lightning is extremely improbable, including th e contribution of non - fault - tolerant features and elements. However, to do this, there must be a reasonable amount of reliable data for the rate of failures.

4.3.2 The following four conditions should be evaluated collectively: 1. The probability of the oc currence of a flammable condition within a fuel tank in the vicinity of an ignition source due to lightning.

2. The probability of the occurrence of a lightning strike of sufficient intensity to produce an ignition source at a failed non - fault - tolerant des ign feature.

3. The potential for the presence of a failure of a non - fault - tolerant protection feature within a fuel system.

4. The total number of non - fault - tolerant features.

4.3.3 The same factors for a qualitative assessment should be considered for th e quantitative assessment approach. The additional step is to quantify each of these factors for use in the numerical assessment. A fault tree analysis (discussed in paragraph 2.9.3 of this AMC) may be used to determine whether the combined risk of the non - fault - tolerant conditions is unlikely to result in a catastrophic event over - 9 the life of the fleet. From a numerical perspective, a probability of the order of 10 Powered by EASA eRules Page 639 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM per flight hour or less is the accepted standard for demonstrating that the combined risk, including all failures, is extremely improbable.

4.4 Evaluating non - fault - tolerance for systems.

Fuel, mechanical, hydraulic, and electrical components that penetrate, are located within, or are connected to the fuel tanks have typically been able to prov ide fault - tolerant design capability. These components include the associated clamps, shields, supports, bonding straps, and connectors. It is therefore expected that applicants will develop fault - tolerant designs for these components.

5 ESTABLISH AIRWORTHINESS LIMITATIONS CS - 25, Appendix H, Section H25.4, Airworthiness Limitations Section , requires mandatory replacement times, inspection intervals, and related inspection and test procedures for the lightnin g protection features that are approved under CS 25.954 . Section H25.4(a)(6) requires CDCCLs, inspections and tests, and mandatory replacement times to be located in a sect ion of the ICA titled ‘Airworthiness Limitations.’ 5.1 Critical design configuration control limitations 5.1.1 The applicant must establish CDCCLs to protect features that prevent lightning - related ignition sources within their fuel systems. This requires the applicant to identify the lightning protection design features, as well as to prepare instructions on how to protect those features. Identification of a feature refers to listing the feature in the CDCCL. During aeroplane operations, modifications, and unrelated maintenance actions, these features can be unintentionally damaged or inappropriately repaired or altered. Instructions on protection are meant to address this safety concern. An example of a common design feature to prevent ignition sources cau sed by wiring is wire separation so that wires cannot chafe against one another or against structure or other components. An example of an instruction on how to protect this design feature would be ‘When performing maintenance or alterations in the vicinit y of these wires, ensure that a minimum wire separation of 15.24 cm (6 inches) is maintained.’ 5.1.2 CDCCLs are essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the type design of the fuel tank s ystem. The CDCCLs should include information regarding how to prevent compromising the critical design features, or to restore them when other maintenance or alterations are being performed. The CDCCLs should be established based on evaluating the design - s pecific critical features that are determined from the safety analysis and determining the anticipated maintenance, alteration, or repair errors that could compromise the feature. The following list of examples of CDCCLs is intended to provide examples of lightning protection features that have been identified in certain designs, and is not intended to be inclusive of all the features that should be considered for a particular design. It is likely that the safety analysis will identify the need for addition al CDCCLs.

5.1.2.1 Fuel tank structural fasteners can be potential lightning ignition sources.

Specific fastener design features such as the fastener material, coating, and countersink depth are typically needed to prevent lightning ignition sources at the fasteners. Installation processes such as fastener hole clearances, fastener pull - ups, and hole angularities can be critical. The orientation of the fastener head in the fuel tank structure can be critical. The criticality of fuel tank structural fastener s may be dependent on their location, particularly Powered by EASA eRules Page 640 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYST EM those located in direct lightning attachment zones. The CDCCLs should identify these critical fastener features and refer to the structural repair manual (SRM) for approved fastener lists and approved inst allation processes for these fasteners.

5.1.2.2 Fuel tube electrical isolation segments can be used to limit induced lightning currents on the fuel tubes, especially on aeroplanes with carbon - fibre composite fuel tank structures. Maintenance, alterations, or repairs of the fuel tube system should maintain the lightning current limits provided by the fuel tube isolation segments. A limitation may specify that the fuel tube isolation segments are required for lightning protection, that replacements must also meet the electrical isolation requirements of the original design, and electrical bonding straps must not bridge the isolation segments.

5.1.2.3 Fuel tank access doors have the potential for lightning - related sparking inside the tank as a result of a direc t lightning strike or a conducted lightning current. The doors may incorporate specific protection features such as electrically conductive gaskets, electrically insulating seals, and multiple fasteners. The limitation may specify that the presence and int egrity of the gaskets, seals and fasteners should be verified when the access doors are installed. Electrical bonding measurements may be required to verify that the electrical resistance between the access door and adjacent structure is less than a specif ied value.

5.1.2.4 Sealant can provide caps over fasteners or fillet seals applied where structural parts are joined within the fuel tank. Poor sealant adhesion or sealant damage could degrade the protection against lightning ignition sources. The limitati on may specify that the integrity of the sealant must be verified in the areas of the fuel system where maintenance or alterations take place. Cracked, peeling, or missing sealant could indicate that the integrity of the protection is compromised.

5.1.2.5 The minimum spacing between metal fuel tubes, hydraulic tubes, and conduits and adjacent structure may be specified to prevent lightning - related arcing. In addition, electrically insulating bushings or grommets may be installed to prevent lightning - related arcing between fuel system components and structures. The limitation may specify that the presence and integrity of the bushings or grommets must be verified in the areas of the fuel system where maintenance or alterations take place, and that the minimum clearance between fuel tubes, hydraulic tubes, or conduits and adjacent structure or components must be verified in areas where maintenance or alterations take place.

5.1.2.6 Fittings for metal hydraulic tubes, nitrogen inerting tubes, and fuel tubes may be installed through the fuel tank walls. These fittings must conduct induced - lightning currents and prevent voltage or thermal sparks within the tank between the fittings and the fuel tank structure. The limitation may require verifying that the electrica l bonding resistance does not exceed a specified value if the fittings are repaired, reinstalled, or altered, and that the integrity and electrical bonding resistance of any required bonding straps must be verified as well.

Powered by EASA eRules Page 641 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 5.1.2.7 Self - bonding couplings t hat rely on physical contact between the coupling and fuel tubes may be used to provide electrical bonding. Anodised coatings applied to the fuel tubes could degrade the electrical bonding. The coatings used on the tubes and couplings could be identified a s a CDCCL to maintain acceptable electrical bonding.

5.1.2.8 Fuel quantity sensing probes and in - tank wiring may require electrical isolation from the adjacent fuel tank structure to prevent lightning - related arcing between the probes, wiring, and structure. The isolation may be provided by electrically non - conductive probe clamps, or non - conductive caps on the ends of the probes. The wiring protection may be provided by separation from the structure. The limitation may specify that the presence and integrity of the non - conducting clamps or end caps, and the wiring separation must be verified in the areas of the fuel system where maintenance or alterations take place.

5.1.3 CDCCLs are intended to identify only the critical features of a design that must be maintained. A CDCCL has no interval, but establishes configuration limitations to protect the critical design features identified in the CDCCL. CDCCLs can also include requirements to have placards installed on the aeroplane with information a bout critical features. For certain equipment, critical protection may be provided by components. These critical protection features must be identified as CDCCLs and should be listed in the component maintenance manual (CMM) to provide awareness to mainten ance and repair facilities.

5.1.4 Certain CDCCLs apply to elements of fuel system components. As such, the maintenance of those critical features may be covered in a CMM. When Airworthiness Limitations need to call out aspects of CMMs, it is a best practic e to limit the CDCCL - controlled content to only those maintenance tasks directly impacting a CDCCL feature, rather than requiring the complete CMM to be a CDCCL.

5.2 Mandatory replacement times, inspection intervals, and related inspection and test procedu res 5.2.1 To comply with CS 25.954(d) , mandatory replacement times, inspection intervals, and the related inspection and test procedures must be developed for the lightning protection features identified in paragra phs 2.3 and 2.6 of this AMC. Mandatory replacement times, inspection intervals, and the related inspection and test procedures must be included in the Airworthiness Limitations Section of the ICA.

5.2.2 To ensure lightning protection is retained over the s ervice life of the aeroplane, references to these mandatory replacement times, inspection intervals, and the related inspection and test procedures are normally included in the maintenance manuals (e.g., the AMM, SRM, SWPM) and service bulletins that provi de maintenance personnel with standard practices for continued airworthiness.

5.2.3 When developing maintenance and service inspection techniques, a review of similar aeroplane designs and their service histories should be conducted to focus on the areas w here past experience has shown there is a potential for affecting lightning protection features.

5.2.4 When developing procedures to remove and reinstall fuel tank access panels, applicants should include instructions to maintain or restore the lightning Powered by EASA eRules Page 642 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM p rotection features such as sealants, fastener assemblies (structural joints), nut plates, bonded parts, insulators, conductive parts, etc.

5.2.5 The applicant should validate the intended maintenance tasks performed in the fuel tank systems and confirm tha t they do indeed provide protection and avoidance of damage to the lightning protection features. The applicant should ensure that the proper parts and materials are specified in the maintenance tasks.

5.2.6 The lightning design specialist should participa te in the determination of the maintenance program necessary for fuel tank lightning protection.

5.2.7 Lightning protection features that are not anticipated to degrade during the life of the aeroplane, and are identified as inherently reliable, do not req uire mandatory maintenance for compliance with CS 25.954(d) , but should be identified to EASA.

The integrity of conductive primary structures is an example of such features. A claim that lightning protection featur es are not anticipated to degrade during the life of the aeroplane when exposed to the effects of the environment, ageing, wear, corrosion, and likely damage must be substantiated and supported by data.

5.2.8 If a protection feature could degrade over the life of the aeroplane, it must be maintained using approved inspections and procedures consistent with the requirements of CS 25.954(d) .

Appendix A. Definitions The following definitions apply to the lightning prot ection of fuel tanks and systems of CS 25.954 and the guidance in this AMC.

A.1 ATTACHMENT POINT.

A point where the lightning flash contacts the aeroplane.

A.2 CONTINUED SAFE FLIGHT AND LANDING.

The aeroplane can safely abort or continue a take - off, or continue controlled flight and landing, possibly using emergency procedures. The aeroplane must do this without requiring exceptional pilot skill or strength. Some aeroplane damage may occur because of the failure condition or on landing. The pilot must be able to land the aeroplane safely at a suitable airport.

A.3 CRITICAL DESIGN CONFIGURATION CONTROL LIMITATIONS (CDCCLs).

A limitation requirement to preserve a critical design feature of a fuel system that is necessary for the design to meet the performance standards of CS 25.954 (and/or CS 25.981 ) throughout the life of the aeroplane model. The purpose of the CDCCL is t o provide instructions to retain the critical features during configuration changes that may be caused by alterations, repairs, or maintenance actions.

A.4 CRITICAL LIGHTNING STRIKE.

As defined by CS 25.954(a)(1) , a critical lightning strike is a lightning strike that attaches to the aeroplane in a location that, when combined with the failure of any design feature or structure, could create an ignition source.

A.5 ESCAPES.

Production or maintenance errors that can be anticipated to occur that could render the fault tolerance, or lightning protection ineffective.

Powered by EASA eRules Page 643 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM A.6 EXTREMELY IMPROBABLE FAILURE CONDITION.

Refer to the definition provided in Section 7 of AMC 25.1309 (qualitat ive and quantitative terms).

A.7 FAULT - TOLERANT DESIGN.

A design that precludes fuel systems ignition sources even when a fault is present.

A.8 FUEL SYSTEMS.

As defined by CS 25.954(a)(2) a fuel system includes any component within either the fuel tank structure or the fuel tank systems and any aeroplane structure or system components that penetrate, connect to, or are located within a fuel tank.

A.9 FUEL TANK STRUCTURE.

Includes structura l members of the fuel tank such as aeroplane skins, access panels, joints, ribs, spars, stringers, and the associated fasteners, brackets, coatings and sealant.

A.10 FUEL TANK SYSTEMS.

Tubing, components, and wiring that penetrate, are located within, or c onnected to the fuel tanks.

A.11 INTRINSICALLY SAFE.

Fuel system design elements that provide effective lightning protection with no foreseeable failure modes that would render them ineffective. These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that specific location.

A.12 LIGHTNING FLASH.

The total lightning event. It may occur in a cloud, between cl ouds, or between a cloud and the ground. It can consist of one or more return strokes, plus intermediate or continuing currents.

A.13 LIGHTNING STRIKE.

Attachment of the lightning flash to the aeroplane.

A.14 LIGHTNING STRIKE ZONES.

Aeroplane surface areas and structures that are susceptible to lightning attachment, dwell times, and current conduction.

A.15 LIGHTNING STROKE (RETURN STROKE).

A lightning current surge that occurs when the lightning leader (the initial current charge) makes contact with the gr ound or another charge centre. A charge centre is an area of high potential of opposite charge.

A.16 PRACTICALITY.

A balance of the available means, economic viability, and proportional benefit to safety.

A.17 RELIABLE DESIGN.

A reliable design is a design that provides lightning protection features that are not anticipated to degrade during the life of the aeroplane.

Powered by EASA eRules Page 644 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) F UEL SYSTEM A.18 RELIABLE FAULT TOLERANCE.

A fault - tolerant fuel system design is a design that precludes ignition sources in the fuel system even when a fault is present; ‘reliable’ means that the system has the ability to maintain the effectiveness of the protection features over the service life of the individual aeroplane.

A.19 REMOTE.

Refer to the definition provided in Section 7 of AMC 25.1309 (qualitative and quantitative terms).

A.20 SYSTEMS.

Systems include fuel, mechanical, hydraulic, electrical, and electrical wiring interconnection system (EWIS) components that penetrate, are located within, or connected to the fuel tanks.

Appendix B. Section 4 Examples B.1 EXAMPLES FOR PARAGRAPH 4.1.2.1 The design elements or features for which providing fault - tolerant prevention of lightning ignition sources should be practical include the: 1. Installation of r ivets and bolts in aluminium structures that are well bonded through processes that ensure the fastener/hole fit, fastener and hole quality, and installation practices; 2. Installation of bolts in composite structures that are well bonded through processes that ensure control of the fastener/hole fit, fastener and hole quality, and installation practices and with additional design features to distribute current, such as foil or mesh at the material surface; and the 3. Installation of lightning protective sealant or cap seals over fastener heads/ends located inside fuel tanks, where necessary.

B.2 EXAMPLES FOR PARAGRAPH 4.1.2.2 The design features or failures for which providing fault - tolerant prevention of lightning ignition sources could be imp ractical include: 1. Fatigue cracking within structural elements such as spars, skins, stringers, and ribs.

Typically, material controls, manufacturing controls, established material allowables, design margins, and life - cycle tests make the occurrence of s ignificant cracking rare.

2. Failures of fasteners highly loaded in tension that lead to separation of the fasteners or parts of the fasteners from the hole, or gapping of the heads or nuts of the fasteners, and the consequent failure of a cap seal. Typica lly, manufacturing controls, design margins, and life - cycle tests make the occurrence of broken bolts rare.

3. The installation of double cap seals or structurally reinforced cap seals to retain a bolt that fails under tension, resulting in a cascading fai lure of the cap seals.

4. Damage that may go undetected by scheduled or directed field inspection, and manufacturing defects in composite structures.

Powered by EASA eRules Page 645 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM B.3 EXAMPLES FOR PARAGRAPH 4.1.2.3 Some examples of practical design, manufacturing, and maintenance pro cesses are listed below. Although these practices themselves are not considered to be independent features for providing fault tolerance, they are measures to minimise the likelihood of failures, or measures necessary to support the assumptions about failu re modes or rates in a safety analysis.

1. A structured design review process (as described in this AMC) to ensure that all the relevant design features are reviewed to identify the critical design areas, critical processes, and associated testing and anal ysis requirements.

2. Engineering review of the proposed design to identify the failure modes that may occur because of manufacturing errors or escapes, maintenance errors, repairs or alterations, ageing, wear, corrosion, or likely damage.

3. Engineering r eview of manufacturing processes to identify the failure modes that may occur because of manufacturing errors or escapes.

4. Engineering review of service history records to identify the failure modes that may occur because of production escapes, maintenan ce errors, repairs or alterations, ageing, wear, corrosion, or likely damage.

5. Implementation of practical manufacturing and quality control processes to address the issues identified through the required engineering reviews.

6. For non - fault - tolerant lo cations, quality control processes that require inspections of critical features by a person other than the person that performed the manufacturing work.

7. Provisions in the ICA to identify cautions in maintenance documents regarding lightning protection features, as well as life limits or repetitive inspections for non - fault - tolerant features. For any penetration into the fuel tank, or any structural damage within the fuel tank, the SRM should specify the repair methods that maintain the lightning protect ion features.

8. Mandatory maintenance actions necessary to ensure compliance is maintained with the lightning protection requirements should be included in the Airworthiness Limitations Section of the ICA as required by Section H2 5.4 of Appendix H to CS - 25 .

B.4 EXAMPLE FOR PARAGRAPH 4.2.5.3 The following is an example of an assessment process addressing the potential for non - fault - tolerant fuel tank structural cracking. To assess the risk due to non - fault tolerance for structural c racks, the following should be accomplished: B.4.1 Determine whether the structure in this zone is susceptible to fatigue cracking. If it is susceptible to fatigue cracking, determine the minimum size of crack that could be a source for arcing. This crack length should then be compared with the inspection methods used for compliance with CS 25.571 (Damage Tolerance), to determine the ability to detect and/or the probability of detecting a crack of this size.

B.4.2 If the Airworthiness Limitations required for compliance with CS 25.571 are already sufficient to ensure that the probability is remote (unlikely to occur on each aeroplane — see AMC 25.1309 ) that a crack will grow to a sufficient size and gap in excess of that necessary to cause sparking during a lightning event, then no lightning - related Airworthiness Limitations are required. The probability of this remote condition Powered by EASA eRules Page 646 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM occurring, together with the remote probability of a critical lightning strike, make these combinations not foreseeable.

B.4.3 As part of the damage - tolerance evaluation, an analysis should be performed to determine the duration of time (in flight cycles) it will take for a crack of minimum arcing size to grow to the minimum detectable length. This crack propagation rate should then be used alo ng with the probability of detection for the specified inspection method to determine the exposure time. That exposure time is the number of flight cycles an aeroplane may be exposed to before an ignition source due to a structural failure (crack, failed f astener, etc.) occurs.

B.4.4 If the Airworthiness Limitations necessary to support compliance with CS 25.571 cannot ensure that the likelihood of a crack in excess of the size that would cause sparking is remote, a nd the crack would not be readily detectable within a few flights due to fuel leaks, then this condition must be included in the risk assessment of non - fault - tolerant conditions. Further, any practical maintenance inspection should be made to minimise the exposure time. A low probability combined with a short exposure time may be necessary to demonstrate that a catastrophic ignition is extremely improbable, i.e., it is not anticipated to occur during the entire operational life of all the aeroplanes of one type.

[Amdt 25/26]

CS 25.955 Fuel flow

ED Decision 2016/010/R (See AMC 25.955) (a) Each fuel system must provide at least 100% of the fuel flow required under each intended operating condition and manoeuvre. Compliance must be shown as follows: (1) Fuel m ust be delivered to each engine at a pressure within the limits specified in the engine type certificate.

(2) The quantity of fuel in the tank may not exceed the amount established as the unusable fuel supply for that tank under the requirements of CS 25.959 plus that necessary to show compliance with this paragraph.

(3) Each main pump must be used that is necessary for each operating condition and attitude for which compliance with this paragraph is shown, and the appropriate emergency pump must be substituted for each main pump so used.

(4) If there is a fuel flowmeter, it must be blocked and the fuel must flow through the meter or its bypass. (See AMC 25.955(a)(4) .)

(b) If an engine can be supplied with fuel from more than one tank, the fuel system must – (1) Reserved.

(2) For each engine, in addition to having appropriate manual switching capability, be designed to prevent interruption of fuel flow to that engine, without attention by the flight crew, when any tank supplying fuel to that engine is depleted of usable fuel during normal operation, and any other tank, that normally supplies fuel to that engine alone, contains usable fuel.

[Amdt 25/18] Powered by EASA eRules Page 647 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM

AMC 25.955(a)(4) Fuel f low

ED Decision 2003/2/RM The word ‘blocked’ should be interpreted to mean ‘with the moving parts fixed in the posit ion for maximum pressure drop’.

CS 25.957 Flow between interconnected tanks

ED Decision 2003/2/RM If fuel can be pumped from one tank to another in flight, the fuel tank vents and the fuel transfer system must be designed so that no structural damage to the tanks can occur because of overfilling.

CS 25.959 Unusable fuel supply

ED Decision 2003/2/RM T he unusable fuel quantity for each fuel tank and its fuel system components must be established at not less than the quantity at which the first evidence of engine malfunction occurs under the most adverse fuel feed condition for all intended operations an d flight manoeuvres involving fuel feeding from that tank. Fuel system component failures need not be considered.

CS 25.961 Fuel system hot weather operation

ED Decision 2003/ 2/RM (a) The fuel system must perform satisfactorily in hot weather operation. This must be shown by showing that the fuel system from the tank outlets to each engine is pressurised, under all intended operations, so as to prevent vapour formation, or must be shown by climbing from the altitude of the airport elected by the applicant to the maximum altitude established as an operating limitation under CS 25.1527 . If a climb test is elected, there may be no evidence of vapour lock or other malfunctioning during the climb test conducted under th e following conditions: (1) Reserved.

(2) For turbine engine powered aeroplanes, the engines must operate at take - off power for the time interval selected for showing the take - off flight path, and at maximum continuous power for the rest of the climb.

(3) The weight of the aeroplane must be the weight with full fuel tanks, minimum crew, and the ballast necessary to maintain the centre of gravity within allowable limits.

(4) The climb airspeed may not exceed – (i) Reserved.

(ii) The maximum airspeed estab lished for climbing from take - off to the maximum operating altitude.

(5) The fuel te mperature must be at least 43.3 ° C (110 ° F).

(b) The test prescribed in sub - paragraph (a) of this paragraph may be performed in flight or on the ground under closely simulate d flight conditions. If a flight test is performed in weather cold enough to interfere with the proper conduct of the test, the fuel tank surfaces, fuel lines, and other fuel system parts subject to cold air must be insulated to simulate, insofar as practi cable, flight in hot weather.

Powered by EASA eRules Page 648 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POW ERPLANT (CS - 25) FUEL SYSTEM

CS 25.963 Fuel tanks: general

ED Decision 20 16 / 010 /R (See AMC 25.963) (a) Each fuel tank must be able to withstand, without failure, the vibration, inertia, fluid and structural loads that it may be subjected to in operation. (See AMC 25.963(a) .)

(b) Flexible fuel tank liners must be app roved or must be shown to be suitable for the particular application.

(c) Integral fuel tanks must have facilities for interior inspection and repair.

(d) Fuel tanks must, so far as it is practicable, be designed, located and installed so that no fuel is r eleased in or near the fuselage or near the engines in quantities sufficient to start a serious fire in otherwise survivable emergency landing conditions , and: (1) Fuel tanks must be able to resist rupture and to retain fuel under ultimate hydrostatic desi gn conditions in which the pressure P within the tank varies in accordance with the formula: 𝑃 = 𝐾𝜌𝑔𝐿 where: P = fuel pressure in Pa (lb/ft ) at each point within the tank L = a reference distance in m (ft) between the point of pressure and the tank farthest boundary in the direction of loading.

3 3  = typical fuel density in kg/m (slugs/ft ) 2 2 g = acceleration due to gravity in m/s (ft/s ) K = 4.5 for the forward loading condition for fuel tanks outside the fuselage contour K = 9 for the forw ard loading condition for fuel tanks within the fuselage contour K = 1.5 for the aft loading condition K = 3.0 for the inboard and outboard loading conditions for fuel tanks within the fuselage contour K = 1.5 for the inboard and outboard loading con ditions for fuel tanks outside of the fuselage contour K = 6 for the downward loading condition K = 3 for the upward loading condition (2) For those (parts of) wing fuel tanks near the fuselage or near the engines, the greater of the fuel pressures res ulting from subparagraphs (i) and (ii) must be used: (i) the fuel pressures resulting from subparagraph (d)(1) above, and: (ii) the lesser of the two following conditions: (A) Fuel pressures resulting from the accelerations as specified in CS 25.561(b)(3) considering the fuel tank full of fuel at maximum fuel density. Fuel pressures based on the 9.0g forward acceleration may be calculated using the fuel static head equal to the streamwise local chord o f the tank. For inboard and outboard conditions, an acceleration of 1.5g may be used in lieu of 3.0g as specified in CS 25.561(b)(3) ; and: Powered by EASA eRules Page 649 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM (B) Fuel pressures resulting from the accelerations as specified in CS 25.561(b)(3) considering a fuel volume beyond 85% of the maximum permissible volume in each tank using the static head associated with the 85% fuel level. A typical density of the appropriate fuel may be used. For inb oard and outboard conditions, an acceleration of 1.5g may be used in lieu of 3.0g as specified in CS 25.561(b)(3) .

(3) Fuel tank internal barriers and baffles may be considered as solid boundaries if shown to be effective in limiting fuel flow.

(4) For each fuel tank and surrounding airframe structure, the effects of crushing and scraping actions with the ground should not cause the spillage of enough fuel, or generate temperatures that would constitute a fire ha zard under the conditions specified in CS 25.721(b) .

(5) Fuel tank installations must be such that the tanks will not rupture as a result of an engine pylon or engine mount or landing gear, tearing away as spec ified in CS 25.721(a) and (c) .

(See AMC 25.963(g) .)

(e) Fuel tank s must comply with the following criteria in order to avoid hazardous fuel leak : (1) Fuel tanks located i n an area where experience or analysis indicates a strike is likely, must be shown by analysis supported by test, or by test to address penetration and deformation by tyre and wheel fragments, small debris from uncontained engine failure or APU failure , or other likely debris (such as runway debris) .

(2) All fuel tank access covers must have the capacity to withstand the heat associated with fire at least as well as an access cover made from aluminium alloy in dimensions appropriate for the purpose for w hich they are to be used, except that the access covers need not be more resistant to fire than an access cover made from the base fuel tank structural material.

(See AMC 25.963(e) .)

(f) For pressurised fuel tanks, a means with failsafe features must be provided to prevent the build - up of an excessive pressure difference between the inside and the outside of the tank.

(g) (Reserved) [Amdt 25/3] [Amdt 25/14] [Amdt 25/18]

AMC 25.963(a) Fuel t anks: General

ED Decision 2003/2/RM Precautions should be taken against the possibility of corrosion resulting from microbi ological contamination of fuel.

Powered by EASA eRules Page 650 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM

AMC 25.963(d) Fuel t ank strength in emergency landing conditions

ED Decision 2007/010/R 1. PURPOSE. This AMC s ets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of CS - 25 related to the strength of fuel tanks in emergency landing conditions.

2. RELATED CERTIFICATION SPECIFICATIONS.

CS 25.561 “Emergency Landing Conditions – General”, CS 25.721 “Landing Gear – General” CS 25.994 “Fuel System Components” CS 25J994 “Fuel System Components” 3. BACKGROUND. For many years the JAA/EASA has required fuel tanks within the fuselage contour to be designed to withstand the inertial load factors prescribed for the emergency la nding conditions as specified in JAR/CS 25.561. These load factors have been developed through many years of experience and are generally considered conservative design criteria applicable to objects of mass that could injure occupants if they came loose i n a minor crash landing.

a. A minor crash landing is a complex dynamic condition with combined loading. However, in order to have simple and conservative design criteria, the emergency landing forces were established as conservative static ultimate load factors acting in each direction independently.

b. Recognising that the emergency landing load factors were applicable to objects of mass that could cause injury to occupants and that the rupture of fuel tanks in the fuselage could also be a serious haza rd to the occupants, § 4b.420 of the Civil Air Regulations (CAR) part 4b (the predecessor of FAR 25) extended the emergency landing load conditions to fuel tanks that are located within the fuselage contour. Even though the emergency landing load factors w ere originally intended for solid items of mass, they were applied to the liquid fuel mass in order to develop hydrostatic pressure loads on the fuel tank structure. The application of the inertia forces as a static load criterion (using the full static he ad pressure) has been considered a conservative criterion for the typical fuel tank configuration within the fuselage contour. This conservatism has been warranted considering the hazard associated with fuel spillage.

c. CS 25.963 has required that fuel tanks, both in and near the fuselage, resist rupture under survivable crash conditions. The advisory material previously associated with CS 25.963 specifies design requirements for all fuel tanks that, if ruptured, could release fuel in or near the fuselage or near the engines in quantities sufficient to start a serious fire.

d. In complying with this CS requirement for wing tanks, several different techniques have been used by manufacturers to develop the fuel ta nk pressure loads due to the emergency landing inertia forces. The real emergency landing is actually a dynamic transient condition during which the fuel must flow in a very short period of time to re - establish a new level surface normal to the inertial fo rce. For many tanks such as large swept wing tanks, the effect is that the actual pressure forces are likely to be much less than that which would be calculated from a static pressure based on a steady state condition using the full geometric pressure head . Because the use of the full pressure head results in unrealistically high pressures and creates a severe design penalty for wing tanks in swept wings, some manufacturers have used the local streamwise head rather Powered by EASA eRules Page 651 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM than the full head. Other manufacturers h ave used the full pressure head but with less than a full tank of fuel. These methods of deriving the pressures for wing tanks have been accepted as producing design pressures for wing tanks that would more closely represent actual emergency landing condit ions. The service record has shown no deficiency in strength for wing fuel tanks designed using these methods.

e. FAR 25 did not contain a requirement to apply fuel inertia pressure requirements to fuel tanks outside the fuselage contour, however, the FA A (like the JAA) has published Special Conditions to accomplish this for fuel tanks located in the tail surfaces. The need for Special Conditions was justified by the fact that these tanks are located in a rearward position from which fuel spillage could d irectly affect a large portion of the fuselage, possibly on both sides at the same time.

4. GENERAL. CS 25.963(d) requires that fuel tanks must be designed, located, and installed so that no fuel is released in quantities sufficient to start a serious fi re in otherwise survivable emergency landing conditions. The prescribed set of design conditions to be considered is as follows: a. Fuel tank pressure loads. CS 25.963(d)(1) provides a conservative method for establishing the fuel tank ultimate emergency landing pressures. The phrase “fuel tanks outside the fuselage contour” is intended to include all fuel tanks where fuel spillage through any tank boundary would remain physically and environmentally isolated from occupied compartments by a barrier that i s at least fire resistant as defined in CS - Definitions. In this regard, cargo compartments that share the same environment with occupied compartments would be treated the same as if they were occupied. The ultimate pressure criteria are different depending on whether the fuel tank under consideration is inside, or outside the fuselage contour. For the purposes of this paragraph a fuel tank should be considered inside the fuselage contour if it is inside the fuselage pressure shell.

If part of the fuel tank pressure boundary also forms part of the fuselage pressure boundary then that part of the boundary should be considered as being within the fuselage contour. Figures 1 and 2 show examples of an underslung wing fuel tank and a fuel tank within a moveable ta ilplane, respectively, both of which would be considered as being entirely outside of the fuselage contour.

The equation for fuel tank pressure uses a factor L, based upon fuel tank geometry. Figure 3 shows examples of the way L is calculated for fuel pressures arising in the forward loading condition, while Figure 4 shows examples for fuel pressures arising in the outboard loading condition.

For Jet A( - 1) fuel, a typical density of 785.0 kg/m3 (6.55 lb/US gallon) may be assumed.

Any internal barriers to free flow of fuel may be considered as a solid pressure barrier provided: (1) It can withstand the loads d ue to the expected fuel pressures arising in the conditions under consideration; and (2) The time “T” for fuel to flow from the upstream side of the barrier to fill the cell downstream of the barrier is greater than 0.5 second. “T” may be conservatively estimated as: Powered by EASA eRules Page 652 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM V 𝑇 = 𝑗 ∑ 𝐶 𝑎 √ 2 𝑔 ℎ 𝐾 𝑑𝑖 𝑖 𝑖 𝑖 = 1 where: V= the volume of air in the fuel cell downstream of the barrier assuming a full tank at 1g flight conditions. For this purpose a fuel cell should be considered as the volume enclosed by solid barriers. In lieu of a more rational analysis, 2% of the downstream fuel volume should be assumed to be trapped air; j = the total number of orifices in baffle rib; Cdi = the discharge coefficient for orifice i. The discharge coefficient may be conservatively assumed to be equal to 1.0 or it may be rationally based up on the orifice size and shape; ai = the area for orifice i; g = the acceleration due to gravity; hi = the hydrostatic head of fuel upstream of orifice i, including all fuel volume enclosed by solid barriers; K = the pressure design factor for the c ondition under consideration.

b. Near the fuselage/near the engines (Compliance with CS 25.963(d)(2) .)

(1) For aircraft with wing mounted engines: (i) The phrase “near the fuselage” is addressing those (parts of) wing fuel tanks located between the fu selage and the most inboard engine; (ii) The phrase “near the engine” is addressing those (parts of) wing fuel tanks as defined in AMC 20 - 128A, figure 2, minimum distance of 10 inches (254 mm) laterally from potential ignition sources of the engine nacel le.

(2) For aircraft with fuselage mounted engines, the phrase “near the fuselage” is addressing those (parts of) wing fuel tanks located within one maximum fuselage width outside the fuselage boundaries.

c. Protection against crushing and scraping action (Compl iance with CS 25.963(d)(4) and CS 25.721(b) and (c) .).

Each fuel tank should be protected against the effects of crushing and scraping action (including thermal effects) of the fuel tank and surrounding airframe s tructure with the ground under the following minor crash landing conditions: (i) An impact at 1.52 m/s (5 fps) vertical velocity on a paved runway at maximum landing weight, with all landing gears retracted and in any other possible combination of gear l egs not extended. The unbalanced pitching and rolling moments due to the ground reactions are assumed to be reacted by inertia and by immediate pilot control action consistent with the aircraft under control until other structure strikes the ground. It sho uld be shown that the loads generated by the primary and subsequent impacts are not of a sufficient level to rupture the tank. A reasonable attitude should be selected within the speed range from VL1 to 1.25 VL2 based upon the fuel tank arrangement.

Powered by EASA eRules Page 653 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM VL1 e quals to VS0 (TAS) at the appropriate landing weight and in standard sea - level conditions, and VL2 equals to VS0 (TAS) at the appropriate landing weight and altitudes in a hot day temperature of 22.8 degrees C (41 degrees F) above standard.

(ii) Sliding on the ground starting from a speed equal to VL1 up to complete stoppage, all gears retracted and with up to a 20° yaw angle and as a separate condition, sliding with any other possible combination of gear legs not extended and with a 0° yaw angle. The effects of runway profile need not be considered.

(iii) The impact and subsequent sliding phases may be treated as separate analyses or as one continuous analysis. Rational analyses that take into account the pitch response of the aircraft may be uti lised, however care must be taken to assure that abrasion and heat transfer effects are not inappropriately reduced at critical ground contact locations.

(iv) For aircraft with wing mounted engines, if failure of engine mounts, or failure of the pylon or its attachments to the wing occurs during the impact or sliding phase, the subsequent effect on the integrity of the fuel tanks should be assessed.

Trajectory analysis of the engine/pylon subsequent to the separation is not required.

(v) The above emerg ency landing conditions are specified at maximum landing weight, where the amount of fuel contained within the tanks may be sufficient to absorb the frictional energy (when the aircraft is sliding on the ground)without causing fuel ignition. When lower fue l states exist in the affected fuel tanks these conditions should also be considered in order to prevent fuel - vapour ignition.

d. Engine / Pylon separation. (Compliance with CS 25.721(c) and CS 25.963(d)(5) .)

Fo r configurations where the nacelle is likely to come into contact with the ground, failure under overload should be considered. Consideration should be given to the separation of an engine nacelle (or nacelle + pylon) under predominantly upward loads and u nder predominantly aft loads. The predominantly upward load and the predominantly aft load conditions should be analysed separately. It should be shown that at engine/pylon failure the fuel tank itself is not ruptured at or near the engine/pylon attachment s.

e. Landing gear separation. (Compliance with CS 25.721(a) and CS 25.963(d)(5) .)

Failure of the landing gear under overload should be considered, assuming the overloads to act in any reasonable combination of v ertical and drag loads, in combination with side loads acting both inboard and outboard. In the absence of a more rational analysis, the side loads must be assumed to be up to 20% of the vertical load or 20% of the drag load, whichever is greater. It shoul d be shown that at the time of separation the fuel tank itself is not ruptured at or near the landing gear attachments. The assessment of secondary impacts of the airframe with the ground following landing gear separation is not required.

If the subsequent trajectory of a separated landing gear would likely puncture an adjacent fuel tank, design precautions should be taken to minimise the risk of fuel leakage.

f. Compliance with the provisions of this paragraph may be shown by analysis or tests, or both.

Powered by EASA eRules Page 654 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 5. OTHER CONSIDERATIONS a. Supporting structure. In accordance with CS 25.561(c) all large mass items that could break loose and cause direct injury to occupants must be restrained under all loads specified in CS 25.561(b). To meet this requirem ent, the supporting structure for fuel tanks, should be able to withstand each of the emergency landing load conditions, as far as they act in the 'cabin occupant sensitive directions', acting statically and independently at the tank centre of gravity as i f it were a rigid body. Where an empennage includes a fuel tank, the empennage structure supporting the fuel tank should meet the restraint conditions applicable to large mass items in the forward direction.

Figure 1: Diagram of Fuel Tank in Underslung W ing that is Outside of the Fire Resistant Boundary Figure 2: Diagram of Fuel Tank Within a Movable Tailplane Powered by EASA eRules Page 655 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM Figure 3 Example of Distances for Fuel Forward Acting Design Pressure Calculations Powered by EASA eRules Page 656 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM Figure 4 – Example of Distances for Fuel Outboard Acting Design Pressure Calculations [Amdt 25/3]

AMC 25.963(e) Fuel Tank Protection

ED Decision 20 13 / 033 /R 1. PURPOSE. This AMC sets forth a means of compliance with the provisions of CS - 25 dealing with the certification requirements for fuel tank s (including sk in and fuel tank access covers) on large aeroplanes. Guidance information is provided for showing compliance with the impact and fire resistance requirements of CS 25.963(e) .

2. BACKGROUND. Fuel tank s have failed in service due to impact with high speed objects such as failed tyre tread material and engine debris following engine failures. Failure of a fuel tank may result in hazardous fuel leak .

3. IMPACT RESISTANCE.

a. All fuel tanks must be designed to address penetration and deformation by tyre fragments, wheel fragments, small debris from uncontained engine failure or APU failure , or other likely debris (such as runway debris) , unless the fuel tanks are located in an area where service experience or analysis indicates a strike is not likely. The rule does not specify rigid standards for impact resistance because of the wide range of likely debris which could impact the fuel tanks . The applicant should, however, choose to m inimise penetration and deformation by analysis supported by test, or test of fuel tanks using Powered by EASA eRules Page 657 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM debris of a type, size, trajectory and velocity that represents conditions anticipated in actual service for the aeroplane model involved. There should be no haz ardous fuel leak after impact .

A hazardous fuel leak results if debris impact to a fuel tank surface (or resulting pressure wave) causes: a) a running leak, b) a dripping leak, or c) a leak that, 15 minutes after wiping dry, results in a wetted aeroplan e surface exceeding 15.2 cm (6 in) in length or diameter.

The leak should be evaluated under maximum fuel pressure (1g on ground with full fuel volume, and also considering any applicable fuel tank pressurisation).

b. T he following may be used for evaluati ng fuel tanks for impact resistance to tyre , wheel, engine and APU debris. Furthermore, protecting the fuel tank against the threats defined in the models below would also protect against threats originating from foreign objects projected from the runway.

(i) Wheel and Tyre Debris - Fuel tanks must be protected against threats from wheel and tyre failures. Refer to AMC 25.734, which provides wheel and tyre failure threat models.

(ii) Engine Debris - The following provides the definition of a debris model t o be used for protection of the fuel tanks against the threat of small engine debris (propulsion engines). It also describes how the debris model impacts a surface and a pass - fail criteria is provided.

This debris model is considered to be representative o f the threat created by engine small non - rotating and rotating parts debris, including ricochets, occurring after an uncontained engine failure event. It is considered to address High Bypass Ratio and Low Bypass Ratio turbine engines.

Note: AMC 20 - 128A rem ains applicable to engine debris, other than small engine fragments, threatening fuel tanks as described here, and also remains applicable to all engine debris to other areas of the aircraft structures and systems .

A. Definition of the debris A solid steel cube with a 9.5 mm (3/8 in) edge length.

B. Velocity of the debris The velocity of the cube at the impact is 213.4 m/s (700 ft/s).

C. Impact areas and pass - fail criteria Two areas are to be considered. See also Figure 1 below.

(1) ± 15 - degree area Within 15 degrees forward of the fan plane (or front engine compressor if no fan) measured from the centre of rotation to 15 degrees aft of the rearmost engine turbine plane measured from the centre of rotation, a normal impact is used (i.e. the angle bet ween the trajectory of the debris and the surface is 90 degrees).

Powered by EASA eRules Page 658 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM The impact should not create a hazardous fuel leak (see definition in paragraph 3.a of this AMC).

The leak should be evaluated under maximum fuel pressure (1g on ground with full fuel volum e, and also considering any applicable fuel tank pressurisation).

(2) Area between – 15 and – 45 degrees (aft of the rearmost engine turbine plane) Within this area, the angle of impact (see Figure 1, α and β angles) is defined by the trajectory of the deb ris originating from the centre of rotation of the rearmost engine turbine plane.

Similarly, as within the ± 15 - degree area, the impact should not create a hazardous fuel leak.

D. Guidance material — When showing compliance with oblique impacts, it is acce ptable to consider a normal impact using a debris velocity at impact equal to the normal component of the oblique velocity vector.

— Orientation of the cube at the impact: testing and analysis should ensure that all orientations (side - on, edge - on, and corne r - on) are represented.

— Impact tests should be completed in adequate number to show repeatable stable localised damage modes and damage extents for all impactor orientations (side - on, edge - on, and corner - on).

Note: α and β angles are examples of possible angles between the fuel tank skin and the debris trajectory at the impact.

Figure 1 — Cube impact angles Powered by EASA eRules Page 659 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM Figure 2 — Example of the ± 15 - degree threat area representation Note: The threat area between – 15 and – 45 degrees is not represented.

(iii) APU Debris — For small APU debris, the small fragment model as defined in AMC 20 - 128A applies. The impact should not create a hazardous fuel leak (as defined in paragraph 3.a above).

Note: AMC 20 - 128A remains applicable to APU debris, other than small APU fragments, threatening fuel tanks as described here, and also remains applicable to all APU debris to other areas of the aircraft structures and systems.

4. RESISTANCE TO FIRE Fuel tank access covers meet the requirements of CS 25.963(e) (2) if they are fabricated from solid aluminium or titanium alloys, or steel. They also meet the above requirement if one of the following criteria is met.

a. The covers can withstand the test of AC 20 - 135, “Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria”, issued 2/9/90, or ISO 2685 - 1992(E), “Aircraft Environment conditions and test procedures for airborne equipment - Resistance to fire in designated fire zones”, for a period of time a t least as great as an equivalent aluminium alloy in dimensions appropriate for the purpose for which they are used.

b. The covers can withstand the test of AC 20 - 135, Powerplant Installation and Propulsion System Component Fire Protection Test Methods, St andards, and Criteria, issued 2/9/90, or ISO 2685 - 1992(E), Aircraft - Environment conditions and test procedures for airborne equipment - Resistance to fire in designated fire zones, for a period of time at least as great as the minimum thickness of the su rrounding wing structure.

Powered by EASA eRules Page 660 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM c. The covers can withstand the test of AC 20 - 135, Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria, issued 2/9/90, or ISO 2685 - 1992(E), Aircraft - Environment conditi ons and test procedures for airborne equipment - Resistance to fire in designated fire zones, for a period of 5 minutes. The test cover should be installed in a test fixture representative of actual installation in the aeroplane. Credit may be allowed for fuel as a heat sink if covers will be protected by fuel during all likely conditions. The maximum amount of fuel that should be allowed during this test is the amount associated with reserve fuel. Also, the static fuel pressure head should be accounted for during the burn test. There should be no burn - through or distortion that would lead to fuel leakage at the end of the tests; although damage to the cover and seal is permissible.

[Amdt 25/3] [Amdt 25/14]

AMC 25.963(g) Fuel t anks: General

ED Decision 2007 / 010/R (Revoked) [Amdt 25/3]

CS 25.965 Fuel tank tests

ED Decision 2003/ 2/RM (a) It must be shown by tests that the fuel tanks, as mounted in the aeroplane can withstand, without failure or leakage, the more critical of the pressures resulting from the c onditions specified in sub - paragraphs (a)(1) and (2) of this paragraph. In addition it must be shown by either analysis or tests, (see AMC 25.965(a) ) that tank surfaces subjected to more critical pressures resultin g from the conditions of sub - paragraphs (a)(3) and (4) of this paragraph, are able to withstand the following pressures: (1) An internal pressure of 24 kPa (3·5 psi).

(2) 125% of the maximum air pressure developed in the tank from ram effect.

(3) Fluid pressures developed during maximum limit accelerations, and deflections, of the aeroplane with a full tank.

(4) Fluid pressures developed during the most adverse combination of aeroplane roll and fuel load.

(b) Each metallic tank with large unsupport ed or unstiffened flat surfaces, whose failure or deformation could cause fuel leakage, must be able to withstand the following test, or its equivalent, without leakage or excessive deformation of the tank walls: (1) Each complete tank assembly and its sup ports must be vibration tested while mounted to simulate the actual installation.

(2) Except as specified in sub - paragraph (b)(4) of this paragraph, the tank assembly must be vibrated for 25 hours at an amplitude of not less than 0.8 mm (1/32 of an inch) ( unless another amplitude is substantiated) while two - thirds filled with water or other suitable test fluid.

Powered by EASA eRules Page 661 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM (3) The test frequency of vibration must be as follows: (i) If no frequency of vibration resulting from any rpm within the normal operating range of engine speeds is critical, the test frequency of vibration must be 2 000 cycles per minute.

(ii) If only one frequency of vibration resulting from any rpm within the normal operating range of engine speeds is critical, that frequency of vibration must b e the test frequency.

(iii) If more than one frequency of vibration resulting from any rpm within the normal operating range of engine speeds is critical, the most critical of these frequencies must be the test frequency.

(4) Under sub - paragraph (b)(3) (ii) and (iii) of this paragraph, the time of test must be adjusted to accomplish the same number of vibration cycles that would be accomplished in 25 hours at the frequency specified in sub - paragraph (b)(3)(i) of this paragraph.

(5) During the test, the tank assembly must be rocked at the rate of 16 to 20 complete cycles per minute, through an angle of 15 ° on b oth sides of the horizontal (30 ° total), about the most critical axis, for 25 hours. If motion about more than one axis is likely to be critical, the ta nk must be rocked about each critical axis for 12·5 hours.

(c) Except where satisfactory operating experience with a similar tank in a similar installation is shown, non - metallic tanks must withstand the test specified in sub - paragraph (b)(5) of this parag raph, wit h fuel at a temperature of 43.3 ° C (110 ° F). During this test, a representative specimen of the tank must be installed in a supporting structure simulating the installation in the aeroplane.

(d) For pressurised fuel tanks, it must be shown by analys is or tests that the fuel tanks can withstand the maximum pressure likely to occur on the ground or in flight.

AMC 25.965(a) Fuel tank t ests

ED Decision 2003/2/RM The analysis or tests should be performed on each complete tank in the configuration ready a nd capable of flight. Each complete tank means any tank fully equipped which is isolated from other tanks by tank walls or which may be isolated by valves un der some flight configurations.

CS 25.967 Fuel tank installations

ED Decision 2016 / 010/R (See AMC 25.967) (a) Each fuel tank must be supported so that tank loads (resulting from the weight of the fuel in the tanks) are not concentrated on unsupported tank surfaces. In addition – (1) There must be pads, if necessary, to prevent chafing between the tank and its supports; (2) Padding must be non - absorbent or treated to prevent the absorption of fluids; (3) If a flexible tank liner is used, it must be supported so that it is not required to withstand fluid loads (see AMC 25.967(a)(3) ); and Powered by EASA eRules Page 662 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM (4) Each interior surface of the tank compartment must be smooth and free of projections that could cause wear of the liner unless – (i) Provisions are made for protection of the liner at these points; or (ii) That construction of the liner itself provides that protection.

(b) Spaces adjacent to tank surfaces must be ventilated to avoid fume accumulation due to minor leakage. If the tank is in a sealed compartment, ventilation may be limite d to drain holes large enough to prevent excessive pressure resulting from altitude changes.

(c) The location of each tank must meet the requirements of CS 25.1185(a) .

(d) No engine nacelle skin immediately behind a major air outlet from the engine compartment may act as the wall of an integral tank.

(e) Each fuel tank must be isolated from personnel compartments by a fumeproof and fuelproof enclosure.

[Amdt 25/18]

AMC 25.967(a)(3) Fuel tank i nstallation

ED Decision 2003/2/RM The installation of a flexible tank and its venting, according to CS 25.975(a)(3) should be such that the tank liner will not be deformed in such a way as to significantly affec t the fuel quantity indic ation.

CS 25.969 Fuel tank expansion space

ED Decision 2003/2/RM Each fuel tank must have an expansion space of not less than 2% of the tank capacity. It must be impossible to fill the expansion space inadvertently with the aeroplane in the normal ground attitude.

For pressure fuelling systems, compliance with this paragraph may be shown with the means provided to comply with CS 25.979(b) .

CS 25.971 Fuel tank sump

ED Decision 2003/ 2/RM (a) Each fuel tank must hav e a sump with an effective capacity, in the normal ground attitude, of not less than the greater of 0·10% of the tank capacity or one - quarter of a litre unless operating limitations are established to ensure that the accumulation of water in service will n ot exceed the sump capacity.

(b) Each fuel tank must allow drainage of any hazardous quantity of water from any part of the tank to its sump with the aeroplane in the ground attitude.

(c) Each fuel tank sump must have an accessible drain that – (1) Allows complete drainage of the sump on the ground; (2) Discharges clear of each part of the aeroplane; and (3) Has manual or automatic means for positive locking in the closed position.

Powered by EASA eRules Page 663 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM

CS 25.973 Fuel tank filler connection

ED Decision 2003/2/RM Each fuel tank filler connection must prevent the entrance of fuel into any part of the aeroplane other than the tank itself. In addition – (a) Reserved (b) Each recessed filler connection that can retain any appreciable quantity of fuel must have a drain that discharges clear of each part of the aeroplane; (c) Each filler cap must provide a fuel - tight seal; and (d) Each fuel filling point must have a provision for electrically bonding the aeroplane to ground fuelling equipment.

CS 2 5.975 Fuel tank vents

ED Decision 2018 / 005/R (a) Fuel tank vents . Each fuel tank must be vented from the top part of the expansion space so that venting is effective under any normal flight condition. In addition – (1) Each vent must be arranged to avoid stoppage by dirt or ice formation; (2) The vent arrangement must prevent siphoning of fuel during normal operation; (3) The venting capacity and vent pressure levels must maintain acceptable differences of pressure between the interior and exterior of the tank, during – (i) Normal flight operation; (ii) Maximum rate of ascent and descent; and (iii) Refuelling and defuelling (where applicable); (4) Airspaces of tanks with interconnected outlets must be interconnected; (5) There may be no point in any vent line where moisture can accumulate with the aeroplane in the ground attitude or the level flight attitude, unless drainage is provided; (6) No vent or drainage provision may end at any point: (i) Where the discharge of fuel from the vent outlet would cons titute a fire hazard; or (ii) From which fumes could enter personnel compartments; and (7) Each fuel tank vent system must prevent explosions, for a minimum of 2 minutes and 30 seconds, caused by the propagation of flames from outside the tank through the fuel tank vents into the fuel tank vapour spaces when any fuel tank vent is continuously exposed to flames. (See AMC 25.975(a)(7) ) [Amdt 25/21]

AMC 25.975(a)(7) Fuel tank vent fire protection

ED Decision 2018/005/R 1. Purpose This AMC provides guidance and acceptable means of compliance with CS 25.975(a)(7) and the related specifications for the prevention of fuel tank explosions caused by the ignition of vapours outside fuel tank vents.

Powered by EASA eRules Page 664 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 2. References 2.1. Related certification specifications: — CS 25.863 Flammable fluid fire protection — CS 25.867 Fire protection: other components — CS 25.901 Installation (paragraphs (b)(2) and (c)) — CS 25.954 Fuel system lightning protection — CS 25.963 Fuel tanks: general (paragraphs (d) and (e)(2)) — CS 25.981 Fuel tank ignition prevention.

2.2. Technical publications — Hill, Richard and George R. Johnson, Investigation of Aircraft Fuel Tank Explosions and Nitrogen Inerting Requirements During Ground Fires, FAA Technical R eport No. FAA - RD - 75 - 119. Washington, D.C.: U.S. Department of Transportation, 1975 — FAA Technical Report ADS - 18, National Technical Information Service (NTIS), Lightning Protection Measures for Aircraft Fuel Systems. Springfield, VA: U.S.

Department of Comm erce, 1964 — Military Standard, Environmental Engineering Considerations and Laboratory Test Methods, MIL - STD - 810G w/Change1, Method 511.6 Procedure II. Philadelphia, PA: U.S. Department of Defense, 2014 — RTCA, Inc., Environmental Conditions and Test Procedur es for Airborne Equipment, RTCA/DO - 160G. Washington DC: RTCA, Inc., 2010 — Coordinating Research Council, Inc., Handbook of Aviation Fuel Properties. Atlanta, GA: CRC, Inc., 2004 — Kuchta, Joseph M., Summary of Ignition Properties of Jet Fuels and Other Aircra ft Combustible Fluids, Technical Report AFAPL - TR - 75 - 70. Springfield, VA: U.S.

Department of Commerce, 1975 3. Definitions — Autogenous Ignition (Auto - Ignition) Temperature (AIT). The minimum temperature at which an optimised flammable vapour and air mixture will spontaneously ignite when heated to a uniform temperature in a normal atmosphere without an external source of ignition, such as a flame or spark.

— Flammability Limit . The highest and lowest concentration of fuel - in - air - by - volume per cent that will sus tain combustion. A fuel - to - air mixture below the lower limit is too lean to burn, while a mixture above the upper limit is too rich to burn. The flammability limit varies with altitude and temperature and is typically presented on a temperature - versus - alti tude plot.

— Flash Point . The minimum temperature at which a flammable liquid will produce flammable vapour at sea level ambient pressure.

— Flame Holding . The ability of a flame arrestor to halt the propagation of a flame front through a passage.

— Ignition Source . A source of sufficient energy to initiate combustion of a fuel - air mixture.

Hot surfaces that can exceed the auto - ignition temperature of the flammable vapour Powered by EASA eRules Page 665 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM under consideration are considered to be ignition sources. Electrical arcs, elec trical sparks, and friction sparks are also considered to be ignition sources if sufficient energy is released to initiate combustion.

— Stoichiometric Ratio . The ratio of fuel to air corresponding to the condition in which the available amounts of fuel and oxygen completely react with each other, thereby resulting in combustion products that contain neither fuel nor oxygen.

4. Acceptable means of compliance Acceptable means of compliance with CS 25.975(a)(7) include: — flame arrestors in the fuel tank vents that prevent flame propagation into the fuel tank (see paragraph 5 of this AMC); — fuel tank inerting systems that exceed the basic requirements of CS 25.981 and prevent fuel tank explosions* (see paragraph 7.1 of this AMC); — fuel tank pressurisation systems or features of the system that result in a closed vent system and that are effective in preventing a fuel tank explosion during all operating conditions (e.g. taxiing, take - off, landing, refuelling, etc.) and pos t - crash fire conditions (see paragraph 7.2 of this AMC); and — fuel tank or vent system fire suppression systems that prevent a fuel tank explosion with a fire present at the fuel tank vent outlet for the required 2 minutes and 30 seconds (see paragraph 7.3 of this AMC).

* Fuel tank inerting systems that meet CS 25.981 would not necessarily be adequate for demonstrating compliance with CS 25.975 because CS 25.981 does not require the fuel tank ullage to be fully inert at all times. If inerting is used as the means of compliance with CS 25.975 , the inerting system must be effective in preventing flame that is present at the vent outlet from propagating to the fuel tank. The applicant should show this during normal operating conditions, all foreseeable ground fire conditions (e.g. from refuelling, refuelling overflow, etc.), and post - crash ground f ire conditions.

5. Flame arrestors 5.1. This paragraph describes the use of flame arrestors as a means of meeting the 2 - minute and 30 - second time requirements defined in CS 25.975(a)(7) . The guidance is based on evaluating the flame arrestor performance during critical case conditions anticipated to occur when fire is adjacent to the fuel tank vent outlet. The flame arrestor should meet the performance described in this AMC during post - crash ground fires or other fire scenarios such as those resulting from fuel leakage due to fuel tank damage or fuel spilled during refuelling mishaps.

5.2. Flame arrestors that meet the standards defined in this AMC may not be effective in preventing the propagation of fires that m ay occur following lightning strikes near the fuel tank vent outlet. The ignition of fuel vapours near the vent outlet caused by lightning results in a high - speed pressure wave that can travel through the flame arrestor without sufficient time for the heat transfer necessary for the flame arrestor to quench the flame front. Instead, fuel tank vent lightning protection may be addressed as discussed in AMC 25.954 ‘Fuel System Lightning Protection’, which is based on locating vents outside the lightning strike zones of the aeroplane. While aeroplane manufacturers have used flame arrestors to address lightning protection in several instances, they needed dedicated t esting that addressed the unique design features to demonstrate the effectiveness of the installation. The guidance in this AMC is intended to address Powered by EASA eRules Page 666 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM compliance with CS 25.975(a)(7) and is not intended to be used as guidance for showing compliance with the lightning protection requirements in CS 25.954 .

5.3. The installation of flame arrestors in the aeroplane fuel vent system will affect the performance of the fuel tank v ent system. The applicant should account for factors such as the introduction of a flow restriction and the associated increase in the pressure drop during refuelling system failure conditions, as well as the impact of environmental conditions such as icin g and lightning, when requesting approval of the fuel tank installation. Means of compliance for these considerations are not addressed in this AMC.

General fuel system guidance is provided in AMC 25.963 and AMC 25.981 .

5.4. Previous results from flame arrestor performance tests indicated that the critical condition for evaluating the effectiveness of the flame arrestor occurs when the flame front contacts the surface of th e flame arrestor, which results in heating of the flame arrestor. As the flame arrestor is heated, the ability of the flame arrestor to absorb energy may be reduced, resulting in its inability to quench the flame. Once this occurs, the flame will then pass through the flame arrestor, resulting in flashback. It is important to realise that flashback through heated flame arrestor channels, which normally quench flames, should not be confused with auto - ignition or hot surface ignition. Flashback will occur whe n the rate of heat loss to the channel wall is insufficient to quench the flame. In this case, the wall acts as an inadequate heat sink and not as an ignition source. The flame retains sufficient heat energy to pass to the upstream side of the flame arrest or.

5.5. Flame propagation past the flame arrestor may also occur due to the ignition of flammable vapours by hot surfaces. The time it takes for the assembly surfaces on the internal side of the flame arrestor, including the line and housing, to be heate d to a temperature higher than the AIT of the flammable vapour mixture could be the limiting factor in establishing the effectiveness of the flame arrestor assembly. The ignition of combustible mixtures by hot surfaces (auto - ignition) involves different ph enomena from the phenomena involved in flashback as discussed in paragraph 5.4 of this AMC. For auto - ignition to occur, a portion of the combustible gas must dwell near a hot surface long enough for the amount of chemical heat produced to become greater th an the heat dissipated to the surroundings. The maximum dwell time (commonly termed the ‘ignition lag’) is a function of the heat transfer characteristics of the gas and the heat source, as well as the kinetics of the combustion process. For this reason, t he surface area and the shape of the hot surface, and the flow field around the heat source, are critical factors in determining whether ignition will occur.

5.6. The test conditions defined in this AMC are intended to evaluate the effectiveness of flame arrestors during two conditions. The first condition is the ignition, by an external source, of flammable vapours at the fuel tank vent outlet. The flame arrestor should be effective in stopping the initial propagation of flames. The second condition is a continuous flow of vapour exiting the fuel vent. The flame arrestor should hold the flames without passing the flames to the upstream portion of the vent system. The applicant should determine the critical test conditions following a review and analysis of the particular flame arrestor installation and its characteristics.

5.7. The conditions under which the flame arrestor should be effective include those where flammable fluid vapours are exiting the fuel tank at flow rates that vary from no flow, which t ypically occurs during normal ground operations, to high - flow conditions, which typically occur during refuelling or when the fuel tank is heated due to a ground fire following an accident.

Powered by EASA eRules Page 667 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 5.8. The applicant should conduct an analysis to determine the pa ss/fail criteria for the aeroplane - specific flame arrestor installation. The analysis should include consideration of hot surface ignition when determining whether the flame arrestor assembly meets the explosion prevention requirement of 2 minutes and 30 s econds. The maximum surface temperatures of the flame arrestor installation and the flame arrestor should be established when meeting the requirement. The applicant should consider the velocity of the flammable fluid vapour on the surface of the flame arre stor and the duct sidewall upstream (tank) side of the flame arrestor. Provided that a uniform vapour velocity is present (i.e. there are no areas of stagnation), a heat source whose temperature exceeds the AITs quoted for static conditions (typically 230 °C/450 °F) will not cause ignition in the flame arrestor installation. Data in the Handbook of Aviation Fuels Properties (see Chapter 2.2 of this AMC) show the relationships between vapour velocities and AITs. Test results from developmental testing of fla me arrestors installed in fuel vent lines have shown that ignition will not occur if the temperature of the centre of the flame arrestor remains below 370 °C/700 °F. However, this temperature limit may not be appropriate for other surfaces in the flame arr estor installation where a uniform flammable vapour flow is not present. The applicant should analyse the flame arrestor design to determine the critical locations and fuel vapour flow conditions that result in the highest surface temperatures, and run an adequate number of test conditions to validate the analysis.

6. Demonstrating compliance using flame arrestors 6.1. The performance of a flame arrestor is influenced by installation effects that may cause variations in critical parameters such as the spe ed of the flame front and the temperatures of the surfaces. The applicant should account for such installation effects in demonstrating compliance. The applicant may choose to show compliance with CS 25.975(a)(7) b y testing a complete, conformed production installation of the flame arrestor (including the upstream and downstream ducting). Alternatively, the applicant may request EASA approval to use other tests and analysis of the flame arrestor and the installation as a means of compliance.

6.2. The applicant may propose to use flame arrestor elements from a supplier. The supplier may have previously qualified an element to flame propagation requirements without consideration of the design of the aeroplane into whi ch the flame arrestor will be installed. The applicant should conduct tests to show that they have accounted for any effects of the installation, including flame front speeds and duct sidewall temperatures.

The fuel types for these tests differ, and should be established as discussed in paragraph 6.3.1.3 of this AMC prior to conducting any testing.

6.3. Flame arrestor installation test.

6.3.1. Test Set - up.

Figure A - 1 shows a schematic of the test set - up. The test set - up involves mounting the flame arrestor element in a tube configuration that is representative of the aeroplane installation. The speed of the flame front that travels down the fuel vent system tubing toward the flame arrestor is a critical factor in the performance of the flame arrestor in prev enting flame propagation. The flame front will accelerate down the tubing, so higher velocities will occur if the flame arrestor is located farther away from the fuel tank vent outlet. Therefore, the shape and diameter of the tubing and its length from the fuel tank vent inlet to the flame arrestor should be representative of the production configuration, unless the flame arrestor element was previously found to comply in an installation in which the speed of Powered by EASA eRules Page 668 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM the flame reaching the flame arrestor was higher . In addition, the orientation of the flame arrestor in the fixture is a critical parameter for the compliance demonstration. For instance, a flame arrestor installation that faces downward, so a ground fire impinges on its face, will have a shorter durati on flame - holding capability than a flame arrestor that is mounted horizontally.

6.3.1.1. Test fixture features.

The applicant should consider the following features in designing the flame arrestor test fixture: 1. Orient the element to simulate the actual aeroplane installation.

2. Cut viewing sections into the pipe upstream and downstream of the flame arrestor element and cover them with transparent material to provide visual access to the element.

3. Locate igniters upstream and downstream of the element.

4. Locate thermocouples in the duct to measure the incoming flammable mixture temperature and the vapour temperatures downstream of the flame arrestor element.

5. Install thermocouples on the surface of the centre of the flame arrestor element’s upstream fa ce and on the surface of the upstream side of the duct.

6. Incorporate a pressure - relief feature in the upstream portion of the system to relieve explosive pressures when ignition of the upstream flammable fluid vapour occurs.

7. Mix air that is at a t emperature higher than the boiling point of the fuel being used (see paragraph 6.3.1.3 of this AMC) with fuel, and introduce it at the inlet of the tube.

8. Vary fuel – air ratios by adjusting the respective fuel - vapour and air - supply rates.

6.3.1.2. Test equipment.

The test equipment should include: 1. The test article, including the flame arrestor and the downstream section of the vent system assembly that meets production specifications.

2. A section of ducting that is representative of the product ion flame arrestor installation.

3. A means of generating a supply of fuel vapour at preselected fuel - to - vapour air ratios and various flow rates.

4. A window for observing upstream and downstream conditions during the test. This should allow to determ ine the location of the flame front relative to the flame arrestor.

5. A means to measure temperatures on the upstream duct surfaces and the flame arrestor.

Powered by EASA eRules Page 669 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 6. A means to measure fuel vapour mixture temperatures both upstream and downstream of the flam e arrestor.

7. A means to relieve explosive pressure upstream of the flame arrestor.

8. Ignition sources for igniting the explosive mixture upstream and downstream of the flame arrestor.

6.3.1.3. Fuel type.

6.3.1.3.1. The applicant should establish the critical fuel type for the test based on a review of the approved fuels for the aeroplane model. The applicant should use fuels in the test that have representative characteristics of the critical fuel approved for use in the aeroplane.

The use of hexane as a representative fuel for kerosene fuels such as Jet A and TS - 1 has been found to be acceptable. Hexane (C6H14) is readily available and easily manipulated in the gaseous state, so it is typically a fuel of choice. The AIT for hexane of 223°C/433°F clos ely simulates that of Jet A kerosene fuel, which has an AIT of 224°C/ 435°F, and JP - 4 which has an AIT of 229°C/445°F.

Note: The applicant should not use fuels with higher AITs than these, such as propane, for the flame arrestor element test because igniti on on the back side of the flame arrestor would not be adequately evaluated.

6.3.1.3.2. Table A - 1 summarises the properties of hexane and provides an example of the method for calculating the stoichiometric relationship of hexane needed for the test.

6.3.1 .3.3. The applicant may use propane for testing of a flame arrestor installation if the AIT is not a critical parameter for the test. For example, testing of a simulated production flame arrestor installation to validate that temperatures of portions of th e installation within the fuel tank remain below the maximum permitted fuel tank surface temperature (typically 200 °C/400 °F) would be acceptable, provided that the applicant or supplier has previously shown that the flame arrestor element meets the flame - holding requirements.

6.3.1.3.4. Table A - 3 summarises the properties of propane as provided in FAA Technical Report ADS - 18, Lightning Protection Measures for Aircraft Fuel Systems (see Chapter 2.2 of this AMC), and provides an example of the method for ca lculating the stoichiometric ratio of propane.

6.3.1.4. Thermocouples.

The applicant should use bare junction 1/16 - to 1/8 - inch metal - sheathed, ceramic - packed, chromel - alumel thermocouples with nominal 22 to 30 AWG (American wire gage) size conductors or equivalent. The applicant should not use air - aspirated, shielded thermocouples. Experience has shown that 1/16 - inch thermocouples may provide more accurate calibration than 1/8 - inch thermocouples; the 1/16 - inch thermocouples are therefore rec ommended.

Powered by EASA eRules Page 670 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 6.3.1.5. Test specimen.

The test specimen should be a production component that conforms to the type design intended for certification.

6.3.2. Test conditions.

Two types of tests are typically needed to demonstrate compliance: one for flame propagation prevention in a static vent vapour flow condition, and one for flame holding in a continuous vapour flow condition. These conditions provide a conservative demonstration of fuel tank vent fire protection capability with respect to delayin g flame front propagation through the fuel vent flame arrestor installation during ground fire conditions.

6.3.2.1. Flame propagation test (static).

This test demonstrates the element’s flame - arresting performance in a static condition at the critical fuel mixture condition of 1.15 ± 0.05 stoichiometric.

This mixture is based on FAA - sponsored tests done by Atlantic Research, documented in the Lightning Protection Measures for Aircraft Fuel Systems report. The report shows curves of the flame arrestor equili brium temperature for various air – flow ratios as a function of the per cent stoichiometric fuel – air ratio (see Figure A - 2 in this AMC). These curves maximise at about 1.10 to 1.20 stoichiometric. The curves indicate that higher temperatures occur at lower flow rates.

6.3.2.1.1. Establish the mixed flow.

Close the fuel and air valves. Ignite the mixture downstream of the element. Verify that flames did not propagate through the flame arrestor by observing it through the viewing window. Verify that the upstre am mixture is combustible by energising the upstream igniter and observing the ignition of the upstream mixture. The applicant should repeat this test a minimum of 5 times at this mixture, as is done with explosion proof testing.

6.3.2.1.2. Flame front vel ocity.

The velocity of the flame front as it reaches the flame arrestor can significantly influence the effectiveness of the flame arrestor in preventing flame propagation. The flame front velocity increases as the flame travels down a vent line containing flammable vapours. The velocity of the flame front is installation - dependent and influenced by the length and diameter of the vent line, and by flow losses between the ignition source and the flame arrestor. The test configuration should include considera tion of these critical features. If an applicant proposes to use a previously approved flame arrestor element in a new installation with a different length or diameter of the vent line than previously tested, the applicant should account for these installa tion differences in the compliance demonstration. The applicant may need to conduct a separate test to demonstrate that the flame arrestor is effective in the installed configuration.

Powered by EASA eRules Page 671 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 6.3.2.2. Flame - holding test.

The purpose of this test is to show that a flame present at the fuel tank vent outlet, when a continuous flow of flammable vapour is exiting the vent, will not propagate into the fuel tank. The test conditions for this test are based on test results documented in the Lightning Protection Measures for Aircraft Fuel Systems report that resulted in the highest flame arrestor temperature.

Run this test at a 1.15 stoichiometric fuel – air ratio. The flammable vapour flow rate that achieves a velocity of 0.75 to 1.0 feet per second (ft/s) across the flame arrestor is the range where flame arrestor failure occurred in the shortest time during development testing.

Adjust the flow to achieve a velocity of 0.75 ft/s (+ 0.25, – 0 ft/s) across the flame arrestor and ignite it downstream of the flame arrestor.

De termine and establish the location of the flame front by viewing it through the viewing window.

Determine the position of the flame front and adjust the vapour flow rate such that the flame front contacts the downstream flame arrestor face, resulting in th e greatest rate of heating of the flame arrestor surface.

Take care to maintain the flammable vapour flow rate at a constant value throughout the test so as to maintain the correct fuel - to - air ratio.

6.3.2.2.1. Flame arrestor element maximum surface temper atures.

Monitor the temperature at the upstream centre of the flame arrestor during the flame - holding test; it is required to stay below 370 °C/700 °F for the first 2 minutes and 30 seconds after the ignition. Data from developmental testing show that the temperature of the centre of the upstream flame arrestor face at which failure (i.e. propagation of the flame) occurred was typically above 370 °C/700 °F, which is well above the AIT of JP - 4 fuel vapour of 229 °C/445 °F, as established during no - flow condi tions. The upstream flame arrestor temperature can go well above the AIT without causing upstream ignition because of the high local velocity of the vapour. For this reason, hexane, with an AIT of 223 °C/433 °F, should be used for the test of the flame arr estor element.

6.3.2.2.2. Flame arrestor installation and vent system maximum surface temperatures.

The compliance demonstration must show that flames present at the vent outlet do not propagate into the fuel tank during the first 2 minutes and 30 seconds after ignition. If the flame arrestor installation or any vent system components that are exposed to the flame are installed in locations where the ignition of flammable vapours could result in the propagation of the fire into the fuel tank, the applicant must show that ignition of the fuel vapours does not occur. This may require the installation of additional surface temperature instrumentation as part of the compliance demonstration test. The applicant should establish temperature limits for any componen ts of the vent or flame arrestor assembly that are located in spaces where flammable vapours may be present, based on the location of the Powered by EASA eRules Page 672 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM components in relation to the fuel tank. AMC 25.981 provides guidance for es tablishing a maximum allowable surface temperature within the fuel tank (the tank walls, baffles, or any components) that provides a safe margin, under all normal or failure conditions, that is at least 30 °C/50 °F below the lowest expected AIT of the appr oved fuels. The AIT of fuels will vary because of a variety of factors (e.g.

ambient pressure, dwell time, fuel type, etc.). The AIT accepted by EASA without further substantiation for kerosene fuels, such as Jet A, under static sea level conditions, is 23 2 °C/450 °F. This results in a maximum allowable surface temperature of 200 °C/400 °F for an affected surface of a fuel tank component. Higher surface temperature limits in flammable fluid leakage zones may be allowed in certain cases where the applicant c an substantiate that the higher temperature limits are acceptable. The applicant should monitor and record surface temperatures for any components where the analysis - established limits were required, and should show that the surface temperatures remain bel ow the established limits.

6.3.3. Pass/fail criteria.

6.3.3.1. The flame arrestor installation should meet the following performance criteria, as described in paragraph 6.3.2 of this AMC: It should pass the static propagation test; It should have a minimum flame - holding time of 2 minutes and 30 seconds; Installation - dependent maximum surface temperature limits should be established for any flame arrestor and vent system components located in fuel tanks or flammable fluid leakage zones that are determined to be potential sources that could propagate the flame from the external vent to the fuel tank.

6.3.3.2. After completing the flame arrestor tests noted above, the applicant should carefully examine the integrity of the structure of the flame ar restor.

Suppliers have constructed flame arrestors from one flat and one corrugated stainless steel sheet that are rolled up and placed into a flanged casing. This construction produces a series of small passages. Structural integrity of the coiled sheet m etal is maintained by either rods that cross at the front and rear faces of the coil or by brazing or welding of the coiled sheet metal at various points around the surface. Flame arrestors have failed the test when the flame passed across the flame arrest or because structural integrity was lost during the test due to failures of welds or brazed joints. Damage to components of the flame arrestor assembly is acceptable if the flame arrestor installation prevents flame propagation during the test, and the mai ntenance requirements specify that the flame arrestor must be repaired or replaced following an event where the flame arrestor was exposed to flame.

Powered by EASA eRules Page 673 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 6.3.4. Related qualification and installation considerations.

This paragraph does not contain an all - incl usive list of applicable qualification considerations. The tests should show that each component performs its intended function within the environment where it is installed. The applicant should establish design - specific qualification requirements in addit ion to the items listed in this paragraph.

6.3.4.1. Vibration.

Test the flame arrestor in a vibration environment representative of the installation.

6.3.4.2. Icing.

Installation of a flame arrestor will probably introduce a point in the vent system where icing is likely. The applicant should account for this effect in the vent system design by either installing pressure - relief provisions that protect the tank from excessive pressure differentials, or by showing that icing or clogging of the flame arrestor with ice is not possible.

6.3.4.3. Fuel tank bottom pressures.

In many cases, applicants have established the size of fuel tank vent systems, and the associated fuel tank refuelling rates, based on the bottom pressure of the fuel tank after failure of the refuelling system shut - off system and the resulting fuel overflow of the tank through the vent system. However, installation of a flame arrestor or modifications to the vent system may result in increased tank bottom pressures. Therefore, if an applicant a dds a flame arrestor to a fuel vent, or modifies an existing flame arrestor, the applicant should evaluate the effects of these changes on the tank bottom pressure, and adjust the refuelling rates to maintain the fuel tank bottom pressures within the limit s that were established by the fuel tank structural analysis.

6.3.4.4. Lightning.

The applicant must show that the fuel tank vent system installation complies with CS 25.954 . AMC 25.954 provides guidance in meeting those requirements. FAA Technical Report ADS - 18 (see paragraph 2.2 of this AMC) provides factors that the applicant should consider when developing features to protect fuel tan k vents from lightning.

7. Demonstrating compliance using fuel tank inerting, fuel tank pressurisation, and fire suppression systems 7.1. Fuel tank inerting.

An applicant’s use of fuel tank inerting systems to show compliance with CS 25.975(a)(7) requires them to demonstrate that the design prevents fuel tank explosions during all operating conditions (e.g. taxiing, take - off, landing, refuelling, etc.) and post - crash fire scenarios. To comply with CS 25.981 , inerting systems are not required to inert the fuel tanks during all operating conditions. Therefore, if an applicant proposes an inerting system as the means of compliance with C S 25.975(a)(7) , the system would need to have additional capability to prevent fuel tank explosions during all operating conditions. For example, inerting systems found compliant with CS 25.981 typically allow the f uel tanks to become flammable during refuelling operations, and when the inerting system is Powered by EASA eRules Page 674 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM inoperative. The applicant would need to address these conditions in order to ensure that the system continues to meet the requirements of CS 25.975(a)(7) .

7.2. Fuel tank pressurisation systems.

Fuel tank pressurisation systems or features of the system that result in a ‘closed’ vent system may become inoperative during an accident or the subsequent post - crash fire scenario. If the applicant proposes fuel tank inerting or pressurisation as the means of compliance with CS 25.975(a)(7) , the applicant must show that these means are effective in preventing a fuel tank explosion during all operating conditions (e.g. taxiing, take - off, landing, refuelling, etc.) and post - crash fire conditions.

7.3. Fire suppression systems.

Fuel tank or vent system fire suppression systems are typically activated by a light sensor, and they discharge a fire - suppressant agent that is only effective for a short time.

Demonstrating compliance using this technology would require the applicant to show its effectiveness in preventing a fuel tank explosion with a fire present at the fuel tank vent outlet for a mini mum of 2 minutes and 30 seconds.

[Amdt 25/21] Powered by EASA eRules Page 675 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUE L SYSTEM

Appendix A – Example of Calculation for Fuel - to - Air Ratio

ED Decision 2018/005/R Table A - 1. Combustion Properties of Hexane Property Value Heat of combustion, BTU/lb. 19 200 Molecular weight 86.17 Limits of inflammability in air (% by volume) per cent: Lower 1.2 Upper 7.4 Flash point – 22 °C/ – 7 °F Boiling point 69 °C/156 °F Auto - ignition temperature (AIT) 223 °C/433 °F Vapour pressure at 21 °C/70 °F (Pa/psia) 17 237/2.5 Note: The equation for the combustion of hexane and oxygen is written as: 2 C 6 H 14 + 19 O = 14 H O + 12 CO 2 2 2 For every 2 moles of hexane consumed, 19 moles of oxygen are required for complete combustion with no residual oxygen. Thus, 172.34 g of hexane require 19 × 32.00 = 608 g of oxygen or 2 627.48 g of air, which is 23.14 per cent by weight oxygen. Hence, the ratio of the weight of air to the weight of hexane required for stoichiometric burning (i.e. complete combustion of hexane with no excess oxygen) is 15.24.

A 1.15 fraction of stoichiometric mixture of air and hexane has an air - to - fuel weight ratio of: 2627 . 48 = 13 . 2 1 . 15 × 172 . 37 Table A - 2. Fuel - to - Air Mixtures for Flame Arrestor Tests JP - 4 Per cent JP - 4 Fuel - Air Hexane Per cent Hexane Fuel - Air Condition by Volume Mass Ratio by Volume Mass Ratio Lean limit 0.90 0.035 1.3 0.04 Between lean limit and 1.10 0.045 1.7 0.05 stoichiometric Stoichiometric 1.58 0.065 2.2 0.0658 1.15 Stoichiometric 1.82 0.074 2.5 0.07567 Between stoichiometric and rich limit 3.0 0.15 6.3 0.2 Rich limit 6.16 0.23 8.0 0.26 Powered by EASA eRules Page 676 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM Table A - 3. Combustion Properties of Propane Property Value Heat of combustion (298 °K), kcal/g - mole 530.6 Flammability limits in air (% by volume), per cent: Lower 2.2 Upper 9.5 Flame temperature (stoichiometric in air, STP) 1 925 °C/3 497 °F Quenching diameter,* cm/in 0.28/0.11 Minimum spark ignition energy,* millijoules 0.027 Critical velocity gradient for flashback,* sec - 1 600 Laminar flame speed,* cm - sec 40 *Applicable to 1.1 stoichiometric propane - to - air at standard temperature and pressure (STP).

Note: The equation for the combustion of propane and oxygen is written as: C H + 5 O = 4 H O + 3 CO 3 8 2 2 2 For every mole of propane consumed, 5 moles of oxygen are required for complete combustion with no residual oxygen. Thus, 44.09 g of propane require 5 × 32.00 = 160 g of oxygen or 691.44 g of air, which is 23.14 per cent by weight oxygen. Hence, the weight of air to weight of propane required for stoichiometric b urning (i.e. complete combustion of propane with no excess oxygen) is 15.7.

A 1.15 fraction of stoichiometric mixture of air and propane has an air - to - fuel weight ratio of: 691 . 44 = 13 . 7 1 . 15 × 44 . 09 Figure A - 1. Fuel Tank Vent Flame Arrestor Test Schematic Powered by EASA eRules Page 677 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM Figure A - 2. Flame Arrestor Surface Temperature at Various Flow Rates and Stoichiometric Mixture Ratios* * FAA Technical Report ADS - 18, Lightning Protection Measures for Aircraft Fuel Systems (see paragraph 2.2 of this AMC).

[Amdt 25/21] Powered by EASA eRules Page 678 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM

CS 25.977 Fuel tank outlet

ED Decision 2003/ 2/RM (a) There must be a fuel strainer for the fuel tank outlet or for the b ooster pump. This strainer must – (1) Reserved.

(2) Prevent the passage of any object that could restrict fuel flow or damage any fuel system co mponent.

(b) Reserved .

(c) The clear area of each fuel tank outlet strainer must be at least five times the area of the outlet line.

(d) The diameter of each strainer must be at least that of the fuel tank outlet.

(e) Each finger strainer must be accessib le for inspection and cleaning.

CS 25.979 Pressure fuelling system

ED Decision 2016 / 010/R (See AMC 25.979) For pressure fuelling systems, the following apply: (a) Each pressure fuelling system fuel manifold connection must have means to prevent the escap e of hazardous quantities of fuel from the system if the fuel entry valve fails.

(b) An automatic shut - off means must be provided to prevent the quantity of fuel in each tank from exceeding the maximum quantity approved for that tank. This means must – (1) Allow checking for proper shut - off operation before each fuelling of the tank; and (2) Provide indication, at each fuelling station, of failure of the shut - off means to stop the fuel flow at the maximum quantity approved for that tank.

(c) A means must be provided to prevent damage to the fuel system in the event of failure of the automatic shut - off means prescribed in sub - paragraph (b) of this paragraph.

(d) The aeroplane pressure fuelling system (not including fuel tanks and fuel tank vents) must withsta nd an ultimate load that is 2·0 times the load arising from the maximum pressures, including surge, that is likely to occur during fuelling. The maximum surge pressure must be established with any combination of tank valves being either intentionally or in advertently closed. (See AMC 25.979(d) .)

(e) The aeroplane defuelling system (not including fuel tanks and fuel tank vents) must withstand an ultimate load that is 2·0 times the load arising from the maximum permis sible defuelling pressure (positive or negative) at the aeroplane fuelling connection.

[Amdt 25/18] Powered by EASA eRules Page 679 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWER PLANT (CS - 25) FUEL SYSTEM

AMC 25.979(d) Pressure fuelling s ystems

ED Decision 2003/ 2/RM 1 Pressure fuelling systems, fuel tanks and the means preventing excessive fuel pressures, should be designed to withstand normal maximum fuelling pressure of not less than 345 kN/m (50 psi) at the coupling to the aeroplane.

2 Pressure fuelling systems should be so arranged that the fuel entry point is at or near the bottom of the t ank so as to reduce the level of electrostatic char ge in the tank during fuelling.

CS 25.981 Fuel tank explosion prevention

ED Decision 2020/024/R (a) No ignition sour ce may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapours. This must be shown by: (1) Determining the highest temperature allowing a safe margin below the lowest expected auto - ignition temperature of the fuel in the fuel tanks.

(2) Demonstrat ing that no temp erature at each place inside each fuel tank where fuel ignition is possible will exceed the temperature determined under sub - paragraph (a)(1) of this p aragraph. This must be verified under all probable operating, failure, and malfunction conditions of each component whose operation, failure, or malfunction could increase the temperature inside the tank.

(3) Except for the ignition sources due to lightning addressed by CS 25.954, demonstrating that an ignition source could not result from each single failure , from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations of failures not shown to be extremely improbable, taking into account the effects of manufacturing variability, ageing, wear, corrosion, and likely damage.

(b) Fuel tank flammability (1) To the extent practicable, design precautions must be taken to prevent the likelihood of flammable vapours within the fuel tanks by limiting heat and energy transfer (See AMC 25.981(b)(1) ).

(2) Except as provided i n sub - paragraph (4) of this paragraph, no fuel tank Fleet Average Flammability Exposure level may exceed the greater of: (i) three percent, or (ii) the exposure achieved in a fuel tank within the wing of the aeroplane model being evaluated. If the wing is not a conventional unheated aluminium wing, the analysis must be based on an assumed Equivalent Conventional Unheated Aluminium Wing (see AMC 25.981(b)(2) ).

The Fleet Average Flammability Exposure is determined in accordance with appendix N of CS - 25.

(3) Any active Flammability Reduction means introduced to allow compliance with sub - paragraph (2) must meet appendix M of CS - 25.

(4) Sub - Paragraph (2) does not apply to a fuel tank if following an ignition of fuel vapou rs within that fuel tank the aeroplane remains capable of continued safe flight and landing.

Powered by EASA eRules Page 680 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM (c) Reserved.

(d) To protect design features that prevent catastrophic ignition sources within the fuel tank or fuel tank system according to subparagraph (a) of this paragraph, and to prevent increasing the flammability exposure of the tanks above that permitted in subparagraph (b) of this paragraph, the type design must include critical design configuration control limitations (CDCCLs) identifying those features and providing instructions on how to protect them. To ensure the continued effectiveness of those features, and prevent degradation of the performance and reliability of any means provided according to subparagraphs (a) or (b) of this paragraph, the type design must also include the necessary inspection and test procedures, intervals between repetitive inspections and tests, and mandatory replacement times for those features. The applicant must include information required by this subparagraph in the Airwo rthiness Limitations Section of the Instructions for Continued Airworthiness required by CS 25.1529 . The type design must also include visible means of identifying the critical features of the design in areas of th e aeroplane where foreseeable maintenance actions, repairs, or alterations may compromise the CDCCLs.

[Amdt 25/1] [Amdt 25/6] [Amdt 25/9] [Amdt 25/18] [Amdt 25/26]

AMC 25.981(a) Fuel T ank I gnition S ource P revention

ED Decision 2020/024/R TABLE OF CONTENT 1 PURPOSE 2 SYSTEM SAFETY ASSESSMENT (SSA) 3 FUEL VAPOUR IGNITION SOURCES 3.1 Overview 3.2 Electrical sparks and electrical arcs 3.3 Filament heating current limit 3.4 Friction sparks 3.5 Maximum allowable surface temperatures 3.6 Fuel system elect rostatics 4 DESIGN CONSIDERATIONS 4.1 Fibre optics 4.2 Fuel pump electrical power supply 4.3 Location of the pump inlet 4.4 Wiring Powered by EASA eRules Page 681 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 5 SAFETY ANALYSIS 5.1 Ignition source failure analysis 5.2 Qualitative safety assessment 5.3 Assumptions and considerations for fuel tank system analysis 6 COMPONENT FAILURE MODE CONSIDERATIONS 6.1 Component qualification review 6.2 Maximum component temperature for qualification of fuel system components 6.3 Possible failure modes for determination of maximum co mponent temperatures 7 AIRWORTHINESS LIMITATIONS FOR THE FUEL TANK SYSTEM Appendix A. Certification of Arc Fault Circuit Breakers (AFCBs) or Ground Fault Interrupters (GFIs) Appendix B. Related Documents Appendix C. Definitions 1 PURPOSE This AMC describes how to show compliance with CS 25.981 , which provides the certification requirements for the prevention of ignition sources, other than lightning, within the fuel tanks of transport category aeroplanes. This AMC i ncludes guidelines for the prevention of failure conditions created from ignition sources other than lightning. It describes a means of compliance, using circuit - protective devices such as an arc - fault circuit - breaker (AFCB) or ground fault interrupter (GF I), to provide fail - safe features that have been accepted as showing compliance with CS 25.981 . This AMC does not apply to the flammability requirements in CS 25.981(b) .

2 SYSTEM SAFETY ASSESSMENT (SSA) 2.1 Before conducting an SSA of the fuel system, each applicant should assemble and review the relevant lessons learned from the overall transport fleet history, as well as from its previous products and suppliers and any oth er available sources to assist in identifying any unforeseen failures, wear, or other conditions that could result in an ignition source.

The sources of information include aeroplane service records, flight logs, inspection records, and component supplier service and sales records.

2.2 Safety assessments of previously certified fuel systems may require additional considerations. For these safety assessments, component sales records may assist in identifying whether component failures and replacements are oc curring. In addition, in some cases, changes to components have been introduced following the original type design certification without consideration of the possible effects of the changes on the system’s compliance with the requirements to prevent igniti on sources. For example, certain components within fuel pumps (e.g., thrust washers) have been changed to improve the life of the pumps, which defeated the original fail - safe features of the pumps.

Therefore, the results of reviewing this service history i nformation, and a review of any changes to components from the original type design, should be documented as part of the safety analysis of the fuel tank system.

Powered by EASA eRules Page 682 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 2.3 The following lists summarise the design features, malfunctions, failures, and maintenan ce/operational - related actions that have been identified through service experience as resulting in degradation of the safety features of aeroplane fuel tank systems. These lists are provided as guidance and are not inclusive of all the failures that need to be considered in the failure assessment. They may assist in evaluating possible failure modes during the evaluation of a fuel tank installation.

2.3.1 Pumps 1. The ingestion of pump inlet components (e.g., inducers, fasteners) into the pump impeller, re leasing debris into the fuel tank.

2. Pump inlet case degradation, allowing the pump inlet check valve to contact the impeller.

3. A failure of one phase of the stator winding during operation of the fuel pump motor, together with a subsequent failure of a second phase of the motor windings, resulting in arcing through the fuel pump housing.

4. Arcing due to the exposure of electrical connections within a pump housing that has been designed with inadequate clearance to the pump cover.

5. The omission of cooling port tubes between the pump assembly and the pump motor assembly during a pump overhaul.

6. Extended dry running of fuel pumps in empty fuel tanks (e.g. caused by a failure of the fuel pump relay in the on position).

7. The use of steel impellers that may produce friction sparks if debris enters the pump.

8. Debris lodged inside pumps.

9. Pump power supply connectors that have been damaged, worn, or corroded, resulting in arcing within the connector that damages the hermetic seal, causin g fuel leakage.

10. Electrical connections within the pump housing that have been designed with inadequate clearance or insulation from the metallic pump housing, resulting in arcing.

11. Thermal switches ageing over time, resulting in a higher trip temper ature.

12. Flame arrestors falling out of their respective mountings.

13. Internal wires coming in contact with the pump rotating group, energising the rotor, and arcing at the impeller/adapter interface.

14. Poor bonding across component interfaces.

15. I nsufficient arc - fault or ground - fault current protection capability.

16. Poor bonding of components to the structure.

17. Loads transferred from the aeroplane fuel - feed plumbing into the pump housing, resulting in a failure of the housing mounts and a subsequent failure of the pump case, which defeated the explosion - proof capabilities of the pump.

18. A premature failure of the fuel pump thrust bearings, allowing steel rotating parts to contact the steel pump side plate.

Powered by EASA eRules Page 683 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 19. Erosion of the fuel pump hou sing, causing a loss of the fuel pump explosion - proof capability and exposure of the fuel pump wiring to the fuel tank.

2.3.2 Wiring to fuel pumps 1. Wear of Teflon or other insulating sleeving and wiring insulation on wires in metallic conduits located in side fuel tanks, allowing arcing from the wire through the conduits into fuel tank ullages.

2. Damage to the insulation on wiring routed adjacent to the fuel tank exterior surfaces, resulting in arcing to the metallic fuel tank surface.

2.3.3 Fuel pump con nectors 1. Electrical arcing at connections within electrical connectors due to bent pins, wear, manufacturing variability (e.g. tolerances), or corrosion.

2. Fuel leakage and a subsequent fuel fire outside the fuel tank caused by corrosion or wear of elec trical connectors to the pump motor, leading to electrical arcing through the connector housing (the connector was located outside the fuel tank).

3. Selection of improper insulating materials in the connector design, resulting in degradation of the materi al because of contact with the fuel that is used to cool and lubricate the pump motor.

2.3.4 Fuel quantity indicating system (FQIS) wiring 1. Degradation of wire insulation material (cracking).

2. Conductive or semi - conductive (silver, copper, or cadmium) deposits on electrical connectors inside fuel tanks.

3. Inadequate wire separation between FQIS wiring and structure, or between other wiring, resulting in contact that causes chafing of the wiring.

4. Unshielded FQIS wires routed in wire bundles together with high - voltage wires, creating the possibility of short - circuit failures on the FQIS wires in excess of the intrinsically safe levels.

5. FQIS wiring that does not adhere to the aeroplane manufacturer’s standard wiring practices (i.e., wires bent back along themselves with a bend radius less than the one defined in the aeroplane manufacturer’s standard wiring practices, multiple splices lying next to one another, etc.).

2.3.5 FQIS probe installation 1. Conductive or semi - conductive corrosion (coppe r or silver sulphur deposits) causing a reduced breakdown voltage in FQIS wiring.

2. Damage to FQIS wire insulation resulting in a reduced breakdown voltage because of wire clamping features at the electrical connections on fuel quantity probes.

3. Contami nation in the fuel tanks creating an arc path for low levels of electrical energy between the FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts, and mechanical impact damage to probes).

Powered by EASA eRules Page 684 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 2.3.6 Valve actuators A failure of one solenoid in a dual solenoid actuated valve, resulting in overheating of one solenoid to a temperature above the auto - ignition temperature.

2.3.7 Float switch systems 1. Conduits containing float switch wiring failures due to the freezing of water that entered the conduit, allowing fuel leakage into the conduit and along the aeroplane front spar, resulting in an engine tailpipe fire.

2. Float switch wire chaffing being observed, which might have provided a potential for a subsequent electrical short to the conduit.

3. A float switch sealing failure that allowed fuel/water to egress into the switch, compromising switch operation in an explosive environment.

2.3.8 Fuel tubes, vent tubes, conduits, and hydraulic lines.

1. Poorly conducting pipe couplings that may become electrical arc sources when exposed to electric currents.

2. Insufficient clearances between tubes and the surrounding structure.

3. Intermittent electrical bonding in flexible couplers.

4. Bonded couplers unable to conduct the expected power fault curren ts without arcing.

2.3.9 Electrical generator power feeder cables 1. Arcing of electrical power feeder cables to a pressurised fuel line, resulting in a fire adjacent to the fuel tank.

2. Arcing of electrical power feeder cables to an aluminium conduit, re sulting in molten metal dropping onto a pressurised fuel line and consequently causing leakage of pressurised fuel.

2.3.10 Bonding straps 1. Corrosion of bonding strap wires, resulting in a failure to provide the required current paths.

2. Inappropriately attached connections (loose or improperly grounded attachment points).

3. Worn static bonds on fuel system plumbing connections inside the fuel tank, due to mechanical wear of the plumbing due to wing movement and corrosion.

4. Corrosion of the bonding su rfaces near fuel tank access panels that could diminish the effectiveness of the bonding features.

5. Ageing of self - bonding fuel system plumbing connections, resulting in higher resistance bonding.

6. Missing bonds.

7. Loose or intermittent contacts between bond straps and other conductive components.

Powered by EASA eRules Page 685 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 2.3.11 Pneumatic system failures Leakage of hot air from ducting located near fuel tanks due to a duct failure, resulting in undetected heating of the tank surfaces to a temperature above the auto - ignition temperature.

2.3.12 Electrostatic Charge 1. The use of a non - conductive type of reticulated polyurethane foam in only a portion of the fuel tank system, which allowed electrostatic charge build - up and arcing in the unprotected portion of the system.

2. Spraying fuel through refuelling nozzles located in the upper portion of the tank.

3 FUEL VAPOUR IGNITION SOURCES 3.1 Overview There are four primary phenomena that can result in the ignition of fuel vapour within aeroplane fuel tanks: — Elect rical sparks and arcs, — Filament heating, — Friction sparks, and — Auto - ignition or hot surface ignition.

3.1.1 The conditions required to ignite fuel vapour from these ignition sources vary with the pressures and temperatures within the fuel tank, and can be affected by sloshing or spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability and eliminating flammable vapour from the fuel tank, it should be assumed that a flammable fuel/air mixture may exist in aeroplane fuel tanks, and it is required that no ignition sources be present.

3.1.2 Any components located in or adjacent to a fuel tank must be designed and installed in such a manner that, during both normal and anticipated failure conditions, ignition of flammable fluid vap our will not occur. Compliance with this requirement is typically shown by a combination of component testing and analysis. Testing of components to meet the appropriate level of explosion - proof requirements should be carried out for various single failure s, and combinations of failures, to show that arcing, sparking, auto - ignition, hot surface ignition, or flame propagation from the component will not occur. The testing of components may be accomplished using several military standards and component qualif ication tests. For example, Method 511.6, Procedures I and II, of Military Standard MIL - STD - 810H ‘Environmental Engineering Considerations and Laboratory Tests’ dated January 2019 defines one method that can be used for showing that a component is explosio n proof as defined in Appendix C of this AMC. Section 9 of EUROCAE ED - 14G Change 1, dated January 2015, ‘Environmental Conditions and Test Procedures for Airborne Equipment’, and the equivalent RTCA, Inc., Document No DO - 160G dated December 2010, can also be used for showing that airborne equipment is explosion proof.

Powered by EASA eRules Page 686 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 3.2 Electrical sparks and electrical arcs 3.2.1 Laboratory testing has shown that the minimum ignition energy in an electrical spark required to ignite hydrocarbon fuel vapour is 200 microj oules*. Therefore, for electrical or electronic systems that introduce electrical energy into fuel tanks, such as FQISs, the energy of any electrical arcs or sparks that are created in any fuel tank should be less than 200 microjoules during either normal operation or operation with failures.

* The 200 - microjoule level comes from various sources. The most quoted is from Lewis and von Elbe’s book, Combustion, Flames and Explosions of Gases (Florida: Academic Press, Inc., 1987; (orig. publ. 1938)). It has a s et of curves for minimum ignition energy for the various hydrocarbon compounds in jet fuel, and they all have similar minimum ignition energy levels of greater than 200 microjoules.

Note: Standards that allow 320 microjoules are not acceptable for showing intrinsic safety. (‘Intrinsically safe’ is defined in Appendix C, paragraph C.19, of this AMC).

3.2.2 To ensure that the design has adequate reliability and acceptable maintenance intervals, a safety factor should be applied to this value when establishing a design limit. Fuel tank systems should be designed to limit the allowable energy level to the lowest practical level. Systems with a maximum energy of 20 microjoules are considered technologically feasible. Normal system operations at minimu m ignition energies of up to 50 microjoules would be acceptable. Under failure conditions, the system should have an ignition energy of less than 200 microjoules.

3.3 Filament heating current limit Analyses and testing indicate that a small piece of steel wool will ignite a flammable mixture when a current of approximately 100 milliamperes (mA) root mean square (RMS) is applied to the steel wool. Therefore, for electrical or electronic systems that introduce electrical energy into fuel tanks, such as FQIS, the electrical current introduced into any fuel tank should be limited. Because there is considerable uncertainty associated with the level of current necessary to produce an ignition source from filament heating, a safety factor should be applied to this value when establishing a design limit. A maximum steady - state current of 25 mA RMS is considered an intrinsically safe design limit for electronic and electrical systems that introduce electrical energy into fuel tanks. For failure conditions, the system should limit the current to 50 mA RMS, and induced transients to 125 mA peak current.

3.4 Friction sparks Pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, lockwire, roll pins, cotter pins, drill chips, manufacturing debris, and so forth m ay be drawn into fuel pumps and contact the impeller, resulting in the possibility of metallic deposits on the rotating and stationary components within the pump. This condition has resulted in the creation of friction sparks, and this should be an assumed failure condition when conducting the SSA.

Fail - safe features as described in paragraph 5.2.19.2.2 of this AMC have been used to mitigate this hazard.

Powered by EASA eRules Page 687 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes S UBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 3.5 Maximum allowable surface temperatures CS 25.981 (a)(1) and (2) requires applicants to: (1) Determine the highest temperature allowing a safe margin below the lowest expected auto - ignition temperature of the fuel in the fuel tanks.

(2) Demonstrate that no temperature at each place inside each fuel tank where fuel ignition is possible will exceed the temperature determined under subparagraph (a)(1) of this paragraph. This must be verified under all probable operating, failure, and malfunction conditions of e ach component whose operation, failure, or malfunction could increase the temperature inside the tank.

3.5.1 Auto - ignition temperatures of fuels Fuels approved for use on transport category aeroplanes have differing auto - ignition temperatures. The auto - ign ition temperature of JP - 4 (wide - cut jet fuel) is approximately 242 °C (468 °F) at one atmosphere of pressure. Under the same atmospheric conditions, the auto - ignition temperature of JET A (kerosene) is approximately 224 °C (435 °F) to 232 °C (450 °F), and of gasoline (i.e. petrol) is approximately 427 °C (800 °F). The auto - ignition temperature of these fuels varies inversely with the ambient pressure. Also, as stated in ASTM E659, Standard Test Method for Autoignition Temperature of Chemicals, ‘the autoigni tion temperature by a given method does not necessarily represent the minimum temperature at which a given material will self - ignite in air. The volume of the vessel used is particularly important since lower autoignition temperatures will be achieved in l arger vessels.’ In view of this, the factors affecting the pressure in the fuel tank should be taken into consideration when determining compliance with CS 25.981 .

3.5.2 Maximum surface temperature A surface whose temperature reaches a value 27.8 °C (50 °F) below the auto - ignition temperature of the fuel air mixture is accepted without further substantiation as providing a safe margin below the lowest auto - ignition temperature of the fuel. A temperature of 204 °C (4 00 °F) is accepted as the maximum surface temperature inside fuel tanks for kerosene type fuels without further substantiation. Higher maximum surface temperatures may be accepted, provided that it is substantiated that the higher surface temperature will not become an ignition source in the installation. (Maximum surface temperature considerations for areas outside the fuel tank are discussed in paragraph 5.3.6.3 of this AMC.)

3.5.3 Transient higher surface temperature The conditions (ambient pressure, dwe ll time, fuel type, etc.) within fuel tanks are such that a higher value may be used as a transient surface temperature limit. For example, a maximum allowable fuel tank surface temperature of 204 °C (400 °F), with a transient excursion that reduces the sa fe margin below 232 °C (450 °F) (i.e., the lowest expected auto - ignition temperature) for a maximum of two minutes, can be used for kerosene type fuels. The excursion above 204 °C (400 °F) occurs only during failure conditions such as a failure of the engi ne pneumatic system to regulate the temperature, or a duct rupture. Utilising elevated temperatures has been based on specific design features, such as an overtemperature shutoff of the pneumatic system so that the temperature cannot reach or exceed the ac cepted auto - ignition temperature of 232 °C (450 °F) for kerosene type fuels. Applicants Powered by EASA eRules Page 688 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM should submit comprehensive test data and an analytical rationale substantiating any transient excursion in order to show that they are maintaining a safe margin below the lowest expected auto - ignition temperature of the fuel.

3.6 Fuel system electrostatics 3.6.1 Electrostatic charges are generated in liquid hydrocarbons when they are in motion with respect to another surface such as fuelling hoses, filters, nozzles, fu el tank structure, and aeroplane plumbing. The documents referenced in Appendix B, paragraphs B.3 and B.5 of this AMC, provide information on this subject. For example, during aeroplane refuelling, jet fuel is loaded either from a tanker truck or from an a irport hydrant system . Flowing fuel can generate an electrical charge, especially through fuel filtration. The accumulation of charge in the fuel is a function of many factors. If the fuel conductivity is low, the relaxation time for dissipation of the ele ctrical charge is long. Additionally, if the conductivity of the aeroplane structure is low, as it is commonly in composite wings, the relaxation time of the fuel bulk charge to structure may be longer than it would be for a traditional metallic wing struc ture. Some composite structures have a lower conductivity than traditional metallic structures. A comparison can be made of the conductivity of the fuel with the conductivity of the aeroplane structure. Jet fuel typically has significantly lower conductivi ty than composite structures, meaning that the conductivity of the jet fuel dominates the charge relaxation rate and consequently results in similar charge relaxation rates between the different types of aeroplane structures. Regardless, the fuel will accu mulate an electrical charge inside an aeroplane fuel tank. This electrical charge may produce a high potential on the fuel surface, and an electrical discharge to the structure. This is particularly a concern if large unbonded objects are located inside an aeroplane fuel tank.

Smaller components may also become charged, and the applicant should address this in the safety assessment. If the vapour space fuel/air mixture is in the flammable range, ignition of the mixture is possible, resulting in a fuel tank explosion and fire.

3.6.2 Charge accumulation is influenced by many factors. Without an electrical conductivity improver (also referred to as a dissipator/dissipater, static dissipater additive, electrical conductivity additive, or conductivity improver ad ditive), typical Jet A fuel has a low electrical conductivity. An electrical conductivity improver will increase the charging rate of fuel, but at the same time greatly improve the conductivity of the fuel to rapidly dissipate the developed charge. Contami nants, considered as ionic impurities, enhance the charging tendency of the specific fuel.

Fuels from different parts of the world and from different refineries will therefore have different charging tendencies based on the types of contaminants present.

3 .6.3 Water contamination, however, increases the charging tendency of the fuel without a corresponding increase in conductivity. Water interacts with the additives or the naturally occurring contaminants in the fuel to provide this pro - static effect.

When refuelling, care should be taken to not disturb the interface between the fuel remaining in the tank and the possible layer of water below it. Disruption of this interface up into the tank ullage/vapour space may lead to an electrical discharge capable of igniting a mixture of flammable fuel vapour and air.

Powered by EASA eRules Page 689 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 3.6.4 Methods for minimising the magnitude of the developed charge have been developed, and are in place on transport category aeroplanes, including the following methods: 3.6.4.1 The refuel plumbing is sized and includes an orifice to maintain maximum flow rates in accordance with the electrostatic guidelines established by the National Fire Protection Association (NFPA) (NFA 77) and the ASTM (D4865).

3.6.4.2 Guidelines have been published (e.g. by ASTM) to limit flow velocities to 6 to 7 metres per second while the discharge port is covered with fuel. These guidelines also indicate that the flow velocity should be held to less than 1 metre per second until the discharge port is co vered with fuel. These guidelines were developed with gasoline (i.e. petrol) in mind and are, therefore, conservative when applied to the kerosene type fuels used in commercial aviation. The design guidelines for commercial aircraft in SAE AIR1662 limit ve locities to 6 to 9 metres per second in fuel plumbing and 3 metres per second at the exit nozzle. Limiting the flow velocity may be achieved by incorporating multiple refuelling discharge ports, lowering the flow velocity through the use of piccolo tubes t hat distribute the fuel at low velocities in the tank, and locating them at or near the bottom of the tank.

Location of the refuelling discharge at the bottom of the tank minimises fuel spray — a contributor to static charge development — and provides for the ports to be covered by fuel reserves in main tanks and in the early stages of fuel flow as the refuel rate varies from 1 metre per second up to the full flow of 6 to 7 metres per second in normally emptied tanks.

Note: It may not be practical to develo p a dual flow rate refuelling system, so one way to address these guidelines may be to limit the refuelling velocities to less than 1 metre per second through the use of multiple discharge points and piccolo tubes.

3.6.5 Methods of relaxing the charge have also been developed. Bonding straps are used on fuel components and plumbing lines to allow the charge to dissipate to the tank structure. During refuelling, the aeroplane is bonded to the refuelling vehicle with a separate bonding wire to provide an elec trical path back to the fuel filter, which is the principal electrostatic charge generator. An electrical conductivity improver may also be used to increase fuel conductivity to quickly dissipate the developed charge. However, EASA does not require this ty pe of additive, unless it is specified as part of the type design approval. Any limitations on the use of an electrical conductivity improver would need to meet the requirements of CS 25.1521 , Powerplant limitation s, and CS 25.1557 , Miscellaneous markings and placards.

3.6.6 Applications of the above methods, and adherence to industry practices and guidelines on electrostatics, should be identified for each aeroplane model. Airline operations and practices regarding aeroplane refuelling should also be evaluated to verify that the procedures necessary for the safe operation of the specific aeroplane model are in place and followed. Restrictions, if any, on refuel rates, fuel p roperties, and the requirement for fuel additives should be identified as CDCCLs.

3.6.7 Polyurethane reticulated foam used for ignition suppression within fuel tanks and other non - conducting objects may accumulate and retain charge. These items may have to be treated with antistatic additives to prevent charge accumulation.

Powered by EASA eRules Page 690 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 4 DESIGN CONSIDERATIONS The number of components and systems inside aeroplane fuel tanks whose failure could result in an ignition source within the fuel tank should be minimised. The following design practices are accepted by EASA for minimising ignition sources: 4.1 Fibre optics Wiring entering the tank for such purposes as temperature monitoring and fuel quantity indication should be minimised. The use of alternate technology, such a s fibre optics, may provide a means of reducing or eliminating electrically powered components from inside the fuel tanks.

4.2 Fuel pump electrical power supply 4.2.1 Fuel pump power wiring If practical, fuel pumps should be located such that the electrica l power for the pumps is routed outside the fuel tanks in such a manner that failures in the electrical power supply cannot create a hot spot inside the tank, or arc into the fuel tank. While the routing of the fuel pump power supply outside the fuel tank, and away from the fuel tank walls, may eliminate the potential for arcing directly into the fuel tank or heating of tank surfaces, the failure analysis should consider the need for electrical circuit - protective devices. If the power supply cannot be route d outside the tank, additional design features should be considered as discussed in paragraph 4.3.2 below.

Note: The applicant should consider, in the design of the pump wiring system and when showing compliance, the electromagnetic effects and electrical transients that may damage the wiring or pump.

4.2.2 Fuel pump electrical connectors 4.2.2.1 Arcing at the pump electrical connector has resulted in uncontrolled fuel leakage, an ignition source, and an uncontrolled fire outside the fuel tank.

This can create a fuel tank ignition source due to the external fire heating the fuel tank surfaces. Fuel pumps should include features to isolate the electrical connector from the portion of the fuel pump where fuel is located.

Applicants should show that the arci ng that occurs in these designs cannot cause a cascading failure from arcing in the electrical connection, resulting in a fuel leak and a fire. One approach includes the incorporation of a dry area between the electrical connector and the fuel pump. Anothe r approach includes extending the fuel pump power wire so the electrical connector is well away from the fuel pump. This approach has included a drip loop on the wire to prevent any fuel leaking onto the wire from being present at the electrical connector.

4.2.2.2 Alternatively, or in addition to isolating electrical connectors from the fuel, limiting the electrical energy passing into the fuel tank can prevent an ignition source from occurring. The design of traditional fuel pumps has resulted in the need to install AFCB or GFI protection features to limit the energy release during an arcing event to prevent an ignition source from occurring.

Powered by EASA eRules Page 691 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 4.3 Location of the pump inlet Debris that may enter a fuel pump inlet can cause sparks inside the fuel tank. One means to address this ignition source has been to locate the pumps such that the pump inlet remains covered with fuel whenever the pump is operating within the aeroplane operating envelope. Another means has been to prevent the propagation of any ignition from the pump into the fuel tank by using flame arrestor technology. (The performance of the flame arrestor should be validated by test to verify its effectiveness at stopping a flame front.) Any protective means, including those shown in paragraphs 4.3.1 and 4.3.2 below, should be demonstrated to be effective under the pitch, roll attitude, and negative G conditions anticipated to occur in service.

4.3.1 Main feed tanks The installation of baffles in the tank structure, and the use of collector tanks that are continually filled with fuel using ejector pumps, are methods that have proven successful in keeping the pump inlets and pump housings submerged in fuel.

4.3.2 Auxiliary tanks For auxiliary tanks that use motor - driven fuel pumps and that are routi nely emptied, the accepted design practices include shutting off the motor - driven pumps before uncovering the fuel pump inlet, and the installation of a flame arrestor in the scavenge pump inlet line, or scavenging the remaining fuel with ejector pumps. (N ote that the installation of features such as a flame arrestor in the fuel system would need to meet the fuel system performance requirements in CS 25.951 , Fuel System: General .)

4.4 Wiring The following paragraphs on wiring represent acceptable approaches for dealing with the wiring used in and near fuel tanks. For specific requirements and further guidance, the applicant should review the wiring installation and design requirements in the electrical wiring interco nnect systems (EWIS) rules of CS - 25 Subpart H and the associated AMC .

4.4.1 Intrinsically safe wiring All the wiring that is intended to conduct intrinsically safe levels of electrical power into or through the fue l tanks should incorporate protective features that prevent an exceedance of the intrinsically safe levels discussed in paragraphs 3.2 and 3.3 of this AMC. This wiring should also be protected from the transients induced by high intensity radiated fields ( HIRF). The following protective features could be used to support that objective: — Separation and shielding of the fuel tank wires from other aeroplane wiring and circuits, — Shielding against HIRF and other electromagnetic effects, and — The installation of tr ansient - suppression devices to preclude unwanted electrical energy from entering the tank.

Powered by EASA eRules Page 692 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 4.4.2 Higher energy wiring This includes all wiring that is not intrinsically safe.

4.4.2.1 Wiring should not be routed through metallic conduits inside the fuel t ank or adjacent to fuel tank surfaces such that damage, inappropriate maintenance, or other failure/wear conditions could result in arcing to the conduit or metallic tank surface and the consequent development of an ignition source in the fuel tank. If met allic or other conductive conduit materials are used, a single failure of electrical arcing of the wiring to the conduit, adjacent tank surfaces, or structure should be assumed to occur. In addition, circuit - protective features or other features should be incorporated to preclude the development of an ignition source in the fuel tank. The methods that may be used to address this foreseeable failure condition include the use of circuit - protective features such as dual conduits, thick - walled conduits, and/or fast - acting AFCB or GFI circuit breakers.

Providing multiple layers of sleeving alone would not be considered acceptable, since wear could defeat the multiple layer protection.

4.4.2.2 Where electric wires are routed through metallic conduits installed in a fuel tank, high surface temperatures or arcing through the conduit walls can be created by short circuits. All the wiring conducting levels of power that exceed intrinsically safe levels (e.g., the fuel pump power supply) into or through a fuel tank shou ld be evaluated assuming arcing to adjacent surfaces, such as metallic conduits or wing surfaces, unless fail - safe protective features are provided. A critical electrical wiring condition might be one in which the insulation is worn, cracked, broken, or of low dielectric strength, allowing intermittent or constant arcing to occur without consuming enough power to cause the circuit protection device, such as a thermal mechanical circuit breaker, to open. Inspection of wiring from in - service aeroplanes has sh own that greater than expected wear may occur on sleeving and wiring insulation due to movement of the wire within the conduit. Roughness of the conduit material and variations in vibration levels for each installation may significantly increase wear. In a ddition, inspections have shown that some protective sleeving has been missing or improperly installed, or the wrong sleeving material has been used, resulting in damage to the insulation. For these reasons, the use of protective sleeving on wiring would n ot, by itself, be adequate for showing compliance. The design should be tolerant to these types of foreseeable failure or maintenance errors.

4.4.3Wire separation The wiring designs used on transport category aeroplanes vary significantly between manufactu rers and models; therefore, it is not possible to define a specific, universal separation distance, or the characteristics of physical barriers between wire bundles, to protect critical wiring from damage. The separation requirements for the wiring and oth er components of EWIS are contained in CS 25.1707 , System separation: EWIS. AMC 25.1707 contains guidance on determining an adequate separation distance between EWIS and between EWIS and aeroplane systems and structures. Even if CS 25.1707 is not in the type certification basis of the aeroplane being modified, the guidelines contained in AMC 25.1707 should be applied, along with the guidelines contained in this AMC, when determining the adequate separation distance. Intrinsically safe wiring for Powered by EASA eRules Page 693 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM fuel tanks nee ds to be protected from induced currents caused by power system switching transients, or electromagnetic interference due to close proximity to other aeroplane wiring. In addition, damage to wire insulation can result in unwanted electrical energy being tr ansmitted into the fuel tank, if the damaged wire can come into contact with the conductor of another wire that is not intrinsically safe. Of particular concern is the possibility of a wire bundle fire that exposes and breaks wires that are not intrinsical ly safe, and also damages the insulation of intrinsically safe wiring that is in close physical proximity. The broken wires may still be energised and could contact conductors of the damaged intrinsically safe wire. If physical separation is used to protec t intrinsically safe fuel system wiring from other wiring, or to protect fuel tank walls from high - power wiring, the applicant must establish the minimum physical separation. The applicant should conduct an analysis to verify that currents and energies gre ater than those specified in paragraphs 3.2 and 3.3 of this AMC will not be applied to intrinsically safe wiring, considering the factors listed below. The following factors are based on the guidance contained in paragraphs 3. and 4. of AMC 25.1707 : 4.4.3.1 The electrical characteristics, power, and criticality of the signals in the wire bundle and adjacent wire bundles; 4.4.3.2 The installation design features including the number, type, fire resistance, and locati on of the support devices along the wire path of the intrinsically safe wire and adjacent higher power wires; 4.4.3.3 The maximum amount of slack wire resulting from wire bundle build tolerances and other wire bundle manufacturing variations; 4.4.3.4 The p robable variations in the installation of the intrinsically safe fuel system wiring and adjacent wiring, including the position or omission of wire support devices and the amount of slack wire that is possible; 4.4.3.5 The expected operating environment, including the amount of deflection or relative movement that can occur and the effect of a failure of a wire support device, or a broken wire, or other methods used to maintain physical separation; 4.4.3.6 The effects of wire bundle fires; 4.4 .3.7 Maintenance practices, as defined by the aeroplane manufacturer’s standard wiring practices manual, and the ICA required by CS 25.1529 , CS 25.1729 ; and 4.4.3.8 Localis ed separation.

Note: Some areas of an aeroplane may have localised areas where maintaining a general physical separation distance is not feasible. This is especially true in smaller transport category aeroplanes or in areas where wiring spans the wing - to - b ody join of larger transport aeroplanes. In those areas that limit the separation distance, additional means of ensuring physical separation and protection of the wiring may be necessary. Testing and/or analysis used to show that the reduced separation dis tance is acceptable should be conservative and consider the worst possible failure condition not shown to be extremely improbable. The applicant should substantiate that the means to achieve the reduced separation provides the Powered by EASA eRules Page 694 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM necessary level of protection for wire - related failures and electromagnetic effects.

4.4.4 Inspection Means should be provided to allow for the visual inspection of the wiring, physical barriers, and other physical means of protection. Non - destructive inspection aids may be used where it is impracticable to provide for direct visual inspection, if it is shown that the inspection is effective and the inspection procedures are specified in the maintenance manual required by CS 25.1529 and CS 25.1729 .

4.4.5 Identification Means must also be provided to make EWIS wires readily identifiable and visible to maintenance, repair, or alteration personnel. The method of identification must remain legible throughout the aeroplane’s operational life. The complete regulatory requireme nts for EWIS identification are contained in CS 25.1711 , Component identification: EWIS.

4.4.6 Circuit breakers Service experience has indicated that thermal mechanical circuit breakers installed in fuel pump circu its have not been shown, on some aeroplane designs, to preclude arcing of electrical wiring through metallic barriers into the fuel tank, barriers such as conduits, fuel pump housings, electrical connectors, or the tank wall. Evidence suggests that arcing from the wiring to metallic surfaces may not result in a hard short, which would trip the circuit breaker, and may result in intermittent low - level arcing that gradually arcs through the metallic barrier into the fuel tank. For these failure conditions, ci rcuit - protective devices such as AFCBs or GFIs may be used to provide the fail - safe features necessary to show compliance. Appendix A of this AMC provides guidance for the certification of an AFCB or GFI.

4.4.7 The use of non - metallic conduits If a non - met allic conduit is used, its compatibility with fuel should be shown. The non - metallic conduit should be evaluated for the effects of ageing due to heat, corrosion at the connecting fittings, electrostatic charge build - up, and resistance to heat damage from internal shorts of the wires routed within the conduit.

4.4.8 Wire splices Splices in fuel system wiring have been allowed as a standard repair procedure.

The acceptability of splices will be based upon the system design and fail - safe features. The safety assessment may show that splices in fuel tank system wiring, such as fuel quantity indicating wiring within the fuel tank and fuel pump windings, are prohibited. This would be defined as a CDCCL.

4.4.9 The use of silver in fuel tanks Silver can combine wit h sulphur or water and form silver - sulphide or oxide deposits between exposed conductors (terminal block connections, etc.). The silver - sulphide deposits reduce the resistance between the conductors and can ignite fuel vapour when exposed to very low level s of electrical energy. If the use of silver in electrical components and wiring in the tank is determined to be critical, it should be defined as a CDCCL. The energy levels that have been shown to ignite fuel vapour during laboratory tests approach the le vels normally used on FQIS wires and probes (e.g. FAA Report No. DOT/FAA/AR - 03/61, Silver - Sulphur Deposits Powered by EASA eRules Page 695 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM on Fuel Quantity Indication System and Attendant Wiring). This issue should be carefully addressed.

4.4.10 The use of steel wool Steel wool has been used as a cleaning tool to remove corrosion and to clean parts inside fuel tanks. Steel wool creates small conductive filaments that can cause ignition sources in a fuel tank if the steel wool makes a connection between two conductors in fuel tank quantity gauging system components. For this reason, applicants should not allow the use of steel wool inside fuel tanks, and should recommend using other abrasives. (However, as stated in paragraph 5.3.4.1 in this AMC, the applicant should assume the presence of conductive debris, such as steel wool, when performing the fuel tank ignition prevention analysis.)

5 SAFETY ANALYSIS 5.1 Ignition source failure analysis Compliance with CS 25.981 requires each applicant to develo p a failure analysis for the fuel tank installation to substantiate that ignition sources will not be present in the fuel tanks. The requirements of CS 25.981 are in addition to the more general propulsion failure analysis requirements of CS 25.901 and CS 25.1309 that have been applied to propulsion installations.

5.1.1 CS 25.981(a)(3) defines three failure scenarios that must be addressed in order to show compliance with the rule: 5.1.1.1 No single failure, regardless of the probability of occurrence of the failure, may cause an ig nition source.

5.1.1.2 No single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely remote (i.e., not shown to be extremely remote or extremely improbable), may cause an ignition source.

5.1.1.3 No combinations of failures that are not shown to be extremely improbable may cause an ignition source. That is, each combination of failures that can create an ignition source must be separately shown to be extremely improbable.

5.1.2 SAE ARP4761, ‘Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment’ dated December 1996, describes methods for completing an SSA. An assessment may range from a simple report, which offers descri ptive details associated with a failure condition, interprets test results, compares two similar systems, or offers other qualitative information, to a detailed failure analysis that may include estimated numerical probabilities. The depth and scope of an acceptable SSA depend on the following: 5.1.3.1 The complexity and criticality of the functions performed by the system under consideration, 5.1.3.2 The severity of the related failure conditions, 5.1.3.3 The uniqueness of the design and the extent of the relevant service experience, 5.1.3.4 The number and complexity of the identified causal failure scenarios, and Powered by EASA eRules Page 696 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 5.1.3.5 The detectability of contributing failures.

Note: CS 25.981 and CS 25.901 are intended to address system failures or conditions that may result in the presence of an ignition source in the fuel tanks. These specifications are not intended to address the failures or conditions that could lead to the ignition of fuel vapour, which are addressed by other specifications, such as: — Uncontained engine debris, — External engine fires following an engine separation, — Damage resulting from explosive materials such as bombs, — Post - crash fire heating of tank surfaces, — Propag ation of fire through the aeroplane vent system into the fuel tanks, or — A fire originating within the engine that burns through the engine case.

5.2 Qualitative safety assessment 5.2.1 Typical aeroplane fuel tank systems have a limited number of possible ignition sources. Figure 1 below shows some causes of ignition sources and methods that may be used to meet the fail - safe requirements. The level of analysis required to show that ignition sources will not develop will depend on the specific desig n features of the fuel tank system being evaluated. Detailed quantitative analysis should not be necessary if a qualitative safety assessment shows that the features incorporated into the fuel tank system design protect against the development of ignition sources within the fuel tank system. For example, if intrinsically safe FQIS wiring entering the fuel tanks and the associated line replacement unit (LRU) were shown to have protective features such as separation (including circuit separation in the LRU) a nd shielding and/or transient suppression/energy limiting devices, the portion of the compliance demonstration for the associated wiring would likely be limited to showing the effectiveness of the features and defining any long - term maintenance requirement s, including the mandatory replacement times, inspection intervals, related inspection procedures, or CDCCLs so that the protective features are not degraded.

Powered by EASA eRules Page 697 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM Figure 1. Examples of Fuel Tank Ignition Source Considerations 5.2.2 In the case of the installation of a flame arrestor in the inlet line to a fuel pump, the compliance demonstration for the fuel pump may be limited to showing that the arrestor was effective at precluding propagation of the flame from the pump back down the inlet line into t he tank, and showing that any anticipated failures or events could not violate the explosion - proof features of the pump assembly. A CDCCL may be necessary to maintain the flame arrestor design feature. If the flame arrestor cannot be shown to be effective for the life of the installation, an Airworthiness Limitation limiting the life of the flame arrestor would be necessary.

In addition, revalidation of the fuel system with other regulations (e.g. icing and reduced flow due to contamination) would be requir ed if modifications were incorporated into the fuel feed system. The SSA criteria, process, analysis methods, validation, and documentation should be consistent with the guidance material provided in SAE ARP4761, using the unique guidance specific to the f uel tank system as defined in this AMC.

5.3 Assumptions and considerations for fuel tank system analysis The applicant should conduct the fuel tank system analysis based on the following assumptions: 5.3.1 Fuel tank flammability The analysis should assume that the environment inside the fuel tank is always flammable. The conditions required to ignite fuel vapour from ignition sources vary with the pressures and temperatures within the fuel tank and can be affected by sloshing or spraying of fuel in the tank . Due to the difficulty in predicting fuel tank flammability, it should be assumed that a flammable fuel/air mixture exists in aeroplane fuel tanks and it is required that no ignition sources be present. The SSA should be prepared considering all the in - fl ight, ground, service, and maintenance conditions for the aeroplane, assuming that an explosive fuel/air mixture is present in the vapour space of fuel tanks and vent systems at all times, unless the fuel tank has features that mitigate the effects of tank ignition (e.g. polyurethane foam).

Powered by EASA eRules Page 698 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 5.3.2 Failure condition classification Unless design features are incorporated that mitigate the hazards resulting from a fuel tank ignition event (e.g. polyurethane foam, an adequate structural margin), the SSA should a ssume that the presence of an ignition source is a catastrophic failure condition.

5.3.3 Latent failures 5.3.3.1 In order to eliminate any ambiguity as to the restrictions on latent failures, CS 25.981(a)(3) explic itly requires that any anticipated latent failure condition must not leave the aeroplane one failure away from a catastrophic fuel tank ignition. In addition to this limitation on latency, CS 25.1309(c) limits the latent failure conditions to those that do not create an ‘unsafe system operating condition.’ Consequently, if a latent failure condition is not extremely remote (i.e., it is anticipated to occur) and it creates an ‘unsafe system operating condition,’ then flight crew alerting must be provided to ‘enable them to take appropriate corrective action.’ Notwithstanding these restrictions on latency, there are practical limitations on the available means of compliance. For example, detecting a failure condition r equires a finite period of time, and there are not always ‘appropriate corrective actions’ that can be taken during the flight. Consequently, for the purpose of complying with CS 25.981(a)(3) , the period of latency for any anticipated significant latent failure condition should be minimised and not allowed to exceed one flight cycle. For the purpose of complying with CS 25.1309(c) , whenever the aeroplane is operating one fai lure away from a catastrophic fuel tank ignition, this should be considered an ‘unsafe system operating condition,’ recognising that sometimes the only appropriate corrective action when problem detection is available is to continue to the destination but not to initiate another flight without making appropriate repairs.

5.3.3.2 Another practical limitation on the available means of compliance is the technological feasibility of providing inherent failure detection within the design for all significant fail ures. Sometimes periodic inspection is the only practicable means of reliably detecting a failure condition. Consequently, when such inspections are identified within the analysis as the means of detection, the inspection method and frequency must be suffi cient to conclude that the probability of occurrence of the significant latent failure condition is extremely remote.

5.3.3.3 Any mandatory replacement time, inspection interval, related inspection procedure, and all the CDCCLs identified as required to prevent development of ignition sources within the fuel tank system for CS 25.981(a) m ust be identified in the Airworthiness Limitations Section of the ICA as fuel system Airworthiness Limitations. The Airworthiness Limitations Section should include the following: 5.3.3.3.1 A designation of the maintenance actions and alterations that must be inspected (critical inspections), including at least those that could result in a failure, malfunction, or defect endangering the safe operation of the aircraft, if not performed properly or if improper parts or materials are used.

Powered by EASA eRules Page 699 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM Note: A validation i nspection should be conducted to reaffirm all or a portion of the initial inspection requirements for those critical inspections that, if not performed properly or if improper parts or materials are used, could result in a failure, malfunction, or defect e ndangering the safe operation of the aeroplane. For those air carriers that use a mechanic for the initial inspection, an inspector should be used to conduct the validation inspection. For those air carriers that use an inspector for the initial inspection , another qualified inspector should be used to conduct the validation inspection.

5.3.3.3.2 The procedures, standards, and limits necessary for critical inspections and acceptance or rejection of the items required to be inspected, and for periodic inspec tions and calibration of precision tools, measuring devices, and test equipment.

5.3.4 Failure conditions In accordance with CS 25.981(a)(3) , the analysis must consider the effects of manufacturing variability, age ing, wear, corrosion, and likely damage. For the purpose of compliance with CS 5.981 , ‘extremely remote’ failure conditions and ‘extremely improbable’ failure conditions are defined in AMC 25.1309 . Likely damage is damage that, using engineering judgment or past experience, would lead one to conclude that an occurrence is foreseeable. Examples of likely damage are: — a wire bundle located where a mechanic could use it as a ha ndhold; — an instrument located where, if someone dropped a wrench, damage would result; or — a fuel probe located where a mechanic could use it as a step in the tank.

5.3.4.1 The analysis should be conducted considering the deficiencies and anomalies listed in paragraph 2.3 of this AMC, the failure modes identified by the review of service information (including review of supplier service data), and any other failure modes identified by the functional hazard assessment of the fuel tank system. For example, th e applicant should assume the presence of conductive debris such as lockwire, steel wool, nuts, bolts, rivets, etc. CS 25.981 requires that the effects of manufacturing variability, ageing, wear, corrosion, and lik ely damage must be considered when showing compliance, which is needed to show compliance with CS 25.901(c) . Credit for fail - safe features must be substantiated.

5.3.4.2 The level of manufacturing variability, agei ng, wear, corrosion, and likely damage that must be considered should be determined based upon an evaluation of the detectability of degraded or out - of - specification configurations, and established and documented within the analysis.

In - service and product ion functional tests, component acceptance tests, and maintenance checks may be used to substantiate the degree to which these states must be considered. For example, inspection of fuel tank system bonding on production aeroplanes has shown that some bonds were inadequate. Functional testing of all bonding was incorporated to address this deficiency. In some cases (e.g. component bonding or ground paths), a degraded state will not be detectable without periodic functional tests of the feature. For these fea tures, inspection/test intervals should be Powered by EASA eRules Page 700 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM established based on previous service experience of equipment installed in the same environment. If previous experience on similar or identical components is not available, conservative initial inspection/test int ervals should be established until design maturity can be assured.

5.3.5 External environment The severity of the external environmental conditions that should be considered when showing compliance with CS 25.981 is that of the conditions established by the certification specifications.

5.3.6 External sources of tank auto - ignition The possibility of fuel tank ignition due to surface - ignition sources created by external tank heating should be considered. This inclu des heating of the tank due to the operation or failure of systems outside the tank within both the pressurised and unpressurised areas of the aeroplane, such as overloaded electric motors or transformers, failures in the pneumatic system, and/or ducting t hat could cause localised heating of tank surfaces. In addition, the possibility of localised heating due to external fires should be considered.

5.3.6.1 CS 25.967(e) requires that, ‘Each fuel tank must be isolated from personnel compartments by a fumeproof and fuelproof enclosure.’ 5.3.6.1.1 Leakage of fuel or vapour into spaces adjacent to the fuel tank, where a secondary fuelproof and fumeproof barrier is not provided, has typically been assumed for areas such as : — The wing leading edges (including any adjacent compartment such as the strut) and trailing edges, — Fairings located below the fuel tanks, — Fuel pump enclosures, and — Unpressurised areas of the fuselage surrounding fuel tanks located in the empennage.

5.3.6. 1.2 Components located in these areas have been required to meet the explosion - proof requirements. These components or systems should be included in the analysis. Examples of such equipment include, but are not limited to, environmental control system (ECS ) air conditioning packs, motors, power assisted valves, fuel pumps, hydraulic pumps/motors, certain flight control actuators, ECS controls, and wiring and valves.

5.3.6.2 A safety review of the flammable fluid leakage zones adjacent to fuel tanks should b e conducted to determine whether the design complies with the requirements of CS 25.863(a) and CS 25.981 . In general, the fire protection philosophy for any area considered a flammable fluid leakage zone is to assume that flammable vapour may be present in the zone and to minimise the probability of ignition of the vapour ( CS 25.863(a) ). This has typically been accomplished by using combinations of the following design considerations: — Grounding and bonding of electrical equipment, — Qualification of electrical equipment as explosion proof, Powered by EASA eRules Page 701 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM — Sealing of electrical connectors, — Proper support, protection, and separation of wiring, — Drainage p rovisions in the leakage zone, — Ventilation of the leakage zone in flight and of areas around the auxiliary tanks, and — Immediate maintenance action to correct leaks in these areas.

5.3.6.3 Surface temperatures in areas adjacent to fuel tanks While EASA (and previously the JAA (Joint Aviation Authorities)) has accepted the use of maximum acceptable surface temperatures 27.8 °C (50 °F) below the applicable auto - ignition temperature of the fuel - air mixture (i.e. a surface temperature of 204 °C (400° F) for fuel tanks filled with kerosene), some higher temperatures have been accepted in certain cases if adequately substantiated by the applicant. Some manufacturers have substantiated that the conditions (ambient pressure, dwell time, fuel type, etc.) within ce rtain flammable fluid leakage zones are such that a higher value may be used.

For example, maximum allowable pneumatic bleed duct surface temperatures of 232°C (450°F), with a transient excursion up to 260°C (500°F) for a maximum of two minutes, have been approved. The excursion above 232°C (450°F) occurs only during failure conditions such as an engine pneumatic high stage bleed valve failure or duct rupture. The approval of these elevated temperatures has been based on compensating design features such as a cockpit indication of over - temperature combined with associated procedures to shutoff the overheated system, insulated ducts, zone ventilation airflow which produces a lean fuel - air mixture, and an automatic over - temperature shutoff of the pneumatic sys tem so that the temperature cannot exceed the accepted 232°C (450°F) temperature for more than two minutes. The internal tank surface temperatures resulting from the failure should not exceed the surface temperature limit for the fuel type used, as describ ed in paragraph 3.5 of this AMC.

5.3.7 Electrical ignition sources The applicant should perform a failure analysis of all the fuel systems and subsystems that have wiring routed into fuel tanks. Systems that should be considered include those for fuel pump power and control and indication, fuel quantity indication, fuel temperature indication, fuel level sensors, and any other wiring routed into or adjacent to fuel tanks. The analysis should consider system level failures, failures within LRUs, and the comp onent level failures discussed below. The analysis should include the existence of latent failures and subsequent failures that may lead to an ignition source within the fuel tank. Examples include undetected failures of tank components or wiring, the unde tected presence of conductive debris, damage to FQIS or level sensor probes, or corrosion, in combination with external failures such as hot shorts or electromagnetic effects.

In addition, the applicant should provide a description of the protective means employed in the fuel system wiring. This should include a description of features such as separation/segregation, transient suppression devices, shielding of wiring, Powered by EASA eRules Page 702 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM and methods employed to maintain configuration control of critical wiring throughout the l ife of the aeroplane.

5.3.8 Electrical short - circuits 5.3.8.1 One method that may provide protection of circuits that enter fuel tanks is the incorporation of a transient suppression device (TSD) in the circuit close to the point where those wires enter the fuel tanks. Consideration should also be given to protection of the wiring between the TSDs and the tank if the protection devices are not located at the tank entrance, and also to the possibility of transients being induced in the wiring between the TSDs and the electrical devices in the fuel tanks. Caution should be exercised when using a TSD to ensure that the TSD addresses both voltage and current suppression in order to limit the energy and current below the limits provided in Section 3.2 of this AMC.

5.3.8.2 Another method of protection that has been used to provide a fail - safe design with respect to electrical shorts is the separation of the wiring to electrical devices in the fuel tanks from other electrical power wires and circuits, combin ed with shielding between the wiring that enters the fuel tanks and any other electrical power - carrying wires in the aircraft installation. The effects of electrical short circuits, including hot shorts, on the equipment and wiring that enters the fuel tan ks should be considered, particularly for the FQIS wiring, fuel level sensors, and probes. Latent failures from factors such as contamination, damage/pinching of wires during installation, or corrosion on the probes, connectors, or wiring should be conside red when evaluating the effects of short circuits. The wire routing, shielding, and segregation outside the fuel tanks, including within the FQIS components (e.g., gauging units), should also be considered when evaluating the effects of short circuits. The evaluation should consider both the electrical arcing and localised heating that may result from short circuits on equipment, FQIS probes, and wiring. The evaluation of electrical short circuits should include consideration of shorts within electrical equ ipment, and the wiring from the equipment into the fuel tank. Prevention of fuel ignition from electrical shorts to the wiring that enters the fuel tanks may require specific wire and circuit separation and wire bundle shielding.

5.3.9 LRU design evaluatio n The design review should include an evaluation of the separation and protective features incorporated into any fuel system LRU whose failure could result in high - level electrical power (i.e., above the intrinsically safe levels) entering the fuel tank. F or example, circuit board failures could cause the LRU power supply circuits for the fuel quantity gauging system to come into contact with the circuits that lead into the fuel tank, resulting in a possible ignition source. Failures that can lead to violat ing the separation features within the LRU can be external or internal events.

External failures include overvoltage or overcurrent, high humidity, temperature, vibration, shock, and contamination. Internal failures include manufacturing defects or flaws i n the conductor, substrate, or coating. To address these failures, the design should either provide isolation and physical separation between the critical circuits, such as the circuits that enter a fuel tank, or adequate protective features, such as the t ransient suppression devices as discussed earlier, to protect the circuits that enter the fuel tank. Any LRU that meets the design requirements Powered by EASA eRules Page 703 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM identified in Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations, is considered acceptable, provided the following issues are addressed: — Ideally, higher power circuits within the LRU should not be located on the same circuit board or in a wire harness or electrical connector with intrinsically safe circuits or wiring; — There should be a physical barrier between circuit boards to isolate the intrinsically safe circuits from the effects of broken components or fire within the LRU; and — If limiting devices are installed on the same circuit board in series with the system circuitry to limit the amount of power or current transmitted to the fuel tank, there should be 7.62 cm (3 inches) between the traces, unless the manufacturer can justify a smaller separatio n on the basis that the effects of fire on the circuit board will not compromise the intrinsically safe circuit(s).

5.3.10 Electromagnetic effects including HIRF See AMC 25.954 for guidelines on establishing compli ance with the requirements for fuel system protection from lightning effects.

5.3.10.1 The evaluation should consider the electromagnetic effects due to HIRF, electrical transients, and RF emissions on the fuel system conductors (e.g.

fuel tank plumbing, s tructure, fuel, equipment and wiring) within the fuel tanks, particularly for the FQIS wiring and probes. The applicant should also consider the latent failures from factors such as contamination, damage, or corrosion on the probes or wiring when evaluatin g the effects of electrical transients. The wire routing, shielding, and segregation of conductors (e.g., plumbing, component casings, wiring, etc.) outside the fuel tanks should also be considered when evaluating the effects of electrical transients becau se the generation of the transient and the coupling to conductors may occur outside the fuel tanks. The evaluation should consider both electrical sparks and arcs, and localised heating, which may result from electromagnetic effects on the fuel tank system , FQIS probes, and wiring.

5.3.10.2 The evaluation should consider latent failures of electromagnetic protection features, such as shielding termination corrosion, shield damage, and transient limiting device failures, and the applicant should establish ap propriate indications or inspection intervals to prevent the existence of latent failure conditions. The failure of other system components may also affect the protection against electromagnetic effects. Consequently, the evaluation should consider the eff ect of any anticipated failure on the continued environmental protection.

5.3.10.3 The evaluation of electromagnetic effects should be based on the specific electromagnetic environment of a particular aeroplane model. Standardised tests, such as those in E UROCAE ED - 14G Change 1 dated January 2015, ‘Environmental Conditions and Test Procedures for Airborne Equipment’, and the equivalent RTCA, Inc., Document No DO - 160G dated December 2010, Sections 19 and 20, are not sufficient alone to show that the appropri ate standardised test categories, procedures, and test levels of EUROCAE ED - 14G/RTCA DO - 160G are selected, without an evaluation of the characteristics of the specific electromagnetic environment and the induced Powered by EASA eRules Page 704 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM transient levels assigned to systems install ed within a particular aeroplane model. Simulation of various latent failures of fuel system components within the tanks may be needed to show the effectiveness of the transient protection. The effectiveness of these features should be verified using the a ppropriate test procedures and test levels of EUROCAE ED - 14G/RTCA DO - 160G, determined above.

5.3.10.4 Prevention of fuel ignition due to electromagnetic effects may require specific wire segregation and separation, wire bundle shielding, or transient suppr ession for wires entering fuel tanks. The effectiveness of the transient protection features should be verified using the appropriate test procedures and test levels of EUROCAE ED - 14G/RTCA DO - 160G, determined above.

5.3.10.5 Redundancy of bond paths A fail ure of bonding jumpers is generally considered a latent failure, since there is no annunciation or indication of the bonding failure. The aeroplane fleet fuel tank inspections that occurred as a result of the TWA 800 investigation (National Transportation Safety Board Aircraft Accident Report NTSB/AAR - 00/03, ‘In - flight Breakup Over the Atlantic Ocean Trans World Airlines Flight 800, Boeing 747 - 131, N93119, Near East Moriches, New York,’ dated July 17, 1996) showed that failures of bonding jumpers, due to da mage, wear, or manufacturing errors, were not unusual. Based on this, it would be difficult to show that the probability of a failure of a single bonding jumper is extremely remote or extremely improbable. Therefore, electrical bonding jumpers or other bon ding provisions would need to consider the consequences of these latent failures. This may result in designs that incorporate electrical bonding redundancy, if the failure of a single electrical bonding feature could create a fuel tank ignition source. Add itionally, manufacturers would need to consider the use of appropriate maintenance to detect failed bonding jumpers. An example of such maintenance might include periodic inspections to limit latency.

5.3.10.6 Self - bonding couplers Early generation, self - b onding, flexible fuel couplers did not have multiple bonding paths. Thus, these bonding couplers exhibited single - point failures that caused a loss of function. These self - bonding flexible couplers failed because of missing bonding springs, anodising on bo nding surfaces, and incorrect installation. The safety assessment of designs incorporating multiple bonding paths must consider these failure modes, and qualification testing should show that no ignition sources are present in the full - up (non - degraded condition) and possible degraded condition with failure modes present within the couplings. For example, failure assessments of clamshell - type, self - bonding metallic couplings in composite fuel tanks have shown that arcing could occur if a coupling was imp roperly latched, or became unlatched and fell to the bottom of the fuel tank. The design of the coupling would need to address these failure modes. Improper latching could be addressed through positive latching features with tactile and visual indications that the coupling is properly latched. Redundant fail - safe features, such as redundant hinge and latching features, redundant bonding features, etc., may be needed to address other possible failure modes.

Powered by EASA eRules Page 705 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 5.3.10.7 Resistance or impedance limits of aeroplan e electrical bonding provisions 5.3.10.7.1 There is no specific EASA guidance on the maximum resistance or impedance of aeroplane electrical bonding provisions because electrical bonding within a fuel system should be tailored to the performance requiremen ts of a particular aeroplane design. The electrical bonding should consider the electrical sources, electrical faults, and electrostatic charges. The electrical bonding should also consider the fuel system design of the specific aeroplane, which would incl ude the structure material used (aluminium, carbon - fibre composites, fibreglass composites, etc.), the configuration of the fuel system (routing of fuel tubes, wires, and hydraulic tubes), and the electrical bonding concept (intentional isolation, self - bon ding fittings, separate bonding jumpers, etc.). Given the large variation in design approaches and the close relationship between the design approach and the electrical bonding requirements, it is not practical for EASA to provide specific guidance on the maximum bonding resistance or impedance.

5.3.10.7.2 Some type certificate (TC) holders have performed tests on their aeroplanes to determine the specific requirements for electrical bonding. Others, in the absence of specific aeroplane test data, have chos en conservative electrical bonding approaches. The approach is a decision each TC holder should make based on the specific situation for that TC holder’s aeroplane models.

5.3.10.8 Bonding integrity checks Past experience has shown that measurement of bond resistance is the desired method of ensuring bond path integrity. During bonding resistance measurements, the protective finish of components might be damaged in order to penetrate the insulating anodised surface layer, which may lead to subsequent corros ion damage. This concern has resulted in some TC holders defining non - intrusive inspections for electrical bonding. These inspections may include detailed visual inspections provided that the quality of the electrical bonding feature can be adequately asse ssed by visual cues, such as visible corrosion, breakage, tightness, or missing bonding provisions. For critical bonds, this method would not by itself be adequate. Other inspection methods include inductively coupled loop resistance measurements that elim inate the need to disconnect bonding jumpers, or to penetrate corrosion - prevention coatings. The need for bonding inspections, the frequency of the inspections, and the determination as to whether the inspections must be an Airworthiness Limitation should be established under the fuel tank SSA.

5.3.10.9 Bond corrosion and integrity 5.3.10.9.1 Degradation of electrical bonding provisions, such as bonding jumpers, has occurred on in - service aeroplanes. Results from aeroplane fuel tank inspections conducted on a sample of aeroplanes by manufacturers and operators showed discolouration, corrosion, and damage to bonding jumpers. It is not clear whether the discolouration indicates that c orrosion that will become more severe Powered by EASA eRules Page 706 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM with time, or whether it is simply a surface colour change. The applicant should define the bonding feature characteristics — such as visible corrosion, discolouration, jumper strand separation, and jumper strand break age — that will be used to distinguish discrepant bonding provisions.

5.3.10.9.2 The level of corrosion observed on bonding features, specifically on bonding jumpers, varies greatly across aeroplane fleets. While some aeroplanes within a fleet and certain locations within the fuel tanks showed no evidence of corrosion, other aeroplanes and locations exhibited higher levels of corrosion. Inspection results indicate that the materials used in certain bonding jumpers (tin - plated copper) may be more prone to co rrosion. Nickel - plated copper wire does not experience similar corrosion. Corrosion programs for aeroplane structures have long recognised the variability of corrosion within the fleet. Factors that influence the level of corrosion of bonding jumpers inclu de the fuel type (sulphur content, etc.), the presence of water in the fuel tank, installation effects such as cracking of the tin plating when the jumper is installed, the temperature, humidity, and chemicals used for preparation of the fuel tanks prior t o aeroplane storage, etc. While certain levels of corrosion or discolouration may be acceptable between inspection intervals, the showing of compliance should include substantiation that the materials used in the bonding jumpers are appropriate for use in the fuel tanks in consideration of the proposed inspection intervals. This substantiation should consider the variability in corrosive environments and the factors noted above that may exist on in - service and stored aeroplanes in the fleet.

5.3.10.10 CS 25.981 states: ‘(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapours.’ Fuel tube flexible couplings and co mponents as small as nuts, bolts, and washers may develop sufficient charge to cause arcing due to electrostatic conditions if not properly accounted for in the design. Electrical bonding would need to be considered if these couplings are identified as ign ition sources during the ignition source evaluation and assessment.

5.3.11 Friction sparks The failure modes and effects analysis (FMEA) should include an evaluation of the effects of debris entering the fuel pumps, including any debris that could be gener ated internally, such as any components upstream of the pump inlet.

Industry practices for fuel tank cleanliness, and design features intended to preclude debris entering the fuel pumps, have not been effective at eliminating debris. Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, sealant, lockwire, and so forth have been drawn into fuel pumps and contacted the impeller. This condition could result in the creation of friction sparks, and it should be an a ssumed failure condition when conducting the SSA. Fail - safe features should be incorporated into the fuel pump design to address this condition. Examples of means that may be incorporated into the fuel pump design to address this concern include: Powered by EASA eRules Page 707 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM — the insta llation of inlet flame arrestors, — the use of reticulated foam, — the use/installation of ejector fuel pumps without impellers to scavenge fuel, or — maintaining fuel over the pump inlet throughout the aeroplane flight attitude envelope.

6 COMPONENT FAILURE MOD E CONSIDERATIONS 6.1 Component qualification review The qualification of components, such as fuel pumps, has not always accounted for unforeseen failures, wear, or inappropriate overhaul or maintenance. Failures to account for these failure modes and testing the pump using the procedures defined in Military Standard MIL - STD - 810H, Method 511.6, Explosive Atmosphere, have led to some fuel pumps entering airline service having never been tested to demonstrate whether they have explosion - proof capabilities . This combined experience suggests that more needs to be done to establish the capabilities of fuel pumps and other fuel system components to operate safely in an explosive environment. Such a capability should be substantiated considering these factors i n addition to the conditions noted in paragraph 3.3 of this AMC.

The amount of qualification review can be significantly reduced if the fail - safe features noted earlier in this AMC are followed (e.g. not operating pumps in the vapour spaces of the tank, in corporating arc fault or ground fault protection on the electrical circuit, etc.).

Therefore, an extensive evaluation of the qualification of components may be required if a qualitative assessment of the component and installation features does not elimina te the component as a potential ignition source.

6.2 Maximum component temperature for qualification of fuel system components The maximum component temperatures may be determined experimentally. Tests should be conducted that are long enough for the compo nent to reach the maximum temperature. All the foreseeable failures and malfunctions of the fuel tank components (including those failures and malfunctions that could be undetected by the flight crew and maintenance personnel) should be considered when det ermining the maximum temperatures.

6.2.1 Components mounted adjacent to the exterior surface of the fuel tank can create a high localised temperature on the inner surface of the tank. This can be investigated by laboratory tests that duplicate the installa tion, or by a validated heat transfer analysis using the maximum potential temperature of the component.

6.2.2 When aeroplane equipment or system components such as engine bleed air ducting or ECS are located near fuel tanks, an FMEA should be performed to determine the failures of adjacent systems or components that could cause elevated surface temperatures. The maximum internal tank temperatures that can occur during normal and failure conditions should be determined. Systems, such as over - temperature pro tection devices, should be evaluated to determine whether periodic health checks are necessary to ensure that latent failures do not exist.

6.3 Possible failure modes for determination of maximum component temperatures Powered by EASA eRules Page 708 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM The following list identifies some po ssible failure modes, but not all the conditions, that should be explored in determining the maximum temperature expected for fuel tank components: 6.3.1 Fuel pumps 6.3.1.1 Normal fuel pump operation considering the highest hot day ambient and fuel tank te mperatures: in many cases, fuel pump motors are protected by a (single) three - phase thermal circuit breaker. In several instances, the resetting of circuit breakers has resulted in arcing inside the fuel tank and the development of an ignition source from an existing failure. Therefore, the fuel pump circuit should also preclude the development of an ignition source if the breaker is reset or forced in by a mechanic. Methods that may be used to address this foreseeable failure condition include the use of c ircuit - protective features such as non - resettable, fast - acting AFCB or GFI circuit breakers.

6.3.1.2 Two - phase operation of three - phase electrical fuel pumps: a failure of a single phase of a multiple - phase fuel pump will significantly increase the load on the remaining phases of the pump and the generation of heat in the pump. In many cases, thermal protection features within the pump have been incorporated to address this failure condition, but these means have not been effective at preventing continued o peration of a pump with a failed electrical phase. Another failure condition that should be considered is the subsequent failure of a second phase of the pump and possible arcing or heat damage. In general, pumps should not be allowed to operate following a failure of a single electrical phase of the pump if such operation could result in the development of an ignition source. Automatic protective means, such as AFCBs or GFIs or other means, should be provided to shut down the pump when a single electrical phase failure occurs. Periodic inspections or maintenance of these features may be required.

6.3.1.3 Dry operation of fuel pumps, including lack of lubrication: service history has shown that flight crews and maintenance personnel have inadvertently operated fuel pumps for long periods of time without fuel in the fuel tank.

Fuel pumps are typically qualified for dry run operation for periods of time based upon assumptions made about the possible duration of inadvertent operation, or the failure conditions, which could result in dry running of the pump. For example, some pumps were operated during qualification testing up to a maximum of 8 hours continuously, with total accumulated dry run operation of 24 hours. These qualification tests w ere accomplished in order to show that the fuel pump performance was still adequate following the dry pump operation. The tests were not conducted in an explosive environment and, hence, were not intended to qualify the pumps for such operation. In other c ases, previous approvals were predicated on the assumption that the fuel pump would not be dry run operated because the pump would be turned off by the flight/ground crew following a pump low - pressure indication. Extended dry operation of pumps may result in surface temperatures above the auto - ignition temperature of the fuel, or may expose the pump to dry run operation where debris from the fuel tank could enter the impeller and cause sparks. Manufacturers’ recommended procedures have not been shown to be adequate in preventing dry run Powered by EASA eRules Page 709 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM operation. Therefore, additional fail - safe features are necessary to preclude ignition sources caused by the dry run operation of aeroplane fuel pumps.

One or more of the following fail - safe means should be considered for the protection of fuel pumps: 1. Incorporating design features to keep the fuel pump inlet submerged in jet fuel to prevent dry running of the pump under all operating conditions.

2. Incorporating automatic pump shutoff features into the fuel pump or aeroplan e to preclude dry run operation.

3. Other means such as the installation of flame arrestors in the fuel pump inlet to preclude flame propagation into the fuel tank.

6.3.1.4 The temperatures associated with the fuel pump following wet operation with wet mec hanical components both at zero and reduced fluid flow.

6.3.1.5 The temperatures associated with moving mechanisms that are locked or seized.

6.3.1.6 The temperatures generated as a consequence of pump impeller slippage.

6.3.1.7 High temperatures or high c urrents due to a broken shaft. The design has to contain the broken shaft, and the pump and its control system must consider the high currents and temperatures that would follow.

6.3.1.8 Failed bearings: the effects of wear on the fuel pump features incorp orated into the design to maintain explosion - proof characteristics should be evaluated. For example, the wear of bearings or failures, including spinning of any bushings, and the possible effects on quenching orifices should be evaluated. In many cases, th e fuel pump explosion - proof features are not redundant, and the failure or degradation of the features is latent. If single or probable combinations of failures in the fuel pump can cause an ignition source, CS 25. 981 requires the incorporation of the fail - safe features noted previously. If wear of the pump can cause the degradation of fail - safe features, appropriate inspections, overhaul, or life limiting of the pump should be included in the Airworthiness Limitati ons Section of the ICA, per CS 25.981(d) and Appendix H to CS - 25, paragraph H25.4 .

6.3.2 FQIS 6.3.2.1 FQIS wiring in the tank, with maximum voltage and current applied, considering normal and failure conditions, including the effects of high - voltage systems outside the tank in proximity to the FQIS wires.

6.3.2.2 FQIS components in the normal and failed state with the above associated maximum voltages and fault c urrents applied.

6.3.3 Float switch system Float switch system temperatures should be determined considering the maximum environment temperatures and the application of the applicable maximum voltage and fault currents.

Powered by EASA eRules Page 710 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPL ANT (CS - 25) FUEL SYSTEM 6.3.4 Fuel system components The t emperatures of the fuel system components should also be evaluated considering the failure of the bonding straps.

6.3.5 Pneumatic system Pneumatic system temperatures need to be evaluated for the effects of duct ruptures impinging on the external tank surf ace. Radiant and conducted heat transfer associated with the tank and components affecting tank wall temperatures should also be considered (see the previous discussion of spaces adjacent to fuel tanks).

6.3.6 Electrical defects and arcing Electrical defec ts that generate excessive heat, and arcing at the electrical connections to the pump housing or within the connector.

6.3.7 Submerged heat exchangers Submerged heat exchangers and supply tubing operating under conditions of maximum heat rejection to the f uel. This should include failures in any systems outside the fuel tank that could result in heat exchanger or supply tubing surface temperatures exceeding 204 °C (400 °F).

6.3.8 Failed or aged seals 6.3.8.1 Spraying of fuel in the tank from any pressurised fuel source may cause electrostatic charging of the components in the fuel tank. In addition, the use of sealant in connectors that is not compatible with the fuel may allow leakage into the connector and the possibility of a fire near the conn ector.

6.3.8.2 Fuel line couplings Ageing of seals may result in hardening of the seal material and leakage and spraying of fuel within the fuel tank; therefore, fuel line coupling designs should be evaluated and a design life should be established for all seals that are shown to age and allow leakage that can cause unacceptable electrostatic charging of components.

6.3.9 Fuel pump cooling flow Fuel used for the cooling of fuel pumps may be sprayed from the fuel pump. Fuel pump cooling flow should not be sp rayed into the fuel tank vapour space for the same reason as stated in 6.3.8 for the spraying of fuel. Means should be provided to distribute the discharged cooling fuel into the fuel tank at or near the bottom of the fuel tank.

6.3.10 Explosion - proof elec trical connector sealant and seals Electrical connections to fuel pumps are typically located either inside or outside the fuel tank in areas of the aeroplane where the presence of flammable fuel vapour should be assumed because no secondary sealing of fue l is provided. Fuel leakage and corrosion at electrical connectors located outside the fuel tank has allowed the presence of both flammable vapour and electrical arcing at connectors, resulting in fires. In other applications, arcing has occurred at the pu mp connections inside the fuel tanks, requiring the installation of appropriately Powered by EASA eRules Page 711 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM sized steel shields to prevent arcing through the connector or pump housing into the fuel tank or areas where flammable vapour could exist.

6.3.11 Arcing at the pump electric al connections Wear, corrosion, manufacturing variability (e.g. tolerances), connector distortion and seal damage from ice, and bent pins in the connector are examples of failures that have caused high resistance or shorting and arcing in electrical connec tors.

Based upon historical data showing that these and other failure modes listed previously in this AMC have occurred in fuel pump connectors, arcing in the connectors is a foreseeable failure. Each of these single or cascading failure modes should be in cluded in the FMEA. The high current loads present during pump start - up and operation exacerbate arcing in the connector. The size and duration of the arcing event should be established based upon the fuel pump electrical circuit protection features. Arcing at the pump electrical connections, and the resultant damage to the pump connector, housing, and explosion - proof features due to intermittent, and maximum energy, arcing events should be assumed. If fuel is present on the backside of the c onnector, failures resulting in fuel leakage in conjunction with arcing in the connector should be assumed if the fuel leak is a latent failure or is the result of a cascading failure. The design of traditional fuel pumps has resulted in the need to instal l AFCB or GFI protection features to address foreseeable failures and limit the energy release during an arcing event to prevent an ignition source from occurring. The pump connector should be shown to contain any resultant arcing or fire and to maintain a ll surface temperatures below the auto - ignition temperature of the fuel. Component manufacturer maintenance records and qualification test results should be reviewed as part of the safety analysis process to establish that any sealants and materials in the connector are compatible with the operating environment and to determine whether a design life or periodic inspections for the pump connector are needed.

7 AIRWORTHINESS LIMITATIONS FOR THE FUEL TANK SYSTEM 7.1 CS - 25 Appendix H, paragraph H25.4(a)(2) requires that each mandatory replacement time, inspection interval, related inspection procedure, and all the CDCCLs approved under CS 25.981 for the fuel tank system, be inclu ded in the Airworthiness Limitations Section of the ICA.

7.2 Critical design configuration control limitations include any information necessary to maintain those design features that were defined in the original type design as being needed to preclude the development of ignition sources. This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the original fuel tank system type design. The original design approval holder should define a method to ensure that this essential information will be evident to those that may perform and approve repairs and alterations. Visual means to alert the maintenance crew should be placed in areas of the aeroplane where inappropriate actions may degrade the integrity of the design configuration. In addition, this information should be communicated by statements in the appropriate manuals, such as wiring diagram manuals.

Powered by EASA eRules Page 712 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM 7.2.1 CDCCLs may include any maintenance procedure that could result in a failure, malfunction, or defect endangering the safe operation of the aeroplane, if not performed properly or if improper parts or materials are used. This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate t he integrity of the original type design of the fuel tank system.

7.2.2 CDCCLs are intended to identify only the critical features of a design that must be maintained. CDCCLs have no intervals; they establish configuration limitations to maintain and to pr otect the ‘critical design features’ identified in the CDCCLs.

CDCCLs can also include requirements to install placards on the aeroplane with information about the critical features. For example, certain components of a fuel pump (or all the components) ma y include critical features that are identified as CDCCLs. These critical features must be identified in the Airworthiness Limitations Section of the ICA and should also be identified in the component maintenance manual (CMM) as CDCCLs to provide awareness to maintenance and repair facilities.

7.2.3 Certain CDCCLs apply to elements of fuel system components. As such, maintenance of those critical features may be covered in a CMM. When Airworthiness Limitations need to call out aspects of CMMs, it is a best practice to limit the CDCCL - controlled content to only those maintenance tasks directly impacting a CDCCL feature, rather than requiring the complete CMM to be a CDCCL.

7.3 Any fuel tank system components that are determined to require periodic maintenance , inspection, or overhaul to maintain the integrity of the system or maintain protective features incorporated to preclude a catastrophic fuel tank ignition event must be defined and included in the Airworthiness Limitations Section of the ICA. An inspecti on Airworthiness Limitation has a specific task and interval (such as 10 years). The inspection interval should be established based on the standard practices defined in AMC 25.1309 for the evaluation of component failures. The inspection could also be required following maintenance to verify that a CDCCL feature is maintained. Examples of inspection Airworthiness Limitations include the following: 7.3.1 Ageing fuel line coupling seals/o - rings In certain instances, the materials used in fuel line couplings may lose flexibility and harden with age. Under pressurised operation, the seal may allow fuel leakage.

This will allow spraying of fuel in the tanks or other areas of the aeroplane where spraying fuel could create a fire hazard. Repetitive inspections, functional checks, or mandatory replacement intervals may be required to prevent leakage.

Note: While not related to compliance with CS 25.981 , the hazards associated with th e ageing of fuel coupling O - rings, resulting in air entering fuel lines during suction feed operation, should also be addressed when developing the fuel system maintenance program.

7.3.2 Wear of pump bushings, bearings, and seals Wearing of pump bushings, bearings, and seals may significantly affect the performance of fuel pumps and degrade the features necessary to maintain the explosive - proof qualification. In most cases, these failure conditions are latent; therefore, incorporat ion of other fail - safe features, as discussed earlier in this AMC, should be considered. If fail - safe features, such as the installation of feeder tanks that are filled using ejector pumps, are incorporated, the functioning of those Powered by EASA eRules Page 713 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM features would need to be ensured by indications or periodic functional tests. The installation of fuel level sensors in the feeder tanks would provide continuous monitoring of the function. Another means could be the installation of flow indicators in the flow line of the eject or pump that can be viewed by maintenance personnel, and a mandatory periodic inspection of this function is one example of a method of a mandatory maintenance action.

7.3.3 Fuel pump electrical power protective features If a failure of an AFCB or GFI prot ective feature and/or a thermal fuse (closed) is latent and this feature is needed to maintain the fail - safe features, periodic checks would likely be needed. The inspection interval, and the need for built - in test features with indications of failures, sh ould be established through the safety analysis process and should consider the factors described in paragraph A.3.4.3 of Appendix A to this AMC.

7.3.4 Transient suppression/energy limiting devices If a failure of the device is latent and this feature is needed to maintain the fail - safe features, periodic checks will likely be needed.

7.3.5 Wire shield grounding Component grounds and wires will likely require inspections and measurements to determine whether they are properly grounded.

7.3.6 Fue l tank access panel/door seals Maintenance tasks should adequately provide procedures for inspections and checks of access panels and door seals.

7.3.7 Corrosion, wear, and damage to fuel pump connectors Maintenance tasks should provide adequate procedures for inspecting and checking fuel pump connectors for wear, corrosion, and damage.

7.3.8 Integrity of the fuel pump electrical supply conduit Maintenance tasks should provide adequate procedures for inspecting the integrity of the structure, sealing, drain holes, and bends of the electrical supply conduit to the fuel pump.

7.4 Maintainability of design and procedures Maintainability, both in the design and procedures (i.e. the master minimum equipment list, aeroplane maintenance manual, etc.), should be ver ified by the applicant. This should include, as a minimum, verification that the system and procedures support the safety analysis assumptions and are tolerant to the anticipated human errors.

7.5 Incorporation by reference into Airworthiness Limitations 7 .5.1 Where the words ‘in accordance with’ or ‘per’ are used in the Airworthiness Limitations, the procedures in the referenced document must be followed to ensure that the critical design feature is maintained. Any changes to these procedures require appro val by EASA before they can be used.

7.5.2 Where the words ‘refer to’ are used in the Airworthiness Limitations, the procedures in the referenced document represent one method of complying with the Airworthiness Limitation. An accepted alternative procedur e may be Powered by EASA eRules Page 714 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM developed by the operator in accordance with its procedures in its maintenance program/manual. Prior approval by EASA is not required for this action.

7.6 Visible identification of CDCCLs 7.6.1 CS 25.981(d ) establishes a requirement for visibly identifying the critical features of a design that are located in certain areas. The DAH should define a method of ensuring that this essential information will be communicated with statements in the appropriate manu als, such as wiring diagram manuals, so it will be evident to those who perform and approve such repairs and alterations, and it will be identified as a CDCCL.

7.6.2 An example of a CDCCL that would result in a requirement for visible means would be mainta ining wire separation between the FQIS wiring and other high - power electrical circuits where the separation of the wiring was determined to be a CDCCL. Acceptable methods of providing visible means would include colour coding and labelling the wiring. For retrofits of markings onto existing wiring, the placement of identification tabs at specific intervals along the wiring would be acceptable. Standardisation within the industry of the colour coding of the wiring used for the fuel tank system would assist m aintenance personnel in the functional identification of wiring. It is recommended to use pink coloured wiring as a standard for fuel tank system wiring.

Appendix A. Certification of Arc Fault Circuit Breakers (AFCBs) or Ground Fault Interrupters (GFIs) A. 1 PURPOSE This Appendix provides guidelines for the certification of AFCB or GFI devices that have been shown to be practical means to protect the circuits of electric - motor fuel pumps and other fuel tank components that use higher than intrinsically safe electrical power (for example, motor - operated valves).

A.2 BACKGROUND A.2.1 Service experience has shown that failures in the power supply circuit of a fuel pump, discussed in the body of this AMC, can result in ignition sources and, therefore, must be assumed as a foreseeable failure condition. Traditional thermal circuit breaker s are sized to prevent nuisance trips during fuel pump transient power demands and have not tripped when intermittent electrical arcs occurred. Intermittent arcing can erode metallic barriers such as conduits, electrical connectors, and the pump housing, r esulting in a loss of the integrity of the explosion - proof features, or creating ignition sources outside in areas adjacent to the fuel tank. Addressing the failure modes discussed in this AMC has resulted in the need to provide fast - acting GFI or AFCBs in traditional fuel pump electrical circuits in order to show compliance with CS 25.981 .

A.2.2 AFCBs have been used as a practical means to protect against arcing in the power circuits of fuel pump motors powered by either alternating current or direct current. SAE International has issued two aerospace standards for AFCBs, one for alternating current circuits and one for direct current circuits. (See paragraph B.3 of Appendix B of this AMC).

A.2.3 Fuel pum p housings and metallic conduits are grounded to the airframe, and any arcing to the cavity wall or conduit creates a ground fault. Therefore, GFIs have been used in AC pump power circuits as a practical means to ensure that power is quickly disconnected f rom the fuel pump in the event of a ground fault in the pump or the associated power wiring.

Powered by EASA eRules Page 715 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM A.3 CERTIFICATION GUIDELINES One acceptable means for the applicant to show compliance with the applicable regulations is to demonstrate, through design, review, a nalysis, and test, that the AFCB or GFI performs as intended under any foreseeable operating conditions and addresses the following guidance: A.3.1 Fault detection trip levels A.3.1.1 The applicant should show that the AFCB or GFI can distinguish between a ctual fault events and events characteristic of the normal aeroplane pump start - up operating loads and environmental conditions. Laboratory testing and/or aeroplane ground/flight testing should be performed to show the ‘intended function’ of the AFCB or GF I. The test methods chosen should reproduce the most common types of arcing in fuel pumps that occur in an aeroplane environment due to ground or arc faults. The AFCB or GFI should be designed to prevent nuisance tripping due to normal aeroplane electrical loads and electrical bus switching, and to operate continuously with the normal and abnormal aeroplane electrical bus switching characteristics associated with the master minimum equipment list dispatch relief configurations.

A.3.1.2 Installation of the A FCB or GFI should not result in an appreciable increase in the loss of the fuel pump function. A reliability requirement of the order of 100 000 hours mean time between failures may be satisfactory, but the applicant should show that a failure of the AFCB or GFI does not result in an appreciable increase in the occurrence of failures that result in the loss of fuel pump function.

A.3.1.3 Sufficient laboratory testing and aeroplane testing should be conducted to show the AFCB or GFI nuisance trip performance , including tests for lightning, HIRF, and electromagnetic compatibility. In addition, sufficient laboratory testing should be conducted to show that the AFCB or GFI trips before arcing in the fuel pump can lead to the ignition of fuel vapour in the fuel t ank.

A.3.1.4 A means should be provided to latch the AFCB or GFI in a state that removes power from the fuel pump motor in the event that a ground fault has been detected, until the AFCB or GFI is reset. A trip of a single AFCB or GFI should not be reset u ntil the reason for the trip has been determined and repaired, or until it has been determined that no ground fault exists. Intermittent arcing can cause tripping of circuit protection devices resulting from failures that are difficult to isolate during ma intenance actions. Single trip events may be attributed to a nuisance fault. However, maintenance instructions should include notes that state that repeated tripping of devices indicates that an intermittent fault exists, and the circuit should not be ener gised until the fault is isolated and repaired.

A.3.2 Software Inadvertent operation of multiple AFCB or GFI devices has the potential to affect the continued operation of more than one engine, a condition that EASA considers to be hazardous. The software used by the AFCB or GFI devices should be developed and verified in accordance with the latest version of AMC 20 - 115.

A.3.3 Airborne electronic hardware Application - specific integrated and complex circuits used by the AFCB or GFI devices should be develope d and tested in accordance with the latest version of AMC 20 - 152.

Powered by EASA eRules Page 716 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM A.3.4 System safety assessment A.3.4.1 AFCB or GFI devices may be installed in circuits that perform essential or critical functions, and/or their performance could impact the safety of fl ight. The applicant should perform an installation SSA in accordance with CS 25.901(c) , 25.981 (a) and (d), and 25.1309 . The SSA should include a functional hazard assessment to determine the effects of failures of the AFCB or GFI devices on the safety of the aeroplane and to verify that the design limits the probability of undesirable failure conditions to acceptable levels. In add ition, the applicant should address the potential for possible common cause trips due to hardware/software errors and common cause trips due to environmental conditions such as HIRF ( CS 25.1317 ), lightning ( CS 25.954 and 25.1316 ), and electromagnetic interference ( CS 25.1301 , and 25.1353(a) ).

A.3.4.2 A failure to provide fuel pump power due to the unintended activation of multiple AFCB or GFI devices has the potential to affect the continued operation of more than one engine. A circuit - protective device failure, cascading failure, or common cause failu re that affects multiple engines would be non - compliant with CS 25.903(b) if it prevents the continued operation of the remaining engines, or requires immediate crew action to prevent a multiple engine power loss.

A.3.4.3 A failure of an AFCB or GFI device to detect an arc or ground fault condition in a fuel pump circuit can contribute to a catastrophic failure condition. Assuming that the loss of the explosion - proof features of the pump (examples discussed in parag raph A.2.1) or arcing at the electrical connector could result from a single failure, EASA considers the undetected failure of an AFCB or GFI alone, which prevents its detection of or response to an arc or ground fault, to be a hazardous failure condition. The probability of a loss of arc or ground fault protection should either be shown to be extremely remote (if latent, consistent with the requirement of CS 25.981(a)(3) ) or annunciated to the flight crew prior to flight. If failures of the AFCB or GFI can contribute to hazardous or catastrophic failure conditions, the safety assessment should analyse the common cause failures or design errors that could result in these conditions and verify that appropriate protect ion to prevent them is provided. Due to the nature of AFCB and GFI devices, special attention should be given to protection from lightning, EMI, and HIRF.

A.3.4.4 As discussed in Section A.3.7 below, means should be provided for the flight crew to reset th e AFCB or GFI in the event that more than one fuel pump AFCB or GFI trips simultaneously in flight.

A.3.4.5 Further, the applicant should show by design, analysis, and fault insertion testing, if applicable, the validity of failure analysis assumptions, an d show that the probability of the failure of AFCB or GFI to detect the existence of a ground or arc - 7 fault condition and remove power from a pump is extremely remote (10 or less) when combined with a single failure as assumed in Section A.3.4.3. In order to show this, AFCB and GFI installations have typically required an automatic built - in test feature that verifies the AFCB or GFI is operational before applying power to the fuel pump prior to each flight (see Section 5.3.3 of this AMC).

Powered by EASA eRules Page 717 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM A.3.5 Power and ground requirements AFCBs or GFIs are active devices and they require power to function. The applicant should show that the AFCB or GFI power and ground connections are implemented such that all the aeroplane’s load margins are sufficient and tha t proper circuit protection or other methods are used to protect the AFCB or GFI power and ground wiring. The applicant should also show that there are no hazards to maintenance or flight crews due to possible hot shorts to electrical panels containing AFC Bs or GFIs. In addition, if the installation of AFCBs or GFIs involves the direct replacement of devices on a given electrical panel, the applicant should show that there is adequate power/heat dissipation and ensure a safe touch temperature.

A.3.6 Built - i n test AFCB and GFI devices should incorporate the built - in test and annunciation features needed to meet the reliability requirements for showing compliance with CS 25.981(a)(3) . For example, if a single or cascading fai lure in the fuel pump electrical circuit can result in an ignition source, a circuit protection feature failure rate less than - 7 extremely remote (1 x 10 ) would be required in order to comply with CS 25.981 .

Tradit ional protective devices without built - in tests and annunciations of failures have not been shown to achieve this level of reliability. Applicants should consider installing multiple protective devices in series or providing built - in tests with annunciatio n.

A.3.7 Troubleshooting procedures A.3.7.1 Because AFCBs or GFIs are capable of detecting ground paths on pumps and aeroplane wiring that may not be detected by visual inspection, the applicant should define the operational and maintenance philosophies an d the methodology associated with an AFCB or GFI trip that does not rely solely on visual inspections.

The applicant should show how the maintenance procedures would be able to safely distinguish and diagnose an AFCB or GFI trip and a nuisance trip without causing a fuel tank explosion. Operational instructions and maintenance procedures should be provided to prevent the resetting of tripped AFCBs or GFIs until it can be assured that resetting an AFCB or GFI will not cause the occurrence of a fuel tank expl osion. Human factors should be taken into account to minimise the possibility of human errors during aeroplane operation and maintenance.

A.3.7.2 If multiple boost pumps are protected with AFCB or GFI devices such that the continued operation of multiple e ngines could be affected, there should be a means for the flight crew to reset tripped AFCB or GFI devices in flight. A loss of fuel pump capability due to inadvertent tripping in some fuel tanks could result in a loss of the fuel reserves needed to comple te an extended operations (ETOPS) flight or a safe diversion. To prevent causing an ignition source, the applicable aeroplane flight manual should contain a limitation against the reset of a single AFCB or GFI. However, in order to address common cause ina dvertent tripping, procedures should be provided for resetting AFCB or GFI devices when multiple AFCBs or GFIs have tripped simultaneously in flight.

A.3.8 Hardware qualification Environmental testing — including thermal, shock and vibration, humidity, flu id susceptibility, altitude, decompression, fungus, waterproof, salt spray, and explosion - proof testing — should be performed in accordance with EUROCAE ED - 14G/RTCA DO - 160G or equivalent standards. The applicant should define an insulation, dielectric, and electrical grounding and bonding standard acceptable to EASA Powered by EASA eRules Page 718 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUB PART E – POWERPLANT (CS - 25) FUEL SYSTEM for the AFCBs or GFIs. Appropriate test categories in each section of EUROCAE ED - 14G/RTCA DO - 160G should be chosen based on the AFCB or GFI installation environment defined for the specific aero plane. Particular attention should be given to the normal and abnormal power input tests outlined in Section 16 of EUROCAE ED - 14G/RTCA DO - 160G. A system with AFCBs or GFIs installed must comply with CS 25.954 and CS 25.1316 for lightning protection, CS 25.1301 and CS 25.1353(a) for electromagnetic compatibility, and CS 25.1317 for HIRF.

A.3.9 Aeroplane tests The applicant should show by ground tests, flight tests, or both that all the AFCBs or GFIs remain armed during both normal and abnormal electrical power bus and load switching as described in para graph A.3.1.1 of this AMC, and are not adversely affected by the operation of other aeroplane systems. The aeroplane tests should also show that neither the AFCBs nor the GFIs would produce electromagnetic interference that would affect other aeroplane sys tems.

A.3.10 Instructions for Continued Airworthiness (ICA) A.3.10.1 The applicant must submit the ICAs required by CS 25.1529 in order to provide the necessary procedures to service and maintain AFCB or GFI installations. As required by Appendix H to CS - 25, H25.4 , the Airworthiness Limitations Section of the ICA must include each mandato ry replacement time, inspection interval, related inspection procedure, and all the critical design configuration control limitations (CDCCLs) approved under CS 25.981 for the AFCB or GFI installation.

Inspection i ntervals determined from the safety analysis should be included for the detection of latent failures that would prevent the AFCBs or GFIs from tripping during a ground or arc fault event.

A.3.10.2 AFCBs or GFIs used for showing compliance with the CS 25.981 requirements for preventing ignition sources are typically CDCCLs in these installations. As required by CS 25.981(d) , the applicant must provide visible means of identif ying the AFCB or GFI as a CDCCL and should provide design features to minimise the inadvertent substitution of an AFCB or GFI with a non - AFCB or GFI device.

A.3.11 Aeroplane flight manual limitations The aeroplane flight manual limitations section should a ddress any limitations related to the intended function of the AFCBs or GFIs and any self - test features of the AFCB or GFI design.

Appendix B. Related Documents B.1 EUROCAE Documents — EUROCAE ED - 14G Change 1 ‘Environmental Conditions and Test Procedures for Airborne Equipment’, dated January 2015.

— EUROCAE ED - 79A ‘Guidelines for development of civil aircraft and systems’, dated December 2010.

— EUROCAE ED - 107A ‘Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment’, dated July 2010.

B.2 RTCA Documents — RTCA DO - 160G, ‘Environmental Conditions and Test Procedures for Airborne Equipment’, 6 December 2010.

Powered by EASA eRules Page 719 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM B.3 SAE International Documents — AIR1662A, ‘Minimization of Electrostatic Hazards in Aircraft Fuel Systems’, dated August 2013.

— ARP4404C, ‘Aircraft Electrical Installations’ (guidance document for design of aerospace vehicle electrical systems).

— ARP4754A, ‘Certification Considerations for Highly Integrated or Complex Aircraft Systems’, dated December 2010.

— ARP4761, ‘Guideline s and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment’, dated December 1996.

— ARP5583A, ‘Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment’, dated June 2010.

— AS50881F, ‘Wiri ng Aerospace Vehicle’ (procurement document used to specify aerospace wiring; replaces MIL - W - 5088), dated May 2015.

— AS5692A, ‘ARC Fault Circuit Breaker (AFCB), Aircraft, Trip - Free Single Phase and Three Phase 115 VAC, 400 Hz - Constant Frequency’, dated De cember 2009.

— AS6019 , ‘ARC Fault Circuit Breaker (AFCB), Aircraft, Trip - Free 28 VDC’, dated June 2012.

B.4 Military Specifications MIL - STD - 810H, Environmental Engineering Considerations and Laboratory Tests, dated January 2019.

B.5 Other Industry Documents — Air Force Aero Propulsion Laboratory Technical Report AFAPL - TR - 75 - 70, Summary of Ignition Properties of Jet Fuels and Other Aircraft Combustible Fluids, dated September 1975, http://www.dtic.m il/get - tr - doc/pdf?AD=ADA021320 .

— ASTM D2155 - 12, Standard Test Method for Determination of Fire Resistance of Aircraft Hydraulic Fluids by Autoignition Temperature.

— ASTM D4865, Standard Guide for Generation and Dissipation of Static Electricity in Petroleum Fuel Systems, August 2009.

— ASTM E659 - 15, Standard Test Method for Autoignition Temperature of Chemicals, ASTM International.

— NASA Report NASA/TM - 2000 - 210077, Some Notes on Sparks and Ignition of Fuels, dated March 2000, https://ntrs.nasa.gov/search.jsp?R=20000053468 .

— National Fire Protection Association NFPA 77, Recommended Practice on Static Electricity, latest edition, http://www.nfpa.org .

— Underwriters Labor atories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations, dated 31 July 2006, https://s tandardscatalog.ul.com/standards/en/standard_913_8 .

Appendix C. Definitions C.1 ARC FAULT CIRCUIT BREAKER (AFCB) A device that provides thermal circuit breaker protection, detects electrical arcing faults, and interrupts electrical power to the fault. (See paragraph B.3 of this AMC for the SAE standards for alternating current and direct current AFCBs.)

Powered by EASA eRules Page 720 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM C.2 AUTO - IGNITION TEMPERATURE The minimum temperature at which an optimised flammable vapour and air mixture will spontaneously ignite when heated to a uniform temperature in a normal atmosphere without an external source of ignition, such as a flame or spark.

C.3 AUXILIARY TANKS Fuel tanks installed that make additional fuel available for increasing the flight range of the aeroplane. The term ‘auxiliary’ means that the tank is secondary to the aeroplane’s main fuel tanks; i.e., the functions of the main tanks are immediately available and operate without immediate supervision by the flight crew in the event of a failure or the inadvertent depl etion of fuel in an auxiliary tank. Auxiliary tanks are usually intended to be emptied of usable fuel during flight and have been installed in various locations including centre wing structures, horizontal stabilisers, wings, and cargo compartments.

C.4 BA RRIER A physical partition attached to the aeroplane structure that separates one wire or group of wires from another wire or group of wires in order to prevent arcing, fire, and other physical damage between wires or groups of wires.

C.5 CRITICAL DESIGN C ONFIGURATION CONTROL LIMITATIONS (CDCCLS) Airworthiness Limitations that define those critical design features of the design that must be maintained to ensure that ignition sources will not develop within the fuel tank system.

C.6 ELECTRICAL SPARK A spark that is initiated by a potential difference, which causes an electrical breakdown of a dielectric such as a fuel/air mixture, produced between electrodes that are initially separated, with the circuit initially carrying no current. The term ‘voltage sparks ’ is sometimes used interchangeably with the term electrical sparks.

C.7 ELECTRICAL ARCS Electrical arcs occur between electrodes that are in contact with each other and carry excessive current, which results in melting at the contact points. This may resu lt in electric arc plasma and/or the ejection of molten or burning material. The term thermal sparks is used interchangeably with the term electrical arcs.

C.8 EXPLOSION PROOF Components designed and constructed so they will not ignite any flammable vapour or liquid surrounding the component under any normal operating condition or any failure condition.

Further information on the possible failure conditions that should be considered is specified in CS 25.981 (a)(3).

C.9 FAIL - SAFE Applicants should assume the presence of foreseeable latent (undetected) failure conditions when demonstrating that subsequent single failures will not jeopardise the safe operation of the aeroplane.

C.10 FILAMENT HEATING The heating of a sma ll diameter piece of conductive material when exposed to electrical current.

C.11 FLAMMABLE Flammable, with respect to a fluid or gas, means susceptible to igniting readily or to exploding.

Powered by EASA eRules Page 721 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM C.12 FLASHPOINT The flashpoint of a flammable fluid is defined as the lowest temperature at which the application of a flame to a heated sample causes the vapour to ignite momentarily, or ‘flash.’ The test standard for jet fuel is defined in the fuel specification.

C.13 FRICTION SPARK A heat source in the form of a spark that is created by mechanical contact, such as debris contacting a rotating fuel pump impeller.

C.14 FUEL SYSTEM AIRWORTHINESS LIMITATION Any mandatory replacement time, inspection interval, related inspection procedure, and all the critical design C DCCLs approved under CS 25.981 for the fuel tank system identified in the Airworthiness Limitations Section of the ICA (as required by CS 25.981 (d) and Section H25.4 of Appendix H to CS - 25 ).

C.15 GROUND FAULT INTERRUPTER (GFI) A device that provides thermal circuit breaker protection, detects an electrical power short circuit - to - ground condition, and interrupts electrical power to the ground fault.

C.16 HOT SHORT Electrical energy introduced into equipment or systems as a result of unintended contact with a power source, such as bent pins in a connector or damaged insulation on adjacent wires.

C.17 IGNITION SOURCE A source of suffic ient energy to initiate combustion of a fuel/air mixture. Hot surfaces that can exceed the auto - ignition temperature of the flammable vapour under consideration are considered to be ignition sources. Electrical arcs, electrical sparks, and friction sparks are also considered ignition sources if sufficient energy is released to initiate combustion.

C.18 INSTALLATION APPRAISAL A qualitative appraisal of the integrity and safety of the installation.

C.19 INTRINSICALLY SAFE Any instrument, equipment, or wiring that is incapable of releasing sufficient electrical or thermal energy to cause an ignition source within the fuel tank under normal operating conditions, or the anticipated failure conditions (see CS 25.981 (a)(3)) and environmental conditions.

C.20 LATENT FAILURE Please refer to the definition provided in AMC 25.1309 .

C.21 LINE REPLACEMENT UNIT (LRU) Any components that can be replaced while the aeroplane remains in operati onal service.

Examples of fuel system LRUs include components such as flight deck and refuelling panel fuel quantity indicators, fuel quantity system processors, and fuel system management control units.

C.22 MAXIMUM ALLOWABLE SURFACE TEMPERATURE As define d in CS 25.981 (a)(1) and (2), the surface temperature within the fuel tank (the tank walls, baffles, or any components) that provides a safe margin under all normal or failure conditions, which is at least 27.8 °C (50 °F) below the lowest expected auto - ignition Powered by EASA eRules Page 722 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM temperat ure of the approved fuels. The auto - ignition temperatures of fuels will vary because of a variety of factors (ambient pressure, dwell time, fuel type, etc.). The value accepted by EASA without further substantiation for kerosene fuels, such as Jet A, under static sea level conditions, is 232.2 °C (450 °F). This results in a maximum allowable surface temperature of 204.4 °C (400 °F) for an affected component surface.

C.23 QUALITATIVE Those analytical processes that assess system and aeroplane safety in an ob jective, non - numerical manner.

C.24 QUANTITATIVE Those analytical processes that apply mathematical methods to assess system and aeroplane safety.

C.25 TRANSIENT SUPPRESSION DEVICE (TSD) A device that limits transient voltages or currents on wiring to syst ems such as the fuel tank quantity, fuel temperature sensors, and fuel level switches, etc., to a predetermined level.

[Amdt 25/1] [Amdt 25/9] [Amdt 25/26]

AMC 25.981(b)(1) Fuel tank flammability design precautions

ED Decision 2009/010/R The intention of this requirement is to introduce design precautions, to avoid unnecessary increases in fuel tank flammability. These precautions should ensure: (i) no large net heat sources going into the tank, (ii) no unnecessary spraying, sloshing or creati on of fuel mist, (iii) minimization of any other energy transfer such as HIRF; Applicants should limit the heat inputs to the maximum extent. Heat sources can be other systems, but also include environmental conditions such as solar radiation. The followin g design features have been found acceptable: — heat insulation between a fuel tank and an adjacent heat source (typically ECS packs), — forced ventilation around a fuel tank, — fuel transfer logic leaving sufficient fuel in transfer tanks exposed to solar radia tions on the ground in order to limit their effects — heat rejecting paintings or solar energy reflecting paints to limit the heat input by solar radiation.

A critical parameter is the maximum temperature rise in any part of the tank under warm day conditions during a 4 hours ground operation. Any physical phenomenon, including environmental conditions such as solar radiation, should be taken into account. A temperature increase in the order of 20°C limit has been found acceptable for tanks not fitte d with an active Flammability Reduction Means and therefore unable to meet the exposure criteria as defined in M25.1(b)(1).

Note 1: for tanks fitted with Flammability Reduction Means, applicants should limit heat and energy transfers to the maximum extent. No maximum temperature increase limit is defined; however the 20 °C limit is applicable in case of dispatch with the active Flammability Reduction Means inoperative.

Powered by EASA eRules Page 723 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM Note 2: the maximum temperature increase under the conditions described above should be q uantified whether or not the affected tank is fitted with a Flammability Reduction Means.

[Amdt 25/6]

AMC 25.981(b)(2) Fuel tank flammability definitions

ED Decision 2009/010/R Equivalent Conventional Unheated Aluminium Wing is an integral tank in an unhea ted semi - monocoque aluminium wing of a subsonic aeroplane that is equivalent in aerodynamic performance, structural capability, fuel tank capacity and tank configuration to the designed wing.

Fleet Average Flammability Exposure is defined in Appendix N a nd means the percentage of time the fuel tank ullage is flammable for a fleet of an aeroplane type operating over the range of flight lengths.

[Amdt 25/6] Powered by EASA eRules Page 724 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM COMPONENTS

FUEL SYSTEM COMPONENTS

CS 25.991 Fuel pumps

ED Decision 2008/006/R (a) Main pumps . E ach fuel pump required for proper engine operation, or required to meet the fuel system requirements of this Subpart (other than those in sub - paragraph (b) of this paragraph), is a main pump. For each main pump, provision must be made to allow the bypass o f each positive displacement fuel pump other than a fuel injection pump approved as part of the engine.

(b) Emergency pumps . There must be emergency pumps or another main pump to feed each engine immediately after failure of any main pump.

[Amdt 25/5]

CS 25.993 Fuel system lines and fittings

ED Decision 2003/2/RM (a) Each fuel line must be installed and supported to prevent excessive vibration and to withstand loads due to fuel pressure and accelerated flight conditions.

(b) Each fuel line connec ted to components of the aeroplane between which relative motion could exist must have provisions for flexibility.

(c) Each flexible connection in fuel lines that may be under pressure and subject to axial loading must use flexible hose assemblies.

(d) Fle xible hose must be approved or must be shown to be suitable for the particular application.

(e) No flexible hose that might be adversely affected by exposure to high temperatures may be used where excessive temperatures will exist during operation or after engine shut - down.

(f) Each fuel line within the fuselage must be designed and installed to allow a reasonable degree of deformation and stretching without leakage.

CS 25.994 Fuel system components

ED Decision 200 7 / 010 /R (See AMC 25.994 ) Fuel system components in an engine nacelle or in the fuselage must be protected from damage which could result in spillage of enough fuel to constitute a fire hazard as a result of a wheels - up landing on a paved runway under each of the conditions prescribed in CS 25.721(b) [Amdt. 25/3]

AMC 25.994 Fuel system c omponents

ED Decision 2003/2/RM FAA Advisory Circular 25.994 - 1 Design Considerations To Protect Fuel Sy stems During A Wheels - Up Landing, dated 24/07/86, is accepted by the Agency as providing acceptable means of compliance with CS 25.994 .

Powered by EASA eRules Page 725 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLA NT (CS - 25) FUEL SYSTEM COMPONENTS

CS 25.995 Fuel valves

ED Decision 2003/ 2/RM In addition to the requirements o f CS 25.1189 for shut - off means, each fuel valve must – (a) Reserved .

(b) Be supported so that no loads resulting from their operation or from accelerated flight conditions are transmitted to the lines attached t o the valve.

CS 25.997 Fuel strainer or filter

ED Decision 2003/2/RM There must be a fuel strainer or filter between the fuel tank outlet and the inlet of either the fuel metering device or an engine driven positive displacement pump, whichever is nearer the fuel tank outlet. This fuel strainer or filter must – (a) Be accessible for draining and cleaning and must incorporate a screen or element which is easily removable; (b) Have a sediment trap and drain except that it need not have a drain if the strainer or filter is easily removable for drain purposes; (c) Be mounted so that its weight is not supported by the connecting lines or by the inlet or outlet connections of the strainer or filter itself, unless adequate strength margins under all loading conditions are provided in the lines and connections; and (d) Have the capacity (with respect to operating limitations established for the engine) to ensure that engine fuel system functioning is not impaired, with the fuel contaminated to a degree (with respect to particle size and density) that is greater than that established for the engine in CS - E.

CS 25.999 Fuel systems drains

ED Decision 2003/ 2/RM (a) Drainage of the fuel system must be accomplished by the use of fuel strainer and fuel tank sump drains.

(b) Each drain required by sub - paragraph (a) of this paragraph must – (1) Discharge clear of all parts of the aeroplane; (2) Have manual or automatic means for positive locking in the closed position; and (3) Have a drain valve – (i) That is readi ly accessible and which can be easily opened and closed; and (ii) That is either located or protected to prevent fuel spillage in the event of a landing with landing gear retracted.

Powered by EASA eRules Page 726 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) FUEL SYSTEM COMPONENTS

CS 25.1001 Fuel jettisoning system

ED Decision 2003/ 2/RM (a) A fuel jet tisoning system must be installed on each aeroplane unless it is shown that the aeroplane meets the climb requirements of CS 25.119 and 25.121(d) at maximum take - off weight , less the actual or computed weight of fuel necessary for a 15 - minute flight comprised of a take - off, go - around, and landing at the airport of departure with the aeroplane configuration, speed, power, and thrust the same as that used in meeting the applic able take - off, approach, and landing climb perf ormance requirements of this CS - 25.

(b) If a fuel jettisoning system is required it must be capable of jettisoning enough fuel within 15 minutes, starting with the weight given in sub - paragraph (a) of this par agraph, to enable the aeroplane to meet the climb requirements of CS 25.119 and 25.121(d) , assuming that the fuel is jettisoned under the conditions, except weight, found least favourable during the flight tests prescribed in sub - paragraph (c) of this para graph.

(c) Fuel jettisoning must be demonstrated beginning at maximum take - off weight with wingflaps and landing gear up and in – (1) A power - off glide at 1·3 V ; SR1 (2) A climb at the one - engine inoperative best rate - of - climb speed, with the critical engin e inoperative and the remaining engines at maximum continuous power; and (3) Level flight at 1·3 V , if the results of the tests in the condition specified in sub - SR1 paragraphs (c)(1) and (2) of this paragraph show that this condition could be critical.

(d) During the flight tests prescribed in subparagraph (c) of this paragraph, it must be shown that – (1) The fuel jettisoning system and its operation are free from fire hazard; (2) The fuel discharges clear of any part of the aeroplane; (3) Fuel or fumes do not enter any parts of the aeroplane; (4) The jettisoning operation does not adversely affect the controllability of the aeroplane.

(e) Reserved.

(f) Means must be provided to prevent jettisoning the fuel in the tanks used for take - off and landing below the level allowing climb from sea level to 3048 m (10 000 ft) and thereafter allowing 45 minutes cruise at a speed for maximum range. However, if there is an auxiliary control independent of the main jettisoning control, the system may be designed to jettison the remaining fuel by means of the auxiliary jettisoning control.

(g) The fuel jettisoning valve must be designed to allow flight personnel to close the valve during any part of the jettisoning operation.

(h) Unless it is shown that using any mea ns (including flaps, slots and slats) for changing the airflow across or around the wings does not adversely affect fuel jettisoning, there must be a placard, adjacent to the jettisoning control, to warn flight - crew members against jettisoning fuel while t he means that change the airflow are being used.

(i) The fuel jettisoning system must be designed so that any reasonably probable single malfunction in the system will not result in a hazardous condition due to unsymmetrical jettisoning of, o r inability to jettison, fuel.

Powered by EASA eRules Page 727 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) OIL SYSTEM

OIL SYSTEM

CS 25.1011 General

ED Decision 2003/2/RM (a) Each engine must have an independent oil system that can supply it with an appropriate quantity of oil at a temperature not above that safe for continuous operation.

(b ) The usable oil capacity may not be less than the product of the endurance of the aeroplane under critical operating conditions and the approved maximum allowable oil consumption of the engine under the same conditions, plus a suitable margin to ensure sy stem circulation.

CS 25.1013 Oil tanks

ED Decision 2003/ 2/RM (a) Installation . Each oil tank installation must meet the requirements of CS 25.967 .

(b) Expansion space . Oil tank expansion space must be provided as follows: (1) Each oil tank must have an expansion space of not less than 10% of the tank capacity.

(2) Each reserve oil tank not directly connected to any engine may have an expansion space of not less than 2% of the tank capacity.

(3) It must be impossi ble to fill the expansion space inadvertently with the aeroplane in the normal ground attitude.

(c) Filler connection . Each recessed oil tank filler connection that can retain any appreciable quantity of oil must have a drain that discharges clear of each part of the aeroplane. In addition each oil tank filler cap must provide an oil - tight seal.

(d) Vent . Oil tanks must be vented as follows: (1) Each oil tank must be vented from the top part of the expansion space so that venting is effective under any no rmal flight condition.

(2) Oil tank vents must be arranged so that condensed water vapour that might freeze and obstruct the line cannot accumulate at any point.

(e) Outlet . There must be means to prevent entrance into the tank itself, or into the tank out let, of any object that might obstruct the flow of oil through the system. No oil tank outlet may be enclosed by any screen or guard that would reduce the flow of oil below a safe value at any operating temperature. There must be a shut - off valve at the ou tlet of each oil tank, unless the external portion of the oil system (including the oil tank supports) is fireproof.

(f) Flexible oil tank liners . Each flexible oil tank liner must be approved or must be shown to be suitable for the particular application .

CS 25.1015 Oil tank tests

ED Decision 2003/ 2/RM Each oil tank must be designed and installed so that – (a) It can withstand, without failure, each vibration, inertia, and fluid load that it may be subjected to in operation; and Powered by EASA eRules Page 728 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) OIL SYSTEM (b) It meets the provisions of CS 25.965 , except – (1) The test pressure – (i) For pressurised tanks used with a turbine engine, may not be less than 34 kPa (5 psi) plus the maximum operating pressure of the tank inste ad of the pressure specified in CS 25.965(a) ; and (ii) For all other tanks, may not be less than 34 kPa (5 psi) instead of the pressure specified in CS 25.965(a) ; and (2) T h e test fluid must be oil at 121 ° C (250 ° F) instead of the fluid specified in CS 25.965(c) .

CS 25.1017 Oil lines and fittings

ED Decision 2003/ 2/RM (a) Each oil line must meet the requirements of CS 25.993 and each oil line and fitting in any designated fire zone must meet the requirements of CS 25.1183 .

(b) Breather lines must be arranged so that – (1) Condensed water vapour that might freeze and obstruct the line cannot accumulate at any point; (2) The breather discharge does not constitute a fire hazard if foaming occurs or causes emitted oil to strike the pilot’s windshield; and (3) The breather does not discharge into the engi ne air induction system.

CS 25.1019 Oil strainer or filter

ED Decision 2003/ 2/RM (a) Each turbine engine installation must incorporate an oil strainer or filter through which all of the engine oil flows and which meets the following requirements: (1) Each oil strainer or filter that has a bypass, must be constructed and installed so that oil will flow at the normal rate through the rest of the system with the strainer or filter completely blocked.

(2) The oil strainer or filter must have the capacity ( with respect to operating limitations established for the engine) to ensure that engine oil system functioning is not impaired when the oil is contaminated to a degree (with respect to particle size and density) that is greater than that esta blished for th e engine under CS - E.

(3) The oil strainer or filter, unless it is installed at an oil tank outlet, must incorporate an indicator that will indicate contamination before it reaches the capacity established in acco rdance with sub - paragraph (a) (2) of this par agraph.

(4) The bypass of a strainer or filter must be constructed and installed so that the release of collected contaminants is minimised by appropriate location of the bypass to ensure that collected contaminants are not in the bypass flow path.

(5) An oil strainer or filter that has no bypass, except one that is installed at an oil tank outlet, must have a means to connect it to t he warning system required in CS 25.1305(c)(7) .

Powered by EASA eRules Page 729 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) OIL SYSTEM

CS 25.1021 Oil system drains

ED De cision 2003/ 2/RM A drain (or drains) must be provided to allow safe drainage of the oil system. Each drain must – (a) Be accessible; and (b) Have manual or automatic means for positive locking in the closed position.

CS 25.1023 Oil radiators

ED Decision 2003/2/RM (a) Each oil radiator must be able to withstand, without failure, any vibration, inertia, and oil pressure load to which it would be subjected in operation.

(b) Each oil radiator air duct must be located so that, in case of fire, fla mes coming from normal openings of the engine nacelle cannot impinge directly upon the radiator.

CS 25.1025 Oil valves

ED Decision 2003/2/RM (a) Each oil shut - off must meet the requirements of CS 25.1189 .

(b) The closing of oil shut - off means may not prevent propeller feathering.

(c) Each oil valve must have positive stops or suitable index provisions in the ‘on’ and ‘off’ positions and must be supported so that no loads resulting from its operation or from accele rated flight conditions are transmitted to the lines attached to the valve.

CS 25.1027 Propeller feathering system

ED Decision 2003/ 2/RM (See AMC 25.1027 .)

(a) If the propeller feathering system depends on engine oil, there must be means to trap an amount of oil in the tank if the supply becomes depleted due to failure of any part of the lubricating system other than the tank itself.

(b) The amount of trapped oil must be enough to accomplish the feathering operatio n and must be available only to the feathering pump. (See AMC 25.1027(b) .)

(c) The ability of the system to accomplish feathering with the trapped oil must be shown. This may be done on the ground using an auxiliary source of oil for lubricating the engine during operation.

(d) Provision must be made to prevent sludge or other foreign matter from affecting the safe operation of the propeller feathering system.

AMC 25.1027 Inadvertent Propeller Feathering

ED Decision 2003/002/RM The design of the propeller feathering system should be such that it is possible to complete the feathering and the unfeathering operation under all normal operating conditions.

Powered by EASA eRules Page 730 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) OIL SYSTEM

AMC 25.1027(b) Propeller Feathering

ED Decision 2003/00 2/RM The amount of trapped oil should be sufficient to cover one feathering operation; taking into account the maximum oil leakage in the feathering system due to wear and deterioration in service.

Powered by EASA eRules Page 731 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) COOLING

COOLING

CS 25.1041 General

ED Decision 200 3/2/RM The powerplant cooling provisions must be able to maintain the temperatures of powerplant components, and engine fluids, within the temperature limits established for these components and fluids, under ground and flight operating conditions, and after norm al engine shutdown.

CS 25.1043 Cooling tests

ED Decision 2016 / 010/R (See AMC 25.1043 ) (a) General . Compliance with CS 25.1041 must be shown by tests, under critical groun d and flight operating conditions. For these tests, the following apply: (1) If the tests are conducted under conditions deviating from the maximum ambient atmospheric temperature, the recorded power - plant temperatures must be corrected under sub - paragrap h (c) of this paragraph.

(2) No corrected temperatures determined under sub - paragraph (1) of this paragraph may exceed established limits.

(3) Reserved.

(b) Maximum ambient atmospheric temperature. A maximum ambient atmospheric temperature corresponding t o sea le vel conditions of at least 37.8 ° C (100 ° F) must be established. The assumed temperature lapse rate is 6.6 ° C per thousand meter (3·6 ° F per thousand feet) of altitude above sea level until a temperature of - 56.5 ° C ( – 69·7 ° F) is reached, above which alt itude the temperature is considered at - 56.5 ° C ( – 69·7 ° F). However, for winterization installations, the applicant may select a maximum ambient atmospheric temperature corresponding to sea - level conditions of less than 37.8 ° C (100 ° F).

(c) Correction factor . Unless a more rational correction applies, temperatures of engine fluids and powerplant components for which temperature limits are established, must be corrected by adding to them the difference between the maximum ambient atmospheric t emperature and the temperature of the ambient air at the time of the first occurrence of the maximum component or fluid temperature recorded during the cooling test.

[Amdt 25/18]

AMC 25.1043 Cooling tests

ED Decision 2014/026/R In accordance with CS 25.1041 , applicants must show that the cooling provisions can maintain the temperatures of powerplant components and engine fluids within the temperature limits for which they have been certified, under ground and fligh t operating conditions, an d after normal engine shutdown.

CS 25.1043(b) establishes 37.8° C (100°F) at sea level as the lowest maximum ambient temperature, except for winterisation installations. Applicants may est ablish a highe r temperature limit if desired.

The assumed temperature lapse rate is 6.6°C per thousand meter (3.6°F per thousand feet) of altitude above sea level until a temperature of - 56.5°C ( – 69.7°F) is reached, above which altitude the Powered by EASA eRules Page 732 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) COOLING temperature is considered at - 56.5°C ( – 69.7°F). The compliance demonstration flight test should be conducted with an ambient temperature as close to the desired maximum ambient atmospheric temperature as practical; the maximum temperature deviation should not normally ex ceed 13.9°C (25°F). If testing is accomplished at lower ambient temperatures, then the test data must be corrected to that which would have resulted from testing on a day with the maximum ambient atmospheric temperature.

The maximum ambient temperature sel ected and demonstrated satisfactorily, taking account of correction factors, shall not be less than the minimum hot day conditions prescribed by CS 25.1043(b) and shall be an aeroplane operating limitation per the requirements of CS 25.1521(d) . The applicant should correct the engine temperatures to as high a value as possible in order to minimise the impact of this limitation.

[Amdt 25/15]

CS 25.1045 Cooling test procedures

ED Decision 2003/ 2/RM (a) Compliance wit h CS 25.1041 must be shown for the take - off, climb, en - route, and landing stages of flight that correspond to the applicable performance requirements. The cooling tests must be conducted with the aeroplane in the c onfiguration, and operating under the conditions, that are critical relative to cooling during each stage of flight. For the cooling tests, a temperature is ‘stabilised’ when its rate of change is less than 1 ° C (2 ° F) per minute.

(b) Temperatures must be stabilised under the conditions from which entry is made into each stage of flight being investigated, unless the entry condition normally is not one during which component and engine fluid temperatures would stabilise (in which case, operation through the full entry condition must be conducted before entry into the stage of flight being investigated in order to allow temperatures to reach their natural levels at the time of entry).

The take - off cooling test must be preceded by a period during which the powerplant component and engine fluid temperatures are stabilised with the engines at ground idle.

(c) Cooling tests for each stage of flight must be continued until – (1) The component and engine fluid temperatures stabilise; (2) The stage of flight is completed; or (3) An operating limitation is reached.

Powered by EASA eRules Page 733 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM

AIR INTAKE SYSTEM

CS 25.1091 Air intake

ED Decision 2016 / 010/R (See AMC 25.1091) (a) The air intake system for each engine must supply – (1) The air required by that en gine under each operating condition for which certification is requested; and (2) The air for proper fuel metering and mixture distribution with the air intake system valves in any position.

(b) Reserved.

(c) Air intakes may not open within the cowling, u nless that part of the cowling is isolated from the engine accessory section by means of a fireproof diaphragm.

(d) (1) There must be means to prevent hazardous quantities of fuel leakage or overflow from drains, vents, or other components of flammable fl uid systems from entering the engine air intake system; and (2) The aeroplane must be designed to prevent water or slush on the runway, taxiway, or other airport operating surfaces from being directed into the engine air intake ducts in hazardous quantitie s, and the air intake ducts must be located or protected so as to minimise the ingestion of foreign matter during take - off, landing and taxying. (See AMC 25.1091(d)(2) .)

(e) If the engine air intake system contains parts or components that could be damaged by foreign objects entering the air intake, it must be shown by tests or, if appropriate, by analysis that the air intake system design can withstand the foreign object ingestion test conditions of CS - E 790 and CS - E 800 without failure of parts or components that could create a hazard. (See AMC 25.1091(e) .)

[Amdt 25/18]

AMC 25.1091(d)(2) Precipitation Covered Runways

ED Decision 2003/ 2/RM 1 Except where it is obvious by in spection or other means, that precipitation on the runway would not enter the engine air intake under the declared operating conditions, including the use of the thrust reverser, compliance with the requirements should be demonstrated by tests using tyres representative of those to be approved for operational use. These tests should clear the aeroplane for operation from runways which are normally clear and also for operation in precipitation up to 13 mm (0·5 in) depth of water or dense slush. The tests sho uld be conducted with the minimum depth of 13 mm (0·5 in) and an average depth of 19 mm (0·75 in), or if approval is sought for a greater depth than 13 mm (0·5 in), the average depth should be 1·5 times the depth for which the take - offs are to be permitted , and the minimum depth should be not less than the depth for which take - offs are to be permitted.

Powered by EASA eRules Page 734 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM 2 It should be shown that the engines operate satisfactorily without unacceptable loss of power at all speeds from zero up to lift - off speed and in the attitudes likely to be used. Any special aeroplane handling techniques necessary to ensure compliance with the requirement should comply with the handling techniques assumed in establishing the scheduled performance of the aircraft.

3 The tests may be made in water or slush either by complete take - offs and landings as necessary in the specified precipitation conditions, or by a series of demonstrations in areas of precipitation sufficiently large to permit the spray pattern to become stabilised and to determine engine behaviour and response. Experience has shown that where a trough is used, a length of 70 to 9 0 m (230 to 295 ft) is usually satisfactory. If marginal results are obtained the effect of the difference between water and slush should be examined.

4 The effects of cross - winds should be examined and where necessary a cross - wind limitation established for inclusion in the Flight Manual for operation from precipitation covered runways.

5 It may be difficult to deduce the effect of low density precipitation (dry snow) from high density testing, but nevertheless clearance of the aeroplane for operation in dense precipitation up to 13 mm (0·5 in) will usually clear the aeroplane for operation in low density precipitation of depths greater than 10 cm (4 in) depth. If clearance is requested for operation in low density precipitation of depths greater than 10 c m (4 in) additional tests (in low density precipitation having a depth close to that for which approval is sought) will be necessary.

6 When auxiliary devices are fitted to prevent spray from being ingested by the engines it will be necessary to do additional tests in low density precipitation to permit operations in de pths greater than 25 mm (1 in).

AMC 25.1091(e) Air Intake System

ED Decision 2003/2/RM The parts or components to be considered are, for example, intake splitters, acoustic lining if in a vulnerable location and inlet duct - mounted instrumentation.

CS 25.1093 Air intake system de - icing and anti - icing provisions

ED Decision 2016 / 010 /R (See AMC 25.1093) (a) Reserved.

(b) Turbine engines Each engine, with all icing protection systems ope rating, must: (1) Operate throughout its flight power range, including the minimum descent idling speeds, in the icing conditions defined in Appendices C , O and P , and in falling and blowing snow within the limitations established for the aeroplane for such operation, without the accumulation of ice on the engine, air intake system components or airframe components that would do any of the following: (i) Adversely affect installed engine operation or cause a sustained loss of power or thrust; or an unacceptable increase in gas path operating temperature; or an airframe/engine incompatibility; or (ii) Result in unacceptable tempor ary power or thrust loss or engine damage; or Powered by EASA eRules Page 735 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM (iii) Cause a stall, surge, or flameout or loss of engine controllability (for example, rollback).

(2) Idle for a minimum of 30 minutes on the ground in the following icing conditions shown in Table 1 below, u nless replaced by similar test conditions that are more critical. These conditions must be demonstrated with the available air bleed for icing protection at its critical condition, without adverse effect, followed by an acceleration to take - off power or th rust, in accordance with the procedures defined in the aeroplane flight manual.

During the idle operation the engine may be run up periodically to a moderate power or thrust setting in a manner acceptable to the Agency. The applicant must document the engi ne run - up procedure (including the maximum time interval between run - ups from idle, run - up power setting, and duration at power), the associated minimum ambient temperature, if any, and the maximum time interval. These conditions must be used in the analys is that establishes the aeroplane operating limitations in accordance with CS 25.1521 . (See AMC 25.1093(b)) Table 1 - Icing conditions for ground tests Condition Total air Water concentration M ean effective Demonstration temperature (minimum) particle diameter (i) Rime ice - 18 to - 9°C Liquid — 0.3 g/m3 15 – 25 μm By test, analysis or condition (0 to 15°F) combination of the two.

(ii) Glaze ice - 9 to - 1°C Liquid — 0.3 g/m3 15 – 25 μm By test, analysis or condition (15 to 30°F) combination of the two.

(iii) Large drop - 9 to - 1°C Liquid — 0.3 g/m3 100 - 3000 μm By test, analysis or condition (15 to 30°F) combination of the two.

[Amdt 25/16] [Amdt 25/18]

AMC 25.1093(b) Power plant i cing

ED Decision 20 16 / 010 /R Compliance with CS 25.1093(b) is required even if certification for flight in icing conditions is not sought. Applicants must, therefore, propose acceptable means of compliance which may include flight tests in nat ural icing conditions.

The results of tests and analysis used for compliance with CS - E 780 may be used to support compliance with CS 25.1093(b) . This requires close coordination between the engine manufacturer and the aeroplane manufacturer to make sure th at CS - E 780 tests cover all potential ice sources.

If an applicant can show that the ice protection and the ice ingestion capability of a powerplant is equivalent to a previously certified powerplant installation which has demonstrated a safe in - service e xperience, then certification may be shown by similarity to previous designs. Other airframe ice shedding sources should also be reviewed if necessary.

(a) Compliance with CS 25.1093(b)(1) Compliance with CS 25.1093(b)(1) can be shown by analysis, laboratory testing, ground testing, dry air flight testing, similarity, and/or natural icing flight testing as necessary.

As a general rule, engine air intake systems, including auxiliary components (e.g. scoops, oil coolers, struts, fairings…), should be shown to operate continuously in icing conditions without regard to time, as in a hold condition. An exception would be for low engine power/thrust conditions where a sustained level flight is not possible. Even then , a conservative approach Powered by EASA eRules Page 736 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM must be used when a series of multiple horizontal and vertical cloud extent factors are assumed.

Applicants are reminded that the cloud horizontal extent factor is not intended to be used to limit the severity of exposure to icing conditions where it is reasonable to assume that the aircraft will be required to operate in that condition. The applicant will show by analysis, and verify by test, that the engine air intake Ice Protection System (IPS) provides adequate protection under all flight operations.

If there is a minimum power/thrust required for descent to ensure satisfactory operation in icing conditions, the increase to that minimum power/thrust in icing conditions should be automatic when the IPS is switched on. The engine may revert back to normal flight idle for short term operation, such as on final approach to landing; in such a case, this reversion to normal flight idle should be assessed in term of engine ice ingestion, and any required operational time limitation or p ilot action should be included in the AFM.

1. Analysis & Test Point Selection.

Applicants will adequately analyse the engine air intake IPS performance and address potential ingestion hazards to the engine from any predicted ice build - up on the engine air intake, including any runback or lip ice.

In establishing compliance with the requirements of CS 25.1093(b)(1) , reference should be made to AMC 25.1419 paragraph (a) for the assessment of the CS - 25 Appendix C icing environment. In particular for the following aspects: — Analytical Simulation Methods; — Analysis of areas and components to be protected; — Impingement Limit Analysis; — Ice Shedding Analysis; — Thermal Analysis and Runback Ice; and — Similarity Analysis.

In establishing compliance with the requireme nts of CS 25.1093(b)(1) , reference should be made to AMC 25.1420 paragraph (d) for the assessment of the Appendix O icing environment in particular for the following aspect s: — Analysis of areas and components to be protected; — Failure analysis, and — Similarity analysis.

In addition, the following specific analysis should be conducted: 1.1 Critical Points Analysis (CPA) A Critical Points Analysis (CPA) is one analytical approach to identify the most critical operational icing conditions to show that an engine air intake system, including auxiliary components (e.g. scoops, oil - coolers, struts, fairings…), complies with CS 25.1093(b)(1) .

For Appendix C icing conditions, in lieu of a detailed CPA, the conditions specified in paragraph 2.1, “Icing wind tunnel tests”, are acceptable and can be used for testing without further justifica tion.

Powered by EASA eRules Page 737 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM The CPA provides a means to predict critical conditions to be assessed and allows for a selection of conditions which will ensure that the ice protection system will be adequate throughout the combined aircraft operation/icing envelope.

The CPA shoul d include ice accretion calculations that account for freezing fraction and aerodynamic effects of the ice as it moves into the air intake, forward aircraft airspeed effects, engine configuration effects and altitude effects such as bypass ratio effects. I t should also include prolonged flight operation in icing (for example, in - flight hold pattern), or repeated icing encounters.

The CPA should consider: 1. the aircraft/engine operating envelope. This should consider climb, cruise, hold and flight idle desc ent conditions in the icing envelopes.

2. the environmental icing envelopes defined in CS - 25 Appendices C, O and P.

The Intermittent Maximum Icing Conditions of Appendix C envelope extension down to −40°C should also be considered.

3. thermal behavior of t he ice protection system in icing conditions. For each icing condition a heat balance can be made to assess the material temperature and runback water/ice accretion in icing conditions. This balance considers the heat available from the de - icing/anti - icing system and the heat lost to the impinging liquid water and external convection. The result determines the need to undertake an icing test at that point.

Applicants should determine the critical ice accretion conditions and compare each of them individuall y with the amount of ice the engine has satisfactorily demonstrated to ingest during engine certification (CS - E 780). Applicants may assume that 1/3 of the ice on the air intake perimeter is ingested as one piece. This assumption is consistent with the his torical approach taken by the engine manufacturers.

The critical ice accretion including runback ice (if any) may be different for each flight phases. If this is the case, the engine manufacturer should provide the relevant information. A particular attent ion should be made to: — ice accretion occurring during the holding phase, which may be ingested during descent at Idle power/thrust (potentially critical for engine performance and handling characteristics) or — ice accretion occurring during the descent at Idle power/thrust (with potentially reduced ice protection availability), which may be ingested during a Go Around at Take - Off power/thrust (potentially critical for mechanical damage).

Airspeed and scoop factor should be part of this assessment.

Applicants should demonstrate that the full flight envelope and the full range of atmospheric icing conditions specified in Appendices C, O and P to CS - 25 have been considered, including the mean effective drop / particle diameter, liquid / total water content, and temperature appropri ate to the flight conditions (for example, configuration, speed, angle - of - attack, and altitude).

To demonstrate unlimited operation of an air intake system in icing conditions, the system should: Powered by EASA eRules Page 738 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM — either operate fully evaporative, or — any ice accretion, incl uding runback ice, which forms should result in less ice than the engine has been demonstrated to ingest per CS - E 780.

The test duration may be reduced if a repeatable build and shed cycle is demonstrated.

It has been historically shown that an air intake thermal IPS designed to be evaporative for the critical points in Appendix C continuous maximum icing conditions, and running wet in Appendix C intermittent maximum icing c onditions, provides satisfactory performance. If the air intake is running wet in continuous maximum icing conditions, then the applicant should calculate the amount of runback ice that would accumulate during any relevant flight phase and compare that to the maximum certified ingestion capability of the engine per CS - E 780.

Scenario to be considered: The applicant should justify the icing scenarios to be considered when determining the critical ice accretion conditions. The flight phases as defined in Part II of Appendix C and Part II of Appendix O could be used to support the justification.

For holding ice accretion, the applicant should determine the effect of a 45 - minute holding in continuous maximum icing conditions of Append ix C . The analysis should assume that the aeroplane remains in a rectangular “race track” pattern, with all turns being made within the icing cloud. Therefore, no horizontal extent correction should be used for this analysis.

If ETOPS certification is des ired, the applicant should consider the maximum ETOPS diversion scenarios.

1.2 Two Minutes Delayed Selection of Air intake IPS Accretion Analysis It should be demonstrated that the ice accretion is acceptable after a representative delay in the selection of the ice protection systems, such as might occur during inadvertent entry into the conditions. In lack of other evidence, a delay of two minutes to switch on the IPS should be assumed. For thermal IPS, the time for the IPS to warm up should be added.

App licants should calculate the amount of air intake lip ice that forms using a continuous maximum condition from Appendix C to CS - 25, with a liquid water content factor of one. Of the total lip ice, only the ice on t he inner barrel side of the stagnation point would be ingested into the engine. Applicants may assume that 1/3 of the ice on the air intake perimeter is ingested as one piece.

1.3 Ice accretion sources Examples of airframe sources of ice accretion include the radome, the spinner, the antenna and the inboard section of the wing for aft fuselage mounted engines.

Clear ice may also occur on the wing upper surfaces when cold - soaked fuel (due to aircraft prolonged operation at high altitude) is in contact with the fuel tanks’ upper surfaces, or cold soaked structural part is in contact with upper surfaces, and the aeroplane is exposed to conditions of atmospheric moisture (for example, fog, precipitation, and condensation of humid air) at ambient temperatures ab ove freezing. This atmospheric moisture, when in contact with cold wing surfaces, may freeze. Simultaneous ice shedding from both wings of an aeroplane may damage Powered by EASA eRules Page 739 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM surrounding components or structure parts and result in ice ingestion damage and power/thrust loss in all engines during take - off of flight for aeroplanes with aft fuselage mounted engines.

Identification of Engine Air intake ice accretion sources includes, for Appendix O to CS - 25 icing environment, an assessment of air intake differing impingemen t limits, catch efficiency, distribution effects, and water contents. The applicant should evaluate the potential ice accumulation aft of the engine air intake protected surfaces for the possibility of ice ingestion by the engine.

The applicant should asse ss the ice accumulations and compare them on the basis of the size or the kinetic energy of the ice slab. It is possible to show that ice accumulations are smaller in size and therefore have equal or less kinetic energy than the CS - E 780 ice ingestion demo nstration. Alternatively, kinetic energy may be used as an acceptable method for comparing the airframe ice source to the results of the CS - E 780 ice ingestion demonstration. Any kinetic energy method must be agreed to by the Agency.

1.4 Ice Detection 1.4 .1 Upper wing mounted ice detection systems For aircraft with aft fuselage mounted engines equipped with upper wing mounted ice detection systems to warn the flight crew of clear ice build - up on the upper surface of the wings, applicants should demonstrate that any undetected ice, including ice formed from cold - soaked fuel, is not greater than the ice ingestion demonstrated for CS - E 780 compliance.

1.4.2 Primary Ice Detection System (PIDS).

The relevant provisions of the AMC 25.1419 paragraph (d) apply.

In addition, if a detection threshold exists in the PIDS (in terms of Liquid Water Content (LWC), amount of ice accretion, etc…) it must be demonstrated that the ice accretion that will occur before the actual detection threshold is reached is consistent with CS - E 780 ice ingestion demonstration. Prolonged exposure (up to a 45 - minute holding configuration in continuous maximum condition from Appendix C to CS - 25) shall be considered at the limit of the detection threshold to evaluate a conservative amount of ice accretion.

For aft fuselage mounted engines, both the engine air intake and the part of the wing in front of the engines should be considered. A conservative assumption is that the ice accretion may detach from both sites simultaneously and be ingested by the engines when the IPS is switched on.

1.5 Appendix P Icing Environment and Pitot - style air intakes design The results of FAA aerofoil testing in a mixed phase icing environment indicate that these icing conditions do not appreciably accrete on unheated aircraft wings.

Furthermore the testing showed that exposure to mixed phase environment results in the same or less ice accretion than exposure to supercooled liquid water environment with the same Total W ater Content (TWC). The overall power required by the running - wet ice protection system was essentially unchanged between all - liquid and mixed - phase conditions.

Powered by EASA eRules Page 740 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM However, in the running - wet mode, the local power density was much higher around the stagnatio n area in the mixed - phase conditions, compared to the purely liquid conditions. This is due to the power required to offset the thermodynamic heat - of - fusion necessary to melt the impacting ice particles that either fully or partially stick to the surface.

This may also explain why Pitot - style air intakes have not proved to be susceptible to mixed phase ice accretion within the air intake, and why Appendix C to CS - 25 compliance methods adequately address those air intakes. Engines designed with reverse flow air intakes, or with air intakes involving considerable changes in airflow direction should be shown to comply with Appendix P to CS 25.

Compliance for Pitot - style air intakes, without considerable changes in airflow direction, may be shown through qualitative analysis of the design and supported by similarity to previous designs that have shown successful service histories.

1.6 Falling and Blowing Snow 1.6.1 CS 25.1093(b)(1) requires that each engine, with all icing protection systems operating, operate satisfactorily in falling and blowing snow throughout the flight power/thrust range, and ground idle. Falling an d blowing snow is a weather condition which needs to be considered for the powerplants and essential Auxiliary Power Units (APUs) of transport category aeroplanes.

1.6.2 All engine air intakes, including those with plenum chambers, screens, particle - separ ators, variable geometry, or any other feature, such as an oil - cooler, struts or fairings, which may provide a potential accumulation site for snow, should be evaluated.

1.6.3 Although snow conditions can be encountered on the ground or in flight, there is little evidence that snow can cause adverse effects in flight on turbojet and turbofan engines with traditional Pitot style air intakes where protection against icing conditions is provided. However, service history has shown that inflight snow (and mixed phase) conditions have caused power interruptions on some turbine engines and APUs with air intakes that incorporate plenum chambers, reverse flow, or particle separating design features.

1.6.4 For turbojet and turbofan engines with traditional Pitot (str aight duct) type air intakes, icing conditions are generally regarded as a more critical case than falling and blowing snow. For these types of air intake, compliance with the icing specifications (at least including the icing environment of Appendix C to CS - 25) will be accepted in lieu of any specific snow testing or analysis.

1.6.5 For non - Pitot type air intakes, demonstration of compliance with the falling and blowing snow specification on ground should be conducted by tests and/or analysis. If acceptabl e powerplant operation can be shown in the following conditions, no take - off restriction on the operation of the aeroplane in snow will be necessary.

a. Visibility: 0.4 Km or less as limited by snow, provided this low visibility is only due to falling snow (i.e. no fog). This condition corresponds approximately to 1 g/m3.

b. Temperatures: − 3 °C to + 2 °C for wet (sticky) snow and – 9 °C to – 2 °C for dry snow, unless other temperatures are found to be critical Powered by EASA eRules Page 741 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM (e.g. where dry snow at a lower temperature co uld cause runback ice where it contacts a heated surface).

c. Blowing snow: Where tests are conducted, the effects of blowing snow may be simulated by taxiing the aircraft at 15 to 25 kts, or by using another aircraft to blow snow over the test powerplant. This condition corresponds approximately to 3 g/m3.

d. Duration: It must be shown that there is no accumulation of snow or slush in the engine, air intake system or on airframe components, which would adversely affect engine operation during any intended ground operation. Compliance evidence should consider a duration which corresponds to the achievement of a steady state condition of accretion and (possible) shedding. Any snow shedding should be acceptable to the engine.

e. Operation: The methods for eva luating the effects of snow on the powerplant should be agreed by the Agency. All types of operation likely to be used on the ground should be considered for the test (or analysis). This should include prolonged idling and power transients consistent with taxiing and other ground manoeuvring conditions.

Where any accumulation does occur, the engine should be run up to full power, to simulate take - off conditions and demonstrate that no hazardous shedding of snow or slush occurs. Adequate means should be used to determine the presence of any hazardous snow accumulation.

f. Snow concentration corresponding to the visibility prescribed is often extremely difficult to locate naturally and it is often difficult to maintain the desired concentrations for the durati on of testing.

Because of this, it is likely that exact target test conditions will not be achieved for all possible test conditions. Reasonable engineering judgment should be used in accepting critical test conditions and alternate approaches, with early coordination between the applicant and the Agency addressing these realities.

1.6.6 For in - flight snow (and mixed phase) conditions, some non - Pitot type air intakes with reverse flow particle separators have been found to accumulate snow/ice in the pocket lip (sometimes referred to as the “bird catcher” section) just below the splitter which divides the engine compressor from the air intake bypass duct. Eventually, the build - up of snow in the pocket (which can melt and refreeze into ice) either spans across to the compressor air intake side of the splitter lip or, the snow/ice build - up is released from the pocket and breaks up whereupon some of the ice pieces can be re - ingested into the compressor side of the inlet. The ingestion of this snow/ice has caused momentary or permanent flameouts and in some cases, foreign object damage to the compressor.

Some aeroplane manufacturers have tried to correct this condition by increasing the amount and/or frequency of applied thermal heat used around the pocket, splitte r, and bypass sections of the air intake. However, short of modifying the engine ice protection systems to the point of Powered by EASA eRules Page 742 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM operating fully evaporative, these fixes have mostly failed to achieve acceptable results.

1.6.7 Aeroplanes with turbine engine or essen tial APU air intakes which have plenum chambers, screens, particle separators, variable geometry, or any other feature (such as an oil cooler) which may provide a hazardous accumulation site for snow should be qualitatively evaluated for in - flight snow con ditions. The qualitative assessment should include: 1) A visual review of the installed engine and air intake (or drawings) to identify potential snow accumulation sites, 2) A review of the engine and engine air intake ice protection systems to determine if the systems were designed to run wet, fully evaporative, or to de - ice during icing conditions, and 3) Unless the air intake ice protection means (e.g. thermal blanket, compressor bleed air, hot oil) operates in a fully evaporative state in and around potential air intake accumulation sites, inlet designs with reverse flow pockets exposed directly to in - flight snow ingestion should be avoided.

Flight testing may be necessary to validate the qualitative assessment.

2. Testing The engine air intakes may be tested with the engine and propeller where appropriate in accordance with the specifications of CS - E 780 and AMC E 780.

Where the air intake is assessed separately (e.g. icing wind tunnel evaluation of IPS performance, lack o f suitable test facilities for engine and air intake, change in the design of the air intake, air intake different from one tested with the engine), it should be shown that the effects of air intake icing would not invalidate the engine tests of CS - E.

Factors to be considered in such evaluations are: — distortion of the airflow and partial blockage of the air intakes, — the shedding into the engine of air intakes ice of a size greater than the engine has been shown to ingest per CS - E 780, — the icing of any engine sensing devices, other subsidiary air intakes or equipment contained within the air intake, and — the time required to bring the protective system into full operation.

In establishing compliance with the requirements of CS 25.1093(b)(1) , reference sho uld be made to AMC 25.1419 , paragraph (b), for the assessment of the Appendix C icing environment.

In conjunction with the CPA, a thorough validation of the IPS may include in particular the following aspects: — flig ht tests in dry air with ice protection equipment operating, — flight tests in icing conditions, natural or artificial, and — ground tests in icing wind tunnel.

In establishing compliance with the requirements of CS 25.1093(b)(1) , reference should be made to AMC 25.1420 , paragraph (d), for the assessment of the Appendix O icing environment.

Powered by EASA eRules Page 743 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM 2.1 Icing wind tunnel tests Icing wind tunnels provide the ability to simulate natural icing conditions in a controlled environment and they have also been used in parti cular to evaluate performance of ice protection systems (IPS), such as pneumatic and thermal systems.

When the tests are conducted in non - altitude conditions, the system power supply and the external aerodynamic and atmospheric conditions should be so modi fied as to represent the required altitude condition as closely as possible.

Where an altitude facility is available, the altitudes to be represented should be consistent with the icing scenario considered. The appropriate inlet incidences or the most crit ical incidence should be simulated.

Icing tests may be performed in sea level facilities. In order to compensate for the altitude effects, consideration is given to the necessary amendments to the test parameters in order to achieve an adequate evaluation.

Flight conditions may need to be corrected to allow simulation in a wind tunnel. To achieve this, the location of the stagnation point on the inlet lip and the amount of water runback at the throat should be maintained between flight and wind tunnel cond itions.

Other test parameters, such as static or total air temperature, may require similitude adjustments to achieve the best match of icing condition parameters, such as those described in FAA AC 20 - 73A.

For each test, the ice protection supply should be representative of the minimum engine power/thrust for which satisfactory operation in icing conditions is claimed.

At the conclusion of each test, the applicants should assess the ice accumulations and compare them with the amount of ice the engine has sa tisfactorily demonstrated to ingest during engine certification (CS - E 780).

Test results may be used to validate the CPA in term of ice accretion prediction.

For the evaluation of the performance of the IPS, either the critical points determined by a CPA o r the conditions defined in Table 1 below may be used to simulate CS - 25 Appendix C conditions: Table 1 – Appendix C test conditions Altitude Liquid Water Content g/m Ambient Air Mean Effective Temperature Droplet Diameter (a) Continuous (b) Intermittent Ft m ° C μm Max Max − 10 17 000 5 182 0.6 2.2 − 20 20 000 6 096 0.3 1.7 20 − 30 25 000 7 620 0.2 1.0 Note: The conditions of water concentration required by these tests are somewhat more severe than those implied by the Appendix C to CS - 25 so as to provide margins.

A separate test should be conducted at each temperature condition of Table 1 above, the test being made up of repetitions of one of the following cycles: 1) 28 km (15.1 NM) in the conditions of Table 1, column (a), appropriate to the temperature, followed by 5 km (2.7 NM) in the conditions of Table 1, column (b), appropriate to the temperature, for a total duration of 30 minutes, or Powered by EASA eRules Page 744 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM 2) 6 km (3.2 NM) in the conditions of Tabl e 1, column (a), appropriate to the temperature, followed by 5 km (2.7 NM) in the conditions of Table 1, column (b), appropriate to the temperature, for a total duration of 10 minutes.

Each test should be run at, or should simulate, different engine power/ thrust conditions, including the minimum power/thrust for which satisfactory operation in icing conditions is claimed.

Flight Idle power/thrust should be assessed against the conditions defined in Table 1 both for Column (a) and Column (b).

If there is a minimum power/thrust required for descent to ensure satisfactory operation in icing conditions, the increase to that minimum power/thrust in icing conditions should be automatic when the IPS is switched on, and this minimum power/thrust associated with des cent in icing conditions should be assessed against the conditions in Table 1 above.

The test duration expressed above assume that steady state conditions (ice shedding cycles) are established. If this is not the case, the test should continue until a maxi mum duration of 45 minutes when using test 1) above or 15 minutes when using test 2) above, except for descent where the test duration may be limited to the time needed to cover an anticipated descent of 3 000 m.

Where an altitude facility is available, th e altitudes to be represented should be as indicated in Table 1.

2.2 Delayed activation of the air intake IPS When the ingestion tests under CS - E 780 do not adequately represent the particular airframe installation, then the delayed IPS activation test sh ould be considered, even for aircraft equipped with PIDS to consider possible manual IPS activation in “degraded” mode.

Either by separate tests, or in combination with those of paragraph 2.1 above, it should be demonstrated that the ice accretion is accep table after a representative delay in the selection of the IPS, such as might occur during inadvertent entry into the conditions. In lack of other evidence, a delay of two minutes to switch on the IPS should be assumed when exposed to Continuous Maximum ex posure of Appendix C to CS - 25. For thermal IPS, the time for the IPS to warm up should be added.

Similar to the accepted compliance with CS - E 780 ice ingestion tests, the use of engine auto - ignition and recovery systems are allowed to show compliance with the delayed activation tests of CS - 25, as long as these automatic systems cannot be easily turned off by the flight crew.

In the case of De - iced air intakes (designed for a cyclic shedding of ice from the engine air intake into the engine) which incorpora te, as part of their design, an air intake particle - separator that stops the ingestion of ice into the core of the engine, engine auto - recovery systems should not be a compensating design feature utilized to minimize the negative effects of an inadequate p article - separating air intake that is not in full compliance with CS 25.1093 .

Powered by EASA eRules Page 745 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM 2.3 Natural Icing Flight Tests Natural icing flight tests may also be used to show compliance with CS 25.1093(b)(1) .

In this context, natural icing flight tests are intended to demonstrate that the engine is capable of operating throughout its flight power/thrust range (including idling), without an adverse effect. This includes the accumulation of ice on the engine, air intake system components, or airframe components that would have an adverse effect on the engine operation or cause a serious loss of power or thrust.

In addition to proving that the engine air intake icing analysis model is accurate, several other key i ssues exist, which the natural ice encounter may address. These include: — the adequacy of flight crew procedures when operation in icing conditions, — the acceptability of control indications to the flight crew as the aeroplane responds to engine fan blade ice shedding during various conditions, — the performance of the engine vibration indication system, as well as other engine indication systems, and — the confirmation that the powerplant installation performs satisfactorily while in icing conditions. This wh ole powerplant installation includes the engine, air intake, and the IPS system.

2.4 Testing in Non - Representative Conditions When damage results from icing test conditions that fall significantly outside Appendices C, O and P to CS - 25 icing envelopes, or when the aeroplane flight test is conducted in an abnormal manner and results in excessive ice shed damage, this may result in a test failure relative to the pre - test pass or fail criteria. Any abnormal conditions should be discussed with the Agency to de termine if the test can be deemed “passed.” An example of an abnormal operation could be flying with one engine at idle while the aircraft is operated in level flight.

3. Comparative Analysis.

For showing compliance with the CS - 25 certification specifications relative to SLD icing conditions represented by Appendix O, the applicant may use a comparative analysis. AMC 25.1420(f) provides guidance for comparative analysis.

(b) Compliance with CS 25.1093(b)(2) Ground taxi exposure to Appendices C and O to CS - 25 1. Critical Points Analysis (CPA).

The temperatures should result from a CPA, considering the full range of temperatures specified in CS 25.1093(b)(2) , conducted to determine the crit ical ice accretion conditions for the air intake.

2. Ground taxi exposure to Appendix O conditions.

The service experience indicates that engine fan damage events exist from exposure to SLD during ground taxi oper ations. For this reason, an additional condition of a 30 - minute, idle power/thrust exposure to SLD on the ground must be addressed. Applicants should include the terminal falling velocity of SLD (for example, freezing rain, freezing drizzle) in their traje ctory assessment, relative to the protected sections of the air intake.

The 100 micron minimum mean effective diameter ( MED) is selected as a reasonably achievable condition, given current technology. To certify by analysis the applicant should Powered by EASA eRules Page 746 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) AIR INTAKE SYSTEM evaluate th e Appendix O drop sizes up to a maximum of 3 000 microns particle size to find a critical condition.

For showing compliance with the CS - 25 certification specifications relative to SLD icing conditions represented by Appendix O, the applicant may use a com parative analysis.

AMC 25.1420(f) provides guidance for comparative analysis.

3. Operating limitation.

The conditions defined in CS 25.1093(b)(2) , in terms of time and temperature, should be considered as limitations necessary for the safe operation in f reezing fog, and made available to the crew in the Aeroplane Flight Manual (refer to CS 25.1581 ).

Nevertheless, the applicant may use an analysis to substantiate safe operation of the engine at temperatures below t he demonstrated minimum temperature. No limitation would then be required in the Aeroplane Flight Manual.

[Amdt 25/16] [Amdt 25/18]

CS 25.1103 Air intake system ducts and air duct systems

ED Decision 2016 / 010/R (See AMC 25.1103) (a) Reserved.

(b) Each air intake system must be – (1) Strong enough to prevent structural failure resulting from engine surging; and (2) Fire - resistant if it is in any fire zone for which a fire extinguishing system is required.

(c) Each duct connected to components between whi ch relative motion could exist must have means for flexibility.

(d) For bleed air systems no hazard may result if a duct rupture or failure occurs at any point between the engine port and the aeroplane unit s erved by the bleed air. (See AMC 25.1103(d) .)

[Amdt 25/18]

AMC 25.1103(d) Air intake system d ucts

ED Decision 2003/2/RM For a single failure case leading to a fire and air duct rupture, consideration should be given to the possibility of fire aggr avation due to air flowing into a designated fire zone of an engine from the remaining engine(s), or another source outside the affected fire zone.

Powered by EASA eRules Page 747 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) EXHAUST SYSTEM

EXHAUST SYSTEM

CS 25.1121 General

ED Decision 2016/010/R (See AMC 25.1121) For powerplant installations the following apply: (a) Each exhaust system must ensure safe disposal of exhaust gases without fire hazard or carbon monoxide contamination in any personnel compartment. For test purposes, any acceptable carbon monoxide detection method may be used to show the absence of carbon monoxide.

(See AMC 25.1121(a) .)

(b) Each exhaust system part with a surface hot enough to ignite flammable fluids or vapours must be located or shielded so that leakage from any system carryi ng flammable fluids or vapours will not result in a fire caused by impingement of the fluids or vapours on any part of the exhaust system including shields for the exhaust system. (See AMC 25.1121(b) .)

(c) Each component that hot exhaust gases could strike, or that could be subjected to high temperatures from exhaust system parts, must be fireproof. All exhaust system components must be separated by fireproof shields from adjacent parts of the aeroplane that are outside the engine compartment.

(d) No exhaust gases may discharge so as to cause a fire hazard with respect to any flammable fluid vent or drain.

(e) No exhaust gases may discharge where they will cause a glare seriously affecting pilot vision at nig ht.

(f) Each exhaust system component must be ventilated to prevent points of excessively high temperature.

(g) Each exhaust shroud must be ventilated or insulated to avoid, during normal operation, a temperature high enough to ignite any flammable fluids or vapours external to the shroud.

[Amdt 25/18]

AMC 25.1121(a) General

ED Decision 2003/ 2/RM 1 If necessary, each exhaust system should be provided with drains to prevent hazardous accumulation of fuel under all conditions of operation.

2 Tests should be made to demonstrate compliance with CS 25.1121(a) and these should include engine starting in downwind conditions and thrust reversal.

AMC 25.1121(b) General

ED Decision 2003/2/RM Leakage should be interpreted to include fuel discharged from the jet pipe under false start conditions both on the ground and in flight. It should be demonstrated that successive attempts to restart do not create a fire hazard. The maximum time for complete drainage of fuel following a false start should be established. This period will be used to determine the minimum interval b etween start attempts.

Powered by EASA eRules Page 748 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) EXHAUST SYSTEM

CS 25.1123 Exhaust piping

ED Decision 2003/2/RM For powerplant installations, the following apply: (a) Exhaust piping must be heat and corrosion resistant, and must have provisions to prevent failure due to expansion by operating temperatures.

(b) Piping must be supported to withstand any vibration and inertia loads to which it would be subjected in operation; and (c) Piping connected to components between which relative motion could exist must have means for flexibil ity.

Powered by EASA eRules Page 749 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POW ERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES

POWERPLANT CONTROLS AND ACCESSORIES

CS 25.1141 Powerplant controls: general

ED Decision 2016 / 010 /R (See AMC 25.1141) Each powerplant control must be located, arranged, and designed under CS 25.777 to 25.781 and marked under CS 25.1555 . In addition, it must meet the following requirements: (a) Each control must be located so that it cannot be inadvertently operated by per sons entering, leaving, or moving normally in, the cockpit.

(b) Each flexible control must be approved or must be shown to be suitable for the particular application.

(c) Each control must have sufficient strength and rigidity to withstand operating loads without failure and without excessive deflection.

(d) Each control must be able to maintain any set position without constant attention by flight - crew members and without creep due to control loads or vibration.

(e) The portion of each powerplant control l ocated in a designated fire zone that is required to be operated in the event of fire must be at least fire resistant. (See CS 25.903(c) .)

(f) For Powerplant valve controls located in the flight deck there must be a means: (1) for the flightcrew to se lect each intended position or function of the valve; and (2) to indicate to the flightcrew: (i) the s elected position or function of the valve; and (ii) when the valve has not responded as intended to the selected position or function.

(See AMC 25.1141(f)) [Amdt 25/1] [Amdt 25/18]

AMC 25.1141(f) Powerplant controls, g eneral

ED Decision 2003/2/RM A continuous indicator need not be provided.

CS 25.1143 Engine controls

ED Decision 2003/ 2/RM (a) There must be a separate power or thrust control for each engine.

(b) Power and thrust controls must be arranged to allow – (1) Separate control of each engine; and (2) Simultaneous control of all engines.

(c) Each power and thrust control must provide a positi ve and immediately responsive means of controlling its engine.

Powered by EASA eRules Page 750 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES (d) For each fluid injection (other than fuel) system and its controls not provided and approved as part of the engine, the flow of the injection fluid must be adequately controlled.

(e) If a p ower or thrust control incorporates a fuel shut - off feature, the control must have a means to prevent the inadvertent movement of the control into the shut - off position. The means must – (1) Have a positive lock or stop at the idle position; and (2) Requir e a separate and distinct operation to place the control in the shut - off position.

CS 25.1145 Ignition switches

ED Decision 2003/2/RM (a) Ignition switches must control each engine ignition circuit on each engine.

(b) There must be means to quickly shut o ff all ignition by the grouping of switches or by a master ignition control.

(c) Each group of ignition switches except ignition switches for turbine engines for which continuous ignition is not required, and each master ignition control must have a means to prevent its inadvertent operation.

CS 25.1149 Propeller speed and pitch controls

ED Decision 2003/ 2/RM (a) There must be a separate propeller speed and pitch control for each propeller.

(b) The controls must be grouped and arranged to allow – (1) Separate control of each propeller; and (2) Simultaneous control of all propellers.

(c) The controls must allow synchronisation of all propellers.

(d) The propeller speed and pitch controls must be to the right of, and at least 25 mm (one inch) below, the pilot’s throttle controls.

CS 25.1153 Propeller feathering controls

ED Decision 2003/2/RM (a) There must be a separate propeller feathering control for each propeller. The control must have means to prevent its inadvertent operati on.

(b) If feathering is accomplished by movement of the propeller pitch or speed control lever, there must be means to prevent the inadvertent movement of this lever to the feathering position during normal operation.

Powered by EASA eRules Page 751 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT CONTROLS A ND ACCESSORIES

CS 25.1155 Reverse thrust and prope ller pitch settings below the

flight regime

ED Decision 2016/010/R (See AMC 25.1155 ) Each control for selecting propeller pitch settings below the flight regime (reverse thrust for turbo - jet powered aeroplanes) mu st have the following: (a) A positive lock or stop which requires a separate and distinct operation by the flight crew to displace the control from the flight regime (forward thrust regime for turbo - jet powered aeroplanes), and it must only be possible to make this separate and distinct operation once the control has reached the flight idle position.

(b) A means to prevent both inadvertent and intentional selection or activation of propeller pitch settings below the flight regime (reverse thrust for turbo - jet powered aeroplanes) when out of the approved in - flight operating envelope for that function, and override of that means is prohibited.

(c) A reliability, such that the loss of the means required by sub - paragraph (b) above is remote.

(d) A ca ution provided to the flight crew when the means required by sub - paragraph (b) above is lost.

(e) A caution provided to the flight crew when a cockpit control is displaced from the flight regime (forward thrust regime for turbo - jet powered aeroplanes) into a position to select propeller pitch settings below the flight regime (reverse thrust for turbo - jet powered aeroplanes) outside the approved in - flight operating envelope. This caution need not be provided if the means required by sub - paragraph (b) is a me chanical baulk that prevents movement of the control.

[Amdt 25/18]

AMC 25.1155 Reverse thrust and propeller pitch settings below the

flight r egime

ED Decision 2003/ 2/RM 1. PURPOSE. This AMC provides guidance for demonstrating compliance with the certifica tion requirement relating to controls which regulate reverse thrust or propeller pitch settings below the flight regime on Large Aeroplanes.

2. RELATED CERTIFICATION SPECIFICATIONS.

Paragraphs which prescribe requirements for the design, substantiation, and certification relating to the control of reverse thrust and propeller pitch settings below the flight regime of Large Aeroplanes include: §25.777 Cockpit Controls.

§25.779 Mot ion and effect of cockpit controls §25.781 Cockpit control knob shape §25.901 Installation §25.903 Engines §25.933 Reversing systems §25.1141 Powerplant controls: General §25.1143 Engine controls Powered by EASA eRules Page 752 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES §25.1149 Propeller speed and pitch controls §25.1155 Reverse thrust and propeller pitch settings below the flight regime §25.1305 Powerplant instruments §25.1309 Equipment, systems, and installations.

§25.1322 Warning, caution, and advisory lights §25.1337 Powerplant instruments 3. APPLICABILITY.

The basic provisions of CS 25.1155 require that the control for selecting reverse thrust (propeller pitch settings below the flight regime) have a positive lock or stop at the flight idle position as well as separate and distinct operation by the flight crew to displace the control from th e in - flight regime. These basic provisions are applicable to all Large Aeroplanes.

The specific provisions of CS 25.1155 are applicable to the control system protecting against the intentional or the inadvertent in - flight selection of the thrust reverser for turbojet powered airplanes or propeller operation at pitch settings below the flight regime for turboprop powered airplanes. However, the specific provisions would not be applicable to a turbojet powered airplane whose reverser was certified for in - fli ght use or to a turbo - propeller powered airplane whose propellers were certified for pitch settings below the normal in - flight operating regime.

In addition to the 25.1155 applicability limitations noted above, the intentional selection provisions should not be interpreted to include a pilot who knowingly gains in - flight access to the prohibited engine control regime by: a) disabling a protective control system (i.e. throttle baulk or warning) by pulling circuit breaker, or b) ignoring a clearly annuncia ted protective control system failure warning or caution message.

4. BACKGROUND.

CS 25.1155 was derived from the equivalent FAA rule and therefore the requirement history below relates to the development of FAR 25.1155. Also the operational occurrences and the development of continued airworthiness solutions mentioned below, are based, largely, on the U.S experience.

a. Requirement History. The requirements to guard against inadvertent operation of both cockpit mounted propeller and turbojet reverse con trol lever(s) date back to CAR 4b (4b.474a). When part 25 was codified in 1965, only the turbojet reverse section of the subject requirement was retained as FAR §25.1155. In 1967, Amendment 25 - 11 broadened §25.1155 to once again include protection against inadvertent inflight operation of thrust reversers and propeller pitch settings below the flight regime. This Amendment required the cockpit propeller control to incorporate positive locks or stops at the flight idle position, and further specified that th e control means must require a separate and distinct operation by the crew, in order to displace the propeller control from the flight regime.

Powered by EASA eRules Page 753 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES b. Operational Experience - Turbo - propeller powered Airplanes . In - service experience during the late 1980s and 1990s of some turbo - propeller powered transport category airplanes, has shown that intentional or inadvertent in - flight operation of the propeller control systems below flight idle has produced two types of hazardous, and in some cases, catastrophic conditions: (i) Permanent engine damage and total loss of thrust on all engines when the propellers that were operating below the flight regime drove the engines to over - speed, and; (ii) Loss of airplane control because at least one propeller operated below the flight regime during flight creating asymmetric control conditions.

As a result of this unsatisfactory service experience, in - flight beta lockout systems were retroactively required (via Airworthiness Dire ctives) on several transport category turboprop airplanes. These beta lockout systems were required only after it was determined that increased crew training, installation of cockpit placards warning crews not to use beta in flight, and stronger wording in AFM warnings and limitations did not preclude additional in - flight beta events.

In addition to the continued airworthiness issues noted above, the FAA also recognized the need to update the FAR requirement to require some form of design improvements for new airplanes. {NOTE: RWB additional words to complete the sentence.} Until the rule changes noted above are complete, the FAA is using the no unsafe feature or characteristic provisions of 21.21(b)(2) to require installation of beta lockout systems on new transport category turbo - propeller powered airplanes.

Intentional selection of beta mode/reverse in flight for rapid aircraft deceleration was not specifically addressed by this regulation. Also, FAR 25.933(b) had been interpreted as not requiring, for t urbo - propeller aircraft, an interlock or other automatic device to prohibit movement of the power lever by the flight crew below the flight idle stop when the aircraft is in flight.

Consequently, initial FAA certification of transport category turbo - prope ller aircraft has not required an inflight beta lockout device to prevent intentional selection of the beta mode/reverse in flight.

Typical beta lockout systems currently use wheel spin - up, squat switch activation, gear - up switch activation, or combinatio ns of these. Certain airplanes, especially those with low wings and without ground spoilers, have a tendency to float during landing. In the case of these airplanes, the application of beta may be delayed on a wet runway because, while the airplane is floa ting, the ground logic or the wheel spin - up may not activate immediately.

Landing performance of turbo - propeller - powered airplanes is based on ground idle availability, which is part of the beta range. Turbo - propeller - powered airplanes landing on field le ngth - limited runways with delayed beta application present a potential hazard.

Overruns are more likely to occur if operating under part 91 (unfactored field lengths); however, the risks are also present if operating under parts 121 or 135 (factored field lengths) on a wet runway. Paragraph (b) of the rule prohibits override, however, there are several acceptable methods that may be used to overcome the deficiencies of the squat switch or wheel spin - up logic alone, such as the use of a radar altimeter or mu ltiple air/ground logic inputs.

Powered by EASA eRules Page 754 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES c. Operational Experience - Turbo - jet (Turbo - fan) Powered Airplanes. For turbojet (turbofan) thrust reversers, there has not been such a bad accident experience of pilot initiated thrust reverser deployment as for the turbo - propeller airplanes, but they have occurred.

There has also been a number of reported cases, where the thrust reversers have been selected before touch down, in order to minimize the landing roll. In these cases, the provision of a weight - on - wheels (WOW) interlock as part of the thrust reverser design, prevented the deployment of the reverser. However, the basic concern about the need to avoid a reversing condition, outside any approved operating regime, is the same for a thrust reverser equipped aircraft, as it is for a propeller powered aircraft i.e. the prevention of Catastrophic failure conditions.

§ 25.933(a) and its AC / AMC describe means by which the thrust reverser system can be shown to have sufficient sys tem integrity, to meet the required Safety Objectives. If the reliability method of compliance with § 25.933(a) is used, the probability of an unwanted reverser deployment in flight will be shown to be <1E - 09. In this case, where very low probabilities of s ystem failures are demonstrated, it was considered to be inappropriate that a single event of pilot selection could cause the same effect, - a reverser deployment.

Recognition that occurrences of thrust reverser selection in flight have occurred, reinforce d by the growing perception that human factors need to be considered, has resulted in thrust reverser controls being considered equally. This approach ensures consistency in the application of § 25.1155 to both turb o - prop and turbo - jet (turbo - fan) reversing systems.

The design objective sought by § 25.1155 has been a common design practice for many turbo - jet (turbofan) thrust reverser designs. This rule establishes that a means to prevent crew selection or activation of reverse thrust or propeller pitch settings below the flight regime must be provided, as the minimum required standard.

d. Override Systems . Historically, some turbo - propeller systems have been provided with an override capability, such that on landing , if the selection of pitch below flight idle is not successful - because of system failures or because signals used in the system may not have transitioned to the ground mode - the flight crew could select the override function to enable use of pitch belo w flight idle during ground operation.

As mentioned above, many turbo - jet (turbofan) powered airplanes equipped with thrust reversers have utilized weight - on - wheels, or other air - ground logic, to prevent selection or activation of thrust reversers in flig ht. Generally, these systems have been capable of successful operation, despite not being equipped with any form of over - ride. It is the intention of the revised version of § 25.1155 to prevent any selection or activation of propeller pitch below the flight regime or reverse thrust in flight. The provision of any override, which would allow selection or activation of propeller pitch below the flight regime or reverse thrust out the approved in flight envelope for that function would not comply with the § 25.1 155 . The design of the system to show compliance with § 25.1155 will need to take into account the Safety Objectives associated with the maintenance of the required landing performance.

5. DEFINITIONS.

a. Approved in - flight operating envelope. An area of the Normal Flight Envelope where a function has been accepted as suitable by the Authorities.

b. Catastrophic. See AMC 25.1309 .

c. Continued Safe Flight and Land ing. See AMC 25.1309 .

Powered by EASA eRules Page 755 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES d. Failure. See AMC 25.1309.

e. Flight idle position. The position of thrust/power lever corresponding to the minimum forward thrust, power or pitch setting authorized in flight.

f. Inadvertent. Action performed by the pilot who did not mean to do it.

g. In - flight. That part of aeroplane operation beginning when the wheels are no longer in contact with the ground during the takeoff and ending when the wheels again contact the ground during landing.

h. Intentional. Action performed by the pilot who meant to do it i. Propeller pitch control system. All those system components which enable the flight crew to command and control propeller pitch j. Remote. See AMC 25.1309 .

k. Reverse control system. All those system components which enable the flight crew to command and control the thrust reverser l . Separate and distinct. More than or in addition to a continuation of motion required for movement and obvious to each member of the flight crew m. Thrust Reversal. A movement of all or part of the thrust reverser from the forward thrust position to a position that spoils or redirects the engine airflow.

n. Turbojet (or turbofan). A gas turbine engine in which propulsive thrust is developed by the reaction of gases being directed through a nozzle.

o. Turbo - propeller. A gas turbine engine in which propulsive thrust is developed by the propeller 6. COMPLIANCE with CS 25.1155 .

a. Cockpit controls. The cockpit controls mean t he control devices used by the crew to select the reverse thrust or the propeller pitch below the flight regime. (See CS 25.1141 , 25.1143 and 25.1149 ) Cockpit controls design must be adequate to permit the crew to perform the handling of the aircraft and to follow the procedures as per AFM, while mitigating crew errors.

b. Preventative means. Acceptable means to prevent intentional or inadvertent selection or activation of reverse thrust or propeller pitch below the flight regime can be: 1) Devices to prevent movement of the cockpit control which prevents selection, or 2) Logic in the Thrust Reverser or Propeller Control which p revents activation.

c. Separate and distinct. To move cockpit controls from the Flight Idle position must require a separate and distinct operation of the control to pass from the Flight Idle position to positions approved only for ground operation. The control must also have features to prevent inad vertent movement of the control through the Flight Idle position. It must only be possible to make this separate and distinct operation once the control has reached the Flight Idle position.

Separate and distinct is more than or in addition to a continuat ion of motion required for movement to the Flight Idle setting and must be obvious to the flight crew.

Powered by EASA eRules Page 756 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES Examples of separate and distinct controls that have been used in previous designs are as follows: i) Physically separate forward/reverse [below fligh t idle] control levers or mechanisms.

ii) Manually actuated latches located on or in the vicinity of the control that cannot be actuated until Flight Idle.

iii) A required change in direction of operation of the control from that needed for movement to Flight Idle.

Examples of separate and distinct control operation, which would not be acceptable include: i) a separate operation, which can be activated away from the Flight Idle position, so that movement of the control from forward thrust to below the flight regime or thrust reversal can be accomplished with a single action.

ii) any separate operation, where latches or equivalent devices can be pre - loaded by the pilot so that a single movement of the control, enables movement below flight idle.

iii) any control arrangement, where it can be ascertained that normal wear and tear could cause the separate and distinct action to be lost.

d. Cockpit indications. The overall indication requirements for Thrust Reverser Control System and Propeller Pitch Control System are given in the CS 25.933 , 25.1305(d)(2) , 25.1309(c) , 25.1322 , and 25.1337(e) paragraphs and their associated AMCs. The following text adds some specific guidance with respect to the requirements of paragraph CS 25.1155(d) and (e) .

Sub - paragraphs “(d)” and “(e)” of the rule require crew ca utions to be provided for two conditions: “(d)” when the means ‘to prevent both inadvertent and intentional selection of propeller pitch settings below the flight regime (thrust reversal for turbo - jet powered airplanes) when out of the approved in - flight operating envelope for that function’ is lost. The purpose of this caution is to inform the flight crew that a fault has occurred to the propeller pitch control system or the thrust reverser control system, so that the protection means is no longer availa ble and any movement of the control below the flight regime (forward thrust regime) may cause a low pitch/high drag condition or thrust reverser deployment. With this information, the flight crew will be able to take appropriate precautions, as advised by approved Manuals and reinforced by their training, to minimise the possibility of a hazardous condition. Without this caution, a fault in the protection means could allow an unsafe condition to occur, whereby any inadvertent or intentional movement of the control below the flight regime could cause a hazardous low pitch or reverse thrust condition.

“(e)” when the cockpit control is displaced from the flight regime (forward thrust for turbo - jet powered airplanes) into a position to select propeller pitch se ttings below the flight regime (thrust reversal for turbo - jet powered airplanes) and the airplane is outside the approved in - flight operating envelope for that function. On some anticipated system designs, the pilot will have the ability to move the cockpi t control below the flight regime (into thrust reverse for turbo - jet powered Powered by EASA eRules Page 757 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES airplanes) with no restriction, other than the ‘separate and distinct operation’ required by CS 25.1155(a) . For this type of design, the means to prevent propeller pitch settings below the flight regime (reverse thrust for turbo - jet powered airplanes) when out of the approved in - flight operating envelope for that function will be a part of the propeller pitch control system or the thrust reverser system.

Whilst there is no immediat e hazard at that point, the control is not in the proper position for flight operations and the flight crew need to be made aware of that situation, so that they can take the appropriate action. In some of the accidents, where the control had be en moved in to the ‘below flight ‘ regime, it was not clear whether this control movement had been inadvertent or intentional. Provision of this caution will give the crew a clear indication of any incorrect placement of the control however the control was positioned. For any design, where there is approval for selection of propeller pitch settings below the flight regime (reverse thrust for turbo - jet powered airplanes), there will be no need to provide this caution when the aircraft is in the approved in - flight operati ng envelope for that function. Also, as made clear in CS 25.1155(e) , there is no requirement to provide any caution for control movement, when on the ground.

e. Reliability considerations. The intention of CS 25.1 155(b) is for the aircraft design to include a means to prevent the flight crew selecting (or activating) propeller pitch settings below the flight regime or reverser deployment, when the aircraft is not in the approved in - flight operating envelope for tha t function. The introduction of the rule stems directly from a number of cases, where such a selection has caused accidents. Because of a large variability in the current perception of the future occurrence rate for this type of flight crew error, a target reliability level for the prevention means is included in the rule, see CS 25.1155(c) . This level of reliability is expected to give a high degree of protection from the unwanted selection or activation of low propeller pitch or reverser deployment. The p rovision of the cautions should provide the necessary safeguard, on the few occasions when the prevention means fails. Additionally, this target safety level should not be inconsistent with the required availability of the reversing function for landing pe rformance.

The safety assessment methods established by CS 25.901(c) and CS 25.1309(b) are appropriate for the determination of the reliability level required by CS 25.115 5(c) and for assessing the effects of any other failure conditions or malfunctions.

f. Reverser/pitch below flight regime availability on ground. Landing or Aborted take - off distances on wet runways usually take credit for the braking effect created by re verse thrust or propeller pitch below flight idle. Therefore availability of these systems when in the approved operating envelope must be maintained.

It must therefore be shown that failures in the system provided to meet CS 25.1155(b) do not degrade sig nificantly the availability of the reverse thrust or low pitch selection on ground.

7. INSTRUCTIONS FOR CONTINUED AIRWORTHINESS.

a. Manufacturing/Quality. Due to the criticality of the reverse thrust function or pitch below flight regime function, manufacturing and quality assurance processes should be assessed and implemented, as appropriate, to ensure the design integrity of the critical components.

Powered by EASA eRules Page 758 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – P OWERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES b. Maintenance and Alterations. Reference to CS 25.901(b)(2) and CS 25.1529 / Appendix H .

The criticality of the control system require s that maintenance and maintainability be emphasized in the design process and derivation of the maintenance control program, as well as subsequent field maintenance, repairs, or alterations.

c. Manuals - Limitations/Procedures. Prohibition of use of rever se thrust or pitch settings below the flight regime when outside the approved in - flight operating envelope for that function should be introduced in AFM.

Cautions as described in 1155(d) and (e) and their related procedures should be included in the Operations Manual.

CS 25.1161 Fuel jettisoning system controls

ED Decision 2003/2/RM Each fuel jettisoning system control must have guards to prevent inadvertent operation. No control may be near any fire extinguisher control or other control used to combat fire.

CS 25.1163 Powerplant accessories

ED Decision 2003/ 2/RM (a) Each engine - mounted accessory must – (1) Be approved for mounting on the engine involved; (2) Use the provisions on the engine for mounting; and (3) Be sealed to prevent contamination of the engine oil system and the accessory system.

(b) Electrical equipment subject to arcing or sparking must be installed to minimise the probability of contact with any flammable fluids or vapours that might be present in a free state.

(c) If continued rotation of an engine - driven cabin supercharger or of any remote accessory driven by the engine is hazardous if malfunctioning occurs, there must be means to prevent rotation without interferi ng with the continued operation of the engine.

CS 25.1165 Engine ignition systems

ED Decision 2003/ 2/RM (a) Each battery ignition system must be supplemented by a generator that is automatically available as an alternate source of electrical energy to all ow continued engine operation if any battery becomes depleted.

(b) The capacity of batteries and generators must be large enough to meet the simultaneous demands of the engine ignition system and the greatest demands of any electrical system components tha t draw electrical energy from the same source.

(c) The design of the engine ignition system must account for – (1) The condition of an inoperative generator; (2) The condition of a completely depleted battery with the generator running at its normal operat ing speed; and (3) The condition of a completely depleted battery with the generator operating at idling speed, if there is only one battery.

Powered by EASA eRules Page 759 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT CONTROLS AND ACCESSORIES (d) Reserved.

(e) No ground wire for any engine may be routed through a fire zone of another engine unless each pa rt of that wire within that zone is fireproof.

(f) Each ignition system must be independent of any electrical circuit not used for assisting, controlling, or analysing the operation of that system.

(g) There must be means to warn appropriate flight - crew me mbers if the malfunctioning of any part of the electrical system is causing the continuous discharge of any battery necessary for engine ignition.

(h) Each engine ignition system of a turbine powered aeroplane must be considered an essential electrical loa d.

CS 25.1167 Accessory gearboxes

ED Decision 2003/ 2/RM For aeroplanes equipped with an accessory gearbox that is not certificated as part of an engine – (a) The engine with gearbox and connecting transmissions and shafts attached must be subjec ted to th e test specified in CS - E 160 and CS - E 740, as applicable.

(b) The accessory gearbox m ust meet the requirements of CS - E 80 and CS - E 590, as applicable; and (c) Possible misalignments and torsional loadings of the gearbox, transmission, and sh aft system, expected to result under normal operating conditions must be evaluated.

Powered by EASA eRules Page 760 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION

POWERPLANT FIRE PROTECTION

CS 25.1181 Designated fire zones: regions included

ED Decision 2003/ 2/RM (See AMC 25.1181 .)

(a) Designated fire zones are – (1) The engine power section; (2) The engine accessory section; (3) Any complete powerplant compartment in which no isolation is provided between the engine power section and the engine accessory section; (4) Reserved.

(5) Any fuel - burning heater and other combustion equipment installation described in CS 25.859 ; (6) The compressor and accessory sections of turbine engines; and (7) Combustor, turbine, and tailpipe sections of turbine engine installations that contain lines or components carrying flammable fluids or gases.

(b) Each designated fire zone must meet the requirements of CS 25.863 , 25.867 , 25.869 , and 25.1185 to 25.1203

AMC 25.1181 Designated fire z ones

ED De cision 2003/ 2/RM 1 ISO 2685, (15 JULY 1992) ‘Aircraft – Environmental conditions and test procedures for airborne equipment – Resistance to fire in designated fire zones’, gives test conditions and methods of demonstrating compliance with the ‘Fire - resist ant’ and ‘Fireproof’ requirements.

2 Tests to demonstrate compliance with the standard grades of resistance to fire may not be necessary if similarity can be shown with other components which have been tested in accordance with this standard.

3 For examp le, materials which are considered satisfactory for use in firewalls without being subjected to fire tests include – a. Stainless steel sheet 0·4 mm (0·016 in) thick; b. Mild steel sheet protected against corrosion 0·45 mm (0·018 in) thick; and c. Titanium sheet 0·45 mm (0·018 in) thick.

Powered by EASA eRules Page 761 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION

CS 25.1182 Nacelle areas behind firewalls, and engine pod

attaching structures containing flammable fluid lines

ED Decision 2003/ 2/RM (a) Each nacelle area immediately behind the firewall, and each portion of any engine pod attaching structure containing flammable fluid lines, must meet each requirement of CS 25.1103(b) , 25.1165(e) , 25.1183 , 25.1185(c) , 25.1187 , 25.1189 and 25.1195 to 25.1203 , including those concerning designated fire zones. However, engine pod attaching structures need not contain fire detection or extinguishing means.

(b) For each area covered by sub - paragraph (a) of this paragraph that contains a retractable landing gear, compliance with that sub - paragraph need only be shown with the landing gear retracted.

CS 25.1183 Flammable fluid - carrying components

ED Decision 2003/ 2/RM (a) Except as prov ided in sub - paragraph (b) of this paragraph, each line, fitting, and other component carrying flammable fluid in any area subject to engine fire conditions, and each component which conveys or contains flammable fluid in a designated fire zone must be fire resistant, except that flammable fluid tanks and supports in a designated fire zone must be fireproof or be enclosed by a fireproof shield unless damage by fire to any non - fireproof part will not cause leakage or spillage of flammable fluid. Components mu st be shielded or located to safeguard against the ignition of leaking flammable fluid.

(b) Sub - paragraph (a) of this paragraph does not apply to – (1) Lines, fittings and components which are already approved as part of a type certificated engine; and (2) Vent and drain lines, and their fittings, whose failure will not result in, or add to, a fire hazard.

(c) All components, including ducts, within a designated fire zone must be fireproof if, when exposed to or damaged by fire, they could – (1) Result in f ire spreading to other regions of the aeroplane, or (2) Cause unintentional operation of, or inability to operate, essential services or equipment.

CS 25.1185 Flammable fluids

ED Decision 2003/2/RM (a) No tank or reservoir that is a part of a system containing flammable fluids or gases may be in a designated fire zone unless the fluid contained, the design of the system, the materials used in the tank, the shut - off means, and all connections, lines and controls provide a degree of safety equal to that which would exist if the tank or reservoir were outside such a zone.

(b) There must be at least 13 mm (0·5 inches) of clear airspace between each tank or reservoir and each firewall or shroud isolating a designated fire zone.

(c) Absorbent materials close to flammable fluid system components that might leak must be covered or treated to prevent the absorption of hazardous quantities of fluids.

Powered by EASA eRules Page 762 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION

CS 25.1187 Drainage and ventilation of fire zones

ED Decision 2003/ 2/RM (a) There must be complete drainage of ea ch part of each designated fire zone to minimise the hazards resulting from failure or malfunctioning of any component containing flammable fluids.

The drainage means must be – (1) Effective under conditions expected to prevail when drainage is needed; an d (2) Arranged so that no discharge fluid will cause an additional fire hazard.

(b) Each designated fire zone must be ventilated to prevent the accumulation of flammable vapours.

(c) No ventilation opening may be where it would allow the entry of flammable fluids, vapours, or flame from other zones.

(d) Each ventilation means must be arranged so that no discharged vapours will cause an additional fire hazard.

(e) Unless the extinguishing agent capacity and rate of discharge are based on maximum air flow thr ough a zone, there must be a means to allow the crew to shut - off sources of forced ventilation to any fire zone except the engine power section of the nacelle and the combustion heater ventilating air ducts.

CS 25.1189 Shut - off means

ED Decision 2005 / 006/R (See AMC 25.1189 .)

(a) Each engine installation and each fire zone specified in CS 25.1181(a)(5) must have a means to shut off or otherwise prevent hazardous quantiti es of fuel, oil, de - icer, and other flammable fluids, from flowing into, within, or through any designated fire zone, except that shutoff means are not required for – (1) Lines, fittings, and components forming an integral part of an engine; and (2) Oil sy stems in which all components of the system in a designated fire zone, including the oil tanks, are fireproof or located in areas not subject to engine fire conditions.

(b) The closing of any fuel shut - off valve for any engine may not make fuel unavailable to the remaining engines.

(c) Operation of any shut - off means may not interfere with the later emergency operation of other equipment, such as the means for feathering the propeller.

(d) Each flammable fluid shut - off means and control must be fireproof or must be located and protected so that any fire in a fire zone will not affect its operation.

(e) No hazardous quantity of flammable fluid may drain into any designated fire zone after shut - off.

(f) There must be means to guard against inadvertent operatio n of the shut - off means and to make it possible for the crew to reopen the shut - off means in flight after it has been closed.

Powered by EASA eRules Page 763 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERP LANT (CS - 25) POWERPLANT FIRE PROTECTION (g) Each tank - to - engine shut - off valve must be located so that the operation of the valve will not be affected by powerplant or engine mount structural failure.

(h) Each shut - off valve must have a means to relieve excessive pressure accumulation unless a means for pressure relief is otherwise provided in the system.

[Amdt 25/1]

AMC 25. 1189 Flammable fluid shut - off means

ED Decision 2005/006/R 1. PURPOSE.

This Acceptable Means of Compliance (AMC) provides information and guidance concerning a means, but not the only means, of compliance with CS 25.1189 which pertains to the shut - off o f flammable fluids for fire zones of Transport Category Aeroplanes. Accordingly, this material is neither mandatory nor regulatory in nature and does not constitute a regulation. In lieu of following this method, the applicant may elect to establish an alt ernate method of compliance that is acceptable to the Agency for complying with the requirements of the CS - 25 paragraphs listed below.

2. SCOPE.

This AMC provides guidance for a means of showing compliance with regulations applicable to flammable fluid shu t - off capability in Transport Category Airplanes. This guidance applies to new designs as well as modifications such as the installation of new engines or APU's or modifications of existing designs that would affect compliance to the requirements for flamm able fluid shut - off means to a fire zone.

3. RELATED CERTIFICATION SPECIFICATIONS.

CS 25.863 , CS 25.1181 , CS 25.1182 , CS 25.1189 , CS 25J1189 .

4. OBJECTIVE This advisory material provides guidelines for determining hazardous quantity of flammable fluids: A. With respect to the requirement CS 25.1189(a) that each fire zone must have a means to shut - off or otherwise prevent hazardous quantities of flammable fluids from flow into, wi thin, or through the fire zone.

B. Wit h respect t o the requirement of CS 25.1189(e) that no hazardous quantity of flammable fluid may drain into any designated fire zone following shut - off.

5. BACKGROUND.

Guidance is required because of different and s ometimes inconsistent interpretation of what hazardous quantity means.

Service History: The fire zone fire safety service history of CS - 25 turbine engine aircraft has been very good, especially considering the potential hazards involved. This is attributed to the multi - faceted fire protection means required by CS - 25. While it is not generally possible to define the contribution of each individual fire protection means, such as flammable fluid shut - off means, it is noted that the relatively few serious accid ents that have occurred often involve initiating events such as engine separation or rotor non - containment, which can potentially negate some fire protection means, and in which flammable fluid shut - off means represent an important, or possibly sole, backu p.

Powered by EASA eRules Page 764 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION Previous incidents have shown that hydraulic system leaks have fuelled fires, especially when fluid mist is produced at high pressure due to small (pinhole) leaks. This type of leakage can be of considerable duration, even with a limited quantity of fla mmable fluid at the source.

6. DEFINITIONS.

A. Hazardous Quantity: An amount which could sustain a fire of sufficient severity and duration so as to result in a hazardous condition.

B. Hazardous Condition: Failure Conditions which would reduce the capability of the aeroplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be: (i) A large reduction in safety margins or functional capabilities; (ii) Physical distress or higher workload such that th e flight crew cannot be relied upon to perform their tasks accurately or completely; or (iii) Serious or fatal injury to a relatively small number of the occupants; (iv) For the purposes of this AMC, and specifically with respect to fire zone fires, any co ndition which could breach or exceed the fire zone integrity requirements or structural fireproofness requirements of CS - 25.

C. Flammable Fluid. Flammable, with respect to a fluid or gas, means susceptible to igniting readily or to exploding. For the purpo se of this AMC igniting readily includes ignition and burning when introduced into an existing flame, and includes fluids such as fuels, hydraulic fluid (including phosphate ester based fluids), oils, and deicing fluids.

7. COMPLIANCE METHODOLOGY: The quan tity of flammable fluid which is hazardous may vary with fire zone size and design, fluid characteristics, different fire scenarios, and other factors. Since one of these factors is the presence or absence of flammable fluid shut - off means, the requirement s of CS 25.1189(a) and CS 25.1189(e) are discussed separately below.

7 .1 Shut - off Mea ns Requirements ( CS 25.1189(a) ) Compliance wi th CS 25.1189(a) has been typically been shown by installation of shut - off means for flammable fluids that could contribute to the hazards associated with an engine fire, except for lines fittings, and components f orming an integral part of an engine and/or fireproof oil system components, which are not required to have a shut - off means per CS 25.1189(a)(1) and (a)(2) . Flammable fluids that have been considered include fuel supplied to the engine/APU, fuel that may enter the fire zone from engine recirculation systems and hydraulic fluids entering the fire zone. Oil that may be supplied from outside the fire zone, deicing fluid, and other fluids would require similar consider ation, however these are not typically incorporated in modern CS - 25 aircraft engine installations.

Although shut - off means are typically incorporated, CS 25.1189(a) allows the option of otherwise preventing flow of hazardous quantities of flammable fluids. A shut - off means is, therefore, not required if no possible scenario will result in the flow of hazardous quantities of flammable fluid. Factors to be considered in determination of whether this compliance means i s ac ceptable include the following: A. Considerations 1) Leakage rates and characteristics, including massive leakage caused by component failure or fire damage, and slow leakage, which may be a spray Powered by EASA eRules Page 765 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION or mist if the source is under pressure, caused by fai lures such as cracks or pinholes.

2) The amount of fluid in the sys tem that is subject to leakage.

3) Combining A.1), and A.2), the range of potential duration of leakage.

4) Scenarios in which the analysed system leakage is subject to ignition and is t he initial fire source.

5) Scenarios in which the initial fire source is a different system, and fire damage to the analysed system can result in leakage which contributes to the magnitude or duration of the fire.

B. Compliance Considering the above factors and service experience of oil systems without shut - off means, it is acceptable to not install a shut - off means for specific systems which contain flammable fluid if th e following conditions are met: 1) All components of the analysed system within t he fire zone are fireproof, and 2) The quantity of fluid which can flow into the fire zone is not greater than the fluid quantity of the engine or APU oil system for an engine or APU fire zone, and 3) Accomplishment of AFM Emergency Procedures will preclu de continuation of a pressurized spray or mist.

The meeting of conditions (1) - (3) are considered acceptable in precluding a hazardous quantity of flammable fluids from flowing into, within or th rough any designated fire zone.

7.2 Drainage Following Shut - of f Requirements ( CS 25.1189(e) ) Following shut - off, flammable fluid will be contained within the components and plumbing in the fire zone, and usually within plumbing between the firewall and shut - off means. This is due to other requirements which affect the location of the shut - off means and, therefore, the amount of fluid between the shut - off means and the firewall that may drain into the fire zone following shut - off. These include the requirement to protect the sh ut - off means from a fire zone fire ( CS 25.1189(d) ), a powerplant or engine mount structural failure ( CS 25.1189(g) ), and engine rotor failure ( CS 25.903(d)(1) ).

An analysis is required for each individual flammable fluid system to determine that the total amount is not hazardous. The analysis should consider the aircraft attitudes expected to be encountered during continued flight fo llowing shut - off, which may include emergency descent attitudes, but would not be expected to include climb attitudes steeper than those associated with one engine inoperative flight at V2. If the analysed system traverses more than one fire zone, each fir e zone should be analysed separately for the maximum fluid volume which can drain into that fire zone. Credit should not be taken for fire extinguishing provisions. The following are alternate criteria for hazardous quantities of flammable fluid for this c ondition: A) A volume not exceeding 0·95 litre (1 US quarts) is not hazardous, or B) An amount shown not to be hazardous by analysis considering the factors listed in 7.1.A above.

Powered by EASA eRules Page 766 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION Additional factors relevant to this condition following shut - off are reduct ion in pressurized spray or mist due to reduction or absence of system pressure, and the possibility of rapid leakage or drainage due to either an initial leak or fire damage of plumbing and components, such as aluminium components or non - metallic hoses, f ollowing the required fire resistance period. Hazard assessment of such rapid leakage and drainage may include airflow ventilation limitation of fire intensity, and fire duration limitation through fire zone drainage.

The analysis may consider that volume which is capable of being drained from the nacelle within a suitable period is not hazardous. The suitable period should be such that fluid leakage into the fire zone will not aggravate a fire beyond a fifteen minute period from its initiation. A five minu te period may be suitable when considering fire resistant components and plumbing for which leakage due to fire damage will not occur during the first five minute period and may not occur immediately thereafter.

[Amdt 25/1]

CS 25.1191 Firewalls

ED Decision 2003/ 2/RM (a) Each engine, fuel - burning heater, other combustion equipment intended for operation in flight, and the combustion, turbine, and tailpipe sections of turbine engines, must be isolated from the rest of the aeroplane by firewalls, shrouds, or equivalent means.

(b) Each firewall and shroud must be – (1) Fireproof; (2) Constructed so that no hazardous quantity of air, fluid, or flame can pass from the compartment to other parts of the aeroplane; (3) Constructed so that each opening is sealed with close fitting fireproof grommets, bushings, or firewall fittings; and (4) Protected against corrosion.

CS 25.1193 Cowling and nacelle skin

ED Decision 2018 / 005 /R (a) Each cowling must be constructed and supported so that it can resist any vibration, inertia, and air load to which it may be subjected in operation.

(b) Cowling must meet the drainage and ventilation requirements of CS 25.1187 .

(c) On aeroplanes with a diaphragm isolating the engine power section from the engine accessory section, each part of the accessory section cowling subject to flame in case of fire in the engine power section of the powerplant must – (1) Be fireproof; and (2) Meet the requirements of CS 25.1191 .

(d) Each part of the cowling subject to high temperatures due to its nearness to exhaust system parts or exhaust gas impingement must be fireproof.

(e) Each aeroplane must: Powered by EASA eRules Page 767 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION (1) Be designed and constructed so that no fire originating in any fire zone can enter, either through openings or by burning through external skin, any other zone or region where it would create additional hazards; (2) Meet sub - paragraph (e)(1) of this paragraph with the landing gear retracted (if appl icable); and (3) have cowlings and nacelles skins, in areas subject to flame if a fire starts in an engine fire zone, complying with the following: (i) For in - flight operations, cowlings and nacelles skins must be fireproof in the complete concerned area s, and (ii) For ground operations, cowlings and nacelles skins must be: (a) Fireproof in the portions of the concerned areas where a skin burn through would affect critical areas of the aeroplane, and (b) Fire - resistant or compliant with subparagraph (e)(1) of this paragraph in the remaining portions of the concerned areas.

(4) Be designed and constructed to minimise the likelihood of any in - flight opening or loss of a cowling that could prevent continued safe flight and landing.

(f) The retention system of each removable or openable cowling must: (1) keep the cowling closed and secured under the operational loads identified in subparagraph (a) of this paragraph following either of the following conditions: (i) improper fastening of any single latching, locking, or other retention device, or (ii) th e failure of any single latch or hinge.

(2) have readily accessible means to close and secure the cowling that do not require excessive force or manual dexterity; and (3) have a reliable means for effectively verifying that the cowling is secured prior to each take - off.

(See AMC 25.1193(e) ) [Amdt 25/13] [Amdt 25/18] [Amdt 25/21]

AMC 25.1193(e) Engine cowling and nacelle skin, APU compartment

external skin

ED Decision 2013/010/R (a) PURPOSE This AMC provides guidance for showing compliance with the certification specifications relating to fire withstanding capability of engine cowlings and nacelles skins, and APU compartment external skins, in areas subject to flame if a fire starts in an eng ine or APU fire zone, in consideration of potential hazard levels associated to operating conditions (flight/ground).

(b) RELATED CERTIFICATION SPECIFICATIONS CS 25.1193(e) , CS 25J1193(e) Powered by EASA eRules Page 768 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION (c) APPLICABILITY This AMC is applicable to engine cowlings and nacelles, and APU compartment external skins (fixed and/or removable).

(d) BACKGROUND CS 25.1193(e) and CS 25J1193(e) previously required the engine cowlings/nacelle sk ins and APU compartment external skins to be fireproof if a fire starts in the engine power or accessory sections or in the APU compartment. During past Type certification projects, it has been found that having non - fireproof engine cowlings/nacelle skins in some locations under some operating conditions do not adversely affect safety. Consequently, in practice, not all cowlings/skins ‘subject to flame if a fire starts in the engine power or accessory sections’ have been required to be fireproof under all o perating conditions and, for instance, some portions were approved as fire - resistant only for ground operating conditions. As it represented a rule relaxation, such non - fireproof cowlings/skins were formally found to be ‘equivalently safe’ to comply with t he rule. Over time, however, these equivalent safety findings became inherent within traditionally accepted design practices. Certification Review Item (CRI) released to cover the relaxation included also interpretations for zone definitions and operating conditions to be considered for fireproofness or fire - resistance compliance demonstration.

(e) FIRE WITHSTANDING REQUIREMENTS, OPERATING CONDITIONS AND POTENTIAL HAZARDS (1) General The required level of ability to withstand the effects of fire varies with the potential hazard level associated with different flight and ground operating conditions, as follows.

(2) Flight Conditions For the purpose of CS 25.1193(e) and CS 25J1193(e) , flight conditions are defined as aeroplane operation from airspeed above minimum V1 until minimum touchdown speed in approved normal or abnormal operations. Cowling and skin in areas subject to flame if a fire starts in an engine or APU fir e zone must be demonstrated to be fireproof.

For demonstrating the fireproof capabilities of the cowling/skin, the following apply: (i) Credit from the external airflow on the cowling/skin can be considered.

(ii) The airflow levels and the engine/APU powers should be consistent with the operating conditions. These parameters should be examined and the most critical ones should be determined.

(iii) The engine/APU should be considered to be operative for the first 5 minutes, and during the remaining 10 minutes under windmilling conditions for engine and stopped conditions for the APU.

(3) Ground conditions For the purpose of CS 25.1193(e) and CS 25J1193(e) , ground conditions are defined as aircraft operation not covered by the flight conditions provided in subparagraph (e)(2) of this AMC. It includes static, taxiing, take - off roll, and landing roll.

(i) Areas where fireproof skins are required — The portion of cowling and skin in areas subject to flames if a fire starts in an engine or APU fire zone, and located so that not containing the effects of the fire could result in serious hazards to the aircraft, injuries to crew, passeng ers or ground personnel, must be fireproof under all conditions. Serious hazards include, but are not limited to, events such as fuel tank Powered by EASA eRules Page 769 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION explosion, hazardous spread of fire to flammable fluid sources outside the fire zone, fuselage penetration and flight control surface damages.

(A) Pod - mounted engines: The portion of the nacelle/cowling skin, which is required to be fireproof on ground, varies by installation. A design is considered acceptable when it is demonstrated that the fireproof area protects th e pylon strut and other portions of the aircraft considered to be put at a serious hazard risk if a burn through occurs. Factors to consider within the analysis and to use when substantiating the design are: the engine location — wing or aft fuselage mount ed, the coupling distance of the nacelle to the wing, the airflow characteristics, the fluid migration scheme and the fire plume patterns. After the initial analysis, similarity demonstration and in - service experience may be used as appropriate.

Analyses h ave demonstrated that the typical area of concern ra nges from 90° (± 45°) to 180° (± 90°) and is centred on the pylon centre line. This area may increase or decrease depending on the analysis results. For example, most wing mounted engines not closely coup led to the wing have been found acceptable with a ± 45° protection while more closely coupled installations and those with other unique design features have required ± 90° protection. The symmetry of the protection may also vary. Wing mounted engines usual ly have symmetrical protection while aft mounted engines may have non - symmetrical protection in order to cover more of the inboard area.

(B) Turbo - propellers, APUs and other non - pod - mounted engines: Due to the wide variations in installation configurations, each installation should be evaluated to determine if not containing the effects of a fire would cause a Powered by EASA eRules Page 770 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION serious hazard such as the example s above. If so, the affected area of the fire zone skin should be fireproof.

(C) For the purpose of the demonstration: — No credit from external airflow on the cowling/skin should be considered in conjunction with the assumption that the aircraft may be s tatic.

— The engine/APU should be considered to be operative for the first 5 minutes and stopped for the remaining 10 minutes.

— Engine/APU operation — Requirements for ability of cowling/skin in areas subject to flames if a fire starts in an engine or APU fire zone to withstand the effects of fire in ground operating conditions apply with either the engine operating or not operating, whichever is the more critical. The Engine/APU operating conditions shall be justified by the applicant.

(ii) Other areas : For the remaining portions of cowling/skin in areas subject to flames, if a fire starts in an engine or APU fire zone, the degree of fire resistance can be lower than ‘fireproof’ due to less serious or less probable hazard to the aircraft, crew, passenge rs and ground personnel under the critical operating conditions.

Any burn through of the APU compartment external skin should consider hazards associated with combustion product and possible outgassing and re - ingestion of toxic air into cabin air system.

(A) Fire - resistant cowlings/skins provide adequate fire protection for those areas as they provide sufficient time to stop the aeroplane and evacuate it.

(B) A lower than ‘fire - resistant’ degree of fire protection may be considered; the following condit ions should then be analysed and submitted to the Agency for approval: — Cowling/skin should have the ability to withstand fire at least equivalent to the ability of a 1 mm (0.040 inch) aluminium sheet in the worst aircraft and engine/APU ground conditions anticipated; — Applicants must substantiate that this lower fire protection level will not lead to hazardous effect s including but not limited to: — Upon burn through of the lower than ‘fire - resistant’ area, both the fire - resistant and/or fire - proof areas sha ll not have their fire withstanding capability affected, — Liberation of parts that would affect the aeroplane evacuation procedure or reduce the efficiency of fire protection means, — Reduction in flammable fluid drainage capability such that fire severity would be increased (magnitude, residual presence, propagation to surrounding area), — Reduction in aeroplane evacuation capability due to proximity to evacuation paths or due to the visibility of the fire hindering the ability of the passengers to evacuate the aeroplane in a rapid and orderly manner, Powered by EASA eRules Page 771 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERP LANT (CS - 25) POWERPLANT FIRE PROTECTION Note: There is some hazard involving aeroplane evacuation even in the absence of burn through due to such concerns as smoke and flaming liquids exiting from openings. Burn through of nacelle skin should not sig nificantly increase these hazards.

— Reduction in fire detection capability such that the flight crew would not be aware of the fire, especially in a situation involving taxiing prior to take - off, — Reduction in fire extinguishing capability which could caus e or aggravate one of the potential hazards listed above.

— Flammable fluid and/or fire spreading o n the aeroplane evacuation path (f) SPECIFIC CONFIGURATION CONSIDERATIONS (1) Multiple skin layers: For some specific fire zones, a fire originating in tha t zone will have to pass through several layers of cowling or skin before burning through the external skin.

This may be the case, for example, for the core zone of some turbofan installations. In such cases, credit may be taken for multiple layers, having regard to the location of the fire source and the likely direction of propagation from that location, providing burn through of the inner layer does not produce other hazardous effects and it does not invalidate other certification specifications such as fire extinguishing capability. The corresponding compliance substantiation should take into account particular geometrical configuration with respect to the risk of flame propagation, as well as critical systems or structures.

(2) Inlet skins: For extern al inlet skins, which enclose fire zones, the guidance provided above for multiple skin layers applies. Inlet ducts should meet CS 25.1103/CS 25J1103 specifications.

(3) Openings: The following considerations are applicable to openings in a fire zone ski n whether the openings are of fixed size, variable or controllable size, or normally closed, such as access or inspection doors, or pressure relief doors.

(i) Openings should be located such that flame exiting the opening would not enter any other region where it could cause a hazard in flight or a serious hazard on the ground as per subparagraph (e)(3). Exception is made for covered openings which meet the same criteria for ability to withstand the effects of fire as the surrounding cowl skin, and which a re not expected to become open under fire conditions. Since pressure relief doors may open during some fire conditions, they should be located such that flames exiting the door will not cause a hazard. However, doors that will remain closed during most fir e conditions, or will tend to re - close following initial opening, have traditionally been assumed to be closed for the purposes of evaluating fire detection and extinguishing.

(ii) Openings should have the same ability to withstand the effects of fire as the adjacent skin with respect to becoming enlarged under fire conditions. Some enlargement, such as burning away of louvers or doublers surrounding the opening or gapping of covered openings, is acceptable provided that the hazard is not significantly increased by a reduction in fire extinguishing or detection capability, increased airflow causing increase in fire size or intensity, or increase in probability of a hazardous spread of fire to other regions.

Powered by EASA eRules Page 772 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION (4) Hinges, Fittings and Latches: These attaching means maintaining the nacelle/cowlings between them or to the aircraft/engine/APU structure may need to have a greater ability to withstand the effect of fire than the surrounding skin. Loss of attaching means may create more severe hazards such as cowling liberation in comparison to a skin burn through. The applicant must justify the required level of fire withstanding capability by test and/or analysis.

(5) Seals : Where seals are used part of the external eng ine nacelle/cowling or APU compartment boundaries, they should at least comply with the same fire integrity standard as the surrounding cowling/skin.

(g) COMPLIANCE DEMONSTRATION Compliance should be substantiated per CS 25.1207 . Substantiation involving airflow patterns may include analytical methods such as Computational Fluid Dynamics, test methods or other flow visualisation methods or a combination of these methods. Fire testing should be accomplished accord ing to the guidance of ISO 2685 with considerations of applications of representative conditions (airflow, loads, vibrations) and establishment of appropriate pass/fail criteria (burn through, elongation, dislocation).

[Amdt 25/13]

AMC 25.1193(e)(4) and (f ) Engine cowling retention

ED Decision 2018/005/R a. Purpose and scope CS 25.1193(e)(4) requires design precautions to be taken to minimise the risk of any in - flight opening or loss of an engine cowling that could prevent continued safe flight and landing.

CS 25.1193(f) requires the retention system of each removable or openable cowling to have a means, which is demonstrated to be reliable and effective, to verify that the c owling is closed and latched prior to each take - off.

Reported occurrences of engine cowling separations revealed that features like latch handles hanging down, cowling gaps, and detection capabilities offered by walk - arounds and/or checks at the completion stage of maintenance activities, had not been reliable or effective in preventing aeroplanes from taking off with unclosed/unlatched cowlings.

For turbofan engines, these occurrences have concerned fan cowls only. Thrust reverser cowls have show n satisfactory in - service experience with regard to the risk of a cowling separation.

Therefore, specifications CS 25.1193(e)(4) and (f) are intended to be applicable to engine fan cowls only.

All dispatch configur ations, as permitted by the master minimum equipment list (MMEL) and the configuration deviation list (CDL), should be considered when showing compliance with CS 25.1193(e)(4) and (f) .

b. Selection of appropriate d esign features The following guidelines are provided to help the applicant in selecting design features appropriate to the engine/nacelle characteristics, an d in showing compliance with CS 25.1193(e)(4) and (f) .

Powered by EASA eRules Page 773 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION Human factors In determining the most appropriate design feature, or combination of design features, to cope with the human - factor aspects that contribute to the risk of an aeroplane being released with unclosed or unlatched cowlings, attention should be p laced on the following aspects of cowling latched/unlatched indications: — Their verification by personnel should not necessitate unusual physical effort (e.g.

bending down or kneeling on the ground); — Their verification by personnel should take into account the variability in the physical capabilities of personnel; — The provision of these indications should take into account a possible lack of diligence of personnel in conducting walk - arounds and in completing their maintenance activities; — The combination of i ndications should draw the attention of personnel without ambiguity (e.g. by paint effects) and should not be rendered ineffective by lighting conditions (night/day), weather conditions, or the operational environment.

Design considerations The following considerations should be taken into account when selecting design features to mitigate the risk of a cowling separation: — A wing - mounted engine/nacelle presents a higher risk than a rear - mounted engine/nacelle, therefore it requires more noticeabl e cowling latched/unlatched indications and/or a combination of them; — An engine/nacelle with a small ground clearance presents a higher risk than one with a large ground clearance, therefore it requires more noticeable indications and/or a combination of them; — A hanging heavy/large piece or part on an engine/nacelle with a large ground clearance may draw the attention of personnel; — A unique indication on the lower part of an engine/nacelle that has a small ground clearance may not be sufficient to draw att ention to it; — The noticeability of a forced gap between the fan cowl and the surrounding structure may be adversely affected by its environment, such as the ambient lighting conditions, external painting or the condition of the surrounding structure, and m ay not be individually sufficient to draw attention to it; — A flashing light in an open gap or outside the nacelle skin may draw the attention of personnel. In such cases, the reliability of the flashing light should be investigated and substantiated, taki ng into account the effects of the engine/nacelle environment; — A mechanical flag on the outside of the nacelle skin may draw the attention of personnel; — A latch which is locked by a key equipped with a red flag may draw the attention of personnel, however a duplicate key without a flag could be used, and therefore the use of a flag may not be sufficient; — A design with a remote indication (i.e. on the flight deck) of the unlatched/unclosed fan cowl condition may effectively draw the attention of the flight crew.

Powered by EASA eRules Page 774 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION Other guidelines Furthermore, the following guidelines related to the use of some of the design features should be taken into account by the applicant: — Procedural control measures may not always be followed as a result of the pressure to dispatch the aeroplane, and because of routine issues; — Improper Instructions for Continuing Airworthiness may be issued, which may lead to: — Improper rigging of the cowls and the associated latches; — Poor maintenance of design features intended to prevent aeroplane dispatch with unlatched cowlings, such as bright paint fading over time (or becoming soaked with the dirt accumulated at the bottom of the nacelle), hold - open cowl devices not performing their intended function, etc.; — Some nacelle painting can defeat the design precautions: — Red or orange nacelle colours may negate the visibility of red/dayglow latches; — A dark nacelle colour may reduce the noticeability of gaps.

— Specific tools may be improperly defined and maintained (e.g. keys required to open cowls, normally fitted with a red flag, being used without a flag).

In order to address the human factors that contribute to the risk, it might be necessary to conduct an in - service and practical evaluation of the proposed design.

[Amdt 25/21]

CS 25.1195 Fire - extinguisher systems

ED Decision 2016/010/R (See AMC 25.1195) (a) Except for combustor, turbine, and tail pipe sections of turbine engine installations that contain lines or components carrying flammable fluids or gases for which it is shown that a fire originating in these sections can be controlled, there must be a fire extinguisher system serving each designated fire zone.

(b) The fire - extinguishing system, the quantity of the extinguishing agent, the rate of discharge, and the discharge distribut ion must be adequate to extinguish fires. It must be shown by either actual or simulated flight tests that under critical airflow conditions in flight the discharge of the extinguishing agent in each designated fire zone specified in sub - paragraph (a) of t his paragraph will provide an agent concentration capable of extinguishing fires in that zone and of minimising the probability of re - ignition. An individual ‘one - shot’ system may be used for fuel burning heaters, and other combustion equipment. For each o ther designated fire zone, two discharges must be provided each of which produces adequate agent concentration. (See AMC 25.1195(b) .)

(c) The fire - extinguishing system for a nacelle must be able to simultaneously p rotect each zone of the nacelle for which protection is provided.

[Amdt 25/18] Powered by EASA eRules Page 775 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION

AMC 25.1195(b) Fire extinguisher s ystems

ED Decision 20 12 / 008 /R Acceptable methods to establish the adequacy of the fire extinguisher system are laid do wn in Advisory Circular 20 - 100 . with reference to Halon concentration levels. This AC is not applicable to extinguishing agents alternative to Halon.

[Amdt 25/12]

CS 25.1197 Fire - extinguishing agents

ED Decision 2012 / 008/R (See AMC 25.11 97 .)

(a) Fire - extinguishing agents must – (1) Be capable of extinguishing flames emanating from any burning of fluids or other combustible materials in the area protected by the fire extinguishing system; and (2) Have thermal stability over the temperature range likely to be experienced in the compartment in which they are stored.

(b) If any toxic extinguishing agent is used, provisions must be made to prevent harmful concentrations of fluid or fluid vapours (from leakage during normal operation of the aeroplane or as a result of discharging the fire extinguisher on the ground or in flight) from entering any personnel compartment, even though a defect may exist in the extinguishing system. This must be shown by test except for built - in carbon diox ide fuselage compartment fire extinguishing systems for which – (1) 2.3 kg (five pounds) or less of carbon dioxide will be discharged, under established fire control procedures, into any fuselage compartment; or (2) There is protective breathing equipment for each flight - crew member on flight deck duty.

[Amdt 25/12]

AMC 25.1197 Fire - Extinguishing Agents

ED Decision 2012/008/R Halon 1301 is no longer an acceptable extin guishing agent, based on EU Law , for engine nacelle and APU fire extinction systems to be installed in aircraft types, for which type certification is requested after 31 December 2014. (See AMC 25.851(c) for more information on Halon alternatives.)

[Amdt 25/12] Commission Regulation (EU) No 744/2010 of 18 August 2010 amendi ng Regulation (EC) No 1005/2009 of the European Parliament and of the Council on substances that deplete the ozone layer, with regard to the critical uses of halon (OJ L 218, 19.8.2010, p. 2).

Powered by EASA eRules Page 776 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION

CS 25.1199 Extinguishing agent containers

ED Decision 2003/ 2/RM (a) Each extinguishing agent container must have a pressure relief to prevent bursting of the container by excessive internal pressures.

(b) The discharge end of each discharge line from a pressure relief connection must b e located so that discharge of the fire extinguishing agent would not damage the aeroplane. The line must also be located or protected to prevent clogging caused by ice or other foreign matter.

(c) There must be a means for each fire extinguishing agent co ntainer to indicate that the container has discharged or that the charging pressure is below the established minimum necessary for proper functioning.

(d) The temperature of each container must be maintained, under intended operating conditions, to prevent the pressure in the container from – (1) Falling below that necessary to provide an adequate rate of discharge; or (2) Rising high enough to cause premature discharge.

(e) If a pyrotechnic capsule is used to discharge the extinguishing agent, each contain er must be installed so that temperature conditions will not cause hazardous deterioration of the pyrotechnic capsule.

CS 25.1201 Fire extinguishing system materials

ED Decision 2003/2/RM (a) No material in any fire extinguishing system may react chemical ly with any extinguishing agent so as to create a hazard.

(b) Each system component in an engine compartment must be fireproof.

CS 25.1203 Fire - detector system

ED Decision 2008 / 006/R (a) There must be approved, quick acting fire or overheat detectors in each designated fire zone, and in the combustion, turbine, and tailpipe sections of turbine engine installations, in numbers and locations ensuring prompt detection of fire in those zones.

(b) Each fire detector system must be constructed and installed so that – (1) It will withstand the vibration, inertia, and other loads to which it may be subjected in operation; (2) There is a means to warn the crew in the event that the sensor or associated wiring within a designated fire zone is severed at one point, unless the system continues to function as a satisfactory detection system after the severing; and (3) There is a means to warn the crew in the event of a short circuit in the sensor or associated wiring within a designated fire zone, unless th e system continues to function as a satisfactory detection system after the short circuit.

(c) No fire or overheat detector may be affected by any oil, water, other fluids, or fumes that might be present.

(d) There must be means to allow the crew to check, in flight, the functioning of each fire or overheat detector electric circuit.

Powered by EASA eRules Page 777 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART E – POWERPLANT (CS - 25) POWERPLANT FIRE PROTECTION (e) C omponents of each fire or overheat detector system in a fire zone must be at least fire - resistant.

(f) No fire or overheat detector system component for any fire zone may pass through another fire zone, unless – (1) It is protected against the possibility of false warnings resulting from fires in zones through which it passes; or (2) Each zone involved is simultaneously protected by the same detector and extinguishing system.

(g) Each fire detector system must be constructed so that when it is in the configuration for installation it will not exceed the alarm activation time approved for the detectors using the response time criteria specified in the appro priate European Technical Standard Order for the detector.

(h) Electrical wiring interconnection systems for each fire or overheat detector system in a fire zone must meet the requirements of CS 25.1713 and 1731 .

[Amdt 25/5]

CS 25.1207 Compliance

ED Decision 2003/ 2/RM Unless otherwise specified, compliance with the requirements of CS 25.1181 to 25.1203 must be shown by a full scale fire test or by one or more of the following methods: (a) Tests of similar powerplant configurations; (b) Tests of components; (c) Service experience of aeroplanes with similar powerplant configurations; (d) Analysis.

Powered by EASA eRules Page 778 of 1495 | Jan 2023

Next: SUBPART F – EQUIPMENT →

SUBPART F – EQUIPMENT

Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

SUBPART F – EQUIPMENT

GENERAL

CS 25.1301 Function and installation

ED Decision 2008 / 006 /R (See AMC 25.1301 ) (a) Each item of installed equipment must – (1 ) Be of a kind and design appropriate to its intended function; (2 ) Be labelled as to its identification, function, or operating limitations, or any applicable combination of these factors. (See AMC 25.1301(a)(2) .)

(3 ) Be installed according to limitations s pecified for that equipment.

(b) Electrical wiring interconnection systems must meet the requirements of subpart H of this CS - 25.

[Amdt 25/2] [Amdt 25/5]

AMC 25.1301(a ) (2) Function and i nstallation

ED Decision 2008 / 006/R When pipelines are marked for the purpose of distinguishing their functions, the markings should be such that the risk of confusion by maintenance or servicing personnel will be minimised. Distinction by means of colour markings alone is not acceptable. Th e use of alphabetic or numerical symbols will be acceptable if recognition depends upon reference to a master key and any relation between symbol and function is carefully avoided. Specification ISO.12 version 2ED 1987 gives acceptable graphical markings.

[Amdt 25/5]

CS 25.1302 Installed systems and equip ment for use by the flight

crew

ED Decision 2007/010/R (See AMC 25.1302 .)

This paragraph applies to installed equipment intended for flight - crew members’ use in the operation of the aeroplane from their normally seated positions on the flight deck. This installed equipment must be shown, individually and in combination with othe r such equipment, to be designed so that qualified flight - crew members trained in its use can safely perform their tasks associated with its intended function by meeting the following requirements: (a) Flight deck controls must be installed to allow acco mplishment of these tasks and information necessary to accomplish these tasks must be provided.

(b) Flight deck controls and information intended for flight crew use must: (1) Be presented in a clear and unambiguous form, at resolution and precision ap propriate to the task.

Powered by EASA eRules Page 779 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (2) Be accessible and usable by the flight crew in a manner consistent with the urgency, frequency, and duration of their tasks, and (3) Enable flight crew awareness, if awareness is required for safe operation, of the effects on the aeroplane or systems resulting from flight crew actions.

(c) Operationally - relevant behaviour of the installed equipment must be: (1) Predictable and unambiguous, and (2) Designed to enable the flight crew to intervene in a manner appropriate to t he task.

(d) To the extent practicable, installed equipment must enable the flight crew to manage errors resulting from the kinds of flight crew interactions with the equipment that can be reasonably expected in service, assuming the flight crew is acting in good faith. This sub - paragraph (d) does not apply to skill - related errors associated with manual control of the aeroplane.

[Amdt 25/3]

AMC 25.1302 Installed Systems and Equipment for Use by the Flight

Crew

ED Decision 2007/010/R Table of content 1 . Purpose 2 . Background 3 . Scope and Assumptions 4 . Certification Planning 5 . Design Considerations and Guidance 6 . Means of Compliance Appendix 1: Related Regulatory Material Appendix 2: Definitions and Acronyms 1. PURPOSE This Acceptable Means of Compliance (AMC) provides guidance material for demonstrating compliance with the requirements of CS 25.1302 and several other paragraphs in CS - 25 that relate to the installed equipment use d by the flight crew in the operation of an aeroplane. In particular, this AMC addresses the design and approval of installed equipment intended for the use of flight - crew members from their normally seated positions on the flight deck. This AMC also provi des recommendations for the design and evaluation of controls, displays, system behaviour, and system integration, as well as design guidance for error management.

Applicants should use Paragraphs 4, 5 and 6 of this AMC together to constitute an acceptable means of compliance. Paragraph 4 “Certification Planning”, describes the activities and communication between the applicant and the Agency for certification planning. Paragraph 5 “Design Considerations and Guidance”, is organised in accordance with the su b - paragraphs of CS 25.1302 and identifies HF related design issues that should be addressed to show compliance with CS 25.1302 and other relevant rules. Paragraph 6 “Means of Compliance” describes general means of compliance and how they may be used.

Powered by EASA eRules Page 780 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) G ENERAL 2. BACKGROUND Flight crews make a positive contribution to the safety of the air transportation system because of their ability to assess continuously changing conditions and situations, analyse potential actions, and make reasoned decisions. However, even well trained, qualified, healthy, alert flight - crew members make errors. Some of these errors may be influenced by the design of the systems and their flight crew interfaces, even with those that are care fully designed. Most of these errors have no significant safety effects, or are detected and/or mitigated in the normal course of events,. Still, accident analyses have identified flight crew performance and error as significant factors in a majority of ac cidents involving transport category aeroplanes.

Accidents most often result from a sequence or combination of errors and safety related events (e.g., equipment failure and weather conditions). Analyses show that the design of the flight deck and other sys tems can influence flight crew task performance and the occurrence and effects of some flight crew errors.

Some current regulatory requirements mean to improve aviation safety by requiring that the flight deck and its equipment be designed with certain cap abilities and characteristics. Approval of flight deck systems with respect to design - related flight crew error has typically been addressed by referring to system specific or general applicability requirements, such as CS 25.1301(a) , CS 25.771(a) , and CS 25.1523 . However, little or no guidance exists to show how the applicant may address potential crew limitations and errors. That i s why CS 25.1302 and this guidance material have been developed.

Often, showing compliance with design requirements that relate to human abilities and limitations is subject to a great deal of interpretation. Find ings may vary depending on the novelty, complexity, or degree of integration related to system design. The EASA considers that guidance describing a structured approach to selecting and developing acceptable means of compliance is useful in aiding standard ised certification practices.

3. SCOPE AND ASSUMPTIONS This AMC provides guidance for showing compliance with CS 25.1302 and guidance related to several other requirements associated with installed equipment the fl ight crew uses in operating the aeroplane. Table 1 below contains a list of requirements related to flight deck design and flight crew interfaces for which this AMC provides guidance. Note that this AMC does not provide a comprehensive means of compliance for any of the requirements beyond CS 25.1302 .

This material applies to flight crew interfaces and system behaviour for installed systems and equipment used by the flight crew on the flight deck while operating th e aeroplane in normal and non - normal conditions. It applies to those aeroplane and equipment design considerations within the scope of CS - 25 for type certificate and supplemental type certificate (STC) projects.

It does not apply to flight crew training, q ualification, or licensing requirements. Similarly, it does not apply to flight crew procedures, except as required within CS - 25.

In showing compliance to the requirements referenced by this AMC, the applicant may assume a qualified flight crew trained in the use of the installed equipment. This means a flight crew that is allowed to fly the aeroplane by meeting the requirements in the operating rules for the relevant Authority.

Powered by EASA eRules Page 781 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Paragraph 3 - Table 1: Requirements relevant to this AMC.

CS - 25 BOOK 1 Requi rements General topic Referenced material in this AMC CS 25.771(a) Unreasonable concentration or Error, 5.6.

fatigue Integration, 5.7.

Controls, 5.3.

System Behaviour, 5.5.

CS 25.771(c) Controllable from either pilot Controls, 5.3.

seat Integration, 5.7.

CS 25.773 Pilot compartment view Integration, 5.7.

CS 25.777(a) Location of cockpit controls. Controls, 5.3.

Integration, 5.7.

CS 25.777(b) Direction of movement of Controls, 5.3.

cockpit controls Integration, 5.7.

CS 25.777(c) Full and unrestricted movement Controls, 5.3.

of controls Integration, 5.7.

CS 25.1301(a) Intended function of installed Error, 5.6.

systems Integration, 5.7.

Controls, 5.3.

Presentation of Information, 5.4.

System Behaviour, 5.5.

CS 25.1302 Flight crew error Error, 5.6.

Integration, 5.7.

Controls, 5.3.

Presentation of Information, 5.4.

System Behaviour, 5.5.

CS 25.1303 Flight and navigation Integration, 5.7.

instruments CS 25.1309(a) Intended function of required Controls, 5.3.

equipment under all operating Integration, 5.7.

conditions CS 25.1309(c) Unsafe system operating Presentation of information, 5.4.

conditions and minimising crew Errors, 5.6.

errors which could create additional hazards CS 25.1321 Visibility of instruments Integration, 5.7.

CS 25.1322 Warning caution and advisory Integration, 5.7.

lights CS 25.1329 Autopilot, flight director and System Behaviour, 5.5.

autothrust CS 25.1523 Minimum flight crew Controls, 5.3.

Integration, 5.7.

CS 25.1543(b) Visibility of instrument markings Presentation of Information, 5.4.

CS 25.1555 (a) Control markings Controls, 5.3.

CS 25 Appendix D Criteria for determining Integration, 5.7.

minimum flight crew C S 25.1302 is a general applicability requirement. Other CS - 25 requirements exist for specific equipment and systems. Where guidance in other AMCs is provided for specific equipment and systems, that guidance is assumed to have precedence if a conflict exis ts with guidance provided Powered by EASA eRules Page 782 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL here. Appendix 1 of this AMC lists references to other related regulatory material and documents.

4. CERTIFICATION PLANNING This paragraph describes applicant activities, communication between the applicant and the Agency, and the documentation necessary for finding compliance in accordance with this AMC.

Requirements for type certification related to complying with CS - 25 may b e found in Part 21.

Applicants can gain significant advantages by involving the Agency in the earliest possible phases of application and design. This will enable timely agreements on potential design related human factors issues to be reached and thereby reduce the applicant’s risk of investing in design features that may not be acceptable to the Agency.

Certain activities that typically take place during development of a new product or a new flight deck system or function, occur before official certific ation data is submitted to demonstrate compliance with the requirements. The applicant may choose to discuss or share these activities with the Agency on an information - only basis. Where appropriate, the Agency may wish to participate in assessments the ap plicant is performing with mock - ups, prototypes, and simulators.

When the Agency agrees, as part of the certification planning process, that a specific evaluation, analysis, or assessment of a human factors issue will become part of the demonstration that the design is in compliance with requirements, that evaluation, analysis, or assessment is given “certification credit”.

Figure 1 illustrates the interaction between paragraph 4, 5 and 6 of this AMC. These paragraphs are used simultaneously during the ce rtification process. Paragraph 4 details applicant activities and communication between the applicant and the Agency. Paragraph 5 provides means of compliance on specific topics. Paragraphs 5.2, 5.6 and 5.7 assist the applicant in determining inputs requir ed for the scoping discussions outlined in paragraph 4.1. Paragraphs 5.3 through 5.5 provide guidance in determining the list of applicable requirements for discussion, outlined in paragraph 4.2. Paragraph 6 provides a list of acceptable general means of c ompliance used to guide the discussions for paragraph 4.3. Paragraph 4.4 lists items that may be documented as a result of the above discussions.

Powered by EASA eRules Page 783 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Paragraph 4 - Fig. 1: Methodical approach to planning certification for design related Human performance issues 4.1 Scope of the flight deck certification programme This paragraph provides means of establishing the scope of the certification programme.

In a process internal to the applicant, the applicant should consider the flight deck controls , information and system behaviour that involve flight crew interaction. The applicant should relate the intended functions of the system(s), components and features to the flight crew tasks. The objective is to improve understanding about how flight crew tasks might be changed or modified as a result of introducing the proposed system(s), components and features. Paragraph 5.2, Intended Function and Associated Flight Crew Tasks, provides guidance.

The certification programme may be impacted by the level of integration, complexity and novelty of the design features, each of which is described in the sub - paragraphs that Powered by EASA eRules Page 784 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL follow. Taking these features into account, the applicant should reach an agreement with the Agency on the scope of flight deck controls, inf ormation and system behaviour that will require extra scrutiny during the certification process. Applicants should be aware that the impact of a novel feature might also be affected by its complexity and the extent of its integration with other elements of the flight deck. A novel but simple feature will likely require less rigorous scrutiny than one that is both novel and complex.

a) Integration In this document, the term “level of systems integration”, refers to the extent to which there are interactions or dependencies between systems affecting the flight crew’s operation of the aeroplane. The applicant should describe such integration among systems, because it may affect means of compliance. Paragraph 5.7 also refers to integration. In the context of tha t paragraph, integration defines how specific systems are integrated into the flight deck and how the level of integration may affect the means of compliance.

b) Complexity Complexity of the system design from the flight crew’s perspective is an important factor that may also affect means of compliance in this process. Complexity has multiple dimensions. The number of information elements the flight crew has to use (the number of pieces of information on a display, for instance) may be an indication of comp lexity. The level of system integration may be a measure of complexity of the system from the flight crew’s perspective. Design of controls can also be complex. An example would be a knob with multiple control modes.

Paragraph 5 addresses several aspects of complexity.

c) Novelty The applicant should identify the degree of design novelty based on the following factors: — Are new technologies introduced that operate in new ways for either established or new flight deck designs?

— Are unusual or additional opera tional procedures needed as a result of the introduction of new technologies?

— Does the design introduce a new way for the flight crew to interact with systems using either conventional or innovative technology?

— Does the design introduce new uses for existi ng systems that change the flight crew’s tasks or responsibilities?

Based on the above criteria, the applicant should characterise features by their novelty. More novel features may require extra scrutiny during certification. Less novel features must stil l be shown to be compliant with requirements, but will usually follow a typical certification process that may be less rigorous than the process described below.

Powered by EASA eRules Page 785 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 4.2 Applicable Requirements The applicant should identify design requirements applicable to each of the systems, components, and features for which means of demonstrating compliance must be selected. This can be accomplished in part by identifying design characteristics that can adve rsely affect flight crew performance, or that pertain to avoidance and management of flight crew errors.

Specific design considerations for requirements involving human performance are discussed in Paragraph 5. The applicability of each design considerati on in Paragraph 5 will depend on the design characteristics identified in paragraph 4.1.

The expected output of the analysis is a list of requirements that will be complied with and for which design considerations will be scrutinised. This list of require ments will be the basis for a compliance matrix identifying the means of compliance proposed for each requirement.

4.3 Select appropriate means of compliance After identifying what should be shown in order to demonstrate compliance, the applicant should review paragraph 6.1 for guidance on selecting the means, or multiple means of compliance, appropriate to the design. In general, it is expected that the level of scrutiny or rigour represented by the means of compliance should increase with higher levels of novelty, complexity and integration of the design.

Paragraph 6 identifies general means of compliance that have been used on many certification programmes and discusses their selection, appropriate uses, and limitations.

The applicant may propose other general means of compliance, subject to approval by the Agency.

Once the human performance issues have been identified and means of compliance have been selected and proposed to the Agency, the Agency may agree, as part of the certification plannin g process, that a specific evaluation, analysis or assessment of a human factors issue will become part of the demonstration that the design is in compliance with requirements. Certification credit can be granted when data is transmitted to and accepted by the Agency using standard certification procedures. This data will be a part of the final record of how the applicant has complied with the requirements.

The output of this step will consist of the means that will be used to show compliance to the requir ements.

4.4 Certification plan The applicant should document the certification process, outputs and agreements described in the previous paragraphs. This may be done in a separate plan or incorporated into a higher level certification plan. The following is a summary of what may be contained in the document: — The new aeroplane, system, control, information or feature(s) — The design feature(s) being evaluated and whether or not the feature(s) is(are) new or novel — The integration or complexity of the new feat ure(s) — Flight crew tasks that are affected or any new tasks that are introduced Powered by EASA eRules Page 786 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL — Any new flight crew procedures — Specific requirements that must be complied with — The means (one or several) that will be used to show compliance — The method for transferring data to the Agency 5. DESIGN CONSIDERATIONS AND GUIDANCE This paragraph contains a discussion of CS 25.1302 and guidance on complying with it and other requirements.

The applicant should first complete the following st eps.

— Identify systems, components, and features of a new design that are potentially affected by the requirements.

— Assess degrees of novelty, complexity, and level of integration using the initial process steps in paragraph 4.

Once these steps have been co mpleted, use the contents of this paragraph to identify what should be shown to demonstrate compliance.

To comply with the requirements of CS - 25, the design of flight deck systems should appropriately address foreseeable capabilities and limitations of th e flight crew. To aid the applicant in complying with this overall objective, this paragraph has been divided into sub - paragraphs. They provide guidance on the following topics: — Applicability and Explanatory material to CS 25.1302 (See paragraph 5.1), — Intended function and associated flight crew tasks(See paragraph 5.2), — Controls (See paragraph 5.3), — Presentation of information(See paragraph 5.4), — System behaviour (See paragraph 5.5), — Flight crew error management(See paragraph 5.6), — Integration (See paragraph 5.7), Each sub - paragraph discusses what the applicant should show to establish compliance with applicable requirements. We are not describing here what might otherwise be referred to as industry “be st practices.” The guidance presented here is the airworthiness standard for use in compliance. Obviously, not all criteria can or should be met by all systems. Because the nature of the guidance in this AMC is broad and general, some of it will conflict in certain instances.

The applicant and the Agency must apply some judgment and experience in determining which guidance applies to what parts of the design and in what sit uations. Headings indicate the regulations to which the guidance applies. First, how ever, we provide a more detailed discussion of CS 25.1302 .

As described in the Background and Scope paragraphs of this document, flight crew error is a contributing factor in accidents. CS 25.1302 was developed to provide a regulatory basis for, and this AMC provides guida nce to address design - related aspects of avoidance and management of flight crew error by taking the following approach: First, by providing guidance about design characteristics that are known to reduce or avoid flight crew error and that address flight crew capabilities and limitations. Requirements in sub - paragraphs (a) through (c) of CS 25.1302 are intended to reduce the design contribution to such Powered by EASA eRules Page 787 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL errors by ensuring information and controls needed by the fligh t crew to perform tasks associated with the intended function of installed equipment are provided, and that they are provided in a usable form. In addition, operationally relevant system behaviour must be understandable, predictable, and supportive of flig ht crew tasks. Guidance is provided in this paragraph on the avoidance of design - induced flight crew error.

Second, CS 25.1302(d) addresses the fact that since flight crew errors will occur, even with a well - traine d and proficient flight crew operating well - designed systems, the design must support management of those errors to avoid safety consequences. Paragraph 5.6 below on flight crew error management provides relevant guidance.

5.1 Applicability and Explanatory Material to CS 25.1302 CS - 25 contains requirements for the design of flight deck equipment that are system - specific (e.g., CS 25.777 , CS 25.1321 , CS 25.1329 , CS 25.1543 etc.), generally applicable (e.g., CS 25.1301(a) , CS 25.1309(c) , CS 25.771 (a) ), and that establish minimum flight crew requirements (e.g. CS 25.1523 and CS - 25 Appendix D). CS 25.1302 augments previously existing generally applicable requirements by adding more explicit requirements for design attributes related to avoidance and management of flight crew error. Other ways to avoid and m anage flight crew error are regulated through requirements governing licensing and qualification of flight - crew members and aircraft operations. Taken together, these complementary approaches provide a high degree of safety.

The complementary approach is i mportant. It is based upon recognition that equipment design, training/licensing/ qualification, and operations/procedures each provide safety contributions to risk mitigation. An appropriate balance is needed among them. There have been cases in the past where design characteristics known to contribute to flight crew error were accepted based upon the rationale that training or procedures would mitigate that risk. We now know that this can often be an inappropriate approach.

Similarly, due to unintended co nsequences, it would not be appropriate to require equipment design to provide total risk mitigation. If a flight - crew member misunderstands a controller's clearance, it does not follow that the Agency should mandate datalink or some other design solution as Certification Specifications. Operating rules currently require equipment to provide some error mitigations (e.g., Terrain Awareness and Warning Systems), but not as part of the airworthiness requirements.

As stated, a proper balance is needed among de sign approval requirements in the minimum airworthiness standards of CS - 25 and requirements for training/ licensing/ qualification and operations/procedures. CS 25.1302 and this AMC were developed with the intent o f achieving that appropriate balance.

Introduction The introductory sentence of CS 25.1302 states that the provisions of this paragraph apply to each item of installed equipment intended for the flight crew’s use in operating the aeroplane from their normally seated positions on the flight deck.

“Intended for the flight - crew member’s use in the operation of the aeroplane from their normally seated position,” means that intended function of the installed equipment i ncludes use by the flight crew in operating the aeroplane. An example of such installed equipment would be a display that provides information enabling the flight crew to navigate. The phrase “flight - crew members” is intended to include any or all individu als comprising the minimum flight crew as determined for compliance with CS 25.1523 . The phrase “from their normally seated position” means flight - crew members are seated at their normal duty stations for operating the aeroplane. This phrase is intended to limit the scope of this requirement so that it does not address systems or equipment not used Powered by EASA eRules Page 788 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL while performing their duties in operating the aeroplane in normal and non - normal conditions. For example, this paragraph is not intended to apply to items such as certain circuit breakers or maintenance controls intended for use by the maintenance crew (or by the flight crew when not operating the aeroplane).

The words “This installed equipment must be shown…” in the first paragraph means the applicant must provi de sufficient evidence to support compliance determinations for each of the CS 25.1302 requirements. This is not intended to require a showing of compliance beyond that required by Part 21A.21(b). Accordingly, for simple items or items similar to previously approved equipment and installations, we do not expect the demonstrations, tests or data needed to show compliance with CS 25.1302 to entail more extensive or onerous eff orts than are necessary to show compliance with previous requirements.

The phrase “individually and in combination with other such equipment” means that the requirements of this paragraph must be met when equipment is installed on the flight deck with ot her equipment. The installed equipment must not prevent other equipment from complying with these requirements. For example, applicants must not design a display so that information it provides is inconsistent or in conflict with information from other ins talled equipment.

In addition, provisions of this paragraph presume a qualified flight crew trained to use the installed equipment. This means the design must meet these requirements for flight - crew members who are allowed to fly the aeroplane by meeting o perating rules qualification requirements. If the applicant seeks type design or supplemental type design approval before a training programme is accepted, the applicant should document any novel, complex, or highly integrated design features and assumptio ns made during design that have the potential to affect training time or flight crew procedures. The requirement and associated material are written assuming that either these design features and assumptions, or knowledge of a training programme (proposed or in the process of being developed) will be coordinated with the appropriate operational approval organisation when judging the adequacy of the design.

The requirement that equipment be designed so the flight crew can safely perform tasks associated with the equipment’s intended function, applies in both normal and non - normal conditions. Tasks intended for performance under non - normal conditions are generally those prescribed by non - normal (including emergency) flight crew procedures.

The phrase “safely p erform their tasks” is intended to describe one of the safety objectives of this requirement. The requirement is that equipment design enables the flight crew to perform the tasks with sufficient accuracy and in a timely manner, without unduly interfering with other required tasks. The phrase “tasks associated with its intended function” is intended to characterise either tasks required to operate the equipment or tasks for which the equipment’s intended function provides support.

CS 25.1302(a) requires the applicant to install appropriate controls and provide necessary information for any flight deck equipment identified in the first paragraph of CS 25.1302 .

Controls and information displays must be suf ficient to allow the flight crew to accomplish their tasks. Although this may seem obvious, this requirement is included because a review of CS - 25 on the subject of human factors revealed that a specific requirement for flight deck controls and information to meet the needs of the flight crew is necessary. This requirement is not reflected in other parts of the rules, so it is important to be explicit.

Powered by EASA eRules Page 789 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL CS 25.1302(b) addresses requirements for flight deck controls a nd information that are necessary and appropriate so the flight crew can accomplish their tasks, as determined through (a) above. The intent is to ensure that the design of the control and information devices makes them usable by the flight crew. This sub - paragraph seeks to reduce design - induced flight crew errors by imposing design requirements on flight deck information presentation and controls. Sub - paragraphs (1) through (3) specify these design requirements.

Design requirements for information and cont rols are necessary to: — Properly support the flight crew in planning their tasks, — Make available to the flight crew appropriate, effective means to carry - out planned actions, — Enable the flight crew to have appropriate feedback information about the effects of their actions on the aeroplane.

CS 25.1302(b)(1) specifically requires that controls and information be provided in a clear and unambiguous form, at a resolution and precision appropriate to the task. As applie d to information, “clear and unambiguous” means that it: — Can be perceived correctly (is legible).

— Can be comprehended in the context of the flight crew task.

— Supports the flight crew’s ability to carry out the action intended to perform the tasks.

For controls, the requirement for “clear and unambiguous” presentation means that the crew must be able to use them appropriately to achieve the intended function of the equipment. The general intent is to foster design of equipment controls whose operation is intuitive, consistent with the effects on the parameters or states they affect, and compatible with operation of other controls on the flight deck.

Sub - paragraph CS 25.1302(b)(1) also requires that the information or control be provided, or operate, at a level of detail and accuracy appropriate to accomplishing the task. Insufficient resolution or precision would mean the flight crew could not perform the task adequately. Conversely, excessive resolution has the po tential to make a task too difficult because of poor readability or the implication that the task should be accomplished more precisely than is actually necessary.

CS 25.1302(b)(2) requires that controls and inform ation be accessible and usable by the flight crew in a manner consistent with the urgency, frequency, and duration of their tasks. For example, controls used more frequently or urgently must be readily accessed, or require fewer steps or actions to perform the task. Less accessible controls may be acceptable if they are needed less frequently or urgently. Controls used less frequently or urgently should not interfere with those used more urgently or frequently. Similarly, tasks requiring a longer time for i nteraction should not interfere with accessibility to information required for urgent or frequent tasks.

CS 25.1302(b)(3) requires that equipment presents information advising the flight crew of the effects of their actions on the aeroplane or systems, if that awareness is required for safe operation. The intent is that the flight crew be aware of system or aeroplane states r esulting from flight crew actions, permitting them to detect and correct their own errors.

Powered by EASA eRules Page 790 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL This sub - paragraph is included because new technology enables new kinds of flight crew interfaces that previous requirements don’t address. Specific deficiencies of existing requirements in addressing human factors are described below: — CS 25.771(a) addresses this topic for controls, but does not include criteria for information presentation.

— CS 25.777(a) addresses controls, but only their location.

— CS 25.777(b) and CS 25.779 address direction of motion and actuation but do not encompass new types of con trols such as cursor devices. These requirements also do not encompass types of control interfaces that can be incorporated into displays via menus, for example, thus affecting their accessibility.

— CS 25.1523 and C S - 25 Appendix D have a different context and purpose (determining minimum crew), so they do not address these requirements in a sufficiently general way.

CS 25.1302(c) requires that installed equipment be designed so its behaviour that is operationally relevant to flight crew’ tasks is: — Predictable and unambiguous.

— Designed to enable the flight crew to intervene in a manner appropriate to the task (and intended function).

Improved flight deck technologies involving integrated and complex information and control systems, have increased safety and performance. However, they have also introduced the need to ensure proper interaction between the flight crew and those systems. Service experience has found that some equipm ent behaviour (especially from automated systems) is excessively complex or dependent upon logical states or mode transitions that are not well understood or expected by the flight crew. Such design characteristics can confuse the flight crew and have been determined to contribute to incidents and accidents.

The phrase “operationally - relevant behaviour” is meant to convey the net effect of the equipment’s system logic, controls, and displayed information upon flight crew awareness or perception of the syste m’s operation to the extent that this is necessary for planning actions or operating the system. The intent is to distinguish such system behaviour from the functional logic within the system design, much of which the flight crew does not know or need to k now and which should be transparent to them.

CS 25.1302(c)(1) requires that system behaviour be such that a qualified flight crew can know what the system is doing and why. It requires that operationally relevant s ystem behaviour be “predictable and unambiguous”. This means that a crew can retain enough information about what their action or a changing situation will cause the system to do under foreseeable circumstances, that they can operate the system safely. Sys tem behaviour must be unambiguous because crew actions may have different effects on the aeroplane depending on its current state or operational circumstances.

CS 25.1302(c)(2) requires that the design be such tha t the flight crew will be able to take some action, or change or alter an input to the system in a manner appropriate to the task.

CS 25.1302(d) addresses the reality that even well - trained, proficient flight crews using well - designed systems will make errors. It requires that equipment be designed to enable the flight crew to manage such errors. For the purpose of this rule, errors “resulting from Powered by EASA eRules Page 791 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL flight crew interaction with the equipment” are those errors in some way attributable to, or related to, design of the controls, behaviour of the equipment, or the information presented. Examples of designs or information that could cause errors are indic ations and controls that are complex and inconsistent with each other or other systems on the flight deck. Another example is a procedure inconsistent with the design of the equipment.

Such errors are considered to be within the scope of this requirement a nd AMC.

What is meant by design which enables the flight crew to “manage errors” is that: — The flight crew must be able to detect and/or recover from errors resulting from their interaction with the equipment, or — Effects of such flight crew errors on the a eroplane functions or capabilities must be evident to the flight crew and continued safe flight and landing must be possible, or — Flight crew errors must be discouraged by switch guards, interlocks, confirmation actions, or other effective means, or — Effect s of errors must be precluded by system logic or redundant, robust, or fault tolerant system design.

The requirement to manage errors applies to those errors that can be reasonably expected in service from qualified and trained flight crews. The term “reas onably expected in service” means errors that have occurred in service with similar or comparable equipment. It also means error that can be projected to occur based on general experience and knowledge of human performance capabilities and limitations rela ted to use of the type of controls, information, or system logic being assessed.

CS 25.1302(d) includes the following statement: “This sub - paragraph does not apply to skill - related errors associated with manual con trol of the aeroplane”. That statement means to exclude errors resulting from flight crew proficiency in control of flight path and attitude with the primary roll, pitch, yaw and thrust controls, and which are related to design of the flight control system s. These issues are considered to be adequately addressed by existing requirements, such as CS - 25 Subpart B and CS 25.671(a) . It is not intended that design be required to compensate for deficiencies in flight crew training or experience. This assumes at least the minimum flight crew requirements for the intended operation, as discussed at the beginning of Paragraph 5.1 above.

This requirement is intended to exclude management of errors resulting from decisions, ac ts, or omissions by the flight crew that are not in good faith. It is intended to avoid imposing requirements on the design to accommodate errors committed with malicious or purely contrary intent. CS 25.1302 is no t intended to require applicants to consider errors resulting from acts of violence or threats of violence.

This “good faith” exclusion is also intended to avoid imposing requirements on design to accommodate errors due to obvious disregard for safety by a flight - crew member.

However, it is recognised that errors committed intentionally may still be in good faith but could be influenced by design characteristics under certain circumstances. An example would be a poorly designed procedure not compatible with the controls or information provided to the flight crew.

The intent of requiring errors to be manageable only “to the extent practicable” is to address both economic and operational practicability. It is meant to avoid imposing requirements without consi dering economic feasibility and commensurate safety benefits. It is also meant to address operational practicability, such as the need to avoid Powered by EASA eRules Page 792 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL introducing error management features into the design that would inappropriately impede flight crew actions or d ecisions in normal or non - normal conditions. For example, it is not intended to require so many guards or interlocks on the means to shut down an engine that the flight crew would be unable to do this reliably within the available time.

Similarly, it is no t intended to reduce the authority or means for the flight crew to intervene or carry out an action when it is their responsibility to do so using their best judgment in good faith.

This sub - paragraph was included because managing errors that result from f light crew interaction with equipment (that can be reasonably expected in service), is an important safety objective. Even though the scope of applicability of this material is limited to errors for which there is a contribution from or relationship to des ign, CS 25.1302(d) is expected to result in design changes that will contribute to safety. One example, among others, would be the use of an "undo" functions in certain designs.

5.2 Intended Function and Associated Flight Crew Tasks CS 25.1301(a) requires that: “each item of installed equipment must - (a) Be of a kind and design appropriate to its intended function”. C S 25.1302 establishes requirements to ensure the design supports flight - crew member’s ability to perform tasks associated with a system’s intended function. In order to show compliance with CS 25.1302 , the intended function of a system and the tasks expected of the flight crew must be known.

An applicant’s statement of intended function must be sufficiently specific and detailed that the Agency can evaluate whether the system is appropriate for the intended function(s) and the associated flight crew tasks. For example, a statement that a new display system is intended to “enhance situation awareness” must be further explained.

A wide variety of different displays enhance situation awareness in different ways.

Examples are; terrain awareness, vertical profile, and even the primary flight displays).

The applicant may need more detailed descriptions for designs with greater levels of novelty, complexity or integration.

An applicant should describe intended functi on(s) and associated task(s) for: — Each item of flight deck equipment, — Flight crew indications and controls for that equipment, — Individual features or functions of that equipment.

This type of information is of the level typically provided in a pilot handbo ok or an operations manual. It would describe indications, controls, and flight crew procedures.

As discussed in paragraph 4, novel features may require more detail, while previously approved systems and features typically require less. Paragraph 4.1 discu sses functions that are sufficiently novel that additional scrutiny is required. Applicants may evaluate whether statements of intended function(s) and associated task(s) are sufficiently specific and detailed by using the following questions: — Does each feature and function have a stated intent?

— Are flight crew tasks associated with the function described?

— What assessments, decisions, and actions are flight - crew members expected to make based on information provided by the system?

— What other informati on is assumed to be used in combination with the system?

Powered by EASA eRules Page 793 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL — Will installation or use of the system interfere with the ability of the flight crew to operate other flight deck systems?

— Are there any assumptions made about the operational environment in which t he equipment will be used?

— What assumptions are made about flight crew attributes or abilities beyond those required in regulations governing flight operations, training, or qualification?

5.3 Controls 5.3.1 Introduction For purposes of this AMC, we defi ne controls as devices the flight crew manipulates in order to operate, configure, and manage the aeroplane and its flight control surfaces, systems, and other equipment. This may include equipment in the flight deck such as; — Buttons — Switches — Knobs — Keyboa rds — Keypads — Touch screens — Cursor control devices — Graphical user interfaces, such as pop - up windows and pull - down menus that provide control functions — Voice activated controls 5.3.2 Showing Compliance with CS 25.1302(b) Applicants should propose means of compliance to show that controls in the proposed design comply with CS 25.1302(b) . The proposed means should be sufficiently detailed to demonstrate that each function, method of control operation, and result of control actuation complies with the requirements, i.e.: — Clear — Unambiguous — Appropriate in resolution and precision — Accessible — Usable — Enables flight crew awareness (provides adequate feedback) For each of these requirements, the proposed means of compliance should include consideration of the following control characteristics for each control individually and in relation to other controls: — Physical location of the control — Physical characteristics of the control (e.g., shape, dimensions, surface texture, range of motion, colour) Powered by EASA eRules Page 794 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPAR T F – EQUIPMENT (CS - 25) GENERAL — Equipment or system(s) that the control directly affects — How the control is labelled — Available control settings — Effect of each possi ble actuation or setting, as a function of initial control setting or other conditions — Whether there are other controls that can produce the same effect (or affect the same target parameter) and conditions under which this will happen — Location and nature o f control actuation feedback The following discussion provides additional guidance for design of controls that comply with CS 25.1302 . It also provides industry accepted best practices.

5.3.3 Clear and Unambiguous Presentation of Control Related Information a. Distinguishable and Predictable Controls [ CS 25.1301(a) , CS 25.1302 ] Each flight - crew member should be able to identify and select the current function of the control with speed and accuracy appropriate to the task.

Function of a control should be readily apparent so that little or no familiarisation is required. The applicant should evaluate consequences of control activation to show they are predictable and obvious to each flight - crew member. This includes control of multiple displays with a single device and shared display areas that flight - crew members access with individual controls. Controls can be made distinguishable or predictable by differences in form, colour, location, and/or labelling. Colour coding is usually not sufficient as a sole distinguishing feature. This applies to physical controls as well as to controls that are part of an interactive graphical user inter face.

b. Labelling [ CS 25.1301(a) , CS 25.1543(b) , CS 25.1555(a) ] For general marking of controls see CS 25.1555(a) . Labels should be readable from the crewmember’s normally seated position in all lighting and environmental conditions. If a control performs more than one function, labelling should include all intended functions unless function of the control is obvious. Labels of graphical controls accessed by a cursor device such as a trackball should be included on the graphical display. When menus lead to additional choices (submenus), the menu label should provide a reasonable description o f the next submenu.

The applicant can label with text or icons. Text and icons should be shown to be distinct and meaningful for the function that they label. The applicant should use standard and/or non - ambiguous abbreviations, nomenclature, or icons, consistent within a function and across the flight deck. ICAO 8400 provides standard abbreviations and is an acceptable basis for selection of labels.

The design should avoid hidden functions (such as clicking on empty space on a display to make som ething happen), However, such hidden functions may be acceptable if adequate alternate means are available for accessing the function. The design should still be evaluated for ease of use and crew understanding.

Powered by EASA eRules Page 795 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL When using icons instead of text labelling, the applicant should show that the flight crew requires only brief exposure to the icon to determine the function of a control and how it operates. Based on design experience, the following guidelines for icons have been shown to lead to usable designs: — T he icon should be analogous to the object it represents — The icon should be in general use in aviation and well known to flight crews — The icon should be based on established standards, when they exist, and conventional meanings.

In all cases, the applicant should show use of icons to be at least equivalent to text labels in terms of speed and error rate. Alternatively, the applicant should show that the increased error rate or task times have no unacceptable effect on safety or flight crew workload and do not cause flight crew confusion.

c. Interaction of Multiple Controls [ CS 25.1302 ] If multiple controls for the flight crew are provided for a function, the applicant should show that there is sufficient inf ormation to make the flight crew aware of which control is currently functioning. As an example, crewmembers need to know which flight - crew member’s input has priority when two cursor control devices can access the same display. Designers should use cautio n when dual controls can affect the same parameter simultaneously.

5.3.4 Accessibility of controls [ CS 25.771(a) , CS 25.777(b) , CS 25.1302 ] The applicant must show that each flight - crew member in the minimum flight crew, as defined by CS 25.1523 , has access to and can operate all necessary controls. Accessibility is one factor in determining whether controls support the intended func tion of equipment used by the flight crew. Any control required for flight - crew member operation in the event of incapacitation of other flight - crew members (in both normal and non - normal conditions) must be shown to be viewable, reachable, and operable by flight - crew members with the stature specified in CS 25.777(c) , from the seated position with shoulder restraints on. If shoulder restraints are lockable, this may be shown with shoulder restraints unlocked.

CS 25.777(c) requires that the location and arrangement of each flight deck control permit full and unrestricted movement of that control without interference from other controls, equipment, or structure in the flight d eck.

Layering of information, as with menus or multiple displays, should not hinder flight crew in identifying the location of the desired control. In this context, location and accessibility are not only the physical location of the control function (on a display device) or any multifunction control (for example,, a cursor control device) used to access them. Location and accessibility also includes consideration of where the control functions may be located within various menu layers and how the flight - cr ew member navigates those layers to access the functions. Accessibility should be shown in conditions of system failures (including crew incapacitation) and minimum equipment list dispatch.

Powered by EASA eRules Page 796 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Control position and direction of motion should be oriented from t he vantage point of the flight - crew member. Control/display compatibility should be maintained from that regard. For example, a control on an overhead panel requires movement of the flight - crew member’s head backwards and orientation of the control movemen t should take this into consideration.

5.3.5 Use of controls a. Environmental issues affecting controls [ CS 25.1301(a) and CS 25.1302 ] Turbulence or vibration and extremes in lighting levels should not prevent the crew from performing all their tasks at an acceptable level o f performance and workload. If use of gloves is anticipated for cold weather operations, the design should account for the effect of their use o n the size and precision of controls. Sensitivity of controls should afford precision sufficient to perform tasks even in adverse environments as defined for the aeroplane’s operational envelope. Analysis of environmental issues as a means of compliance (s ee 6.3.3) is necessary, but not sufficient for new control types or technologies or for novel use of controls that are themselves not new or novel.

The applicant should show that controls required to regain aeroplane or system control and controls require d to continue operating the aeroplane in a safe manner are usable in conditions such as dense smoke in the flight deck or severe vibrations. An example of the latter condition would be after a fan blade loss.

b. Control - display compatibility [ CS 25.777(b) ] To ensure that a control is unambiguous, the relationship and interaction between a control and its associated display or indications should be readily apparent, understandable, and logical. A control input is oft en required in response to information on a display or to change a parameter setting on a display. The applicant should specifically asses any rotary knob that has no obvious “increase” or “decrease” function with regard to flight crew expectations and its consistency with other controls on the flight deck. The Society of Automotive Engineers’ (SAE) publication ARP 4102, section 5.3, is an acceptable means of compliance for controls used in flight deck equipment.

When a control is used to move an actuator t hrough its range of travel, the equipment should provide, within the time required for the relevant task, operationally significant feedback of the actuator’s position within its range.

Examples of information that could appear relative to an actuator’s ra nge of travel include trim system positions, target speed, and the state of various systems valves.

Controls associated with a display should be located so that they do not interfere with the performance of the crew task. Controls whose function is specifi c to a particular display surface should be mounted near to the display or function being controlled. Locating controls immediately below a display is generally preferable as mounting controls immediately above a display has, in many cases, caused the flig ht - crew member’s hand to obscure viewing of the display when operating controls. However, controls on the bezel of multifunction displays have been found to be acceptable.

Powered by EASA eRules Page 797 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Spatial separation between a control and its display may be necessary. This is the c ase with a system’s control located with others for that same system, or when it is one of several controls on a panel dedicated to controls for that multifunction display. When there is large spatial separation between a control and its associated display , the applicant should show that use of the control for the associated task(s), is acceptable in terms of types of errors, error rate(s) and access time(s).

In general, control design and placement should avoid the possibility that the visibility of inform ation could be blocked. If range of control movement temporarily blocks the flight crew’s view of information, the applicant should show that this information is either not necessary at that time or available in another accessible location.

Annunciations/ labels on electronic displays should be identical to labels on related switches and buttons located elsewhere on the flight deck. If display labels are not identical to related controls, the applicant should show that flight - crew members can quickly, easil y, and accurately identify associated controls.

5.3.6 Adequacy of Feedback [ CS 25.771(a) , CS 25.1301(a) , CS 25.1302 )] Feedback for control inputs is necessary to give the flight crew awareness of the effects of their actions. Each control should provide feedback to the crewmember for menu selections, data entries, contr ol actions, or other inputs. There should be clear and unambiguous indication when crew input is not accepted or followed by the system. This feedback can be visual, auditory, or tactile. Feedback, in whatever form, should be provided to inform the crew th at: — A control has been activated (commanded state/value) — The function is in process (given an extended processing time) — The action associated with the control has been initiated (actual state/value if different from the commanded state).

The type, duration and appropriateness of feedback, will depend upon the crew’s task and the specific information required for successful operation. As an example, switch position alone is insufficient feedback if awareness of actual system response or the state of the syst em as a result of an action is required.

Controls that may be used while the user is looking outside or at unrelated displays should provide tactile feedback. Keypads should provide tactile feedback for any key depression. In cases when this is omitted, it should be replaced with appropriate visual or other feedback that the system has received the inputs and is responding as expected.

Equipment should provide appropriate visual feedback, not only for knob, switch, and pushbutton position, but also for grap hical control methods such as pull - down menus and pop - up windows. The user interacting with a graphical control should receive positive indication that a hierarchical menu item has been selected, a graphical button has been activated, or other input has be en accepted.

The applicant should show that feedback in all forms is obvious and unambiguous to the flight crew in performance of the tasks associated with the intended function of the equipment.

Powered by EASA eRules Page 798 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 5.4 Presentation of Information 5.4.1 Introduction Applicant s should propose means of compliance to show that information displayed in the proposed design complies with CS 25.1302(b) . The proposed means should be sufficiently detailed to show that the function, method of co ntrol operation and result, complies with the requirements, i.e.: — Clear — Unambiguous — Appropriate in resolution and precision — Accessible — Usable — Enables Flight Crew awareness (provides adequate feedback) Presentation of information to the flight crew can be visual (for i nstance, on an LCD), auditory ( a “talking” checklist) or tactile (for example, control feel).

Information presentation on the integrated flight deck, regardless of the medium used, should meet all of the requirements bulleted above. For visual displays, this AMC addresses mainly display format issues and not display hardware characteristics. The following provides design considerations for requirements found in CS 25.1301(a) , CS 25.1301(b) , CS 25.1302 , and CS 25.1543(b) . In the event of a conflict between this document and AMC 25 - 11 regarding guidance on specific electronic visual display functions, AMC 25 - 11 takes precedence.

5.4.2 Clear and Unambiguous Presentation of Information a. Qualitative and quantitative display formats [ CS 25.1301(a) and C S 25.1302 ] Applicants should show that display formats include the type of information the flight crew needs for the task, specifically with regard to the speed and precision of reading required. For example, the information could be in the form of a text message, numerical value, or a graphical representation of state or rate information). State information identifies the specific value of a parameter at a particular time. Rate information indicates the rate of change of that parameter.

If the flight crew ’s sole means of detecting non - normal values is by monitoring values presented on the display, the equipment should offer qualitative display formats. Qualitative display formats better convey rate and trend information. If this is not practical, the appli cant should show that the flight crew can perform the tasks for which the information is used. Quantitative presentation of information is better for tasks requiring precise values.

Digital readouts or present value indices incorporated into qualitative di splays should not make the scale markings or graduations unusable as they pass the present value index.

b. Consistency [ CS 25.1302 ] If similar information is presented in multiple locations or modes (visual and aud itory, for example), consistent presentation of information is desirable.

Consistency in information presentation within the system tends to minimise flight crew error. If information cannot be presented consistently within the flight deck, Powered by EASA eRules Page 799 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL the applicant s hould show that differences do not increase error rates or task times leading to significant safety or flight crew workload and do not cause flight crew confusion.

c. Characters, fonts, lines and scale markings [ CS 25.1301(a) and CS 25.1543(b) ] The applicable crew members, seated at their stations and using normal head movement, should be able to see and read display format features such as fonts, symbols, icons and markings. In some cases, cross flight deck readability may be required. Examples of situations where this might be needed are cases of display failure or when cross checking flight instruments. Readability must be maintained in sunlight viewing conditions (per CS 25.773(a)) and under other adverse conditions such as vibration. Figures and letters should subtend not less than the visual angles defined in SAE ARP 4102 - 7 at the design eye position of the flight - crew m ember who normally uses the information.

d. Colour [ CS 25.1302 ] Avoid using many different colours to convey meaning on displays. However, judicious use of colour can be very effective in minimising display interpr etation workload and response time. Colour can be used to group logical electronic display functions or data types. A common colour philosophy across the flight deck is desirable, although deviations may be approved with acceptable justification.

Applicant s should show that the chosen colour set is not susceptible to confusion or misinterpretation due to differences in colour usage between displays. Improper colour coding increases response times for display item recognition and selection, and increases lik elihood of errors in situations where the speed of performing a task is more important than accuracy. Extensive use of the colours red and amber for other than alerting functions or potentially unsafe conditions is discouraged.

Such use diminishes the atte ntion - getting characteristics of true warnings and cautions.

Use of colour as the sole means of presenting information is also discouraged. It may be acceptable however, to indicate the criticality of the information in relation to the task. Colour, when u sed for task essential information, should be in addition to other coding characteristics, such as texture or differences in luminance.

AMC 25 - 11 contains recommended colour sets for specific display features.

Appl icants should show that layering information on a display does not add to confusion and clutter as a result of the colour standards and symbols used. Designs requiring flight - crew members to manually de - clutter such displays should also be avoided.

e. Symb ology, Text, and Auditory Messages [ CS 25.1302 ] Designs can base many elements of electronic display formats on established standards and conventional meanings. For example, ICAO 8400 provides abbreviations and is one standard that could be applied to flight deck text. SAE ARP 4102 - 7, Appendix A - C and SAE ARP 5289 are acceptable standards for avionic display symbols.

The position of a message or symbol within a display also conveys meaning to the flight - crew member. Without the consistent or repeatable location of a symbol in a specific area of the electronic display, interpretation errors and response times may increase. Applicants should give careful attention to symbol priority (priority Powered by EASA eRules Page 800 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL of displaying one symbol o verlaying another symbol by editing out the secondary symbol) to ensure that higher priority symbols remain viewable.

New symbols (a new design or a new symbol for a function which historically had an associated symbol) should be tested for distinguishabil ity and flight crew comprehension and retention.

The applicant should show that display text and auditory messages are distinct and meaningful for the information presented. Assess messages for whether they convey the intended meaning. Equipment should dis play standard and/or non - ambiguous abbreviations and nomenclature, consistent within a function and across the flight deck.

5.4.3 Accessibility and Usability of Information a. Accessibility of information [ CS 25.13 02 ] Some information may at certain times be immediately needed by the flight crew, while other information may not be necessary during all phases of flight. The applicant should show that the flight crew can access and manage (configure) all necessary inf ormation on the dedicated and multifunction displays for the phase of flight. The applicant should show that any information required for continued safe flight and landing is accessible in the relevant degraded display modes following failures as defined b y CS 25.1309 . The applicant should specifically assess what information is necessary in those conditions, and how such information will be simultaneously displayed. The applicant should also show that supplemental information does not displace or otherwise interfere with required information.

Analysis as the sole means of compliance is not sufficient for new or novel display management schemes. The applicant should use simulation of typical operational scenarios to validate the flight crew’s ability to mana ge available information.

b. Clutter [ CS 25.1302 ] Clutter is the presentation of information in a way that distracts flight - crew members from their primary task. Visual or auditory clutter is undesirable. To reduce flight - crew member’s interpretation time, equipment should present information simply and in a well - ordered way. Applicants should show that an information delivery method (whether visual or auditory) presents the information the fli ght - crew member actually requires to perform the task at hand. The flight crew can use their own discretion to limit the amount of information that needs to be presented at any point in time. For instance, a design might allow the flight crew to program a system so that it displays the most important information all the time, and less important information on request. When a design allows, flight crew selection of additional information, the basic display modes should remain uncluttered.

Automatically de - cl uttering display options can hide needed information from the flight - crew member. The applicant should show that equipment that uses automatic de - selection of data to enhance the flight - crew member’s performance in certain emergency conditions provides th e information the flight - crew member requires. Use of part - time displays depends not only on information de - clutter goals but also on display availability and criticality. Therefore, when designing such features, the applicant should follow the guidance i n AMC 25 - 11 .

Powered by EASA eRules Page 801 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Because of the transient nature of auditory information presentation, designers should be careful to avoid the potential for competing auditory presentations that may conflict with each other and hinde r interpretation. Prioritisation and timing may be useful to avoid this potential problem.

Prioritise information according to task criticality. Lower priority information should not mask higher priority information and higher priority information should b e available, readily detectable, easily distinguishable and usable. This does not mean that the display format needs to change based on phase of flight.

c. System response to control input [ CS 25.1302 ] Long or vari able response times between control input and system response can adversely affect system usability. The applicant should show that response to control input, such as setting values, displaying parameters, or moving a cursor symbol on a graphical display i s fast enough to allow the flight crew to complete the task at an acceptable performance level. For actions requiring noticeable system processing time equipment should indicate that system response is pending.

5.5 System Behaviour 5.5.1 Introduction Flig ht crew task demands vary depending on the characteristics of the system design. Systems differ in their responses to relevant flight crew input. The response can be direct and unique as in mechanical systems or it can vary as a function of an intervening subsystem (such as hydraulics or electrics). Some systems even automatically vary their response to capture or maintain a desired aeroplane or system state.

As described in paragraph 5.1, CS 25.1302(c) states that installed equipment must be designed so that the behaviour of the equipment that is operationally relevant to the flight crew’s tasks is: (1) predictable and unambiguous, and (2) designed to enable the flight crew to intervene in a manner appropriate to th e task (and intended function).

The requirement for operationally relevant system behaviour to be predictable and unambiguous will enable a qualified flight crew to know what the system is doing and why. This means that a crew should have enough informatio n about what the system will do under foreseeable circumstances as a result of their action or a changing situation that they can operate the system safely. This distinguishes system behaviour from the functional logic within the system design, much of whi ch the flight crew does not know or need to know.

If flight crew intervention is part of the intended function or non - normal procedures for the system, the crewmember may need to take some action, or change an input to the system. The system must be desig ned accordingly. The requirement for flight crew intervention capabilities recognises this reality.

Improved technologies, which have increased safety and performance, have also introduced the need to ensure proper cooperation between the flight crew and the integrated, complex information and control systems. If system behaviour is not understood or expected by the flight crew, confusion may result.

Powered by EASA eRules Page 802 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Some automated systems involve tasks that require flight crew attention for effective and safe performa nce. Examples include the flight management system (FMS) or flight guidance systems. Alternatively, systems designed to operate autonomously, in the sense that they require very limited or no human interaction, are referred to as 'automatic systems'. Such systems are switched 'on' or 'off 'or run automatically and are not covered in this paragraph. Examples include fly - by - wire systems, full authority digital engine controls (FADEC), and yaw dampers.

Detailed specific guidance for automatic systems can be fo und in relevant parts of CS - 25.

Service experience shows that automated system behaviour that is excessively complex or dependent on logical states, or mode transitions are not understood or expected by the flight crew can lead to flight crew confusion. De sign characteristics such as these have been determined to contribute to incidents and accidents.

This sub - paragraph provides guidance material for showing compliance with these design considerations for requirements found in CS 25.1302(c) , CS 25.1301(a) , CS 25.1309 (c) , or any other relevant paragraphs of CS - 25.

5.5.2 System Function Allocation The applicant should show that functions of the proposed design are allocated so that: — The flight crew can be expected to complete their allocated tasks successfully in both normal and non - normal operational conditions, within the bounds of acceptable workload and without requiring undue concentration or causing undue fatigue. (See CS 25.1523 and CS - 25 Appendix D for workload evaluation); — Flight crew interaction with the system enables them to understand the situation, and enables timely detection of failures and crew intervention when appropriate; — Task sharing and distribution of tasks among flight - crew members and the system during normal and non - normal operations is considered.

5.5.3 System Functional Behaviour A system’s behaviour results from the interaction between the flight crew and the automated system and i s determined by: — The system’s functions and the logic that governs its operation; and — The user interface, which consists of the controls and information displays that communicate the flight crew’s inputs to the system and provide feedback on system behavio ur to the crew.

It is important that the design reflect a consideration of both of these together.

This will avoid a design in which the functional logic governing system behaviour can have an unacceptable effect on crew performance. Examples of system fun ctional logic and behaviour issues that may be associated with errors and other difficulties for the flight crew are the following: — Complexity of the flight crew interface for both inputs (entering data) and outputs.

Powered by EASA eRules Page 803 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQ UIPMENT (CS - 25) GENERAL — Inadequate understanding and inaccurate expectations of system behaviour by the flight crew following mode selections and transitions.

Inadequate understanding and incorrect expectations by the flight crew of system intentions and behaviour.

Predictable and Unambiguous System Behaviour ( CS 25.1302(c)(1) ) Applicants should propose the means they will use to show that system or system mode behaviour in the proposed design is predictable and unambiguous to the flight crew.

System or system mode behaviour th at is ambiguous or unpredictable to the flight crew has been found to cause or contribute to flight crew errors. It can also potentially degrade the flight crew’s ability to perform their tasks in both normal and non - normal conditions. Certain design chara cteristics have been found to minimise flight crew errors and other crew performance problems.

The following design considerations are applicable to operationally relevant system or system mode behaviours: — Simplicity of design (for example, number of modes , mode transitions).

— Clear and unambiguous mode annunciation. For example, a mode engagement or arming selection by the flight crew should result in annunciation, indication or display feedback adequate to provide awareness of the effect of their action.

— A ccessible and usable methods of mode arming, engagement and de - selection. For example, the control action necessary to arm, engage, disarm or disengage a mode should not depend on the mode that is currently armed or engaged, on the setting of one or more o ther controls, or on the state or status of that or another system.

— Predictable un - commanded mode change and reversions. For example, there should be sufficient annunciation, indication or display information to provide awareness of uncommanded changes of the engaged or armed mode of a system.

Note that formal descriptions of modes typically define them as mutually exclusive, so that a system cannot be in more than one mode at a particular time. For instance, a display can be in “north up” mode or “track up ” mode, but not both at the same time.

For specific guidance on flight guidance system modes, see AMC 25.1329 .

Flight Crew Intervention ( CS 25.1302(c)(2) ) Applicants should propose the means that they will use to show that system behaviour in the proposed design allows the flight crew to intervene in operation of the system without compromising safety. This should include descriptions of how they will determ ine that functions and conditions in which intervention should be possible have been addressed.

If done by analysis, the completeness of the analysis may be established either by defining acceptable criteria for the depth and breadth of the analysis, or by proposing an analysis method that is inherently complete. In addition, applicant’s Powered by EASA eRules Page 804 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL proposed methods should describe how they would determine that each intervention means is appropriate to the task.

Controls for Automated Systems Automated systems can pe rform various tasks selected by and under supervision of the flight crew. Controls should be provided for managing functionalities of such a system or set of systems. The design of such “automation specific” controls should enable the crew to: — Safely prepa re the system for the task to be executed or the subsequent task to be executed. Preparation of a new task (for example, new flight trajectory) should not interfere with, or be confused with, the task being executed by the automated system.

— Activate the appropriate system function without confusion about what is being controlled, in accordance with crew expectations. For example, the flight crew should have no confusion when using a vertical speed selector which could set either vertical speed or flight p ath angle.

— Manually intervene in any system function, as required by operational conditions, or to revert to manual control. For example, manual intervention might be needed during loss of system functionality, system abnormalities, or failure conditions.

Displays for Automated Systems Automated systems can perform various tasks with minimal crew interventions, but under the supervision of the flight crew. To ensure effective supervision and maintain crew awareness of system state and system “intention” (fu ture states), displays should provide recognisable feedback on: — Entries made by the crew into the system so that the crew can detect and correct errors.

— Present state of the automated system or mode of operation. (What is it doing?)

— Actions taken by the sy stem to achieve or maintain a desired state. (What is it trying to do?)

— Future states scheduled by the automation. (What is it going to do next?)

— Transitions between system states.

The applicant should consider the following aspects of automated system des ign: — Indications of commanded and actual values should enable the flight crew to determine whether the automated systems will perform according to their expectations; — If the automated system nears its operational authority or is operating abnormally for th e conditions, or is unable to perform at the selected level, it should inform the flight crew, as appropriate for the task; — The automated system should support crew coordination and cooperation by ensuring shared awareness of system status and crew inputs to the system; and Powered by EASA eRules Page 805 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL — The automated system should enable the flight crew to review and confirm the accuracy of commands constructed before being activated. This is particularly important for automated systems because they can require complex input tasks.

5.6 Flight Crew Error Management 5.6.1 Showing Compliance with CS 25.1302(d) It is important to recognise that flight crews will make errors, even when well trained, experienced and rested individuals are using well - d esigned systems.

Therefore, CS 25.1302(d) requires that “To the extent practicable, the installed equipment must enable the flight crew to manage errors resulting from flight crew interaction with the equipment tha t can be reasonably expected in service, assuming flight crews acting in good faith. This sub - paragraph does not apply to skill - related errors associated with manual control of the aeroplane.” To comply with CS 25. 1302(d) , the design should meet at least one of the following criteria. It should: — Enable the flight crew to detect (see 5.6.2), and/or recover from errors (see 5.6.3); or — Ensure that effects of flight crew errors on the aeroplane functions or capabilities are evident to the flight crew and continued safe flight and landing is possible (see 5.6.4); or — Discourage flight crew errors by using switch guards, interlocks, confirmation actions, or similar means, or preclude the effects of errors through system log ic and/or redundant, robust, or fault tolerant system design (see 5.6.5).

These objectives: — Are, in a general sense, in a preferred order.

— Recognise and assume that flight crew errors cannot be entirely prevented, and that no validated methods exist to reliably predict either their probability or all the sequences of events with which they may be associated.

— Call for means of compliance that are methodical and complementary to, and separate and distinct from, aeroplane system analysis methods such as sys tem safety assessments.

As discussed previously in paragraph 5.1, Compliance with CS 25.1302(d) is not intended to require consideration of errors resulting from acts of violence or threats of violence. Additionall y, the requirement is intended to require consideration of only those errors that are design related.

Errors that do have a design - related component are considered to be within the scope of this regulatory and advisory material. Examples are a procedure t hat is inconsistent with the design of the equipment, or indications and controls that are complex and inconsistent with each other or other systems on the flight deck.

When demonstrating compliance, the applicant should evaluate flight crew tasks in both normal and non - normal conditions, considering that many of the same design characteristics are relevant in either case. For example, under non - normal Powered by EASA eRules Page 806 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL conditions, the flying tasks (navigation, communication and monitoring), required for normal conditions ar e generally still present, although they may be more difficult in some non - normal conditions. So tasks associated with the non - normal conditions should be considered as additive. The applicant should not expect the errors considered to be different from th ose in normal conditions, but any evaluation should account for the change in expected tasks.

To show compliance with CS 25.1302(d) , an applicant may employ any of the general types of methods of compliance discussed in Paragraph 6, singly or in combination. These methods must be consistent with an approved certification plan as discussed in Paragraph 4, and account for the objectives above and the considerations described below. When using some of these methods, it may be helpful for some applicants to refer to other references relating to understanding error occurrence. Here is a brief summary of those methods and how they can be applied to address flight crew error considerations: — Statement of Si milarity (paragraph 6.3.1): A statement of similarity may be used to substantiate that the design has sufficient certification precedent to conclude that the ability of the flight crew to manage errors is not significantly changed. Applicants may also use service experience data to identify errors known to commonly occur for similar crew interfaces or system behaviour. As part of showing compliance, the applicant should identify steps taken in the new design to avoid or mitigate similar errors.

— Design Descr iptions (paragraph 6.3.2): Applicants may structure design descriptions and rationale to show how various types of errors are considered in the design and addressed, mitigated or managed. Applicants can also use a description of how the design adheres to a n established and valid design philosophy to substantiate that the design enables flight crews to manage errors.

— Calculation and Engineering Analysis (paragraph 6.3.3): As one possible means of showing compliance with CS 25.1302(d) , an applicant may document means of error management through analysis of controls, indications, system behaviour, and related flight crew tasks. This would need to be done in conjunction with an understanding of potential error opportunit ies and the means available for the flight crew to manage those errors. In most cases it is not considered feasible to predict the probability of flight crew errors with sufficient validity or precision to support a means of compliance. If an applicant cho oses to use a quantitative approach, the validity of the approach should be established.

— Evaluations, Demonstrations, and Tests (paragraph 6.3.4 - 6): For compliance purposes, evaluations are intended to identify error possibilities that may be considered fo r mitigation in design or training. In any case, scenario objectives and assumptions should be clearly stated before running the evaluations, demonstrations, or tests. In that way, any discrepancy in those expectations can be discussed and explained in the analysis of the results.

As discussed further in Paragraph 6, these evaluations, demonstrations, or tests should use appropriate scenarios that reflect intended function and tasks, including use of the equipment in normal and non - normal conditions. Scenar ios should be designed to consider flight crew error. If inappropriate scenarios are Powered by EASA eRules Page 807 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL used or important conditions are not considered, incorrect conclusions can result.

For example, if no errors occur during an evaluation it may mean only that the scenarios are too simple. On the other hand, if some errors do occur, it may mean any of the following: — The design, procedures, or training should be modified, — The scenarios are unrealistically challenging, or — Insufficient training occurred prior to the evaluatio n.

In such evaluations it is not considered feasible to establish criteria for error frequency.

5.6.2 Error Detection Applicants should design equipment to provide information so the flight crew can become aware of an error or a system/aeroplane state res ulting from a system action. Applicants should show that this information is available to the flight crew, adequately detectable, and clearly related to the error in order to enable recovery in a timely manner.

Information for error detection may take thre e basic forms: Indications provided to the flight crew during normal monitoring tasks. As an example, if an incorrect knob was used, resulting in an unintended heading change, the change would be detected through the display of target values. Presentation of a temporary flight plan for flight crew review before accepting it would be another way of providing crew awareness of errors.

Indications on instruments in the primary field of view that are used during normal operation may be adequate if the indicati ons themselves contain information used on a regular basis and are provided in a readily accessible form. These may include mode annunciations and normal aeroplane state information such as altitude or heading. Other locations for the information may be ap propriate depending on the flight crew’s tasks, such as on the control - display unit when the task involves dealing with a flight plan. Paragraph 5.4, Presentation of Information, contains additional guidance to determine whether information is adequately d etectable.

Flight crew indications that provide information of an error or a resulting aeroplane system condition. An example might be an alert to the flight crew about the system state resulting from accidentally shutting down a hydraulic pump. Note that if the indication is an alert, it is related to the resulting system state, not necessarily directly to the error itself. Existence of a flight crew alert that occurs in response to flight crew error may be sufficient to establish that information exists a nd is adequately detectable, if the alert directly and appropriately relates to the error.

Definitions of alert levels in CS 25.1322 are sufficient to establish that the urgency of the alert is appropriate. Content of the indication should directly relate to the error. Indications for indirect effects of an error may lead the flight crew to believe there may be non - error causes for the annunciated condition.

“Global” alerts that cover a multitude of possible errors by annunciating external hazards or aeroplane envelope or operational conditions. Examples include monitoring systems such as terrain awareness warning systems (TAWS) and traffic collision avoidance systems (TCAS). An example would be a TAWS alert resulti ng from turning the wrong direction in a holding pattern in mountainous terrain.

Powered by EASA eRules Page 808 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL The applicant should consider the following when establishing whether the degree or type of information is available to the flight crew, adequately detectable, and clearly re lated to the error: — Effects of some errors are easily and reliably determined by the system (by design), and some are not. For those that cannot be sensed by the system, design and arrangement of the information monitored and scanned by the flight crew can facilitate error detection. An example would be alignment of engine speed indicator needles in the same direction during normal operation.

— Aeroplane alerting and indication systems may not detect whether an action is erroneous because systems cannot know flight crew intent for many operational circumstances. In these cases, reliance is often placed on the flight crew’s ability to scan and observe indications that will change as a result of an action such as selecting a new altitude or heading, or making a change to a flight plan in a flight management system. For errors of this nature, detection depends on flight crew interpretation of available information. Training, crew resource management, and monitoring systems such as TAWS and TCAS are examples of way s to provide a redundant level of safety if any or all flight - crew members fail to detect certain errors.

— From a design standpoint, some information, such as heading, altitude, and fuel state, should be provided as readily available indications rather than in the form of alerts when there is potential for them to contribute to excessive nuisance alerts.

The applicant may establish that information is available and clearly related to the error by design description when precedent exists or when a reasonable case may be made that the content of the information is clearly related to the error that caused it. In some cases, piloted evaluations (see 6.3.4) may be needed to assess whether the information provided is adequately available and detectable.

5.6.3 Error Recovery Assuming that the flight crew detects errors or their effects, the next logical step is to ensure that the error can be reversed, or the effect of the error can be mitigated in some way so that the aeroplane is returned to a safe stat e.

An acceptable means to establish that an error is recoverable is to show that: — Controls and indications exist that can be used either to reverse an erroneous action directly so that the aeroplane or system is returned to the original state, or to mitiga te the effect so that the aeroplane or system is returned to a safe state, and — The flight crew can be expected to use those controls and indications to accomplish the corrective actions in a timely manner.

To establish the adequacy of controls and indicati ons that facilitate error recovery, a statement of similarity or design description of the system and crew interface may be sufficient. For simple or familiar types of system interfaces, or systems that are not novel, even if complex, a statement of simila rity or design description of the crew interfaces and procedures associated with indications is an acceptable means of compliance.

Powered by EASA eRules Page 809 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL To establish that the flight crew can be expected to use those controls and indications to accomplish corrective actions in a timely manner, evaluation of flight crew procedures in a simulated flight deck environment can be highly effective.

This evaluation should include examination of nomenclature used in alert messages, controls, and other indications. It should also include the logical flow of procedural steps and the effects that executing the procedures have on other systems.

5.6.4 Error Effects Another means of satisfying the objective of error mitigation is to ensure that effects of the error or relevant effects on aeropl ane state: — Are evident to the flight crew, and — Do not adversely impact safety (do not prevent continued safe flight and landing).

Piloted evaluations in the aeroplane or in simulation may be relevant if flight crew performance issues are in question for de termining whether a state following an error permits continued safe flight and landing. Evaluations and/or analyses may be used to show that, following an error, the flight crew has the information in an effective form and has the aeroplane capability requ ired to continue safe flight and landing.

5.6.5 Precluding Errors or Their Effects For irreversible errors that have potential safety implications, means to discourage the errors are recommended. Acceptable ways to discourage errors include switch guards, interlocks, or multiple confirmation actions. For example, generator drive controls on many aeroplanes have guards over the switches to discourage inadvertent actuation, because once disengaged, the drives cannot be re - engaged while in flight or wi th the engine running. An example of multiple confirmations would be presentation of a temporary flight plan that the flight crew can review before accepting.

Another way of avoiding flight crew error is to design systems to remove misleading or inaccurate information, (e.g., sensor failures), from displays. An example would be a system that removes flight director bars from a primary flight display or removing “own - ship” position from an airport surface map display when the data driving the symbols is inco rrect.

The applicant should avoid applying an excessive number of protections for a given error. Excessive use of protections could have unintended safety consequences.

They might hamper the flight - crew member‘s ability to use judgment and take actions in the best interest of safety in situations not predicted by the applicant. If protections become a nuisance in daily operation flight crews may use well - intentioned and inventive means to circumvent them. This could have further effects not anticipated by t he operator or the designer.

Powered by EASA eRules Page 810 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 5.7 Integration 5.7.1 Introduction Many systems, such as flight management systems, are integrated physically and functionally into the flight deck and may interact with other flight deck systems. It is important to consider a design not just in isolation, but in the context of the overall flight deck. Integration issues include where a display or control is installed, how it interacts with other systems, and whether there is internal consistency across functions within a mult i - function display, as well as consistency with the rest of the flight deck’s equipment.

CS 25.1302 requires that “…installed equipment must be shown, individually and in combination with other such equipment, to b e designed so that qualified flight - crew members trained in its use can safely perform their tasks associated with its intended function …”. To comply with this integration requirement, all flight deck equipment must be able to be used by the flight crew t o perform their tasks, in any combination reasonably expected in service. Flight deck equipment includes interfaces to aeroplane systems the flight crew interacts with, such as controls, displays, indications, and annunciators.

Analyses, evaluations, tests and other data developed to establish compliance with each of the specific requirements in CS 25.1302 (a) through (d) should address integration of new or novel design features or equipment with previously approve d features or equipment as well as with other new items. It should include consideration of the following integration factors: — Consistency (see 5.7.2) — Consistency trade - offs (see 5.7.3) — Flight deck environment (see 5.7.4) — Integration related workload and error (see 5.7.5) 5.7.2 Consistency Consistency needs to be considered within a given system and across the flight deck. Inconsistencies may result in vulnerabilities, such as increased workload and errors, especially during stressful situatio ns. For example, in some flight management systems, the format for entering latitude and longitude differs across the display pages. This may induce flight crew errors, or at least increase flight crew workload. Additionally, errors may result if latitude and longitude is displayed in a format that differs from formats on the most commonly used paper charts.

Because of this, it is desirable to use formats that are consistent with other media whenever possible. Although trade - offs exist, as discussed in the next paragraph, the following are design attributes to consider for consistency within and across systems: — Symbology, data entry conventions, formatting, colour philosophy, terminology, and labelling.

— Function and logic. For example, when two or more syste ms are active and performing the same function, they should operate consistently and use the same style interface.

Powered by EASA eRules Page 811 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL — Information presented with other information of the same type that is used in the flight deck. For example, navigation symbology used on othe r flight deck systems or on commonly used paper charts should be considered when developing the symbology to be used on electronic map displays.

— The operational environment. It is important that a flight management system is consistent with the operational environment so that the order of the steps required to enter a clearance into the system is consistent with the order in which they are given by air traffic management.

Adherence to a flight deck design philosophy is one way to achieve consistency within a given system as well as within the overall flight deck. Another way is to standardise aspects of the design by using accepted, published industry standards such as the labels and abbreviations recommended in ICAO Annex 8400/5. The applicant might Standar dise symbols used to depict navigation aids (the very high frequency omnidirectional ranges, VORs, for example), by following the conventions recommended in SAE ARP5289. However, inappropriate standardisation, rigidly applied, can be a barrier to innovatio n and product improvement. Additionally, standardisation may result in a standard to the lowest common denominator. Thus, guidance in this paragraph promotes consistency rather than rigid standardisation.

5.7.3 Consistency Trade - Offs It is recognised that it is not always possible or desirable to provide a consistent flight crew interface. Despite conformance with the flight deck design philosophy, principles of consistency, etc, it is possible to negatively impact flight crew workload,. For example, all au ditory alerts may adhere to a flight deck alerting philosophy, but the number of alerts may be unacceptable. Consistent format across the flight deck may not work when individual task requirements necessitate presentation of data in two significantly diffe rent formats. An example is a weather radar display formatted to show a sector of the environment, while a moving map display shows a 360 degree view. In such cases it should be demonstrated that the interface design is compatible with the requirements of the piloting task and can be used individually and in combination with other interfaces without interference to either system or function.

Additionally: — The applicant should provide an analysis identifying each piece of information or data presented in mul tiple locations and show that the data is presented in a consistent manner or, where that is not true, justify why that is not appropriate.

— Where information is inconsistent, that inconsistency should be obvious or annunciated, and should not contribute to errors in information interpretation.

— There should be a rationale for instances where a system’s design diverges from the flight deck design philosophy. Consider any impact on workload and errors as a result of this divergence.

— The applicant should descri be what conclusion the flight crew is expected to draw and what action should be taken when information on the display Powered by EASA eRules Page 812 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) G ENERAL conflicts with other information on the flight deck (either with or without a failure).

5.7.4 Flight Deck Environment The flight deck sys tem is influenced by physical characteristics of the aeroplane into which a system is integrated, as well as by operational environment characteristics. The system is subject to such influences on the flight deck as turbulence, noise, ambient light, smoke, and vibrations (such as those that may result from ice or fan blade loss). System design should recognise the effect of such influences on usability, workload, and crew task performance. Turbulence and ambient light, for example, may affect readability of a display. Flight deck noise may affect audibility of aural alerts. The applicant should also consider the impact of the flight deck environment for non - normal situations, such as unusual attitude recovery or regaining control of the aeroplane or system.

The flight deck environment includes the layout, or physical arrangement of the controls and information displays. Layout should take into account crew requirements in terms of: — Access and reach (to controls).

— Visibility and readability of displays and labels.

— Task - oriented location and grouping of human - machine interaction elements.

An example of poor physical integration would be a required traffic avoidance system obscured by thrust levers in the normal operating position.

5.7.5 Integration Related Wo rkload and Error When integrating functions and/or equipment, designers should be aware of potential effects, both positive and negative, that integration can have on crew workload and its subsequent impact on error management. Systems must be designed and evaluated, both in isolation and in combination with other flight deck systems, to ensure that the flight crew is able to detect, reverse, or recover from errors. This may be more challenging when integrating systems that employ higher levels of automatio n or have a high degree of interaction and dependency on other flight deck systems.

Applicants should show that the integrated design does not adversely impact workload or errors given the context of the entire flight regime. Examples of such impacts would be increased time to: — Interpret a function, — Make a decision, — Take appropriate actions.

Controls, particularly multi - function controls and/or novel control types, may present the potential for misidentification and increased response times. Designs should generally avoid multi - function controls with hidden functions, because they increase both crew workload and the potential for error.

Two examples of integrated design features that may or may not impact error and workload are as follows: Powered by EASA eRules Page 813 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL — Pr esenting the same information in two different formats. This may increase workload, such as when altitude information is presented concurrently in tape and round - dial formats. Yet different formats may be suitable depending on the design and the flight cre w task. For example, an analog display of engine revolutions - per - minute can facilitate a quick scan, whereas a digital numeric display can facilitate precise inputs. The applicant is responsible for demonstrating compliance with CS 25.1523 and showing that differences in the formats do not result in unacceptable workload levels.

— Presenting conflicting information. Increases in workload and error may result from two displays depicting conflicting altitude informatio n on the flight deck concurrently, regardless of format. Systems may exhibit minor differences between each flight - crew member station, but all such differences should be evaluated specifically to ensure that potential for interpretation error is minimised , or that a method exists for the flight crew to detect incorrect information, or that the effects of these errors can be precluded.

The applicant should show that the proposed function will not inappropriately draw attention away from other flight deck i nformation and tasks in a way that degrades flight crew performance and decreases the overall level of safety. There are some cases where it may be acceptable for system design to increase workload.

For example, adding a display into the flight deck may in crease workload by virtue of the additional time flight - crew members spend looking at it, but the safety benefit the additional information provides may make it an acceptable trade - off.

Because each new system integrated into the flight deck may have a pos itive or negative effect on workload, each must be evaluated in isolation and combination with the other systems for compliance with CS 25.1523 . This is to ensure that the overall workload is acceptable, i.e., that performance of flight tasks is not advers ely impacted and that the crew’s detection and interpretation of information does not lead to unacceptable response times. Special attention should be paid to CS - 25 Appendix D and specifically compliance for items that the appendix lists as workload factor s. They include “accessibility, ease, and simplicity of operation of all necessary flight, power, and equipment controls.” 6. MEANS OF COMPLIANCE This paragraph discusses considerations in selecting means of compliance. It provides six general acceptable m eans to demonstrate compliance in addressing human performance issues. These means of compliance are generic and have been used in certification programmes.

The acceptable means of compliance to be used on any given project should be determined on a case - b y - case basis, driven by the specific compliance issues. They should be developed and proposed by the applicant, and then agreed to by the Agency. Uses and limitations of each type of compliance means are provided in paragraph 6.3.

6.1 Selecting Means of Co mpliance — The means of compliance discussed in this paragraph include: — Statements of similarity (See paragraph 6.3.1), — Design description (See paragraph 6.3.2), — Calculations/analyses (See paragraph 6.3.3), Powered by EASA eRules Page 814 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL — Evaluations (See paragraph 6.3.4), — Tests ( See par agraph 6.3.5), There is no generic method to determine appropriate compliance means for a specific project. The choice of an appropriate compliance means or combination of several different means depends on a number of factors specific to a project.

Some c ertification projects may necessitate more than one means of demonstrating compliance with a particular requirement. For example, when flight testing in a conforming aeroplane is not possible, a combination of design review and part - task simulation evaluat ion may be proposed.

Answering the following questions will aid in selecting means of compliance.

— With which means of compliance will it possible to gather the required certification data?

— Will a single means of compliance provide all of the data or will s everal means of compliance be used in series or in parallel?

— What level of fidelity of the facility is required to collect the required data?

— Who will be the participants?

— What level of training is required prior to acting as a participant?

— How will the da ta from an evaluation be presented to show compliance?

— Will results of a demonstration be submitted for credit?

— If a test is required, what conformed facility will be used?

6.2 Discussion and Agreement with the Agency on Compliance Demonstrations The applicant’s proposal for means of compliance must be coordinated with the Agency to ensure that all aspects necessary for desired credit towards certification are achieved.

These could include the planned scenarios, the necessary types o f human performance issues to be explored, or the conditions under which the test will be conducted to provide a realistic environment for the evaluation.

6.3 Description of Means of Compliance The six general means of compliance found to be acceptable for use in demonstrating compliance related to flight deck design are described in the following sub - paragraphs.

6.3.1 Statement of Similarity Description A statement of similarity is a description of the system to be approved and a description of a previously approved system detailing the physical, logical, and operational similarities with respect to compliance with requirements.

Deliverable A statement of similarity could be part of a certification report, containing references to existing certification data/documents.

Participants Not applicable.

Conformity Not applicable.

Powered by EASA eRules Page 815 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Uses It may be possible to substantiate the adequacy of a design by comparing it to previously certificated systems shown to be robust with respect to lack of contribution to crew error and/or capability of the flight crew to manage the situation should an error occur. This avoids repetition of unnecessary effort to justify the safety of such systems.

Limitations A statement of similarity to show compliance mu st be used with care. The flight deck should be evaluated as a whole, not as merely a set of individual functions or systems. Two functions or features previously approved on separate programmes may be incompatible when combined on a single flight deck. Al so, changing one feature in a flight deck may necessitate corresponding changes in other features, to maintain consistency and prevent confusion.

Example If the window design in a new aeroplane is identical to that in an existing aeroplane, a statement of similarity may be an acceptable means of compliance to meet CS 25.773.

6.3.2 Design Description The applicant may elect to substantiate that the design meets the requirements of a specific paragraph by describing the design. Applicants have tradition ally used drawings, configuration descriptions, and/or design philosophy to show compliance. Selection of participants and conformity are not relevant to this means of compliance.

a. Drawings Description Layout drawings or engineering drawings, or both, d epicting the geometric arrangement of hardware or display graphics.

Deliverable The drawing, which can be part of a certification report.

Uses Applicants can use drawings for very simple certification programmes when the change to the flight deck is very simple and straightforward. Drawings can also be used to support compliance findings for more complex interfaces.

Limitations The use of drawings is limited to physical arrangements and graphical concerns.

b. Configuration Description Description A configuration description is a description of the layout, general arrangement, direction of movement, etc., of regulated item. It can also be a reference to documentation, giving such a description (for example from a different project with similar lay out) . It could be used to show the relative locations of flight instruments, groupings of control functions, allocation of colour codes to displays and alerts, etc.

Deliverable Explanation of functional aspects of crew interface: text description of certification item and/or functional aspects of the crew interface with the system (with visuals as appropriate).

Uses Configuration descriptions are generally less formalised than engineering drawings. They are developed to point out feat ures of the design that support a finding of compliance. In some cases, such configuration descriptions may provide sufficient information for a finding of compliance. More often, however, they provide important background information, while Powered by EASA eRules Page 816 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL final confirma tion of compliance is found through other means, such as demonstrations or tests. The background information provided by configuration descriptions may significantly reduce the complexity and/or risk associated with demonstrations or tests. The applicant w ill have already communicated how a system works with the configuration description and any discussions or assumptions may have already been coordinated.

Limitations Configuration descriptions may provide sufficient information for a finding of complianc e with a specific requirement. More often, though, they provide important background information, while final confirmation of compliance is found by other means, such as demonstrations or tests. Background information provided by configuration descriptions may significantly reduce the complexity and/or risk associated with the demonstrations or tests.

c. Design philosophy Description A design philosophy approach can be used to demonstrate that an overall safety - centred philosophy, as detailed in the desi gn specifications for the product/system or flight deck, has been applied.

Deliverable Text description of certification item and/or functional aspects of the crew interface with the system (with figures and drawings as appropriate) and its relationship to overall design philosophy.

Uses Documents the ability of a design to meet requirements of a specific paragraph.

Limitations In most cases, this means of compliance will be insufficient as the sole means to demonstrate compliance.

Examp le Design philosophy may be used as a means of compliance when a new alert is added to the flight deck, if the new alert is consistent with the acceptable existing alerting philosophy.

6.3.3 Calculation/analysis Description Calculations or engineering analyses (“paper and pencil” assessments) that do not require direct participant interaction with a physical representation of the equipment.

Deliverable Report detailing the analysis, its components, evaluation assumptions, and basis for decision making. The report details results and conclusions.

Participants Conducted by the applicant.

Conformity Not applicable.

Uses Provides a systematic evaluation of specific or overall aspects of the human interface part of the product/system/fl ight deck. May be specified by guidance material.

Limitations Carefully consider the validity of the assessment technique for analyses not based on advisory material or accepted industry standard methods. Applicants may be asked to validate any computational tools used in such analyses. If analysis involves comparing measured Powered by EASA eRules Page 817 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL characteristics to recommendations derived from pre - existing research (internal or public domain), the applicant may be asked to justify the applicability of data to the project.

Example An applicant may conduct a vision analysis to demonstrate that the flight crew has a clear and undistorted view out the windows. Similarly, an analysis may also demonstrate that flight, navigation and powerplant instruments are plainly visible from the flight - crew member station. The applicant may need to valida te results of the analysis in ground or flight test.

6.3.4 Evaluations The applicant may use a wide variety of part - task to full - installation representations of the product/system or flight deck for evaluations. These all have two characteristics in common: (1) the representation of the human interface and the system interface do not necessarily conform to the final documentation, and (2) the certification Agency is generally not present. The paragraphs below address mock - ups, part - task simulations, full simulations, and in - flight evaluations that typically make up this group of means of compliance. A mock - up is a full - scale, static representation of the physical configuration (form and fit). It does not include functional aspects of the flight deck and its installed equipment.

Description Evaluations are assessments of the design conducted by the applicant, who then provides a report of the results to the Agency.

Deliverable A report, delivered to the Agency.

Participants Appli cant and possibly Agency Facilities An evaluation can be conducted in a mock - up, on a bench, or in a laboratory, simulator or aeroplane.

Conformity Conformity is not required.

Mock - up evaluation Mock - ups can be used as representations of the design, allowing participants to physically interact with the design. Three - dimensional representations of the design in a CAD system, in conjunction with three - dimensional models of the flight deck occupants, have also been used as “virtual” mock - ups for certain limited types of evaluations. Reach assessments, for example, can use either type of mock - up.

Example of a mock - up evaluation An analysis to demonstrate that controls are arranged so that flight - crew members from 1.58 m (5f t 2 inches) to 1.91 m (6ft 3 inches) in height can reach all controls. This analysis may use computer - generated data based on engineering drawings. The applicant may demonstrate results of the analysis in the actual aeroplane.

Bench or laboratory evaluati on The applicant can conduct an evaluation using devices emulating crew interfaces for a single system or a related group of systems. The applicant can use flight hardware, simulated systems, or combinations of these.

Example of a bench or laboratory ev aluation A bench evaluation for an integrated system could be an avionics suite installed in a mock - up of a flight deck, with the main displays and autopilot controls included. Such a tool may be Powered by EASA eRules Page 818 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL valuable during development and for providing system famili arisation to the Agency.

However, in a highly integrated architecture, it may be difficult or impossible to assess how well the avionics system will fit into the overall flight deck without more complete simulation or use of the actual aeroplane.

Simulato r evaluation A simulator evaluation uses devices that present an integrated emulation (using flight hardware, simulated systems, or combinations of these) of the flight deck and the operational environment. These devices can also be “flown” with response characteristics that replicate, to some extent, responses of the aeroplane. Simulation functional and physical fidelity (or degree of realism) requirements will typically depend on the configurations, functions, tasks, and equipment.

Aeroplane evaluation This is an evaluation conducted in the actual aeroplane.

Uses Traditionally, these types of activities have been used as part of the design process without formal certification credit. However, these activities can result in better designs that are more likely to be compliant with applicable requirements.

Limitatio ns Evaluations are limited by the extent to which the facilities actually represent the flight deck configuration and realistically represent flight crew tasks. As flight deck systems become more integrated, part - task evaluations may become less useful as a means of compliance, even though their utility as engineering tools may increase.

6.3.5 Tests Tests are means of compliance conducted in a manner very similar to evaluations (described above in paragraph 6.3.4). There is, however, a significant diff erence.

Tests require a conforming product/system and system interface. A test can be conducted on a bench, in a laboratory, in a simulator, or on an aeroplane.

Description Tests are assessments of the design conducted with the Agency present.

Deliverab le A report, delivered to the Agency.

Participants Applicant and possibly Agency Facilities A test can be conducted on a bench or in a laboratory, simulator or an aeroplane.

Conformity The facility must be conforming.

Bench or laboratory test This type of testing is usually confined to showing that components perform as designed.

Bench tests are usually not enough to stand alone as a means of compliance. They can, however, provide useful supporting data in combination with other means.

Example of a bench or laboratory test The applicant might show visibility of a display under the brightest of expected lighting conditions with a bench test, provided there is supporting analysis to define the expected lighting conditions. Such supporting information might include a geometric analysis to show potential directions from which the sun could shine on the display, with calculations of expected viewing angles. These conditions might then be reproduced in the laboratory.

Powered by EASA eRules Page 819 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Conformity related to a bench or laboratory test The part or system would need to be conforming to show compliance.

Simulator test A simulator test uses devices that present an integrated emulation (using flight hardware, simulated systems, or combinations of these) of the flight deck and the operational environment. They can also be “flown” with response characteristics that replicat e the responses of the aeroplane. The applicant should determine the physical and functional fidelity requirements of the simulation as a function of the issue under evaluation.

Simulator test conformity and fidelity issues Only conforming parts of the flight deck may be used for simulator tests. Applicants may use a flight crew training simulator to validate most of the normal and emergency procedures for the design, and any workload effects of the equipment on the flight crew. If the flight deck is ful ly conforming and the avionics are driven by conforming hardware and software, then the applicant may conduct and use integrated avionics testing for showing compliance. Note that not all aspects of the simulation must have a high level of fidelity for any given compliance issue. Rather, assess fidelity requirements in view of the issue being evaluated.

Aeroplane test Aeroplane tests can be conducted either on the ground or in flight.

Example of an aeroplane test An example of a ground test is an evalua tion for the potential of reflections on displays. Such a test usually involves covering the flight deck windows to simulate darkness and setting the flight deck lighting to desired levels. This particular test may not be possible in a simulator, because o f differences in the light sources, display hardware, and/or window construction.

Flight testing during certification is the final demonstration of the design. These are tests conducted in a conforming aeroplane during flight. The aeroplane and its compone nts (flight deck) are the most representative of the type design to be certified and will be the closest to real operations of the equipment. In - flight testing is the most realistic testing environment, although it is limited to those evaluations that can be conducted safely. Flight testing can be used to validate and verify other tests previously conducted during the development and certification programme. It is often best to use flight testing as final confirmation of data collected using other means of compliance, including analyses and evaluations.

Limitations of flight tests Flight tests may be limited by the extent to which flight conditions of particular interest (for example, weather, failure, unusual attitudes) can be found/produced and then safely evaluated in flight. Also note that flight testing on the aeroplane provides the least control over conditions of any of the means of compliance. The Agency and the applicant should thoroughly discuss how and when flight tests and their results will be used to show compliance.

[Amdt 25/3] Powered by EASA eRules Page 820 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

AMC 25.1302 APPENDIX 1: Related regulatory material and

documents

ED Decision 2007/010/R The following is a list of requirements, acceptable means of compliance and other documents relevant to flight deck design and flight crew interfaces which may be useful when reviewing this AMC.

1.1 Related EASA Certification Specifications Table 1.1 List of related regulations and AMCs referenced in this document: CS - 25 BOOK 1 General topic CS - 25 BOOK 2 Accep table Requirements Means of Compliance CS 25.785 (g) Seats, berths, safety belts and harnesses AMC 25.785 (g) CS 25.1309(c) Minimising flight crew errors that could create AMC 25.1309 additional hazards.

CS 25.1523 Minimum flight crew and workload. AMC 25.1523 CS 25.1321 Arrangement and visibility CS 25.1322 Colours for warning, caution, or advisory lights. AMC 25.1322 CS 25.1329 Autopilot, flight director, autothrust AMC 25.1329 Electronic displays AMC 25 - 11 CS 25.1543 Instrument markings - general AMC 25.1543 Note: The table above does not list all requirements associated with flight deck design and human performance. This AMC does not provide guidance for requirements that already have specific design requirements, such as CS 25.777(e) , which states that “Wing flap controls and other auxiliary lift device controls must be located on top of the pedestal, aft of the throttles, centrally or to the right of the pedestal centerline, and not le ss than 25 cm (10 inches) aft of the landing gear control.” 1.2 RESERVED 1.3 FAA Orders and Policy — Policy Memo ANM - 99 - 2, Guidance for Reviewing Certification Plans to Address Human Factors for Certification of Transport Airplane Flight Decks.

— Policy Memo A NM - 0103, Factors to Consider When Reviewing an Applicant’s Proposed Human Factors Methods of Compliance for Flight Deck Certification.

— FAA Notice 8110.98, Addressing Human Factors/Pilot Interface Issues of Complex, Integrated Avionics as Part of the Techni cal Standard Order (TSO) Process.

1.4 Other documents Following is a list of other documents relevant to flight deck design and flight crew interfaces that may be useful when reviewing this AMC. Some contain special constraints and limitations, however, pa rticularly those that are not aviation specific. For example, International Standard ISO 9241 - 4 has much useful guidance that is not aviation specific. When using that document, applicants should consider environmental factors such as the intended operatio nal environment, turbulence, and lighting as well as cross - side reach.

— SAE ARP 4033 (Pilot - System Integration), August 1995 — SAE ARP5289, Electronic Aeronautical Symbols — SAE ARP - 4102/7, Electronic Displays Powered by EASA eRules Page 821 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL — FAA Human Factors Team report on: The Interfaces Between Flightcrews and Modern Flight Deck Systems, 1996 — DOT/FAA/RD – 93/5: Human Factors for Flight Deck Certification Personnel — ICAO 8400/5, Procedures for Air Navigation Services ICAO Abbreviations and Codes. Fifth Edition, 1999 — ICAO Human Fac tors Training Manual: DOC 9683 – AN/950 — International Standards ISO 9241 - 4, Ergonomic Requirements for Office Work with Visual Display Terminals (VDTs) [Amdt 25/3 ]

AMC 25.1302 Appendix 2: Definitions and acronyms

ED Decision 20 11 / 004 /R Following is a list of terms, abbreviations, and acronyms used throughout this advisory material and in CS - 25.

2.1 Abbreviations and acronyms AC – Advisory circular AMC – Acceptable Means of Compliance CS – Certification Specifications DOT – Department of Transportation EASA – European Aviation Safety Agency FAA – Federal Aviation Administration ICAO – International Civil Aviation Organization ISO – International Standards Organization JAR – Joint Aviation Requirements JAR OPS – Joint Aviation Requirements (Commercial Air Transportation - Aeroplanes) MOC – Means of Compliance SAE – Society of Automotive Engineers STC – Supplemental Type Certificate TAWS – Terrain Awareness Warning System TCAS – Traffic Collision Avoidance System TSO – Technical Standards Order VOR – Very High Frequency Omnidirectional Range 2.2 Definitions Following is a list of terms and definitions used in this AMC.

Alert – A generic term used to describe a flight deck indication meant to attract the attention of t he flight crew, and identify to them a non - normal operational or aeroplane system condition. Warnings, Cautions, and Advisories are considered to be a lerts. (Reference definition in AMC 25.1322) Powered by EASA eRules Page 822 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Automation – The autonomous execution of a task (or tasks) by aeroplane systems started by a high - level control action of the flight crew.

Conformity – Official verification that the flight deck/system/product conforms to the type design data. Conformity of the facility is one parameter that distinguishes one means of compliance from another.

Control Device (Flight Deck Control) – Device used by the flight crew to transmit their intent to the aeroplane systems.

Cursor Control Device – Control device for interacting with virtual controls, typically used with a graphical user interface on an electro - optical display.

Design Philosophy – A high - level description of human - centred design principles that guide the designer and aid in ensuri ng that a consistent, coherent user interface is presented to the flight crew.

Display – Device (typically visual but may be auditory or tactile) that transmits data or information from the aeroplane to the flight crew.

Multifunction Control – A control de vice that can be used for many functions as opposed to a control device with a single dedicated function.

Task Analysis – A formal analytical method used to describe the nature and relationship of complex tasks involving a human operator.

[Amdt 25/3 ] [Amdt 25/11]

CS 25.1303 Flight and navigation instruments

ED Decision 2018 / 005 /R (a) The following flight and navigation instruments must be ins talled so that the instruments are visible from each pilot station: (1) A free - air temperature indicator or an air - t emperature indicator which provides indications that are convertible to free - air temperature.

(2) A clock displaying hours, minutes, and seconds with a sweep - second pointer or digital presentation.

(3) A magnetic direction indicator.

(b) The following flig ht and navigation instruments must be installed at each pilot station: (1) An airspeed indicator. If airspeed limitations vary with altitude, the indicator must have a maximum allowable airspeed indicator showing the variation of V with altitude.

MO (2) An altimeter (sensitive).

(3) A rate - of - climb indicator (vertical speed).

(4) A gyroscopic rate of turn indicator combined with an integral slip - skid indicator (turn - and - bank indicator) except that only a slipskid indicator is required on aeroplanes with a o third attitude instrument system usable through flight attitudes of 360 of pitch and roll, which is powered from a source independent of the electrical generating system and continues reliable operation for a minimum of 30 minutes after total failure of t he electrical generating system, and is installed in accordance with CS 25.1321(a) .

Powered by EASA eRules Page 823 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (5) A bank and pitch indicator (gyroscopically stabilised). (See AMC 25.1303(b)(5) .)

(6) A direction indicator (gyroscopically stabilised, magnetic or non - magnetic).

(c) The following flight and navigation instruments are required as prescribed in this paragraph: (1) A speed warni ng device which must give effective aural warning (differing distinctively from aural warnings used for other purposes) to the pilots whenever the speed exceeds V plus 11.1 km/h (6 knots) or M + 0·01. The upper limit of the production tolerance MO MO for the warning device may not exceed the prescribed warning speed. (See AMC 25.1303(c)(1) .)

(2) A mach meter is required at each pilot station for aeroplanes with compressibility limitations not otherwise indicated to th e pilot by the airspeed indicating system required under sub - paragraph (b)(1) of this paragraph.

[Amdt 25/18] [Amdt 25/21]

AMC 25.1303(a)(3) Direction indicators

ED Decision 2018/005/R In this AMC, ‘primary direction indicator’ refers to the direction indi cator required by CS 25.1303(b)(6) and ‘standby direction indicator’ to the one required by CS 25.1303(a)(3) .

When designing and installing a standby direction indicator, t he applicant should follow the guidelines below: (a) Independence between the primary direction indicator and the standby direction indicator should be established in all foreseeable operating conditions. Failure conditions and subsequent switching to the backup source of direction should be carefully consid ered; (b) The reliability of the standby direction indicator should be commensurate with the identified hazard level. Consideration should be given to CS 25.1333(b) and A MC 25 - 11 , Chapter 4, Table 6; (c) Additional availability assessments should be provided: (1) Direction indications should be available immediately following the loss of the primary direction source without additional crew member action, and after any single failure or combination of failures. Consideration should be given to CS 25.1333(b) ; (2) Direction indications should not be adversely affected following a loss of normal electrical power. Consideration sho uld be given to CS 25.1351(d) ; (3) Operation during and after exposure to a high - intensity radiated field (HIRF) environment should be demonstrated. Consideration should be given to CS 25.1317(a) ; (4) Operation after exposure to indirect effects of lightning should be established.

Consideration should be given to CS 25.1316(a) .

[Amdt 25/21] Powered by EASA eRules Page 824 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

AMC 25.1303(b)(5) Attitude Displays

ED Decision 2003/ 2/RM 1 Attitude Displays 1.1 For turbo - jet aeroplanes each display should be usable over the full range of 360° in pitch and in roll. For propeller - driven aeroplanes the pitch range may be reduced to ± 75° provided that no mislea ding indication is given when the limiting attitude is exceeded.

1.2 Paragraph 1.1 is not intended to prohibit the use of vertical references having controlled gyro precession, or its equivalent in the case of a stable platform, but precession should not occur at a pitch attitude closer to the horizontal than 70°, and should be completed within an attitude change of 15°.

1.3 The display should take the form of an artificial horizon line, which moves relative to a fixed reference aeroplane symbol so as to indicate the position of the true horizon.

NOTES: 1 It is acceptable for the fixed reference aeroplane symbol to be positioned so that it is aligned with the horizon line during cruising flight.

2 If a variable index is provided in addition to the fixed aeroplane symbol it should be so designed that it will not introduce any risk of misinterpretation of the display.

1.4 There should be no means accessible to the flight crew of adjusting the relationship between the horizon line and the reference aeropla ne symbol.

1.5 The artificial horizon line should move in roll so as to remain parallel to the true horizon, i.e. when the aeroplane rolls through an angle of 30° the artificial horizon line should also rotate through 30° relative to the fixed index.

1.6 The artificial horizon line should remain in view over a range of pitch attitudes sufficient to cover all normal operation of the aeroplane plus a margin of not less than 2° in either direction. Additional ‘ghost’ horizon lines should be provided parallel to the main horizon line so that beyond this range at least one such line is in view at an attitude with the range of the display.

1.7 The pitch attitude scale should be sensibly linear while the main horizontal line is in view, but may become non - linear beyond this range.

All the attitude displays in the aeroplane should have a similar presentation so as to prevent any risk of confusion in transferring attention from one display to another.

1.9 Sufficient pitch and bank angle graduations and markings s hould be provided to allow an acceptably accurate reading of attitude and to minimise the possibility of confusion at extreme attitudes.

1.10 A bank angle index and scale should be provided. The index may be on the fixed or moving part of the display.

1. 11 The ‘earth’ and ‘sky’ areas of the display should be of contrasting colours or shades. The distinction should not be lost at any pitch or roll angle.

1.12 Any additional information (e.g. flight director commands) displayed on an attitude display shoul d not obscure or significantly degrade the attitude information.

1.13 The display should be clearly visible under all conditions of daylight and artificial lighting.

1.14 Words that may be ambiguous (e.g. ‘climb’, ‘dive’, ‘push’, ‘pull’) should not be us ed.

Powered by EASA eRules Page 825 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 2 Attitude Display Systems (Acceptable Means of Compliance) 2.1 The probability of indication of dangerously incorrect information without a warning being given should be Extremely Remote.

2.2 The warning may be provided by means of self - or comparison - monitoring and should be clear and unambiguous, e.g. a flashing li ght. Instrument flags are unlikely to be acceptable as a comparator warning unless they exclude a significant portion of the display in which case means should be provided to permit the removal of the flag from the display, which is not in error.

2.3 The definition of dangerously incorrect information depends to some extent on the characteristics of the aeroplane, but in general an error greater than 5° in pitch or 10° in roll will be considered to be dangerous.

AMC 25.1303(c)(1) Flight and navigation i nstruments

ED Decision 2003/ 2/RM In the absence of warning through the inherent aerodynamic qualities of the aeroplane (e.g. buffeting) it should be shown that no single faults can result both in misleading airspeed information and in operatio n of the warning system outside its tolerances, such as would be likely to lead to exceedance of V /M .

MO MO

CS 25.1305 Powerplant instruments

ED Decision 2021/015/R (See AMC 25.1305) The following are required powerplant instruments: (a) For all aeroplane s (1) A fuel pressure warning means for each engine, or a master warning means for all engines with provision for isolating the individual warning means from the master warning means.

(2) Fuel indication system(s) which: (i) Provide(s) to the flight crew a full - time display of the total quantity of usable fuel on board; (ii) Is (are) capable of indicating to the flight crew the quantity of usable fuel in each tank in accordance with CS 25.1337(b) ; (iii) Provide(s) f uel quantity and availability information to the flight crew, including alerts, to indicate any fuel system condition (e.g. misconfiguration or failure) that, if not corrected, would result in no fuel being supplied to one or more engine(s).

This includes: (A) Abnormal fuel transfer between tanks; (B) Trapped fuel; (C) Fuel leaks including in the engines.

Powered by EASA eRules Page 826 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPAR T F – EQUIPMENT (CS - 25) GENERAL (iv) Provide(s) a low fuel level cockpit alert for any tank and/or collector cell that should not become depleted of fuel.

Each alert is such that: (A) It is provided to the flight crew when the usable quantity of fuel in the tank concerned reaches the quantit y required to operate the engine(s) for 30 minutes at cruise conditions; (B) The alert and the fuel quantity indication for that tank are not adversely affected by the same single failure. (See AMC 25.1305(a)(2) ) ( 3) An oil quantity indicator for each oil tank.

(4) An oil pressure indicator for each independent pressure oil system of each engine.

(5) An oil pressure warning means for each engine, or a master warning means for all engines with provision for isolating the individual warning means from the master warning means.

(6) An oil temperature indicator for each engine.

(7) Fire - warning devices that provide visual and audible warning.

(8) An augmentation liquid quantity indicator (appropriate for the man ner in which the liquid is to be used in operation) for each tank.

(b) Reserved.

(c) For turbine engine - powered aeroplanes. In addition to the powerplant instruments required by sub - paragraph (a) of this paragraph, the following powerplant instruments are required: (1) A gas temperature indicator for each engine.

(2) A fuel flow meter indicator for each engine.

(3) A tachometer (to indicate the speed of the rotors with established limiting speeds) for each engine.

(4) A means to indicate, to the flight crew , the operation of each engine starter that can be operated continuously but that is neither designed for continuous operation nor designed to prevent hazard if it failed.

(5) An indicator to indicate the functioning of the powerplant ice protection system for each engine.

(6) An indicator for the fuel strainer or filter required by CS 25.997 to indicate the occurrence of contamination of the strainer or filter before it reaches the capacity established in accordanc e with CS 25.997(d) .

(7) A warning means for the oil strainer or filter required by CS 25.1019 , if it has no bypass, to warn the pilot of the occurrence of contamination of the strainer or filter screen before it reaches the capacity established in accordance with CS 25.1019(a)(2) .

(8) An indicator to indic ate the proper functioning of any heater used to prevent ice clogging of fuel system components.

(9) A vibration indication system that indicates unbalances in engine rotor systems and, when applicable, in propeller rotating assemblies.

Powered by EASA eRules Page 827 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (d) For turbo - jet e ngine - powered aeroplanes. In addition to the powerplant instruments required by sub - paragraphs (a) and (c) of this paragraph, the following powerplant instruments are required: (1) An indicator to indicate thrust, or a parameter that is directly related t o thrust, to the pilot. The indication must be based on the direct measurement of thrust or of the parameters that are directly related to thrust. The indicator must indicate a change in thrust resulting from any engine malfunction, damage or deterioration . (See AMC 25.1305(d)(1) .)

(2) A position indicating means to indicate to the flight crew w hen the thrust reversing device – (i) Is not in the selected position, and (ii) Is in the reverse thrust position, for each engine using a thrust - reversing device.

(e) For turbo - propeller - powered aeroplanes . In addition to the powerplant instruments required by sub - paragraphs (a) and (c) of this paragraph, the following powerplant instruments are required: (1) A torque indica tor for each engine.

(2) Position indicating means to indicate to the flight crew when the propeller blade angle is below the flight low pitch position, for each propeller.

(3) Reserved (f) For aeroplanes equipped with fluid systems (other than fuel) for t hrust or power augmentation , an approved means must be provided to indicate the proper functioning of that system to the flight crew.

[Amdt No: 25/12] [Amdt No: 25/18] [Amdt No: 25/27]

AMC 25.1305(a)(2) Fuel indication system(s)

ED Decision 2012/008/R 0. Related references AMC 25 - 11 Electronic Flight Deck Displays 1. Purpose This AMC provides guidance and means of compliance for demonstrating compliance with CS 25.1305(a)(2) when designing a fuel indication system(s).

2. General objective a. The primary function of fuel indication system(s) is indicating the usable fuel quantity on board an aircraft. Additionally, the fuel indication system(s) provide(s) a ny alert and information to the flight crew to assist them in the task of managing the fuel quantity on board.

b. Service experience indicates that scenarios leading to impending fuel starvation of one or more engines have developed into an unsafe system operating condition. Therefore, such scenarios have to be identified and, as required per CS 25.1309(c) , appropriate Powered by EASA eRules Page 828 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL information should be provided to the flight crew to enable them to take corrective action.

Thi s information, including alerts, is provided in a timely manner so that any unsafe fuel starvation situation can be avoided.

c. The fuel indication system(s) alerts as a minimum inform the flight crew of: — any abnormal fuel transfer; — a trapped fuel situat ion; — the existence of a fuel leak; — a low fuel level situation.

For each alert, corrective actions are made available to the flight crew. This should include for instance: — procedure(s) to identify and isolate the fuel leak; — procedure(s) to correct the a bnormal fuel transfer and/or to manage the trapped fuel situation; — diversion procedure or the instruction to land as soon as possible; — any required procedure to avoid additional hazard (for instance: fuel coming into contact with wheel brakes during land ing when a fuel leak is not isolated; exceeding centre of gravity or fuel imbalance limits).

3. Usable fuel quantity a. The total usable fuel quantity is considered essential information. Operational regulations require the flight crew to regularly check the remaining total usable fuel quantity. This quantity is then evaluated when comparing the actual quantity of fuel used to the planned fuel consumption, and to ensure that sufficient fuel is available to complete the flight with the required fuel reserv e. The total usable fuel quantity is therefore displayed full - time and it is easily and directly readable by the flight crew.

b. As required per CS 25.1337(b) , there is a means to indicate to the flight crew the u sable fuel quantity in each fuel tank. It is considered acceptable that these individual tank quantities be only displayed when required. This may be displayed either at pilot discretion (on demand) or automatically as determined to support operational pro cedures associated with fuel system alerts.

4. Abnormal fuel transfer between tanks The fuel indication system(s) provide(s) any alert and information enabling identification of abnormal fuel transfer between tanks.

Abnormal fuel transfer between tanks is a fuel transfer that - if no corrective action is taken - can lead to no fuel beco ming available to an engine and/or fuel imbalance. This may result either from a fuel management system failure or from inappropriate flight crew action.

5. Trapped fuel The fuel indication system(s) provide(s) any alert and information enabling identifi cation of trapped fuel situations.

Trapped fuel means any fuel quantity (above the unusable fuel quantity) gauged by the FQIS that cannot be supplied to the engine.

Powered by EASA eRules Page 829 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL For instance, failure of an isolation valve in an auxiliary tank, failure of a transfer p ump, fuel pipe failure inside a tank could result in trapped fuel. Also, inappropriate selection of fuel system configuration by the flight crew has to be considered.

6. Fuel leaks The fuel indication system(s) provide(s), as early as practical, any aler t and information enabling the crew to identify a fuel leak.

Fuel leaks can be caused by a loss of integrity of the fuel system (for instance, fuel pipes failures, leakage of connections) and result in fuel being drained overboard the aircraft.

The fuel le aks analysis will identify all foreseeable leakage sources from the aircraft fuel tank(s) to the engine fuel nozzles. For the engines, it means that the effects of leaks upstream and downstream of the engine fuel flow meter have to be considered.

The leak detection may be performed by monitoring and comparing several sources of information (for instance fuel flows, fuel used computation, usable fuel quantities per tank(s) and total usable fuel on board before take - off).

7. Low fuel level alert a. The fuel indication system(s) trigger(s) an alert in case of low fuel level. The low fuel level cockpit alert is applicable to any tank or collector cell that is not expected to be depleted in flight because otherwise this situation would lead to an engine fuel st arvation. Fuel tanks that may normally be depleted during flight do not require a low fuel level alert.

b. The alert is triggered when the quantity of usable fuel in the tank concerned reaches the quantity required to operate an engine for 30 minutes wit h the aircraft operated in optimum cruise conditions. When defining the 30 minutes under optimum cruise conditions the applicant will consider the mission profile for which the aircraft is designed.

c. The safety analysis in accordance with CS 25.1309(b) and (c) includes as a minimum the following failure scenarios: — Erroneous high fuel quantity indication system (FQIS) readings; — Loss of FQIS gauging information.

No single failure of the FQIS (including total loss of FQIS power supply) or total loss of the primary basic FQIS information will lead to the fuel low level alert not being correctly triggered.

[Amdt 25/12]

AMC 25.1305(c)(5) Powerplant ice protection system functioning

indication

ED Decision 2018/005/R In addition to an indication of the functioning of each nacelle ice protection system, an indication of the functioning of each engine ice protection system should be provided under the following conditions: 1. If the engine ice protection system requires a flight crew action to operate it (i.e. the system is manual), and Powered by EASA eRules Page 830 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 2. If the engine ice protection system does not require a flight crew action to operate it (i.e. the system is automatic, or it functions permanently), unless all of the following conditions are met: — The engine thrust/torque and aeroplane performance are not significantly affected by the engine ice protection system switching on/off; — There is no significant effect of the engine ice protection system switching on/off on the flight de ck instruments, controls (such as the throttle lever) and the flight deck environment (such as noise); — The engine ice protection system failures are indicated to the flight crew; and — The indication of the functioning of the engine ice protection system is not used to indicate to the flight crew that the aircraft is operating in an icing environment, requiring, for example, the flight crew to apply an AFM procedure to protect the engine against the effects of the icing environment.

[Amdt 25/21]

AMC 25.1305(d)(1) Powerplant i nstruments

ED Decision 2003/ 2/RM The following are examples of parameters, which are considered to be directly related to thrust; fan RPM(N ), integrated engine pressure ratio (IEPR) and engine pressure ratio ( EPR), depending on engine type.

CS 25.1307 Miscellaneous equipment

ED Decision 2003/2/RM The following is required miscellaneous equipment: (a) Reserved (b) Two or more independent sources of electrical energy.

(c) Electrical protective de vices, as prescribed in this CS - 25 .

(d) Two systems for two - way radio communications, with controls for each accessible from each pilot station, designed and installed so that failure of one system will not preclude operation of the other system. The use of a common antenna system is accep table if adequate reliability is shown.

(e) Two systems for radio navigation, with controls for each accessible from each pilot station, designed and installed so that failure of one system will not preclude operation of the other system. The use of a comm on antenna system is acceptable if adequate reliability is shown.

CS 25.1309 Equipment, systems and installations

ED Decision 2020/001/R (See AMC 25.1309 ) The requirements of this paragraph, except as identified below, are applicable, in addition to specific design requirements of CS - 25, to any equipment or system as installed in the aeroplane. Although this paragraph does not apply to the performance and flight characteristic requirements of Subpart B and the str uctural requirements of Subparts C and D, it does apply to any system on which compliance with any of those requirements is dependent. Jams of flight control surfaces or pilot controls covered by CS 25.671(c)(3) are excepted from the requirements of CS 25.1309(b) (1)(ii) . Certain single failures Powered by EASA eRules Page 831 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL covered by CS 25.735(b) are excepted from the requirements of CS 25.1309(b) . The failure conditions covered by CS 25.810 and CS 25.812 are excepted from the requirements of CS 25.1309(b) . The requirements of CS 25.1309(b) apply to powerplant installations as specified in CS 25.901(c) .

(a) The aeroplane equipment and systems must be designed and installed so that: (1) Those required for type certification or by operating rules, or whose improper functioning would reduce safety, perform as intended u nder the aeroplane operating and environmental conditions.

(2) Other equipment and systems are not a source of danger in themselves and do not adversely affect the proper functioning of those covered by sub - paragraph (a)(1) of this paragraph.

(b) The aerop lane systems and associated components, considered separately and in relation to other systems, must be designed so that - (1) Any catastrophic failure condition (i) is extremely improbable; and (ii) does not result from a single failure; and (2) Any hazardous failure condition is extremely remote; and (3) Any major failure condition is remote; and (4) Any significant latent failure is eliminated as far as practical, or, if not practical to eliminate, the latency of the significant latent failure is mi nimised; and (5) For each catastrophic failure condition that results from two failures, either one of which is latent for more than one flight, it must be shown that: (i) it is impractical to provide additional redundancy; and (ii) given that a single lat ent failure has occurred on a given flight, the failure condition is remote; and (iii) the sum of the probabilities of the latent failures which are combined with each evident failure does not exceed 1/1 000.

(c) Information concerning unsafe system operat ing conditions must be provided to the flight crew to enable them to take appropriate corrective action in a timely manner. Installed systems and equipment for use by the flight crew, including flight deck controls and information, must be designed to mini mise flight crew errors which could create additional hazards.

(d) Electrical wiring interconnection systems must be assessed in accordance with the requirements of CS 25.1709 .

(e) Certification Maintenance Require ments must be established to prevent the development of the failure conditions described in CS 25.1309(b) , and must be included in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness required by CS 25.1529 .

[Amdt 25/5] [Amdt 25/6] [Amdt 25/19] [Amdt 25/20] [Amdt 25/24] Powered by EASA eRules Page 832 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

AMC 25.1309 System d esign and a nalysis

ED Decision 2021/015/R Table of Contents 1. PURPOSE 2. RESERVED 3. RELATED DOCUMENTS a. Advisory Circulars, Acceptable Means of Compliance b. Industry Documents 4. APPLICABILITY OF CS 25.1309 5. DEFINITIONS 6. BACKGROUND a. General b. Fail - Safe Design Concept c. Development of Aeroplane and System Functions 7. FAILURE CONDITION CLASSIFICATIONS AND PROBABILITY TE RMS a. Classifications b. Qualitative Probability Terms c. Quantitative Probability Terms 8. SAFETY OBJECTIVE 9. COMPLIANCE WITH CS 25.1309 a. Compliance with CS 25.1309(a) b. Compliance with CS 25.1309(b) (1) General (2) Planning (3) Availability of Industry Standards and Guidance Materials (4) Acceptable Application of Development Assurance Methods (5) Crew and Maintenance Actions (6) Significant Latent Failures c. Compliance with CS 25.1309(c) 10. IDENTIFICATION OF FAILURE CONDITIONS AND CONSIDERATIONS WHEN ASSESSING THEIR EFFECTS a. Identification of Failure Conditions b. Identification of Failure Conditions Using a Functional Hazard Assessment c. Considerations When Assessing Failure Condition Effects Powered by EASA eRules Page 833 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 11. ASSESSMENT OF FAILURE CONDITION PROBABILITIES AND ANALYSIS CONSIDERATIONS a. Assessment of Failure Condition Probabilities b. Single Failure Considerations c. Common - Cause Failure Considerations d. Depth of Analysis e. Calculation of Average Probability per Flight Hour (Quantitative Analysis) f. Integrated Systems g. Operational or Environmental Conditions h. Justification of Assumptions, Data Sources and Analytical Techniques 12. OPERATIONAL AND MAINTENANCE CONSIDERATIONS a. Flight Crew Action b. Maintenance Action c. C andidate Certification Maintenance Requirements d. Flight with Equipment or Functions known to be Inoperative 13. ASSESSMENT OF MODIFICATIONS TO PREVIOUSLY CERTIFIED AEROPLANES APPENDIX 1. ASSESSMENT METHODS APPENDIX 2. SAFETY ASSESSMENT PROCESS OVERVIEW A PPENDIX 3. CALCULATION OF THE AVERAGE PROBABILITY PER FLIGHT HOUR APPENDIX 4. ALLOWABLE PROBABILITIES APPENDIX 5. EXAMPLE OF LIMIT LATENCY AND RESIDUAL PROBABILITY ANALYSIS 1. PURPOSE.

a. This AMC describes acceptable means for showing compliance with the requirements of CS 25.1309 . These means are intended to provide guidance to supplement the engineering and operational judgement that must form th e basis of any compliance demonstration.

b. The extent to which the more structured methods and guidelines contained in this AMC should be applied is a function of systems complexity and systems failure consequence.

In general, the extent and structure of the analyses required to show compliance with CS 25.1309 will be greater when the system is more complex and the effects of the Failure Conditions are more severe. This AMC is not intended to require that the more structured techniques introduced in this revision be applied where traditional techniques have been shown to be acceptable for more traditional systems designs. The means described in this AMC are not mandatory. Other means may be used if they show complia nce with CS 25.1309 .

Powered by EASA eRules Page 834 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 2. RESERVED.

3. RELATED DOCUMENTS.

The following guidance and advisory materials are referenced herein: a. Advisory Circulars, Acceptable Means of Compliance.

(1) AMC 25.1322 Alerting Systems.

(2) AC 25.19/ AMC 25.19 Certification Maintenance Requirements.

(3) AMC 20 - 115 Software Considerations for Airborne Systems and Equipment Certification (4) AMC 25. 901 (c) Safety Assessment of Powerplant Installations.

b. Industry documents.

(1) RTCA, Inc., Doc ument No. DO - 160D/EUROCAE ED - 14G , Environmental Conditions and Test Procedures for Airborne Equipment.

( 2 ) Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 4754 A /EUROCAE ED - 79 A , Guidelines for development of civil aircraft and systems .

(3 ) Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.

4. APPLICABILITY OF CS 25.1309 .

Paragraph 25.1309 is intended as a general requirement that should be applied to any equipment or system as installed, in addition to specific systems requirement s, except as indicated below.

a. While CS 25.1309 does not apply to the performance and flight characteristics of Subpart B and structural requirements of Subparts C and D, it does apply to any system on which comp liance with any of those requirements is based. For example, it does not apply to an aeroplane's inherent stall characteristics or their evaluation, but it does apply to a stall warning system used to enable compliance with CS 25.207 .

b. Jams of flight control surfaces or pilot controls that are covered by CS 25.671(c)(3) are excepted from the requirements of CS 25.1309(b)(1)(ii ).

c. Certain single failures covered by CS 25.735(b)(1) are excepted from the requirements of CS 25.1309(b) . The reason concerns the brake system requirement that limits the ef fect of a single failure to doubling the brake roll stopping distance. This requirement has been shown to provide a satisfactory level of safety without the need to analyse the particular circumstances and conditions under which the single failure occurs.

d. The failure conditions covered by CS 25.810 and CS 25.812 are excepted from the requirements of CS 25.1309(b) . The se f ailure c o nditions related to loss of function are associated with varied evacuation scenarios for which the probability cannot be determined. It has not been proven possible to define appropriate scenarios under which compliance with CS 25.1309(b) can be demonstrated. It is therefore considered more practical to require particular design features or specific reliability demonstrations as described in CS 25.810 and CS 25.812 . Traditionally, this approach has been found to be acceptable.

Powered by EASA eRules Page 835 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQ UIPMENT (CS - 25) GENERAL e. The requirements of CS 25.1309 are generally applicable to engine, propeller, and propulsion system installations. The specific applicability and exceptions are stated in CS 25.901(c) .

f. Some systems and some functions already receive an evalu ation to show compliance with specific requirements for specific f ailure c onditions and , therefore , meet the intent of CS 25.1309 without the need for additional analysis for those specific f ailure c onditions.

g. T he safety assessment process should consider all phases during flight and on ground when the aeroplane is in service. While this includes the conditions associated with the pre - flight preparation, embarkation and disembarkation, taxi phase, etc., it, there fore, does not include periods of shop maintenance, storage, or other out - of - service activities.

Where relevant, the effects on persons other than the aeroplane occupants should be taken into account when assessing failure conditions in compliance with CS 25.1309.

5. DEFINITIONS.

The following definitions apply to the system design and analysis requirements of CS 25.1309 and the guidance material provided in this AMC. They should not be assumed to apply to the same or similar terms used in other regulations or AMCs. Terms for which standard dictionary definitions apply are not defined herein.

a. Analysis. The terms "analy sis" and "assessment" are used throughout. Each has a broad definition and the two terms are to some extent interchangeable. However, the term analysis generally implies a more specific, more detailed evaluation, while the term assessment may be a more gen eral or broader evaluation but may include one or more types of analysis. In practice, the meaning comes from the specific application, e.g., fault tree analysis, Markov analysis, Preliminary System Safety Assessment, etc.

b. Assessment. See the definition of analysis above.

c. At - Risk Time. The period of time during which an item must fail in order to cause the failure effect in question. This is usually associated with the final fault in a fault sequence leading to a specific failure co ndition.

d . Average Probability Per Flight Hour. For the purpose of this AMC, is a representation of the number of times the subject Failure Condition is predicted to occur during the entire operating life of all aeroplanes of the type divided by the antic ipated total operating hours of all aeroplanes of that type (Note: The Average Probability Per Flight Hour is normally calculated as the probability of a Failure Condition occurring during a typical flight of mean duration divided by that mean duration).

e . Candidate Certification Maintenance Requirements (CCMR). A periodic maintenance or flight crew check may be used in a safety analysis to help demonstrate compliance with CS 25.1309(b) for h azardous and c atastroph ic f ailure c onditions. Where such checks cannot be accepted as basic servicing or airmanship they become Candidate Certification Maintenance Requirements (CCMRs). AMC 25.19 defines a method by which Certification M aintenance Requirements (CMRs) are identified from the candidates. A CMR becomes a required periodic maintenance check identified as an operating limitation of the type certificate for the aeroplane.

f . Check. An examination (e.g., an inspection or test) to determine the physical integrity and/or functional capability of an item.

g . Complex. A system is Complex when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods.

Powered by EASA eRules Page 836 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL h. Complexity . An attribute of functions, systems or items, which makes their operation, failure modes, or failure effects difficult to comprehend without the aid of analytical methods.

i . Conventional. A system is considered to be Conv entional if its functionality, the technological means used to implement its functionality, and its intended usage are all the same as, or closely similar to, that of previously approved systems that are commonly - used.

j . Design Appraisal. This is a qualit ative appraisal of the integrity and safety of the system design.

k . Development Assurance. All those planned and systematic actions used to substantiate, to an adequate level of confidence, that errors in requirements, design, and implementation have been identified and corrected such that the system satisfies the applicable certification basis.

l . Development Error. A mistake in requirements, design, or implementation.

m . Error . An omission or incorrect action by a crewmember or maintenance personnel, or a development error (e.g. mistake in requirements determination, design, or implementation).

n . Event. An occurrence which has its origin distinct from the aeroplane, such as atmospheric conditions (e.g. gusts, temperature variations, icing and lightning s trikes), runway conditions, conditions of communication, navigation, and surveillance services, bird - strike, cabin and baggage fires. The term is not intended to cover sabotage.

o. Exposure Time. The period of time between the time when an item was last kn own to be operating properly and the time when it will be known to be operating properly again.

p. Failure. An occurrence, which affects the operation of a component, part, or element such that it can no longer function as intended, (this includes both los s of function and malfunction). Note: Errors may cause Failures, but are not considered to be Failures.

q . Failure Condition. A condition having an effect on the aeroplane and/or its occupants, either direct or consequential, which is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events.

r . Installation Appraisal. This is a qualitative appraisal of the integrity and safety of the installation. Any deviations from normal, industry - accepted installation practices, such as clearances or tolerances, should be evaluated, es pecially when appraising modifications made after entry into service.

s. Item. A hardware or software element having bounded and well - defined interfaces.

t . Latent Failure. A failure is latent until it is made known to the flight crew or maintenance person nel.

u . Qualitative. Those analytical processes that assess system and aeroplane safety in an objective, nonnumerical manner.

v . Quantitative. Those analytical processes that apply mathematical methods to assess system and aeroplane safety.

w . Redundancy. The presence of more than one independent means for accomplishing a given function or flight operation.

Powered by EASA eRules Page 837 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL x. Significant Latent Failure. A latent failure that would, in combination with one or more specific failure(s) or event(s), result in a hazardous or ca tastrophic failure condition.

y. System . A combination of interrelated items arranged to perform one or more specific functions.

6. BACKGROUND a. General For a number of years aeroplane systems were evaluated to specific requirements, to the " ʽsingle fault’ " criterion, or to the fail - safe design concept. As later - generation aeroplanes developed, more safety - critical functions were required to be performed, which generally resulted in an increase in the complexity of the systems designed to perform these functions. The potential hazards to the aeroplane and its occupants which could arise in the event of loss of one or more functions provided by a system or t hat system's malfunction had to be considered, as also did the interaction between systems performing different functions. This has led to the general principle that an inverse relationship should exist between the probability of a failure condition and it s effect on the aeroplane and/or its occupants (see Figure 1). In assessing the acceptability of a design it was recognised that rational probability values would have to be established.

Historical evidence indicated that the probability of a serious accid ent due to operational and airframe - related causes was approximately one per million hours of flight.

Furthermore, about 10 % of the total were attributed to failure conditions caused by the aeroplane's systems. It seems reasonable that serious accidents c aused by systems should not be allowed a higher probability than this in new aeroplane designs. It is reasonable to expect that the probability of a serious accident from all such failure - 7 conditions be not greater than one per ten million flight hours or 1 × 10 per flight hour for a newly designed aeroplane. The difficulty with this is that it is not possible to say whether the target has been met until all the systems on the aeroplane are collectively analysed numerically. For this reason it was assumed, arbitrarily, that there are about one hundred potential failure conditions in an aeroplane, which could be C catastrophic.

- 7 The target allowable average probability per flight hour of 1 × 10 was thus apportioned equally among these failure conditions, res ulting in an allocation of not greater than 1 × - 9 10 to each. The upper limit for the average probability per flight hour for catastrophic - 9 failure conditions would be 1 × 10 , which establishes an approximate probability value for the term ʽextremely impr obable’. Failure conditions having less severe effects could be relatively more likely to occur.

b. Fail - Safe Design Concept.

The CS - 25 airworthiness standards are based on, and incorporate, the objectives and principles or techniques of the fail - safe desi gn concept, which considers the effects of failures and combinations of failures in defining a safe design.

(1) The following basic objectives pertaining to failures apply: (i) In any system or subsystem, the failure of any single element, component, or co nnection during any one flight should be assumed, regardless of its probability. Such single failures should not be catastrophic.

(ii) Subsequent failures of related systems during the same flight, whether detected or latent, and combinations thereof, shou ld also be considered.

Powered by EASA eRules Page 838 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (2) The fail - safe design concept uses the following design principles or techniques in order to ensure a safe design. The use of only one of these principles or techniques is seldom adequate. A combination of two or more is usually needed to provide a fail - safe design; i.e. to ensure that major failure conditions are remote, hazardous failure conditions are extremely remote, and catastrophic failure conditions are extremely improbable: (i) Designed Integrity and Quality, including L ife Limits , to ensure intended function and prevent failures.

(ii) Redundancy or Backup Systems to enable continued function after any single (or other defined number of) failure(s); e.g., two or more engines, hydraulic systems, flight control systems, etc .

(iii) Isolation and/or Segregation of Systems, Components, and Elements so that the failure of one does not cause the failure of another.

(iv) Proven Reliability so that multiple, independent failures are unlikely to occur during the same flight.

(v) Failure Warning or Indication to provide detection.

(vi) Flight crew Procedures specifying corrective action for use after failure detection.

(vii) Checkability: th e capability to check a component's condition.

(viii) Designed Failure Effect Limits , including the capability to sustain damage, to limit the safety impact or effects of a failure.

(ix) Designed Failure Path to control and direct the effects of a failur e in a way that limits its safety impact.

(x) Margins or Factors of Safety to allow for any undefined or unforeseeable adverse conditions.

(xi) Error - Tolerance that considers adverse effects of foreseeable errors during the aeroplane's design, test, manu facture, operation, and maintenance.

c. Development of Aeroplane and System Functions.

(1) A concern arose regarding the efficiency and coverage of the techniques used for assessing safety aspects of aeroplane and systems functions implemented through the use of electronic technology and software - based techniques. The concern is that design and analysis techniques traditionally applied to deterministic risks or to conventional, non - complex systems may not provide adequate safety coverage for these aeroplan e and system functions. Thus, other assurance techniques, such as development assurance utilising a combination of integral processes (e.g.

process assurance, configuration management, requirement validation and implementation verification), or structured analysis or assessment techniques applied at the aeroplane level and across integrated or interacting systems, have been requested. Their systematic use increases confidence that development errors and integration or interaction effects have been adequatel y identified and corrected.

(2) Considering the above developments, as well as revisions made to the CS 25.1309 , this AMC was revised to include new approaches, both qualitative and quantitative, which may be used to assist in determining safety requirements and Powered by EASA eRules Page 839 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL establishing compliance with these requirements, and to reflect revisions in the rule, considering the whole aeroplane and its systems. It also provides guidance for determining when, or if, particular analy ses or development assurance actions should be conducted in the frame of the development and safety assessment processes. Numerical values are assigned to the probabilistic terms included in the requirements for use in those cases where the impact of syste m failures is examined by quantitative methods of analysis. The analytical tools used in determining numerical values are intended to supplement, but not replace, qualitative methods based on engineering and operational judgement.

7. FAILURE CONDITION CLASSIFICATIONS AND PROBABILITY TERMS a. Classifications.

Failure conditions may be classified according to the severity of their effects as follows: (1) No Safety Effect : Failure conditions that would have no effect on safety; for example, failure conditions that would not affect the operational capability of the aeroplane or increase crew workload.

(2) Minor : Failure conditions which would not significantly reduce aeroplane safety, and which involve crew actions that are well withi n their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in crew workload, such as routine flight plan changes, or some physical discomfort to passengers or cabin crew.

(3) Major : Failure conditions which would reduce the capability of the aeroplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or f unctional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, or discomfort to the flight crew, or physical distress to passengers or cabin crew, possibly including injuries.

(4) Hazardous : Failure conditions , which would reduce the capability of the aeroplane or the ability of the crew to cope with adverse operating , conditions to the extent that there would be: (i) A large reduction in safety margins or functional capabilities; (ii) Physical distress or excess ive workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely; or (iii) Serious or fatal injury to a relatively small number of the occupants other than the flight crew.

(5) Catastrophic : Failure conditions , w hich would result in multiple fatalities, usually with the loss of the aeroplane.

(Note: A failure condition which would prevent continued safe flight and landing should be classified catastrophic unless otherwise defined in other specific AMCs.

For flight control systems, continued safe flight and landing is defined in AMC 25.671, paragraphs 4 and 7 .)

b. Qualitative Probability Terms.

When using qualitative analyses to determine compliance with CS 25.1309(b) , the following descriptions of the probability terms used in CS 25.1309 and this AMC have become commonly accepted as aids to engineering judgement: Powered by EASA eRules Page 840 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (1) Probable failure conditio ns are those anticipated to occur one or more times during the entire operational life of each aeroplane.

(2) Remote failure conditions are those unlikely to occur to each aeroplane during its total life, but which may occur several times when considering the total operational life of a number of aeroplanes of the type.

(3) Extremely remote failure conditions are those not anticipated to occur to each aeroplane during its total life but which may occur a few times when considering the total operational life of all aeroplanes of the type.

(4) Extremely improbable failure conditions are those so unlikely that they are not anticipated to occur during the entire operational life of all aeroplanes of one type.

c. Quantitative Probability Terms.

When using quantit ative analyses to help determine compliance with CS 25.1309(b) , the following descriptions of the probability terms used in this requirement and this AMC have become commonly accepted as aids to engineering judgeme nt. They are expressed in terms of acceptable ranges for the average probability per flight hour.

(1) Probability Ranges.

(i) Probable failure conditions are those having average probability per flight - 5 hour greater than of the order of 1 × 10 .

(ii) Remote failure conditions are those having an average probability per flight - 5 - hour of the order of 1 × 10 or less, but greater than of the order of 1 × 10 .

(iii) Extremely remote failure conditions are those having an average probability - 7 per flight hour of the order of 1 × 10 or less, but greater than of the order - 9 of 1 × 10 .

(iv) Extremely improbable failure conditions are those having an average - 9 probability per flight hour of the order of 1 × 10 or less.

8. SAFETY OBJECTIVE.

a. The objective of CS 25.1309 is to ensure an acceptable safety level for equipment and systems as installed on the aeroplane. A logical and acceptable inverse relationship must exist between the average probability per flight hour and the severity of failure condition effects, as shown in Figure 1, such that: (1) Failure conditions with no safety effect have no probability requirement.

(2) Minor failure conditions may be probable.

(3) Major failure conditions must be no more frequent than remote.

(4) Hazardous failure conditions must be no more frequent than extremely remote.

(5) Catastrophic failure conditions must be extremely improbable.

Powered by EASA eRules Page 841 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Figure 1: Relationship between Probability and Severity of Failure Condition E ffects b. The classification of the f ailure c onditions associated with the severity of their effects are described in Figure 2a.

The safety objectives associated with f ailure c onditions are described in Figure 2 b .

Figure 2a: Relationship Between Severity of the Effects and Classification of Failure Conditions Effect on No effect on Slight Significant Large reduction Normally with Aeroplane operational reduction in reduction in in functional hull loss capabilities or functional functional capabilities or safety capabilities or c apabilities or safety margins safety margins safety margins Effect on Inconvenience Physical Physical Serious or fatal Multiple Occupants discomfort distress, injury to a small fatalities excluding possibly number of Flight Crew including passengers or injuries cabin crew Effect on No effect on Slight increase Physical Physical distress Fatalities or Severity of the Effects Flight Crew flight crew in workload discomfort or a or excessive incapacitation significant workload increase in impairs ability to workload perform tasks Classification of No Safety Minor Major Hazardous Catastrophic Failure Conditions Effect Figure 2 b : Relationship Between Classification of Failure Conditions and Probability Classification of No Safety Minor Major Hazardous Catastrophic Failure Conditions Effect Allowable No Probability < - Probable - > < -- Remote -- > Extremely Extremely Qualitative Requirement < -------------- > Improbable Probability Remote Allowable No Probability < -------------- > < -------------- > < -------------- > Quantitative Requirement Powered by EASA eRules Page 842 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 3 - 5 - 7 - 9 Probability: <10 - <10 <10 <10 Average Probability per Flight Hour on Note 1 the Order of: Note 1: A numerical probability range is provided here as a reference. The applicant is not required to perform a quantitative analysis, nor substantiate by such an analysis, that this numerical criteria has been met for Minor Failure Conditions. Current transport category aeroplane products are regarded as meeting this standard simply by using current commonly - accepted industry practice.

c. The safety objectives associated with catastrophic failure conditions must be satisfied by demonstrating that: (1) No single failure will result in a catastrophic failure condition ; and (2) Each catastrophic failure condition is extremely improbable; and (3) Given that a single latent failure has occurred on a given flight, each catastrophic failure condition, resultin g from two failures, either of which is latent for more than one flight, is remote.

9. COMPLIANCE WITH CS 25.1309 .

This paragraph describes specific means of compliance for CS 25.1309 . The applicant should obtain early concurrence of the certification authority on the choice of an acceptable means of compliance.

a. Compliance with CS 25.1309(a) .

(1) Equipment covered by CS 25.1309(a)(1) must be shown to function properly when installed. The aeroplane operating and environmental conditions over which proper functioning of the equipment, systems, and installation is required to be considered includes th e full normal envelope of the aeroplane as defined by the Aeroplane Flight Manual operating limitations together with any modification to that envelope associated with abnormal or emergency procedures. Other external environmental conditions such as atmosp heric turbulence, HIRF, lightning, and precipitation, which the aeroplane is reasonably expected to encounter, should also be considered. The severity of the external environmental conditions , which should be considered , are limited to those established by certification standards and precedence.

(2) In addition to the external operating and environmental conditions, the effect of the environment within the aeroplane should be considered. These effects should include vibration and acceleration loads, variati ons in fluid pressure and electrical power, fluid or vapour contamination, due either to the normal environment or accidental leaks or spillage and handling by personnel. Document referenced in paragraph 3b(1) defines a series of standard environmental tes t conditions and procedures, which may be used to support compliance. Equipment covered by (CS) Technical Standard Orders containing environmental test procedures or equipment qualified to other environmental test standards can be used to support complianc e. The conditions under which the installed equipment will be operated should be equal to or less severe than the environment for which the equipment is qualified.

(3) The required substantiation of the proper functioning of equipment, systems, and install ations under the operating and environmental conditions approved for the aeroplane may be shown by test and/or analysis or reference to comparable Powered by EASA eRules Page 843 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL service experience on other aeroplanes. It must be shown that the comparable service experience is valid for the proposed installation. For the equipment systems and installations covered by CS 25.1309(a)(1) , the compliance demonstration should also confirm that the normal functioning of such equipment, systems, and insta llations does not interfere with the proper functioning of other equipment, systems, or installations covered by CS 25.1309(a)(1) .

(4) The equipment, systems, and installations covered by CS 25.1309(a)(2) are typic ally those associated with amenities for passengers such as passenger entertainment systems, in - flight telephones, etc., whose failure or improper functioning in itself should not affect the safety of the aeroplane. Operational and environmental qualificat ion requirements for those equipment, systems, and installations are reduced to the tests that are necessary to show that their normal or abnormal functioning does not adversely affect the proper functioning of the equipment, systems, or installations cove red by CS 25.1309(a)(1) and does not otherwise adversely influence the safety of the aeroplane or its occupants. Examples of adverse influences are: fire, explosion, exposing passengers to high voltages, etc.

Normal installation practices should result in sufficiently obvious isolation so that substantiation can be based on a relatively simple qualitative installation evaluation. If the possible impacts, including failure modes or effects, are questionable, or isolation between systems is provided by comple x means, more formal structured evaluation methods may be necessary.

b. Compliance with CS 25.1309(b) .

Paragraph 25.1309(b) requires that the aeroplane systems and associated components, considered separately and in relation to other systems, must be designed so that any catastrophic failure condition is extremely improbable and does not result from a single failure. It also r equires that any hazardous failure condition is extremely remote, and that any major failure condition is remote. An analysis should always consider the application of the fail - safe design concept described in paragraph 6.b, and give special attention to e nsuring the effective use of design techniques that would prevent single failures or other events from damaging or otherwise adversely affecting more than one redundant system channel or more than one system performing operationally similar functions.

(1) General. Compliance with the requirements of CS 25.1309(b) should be shown by analysis and, where necessary, by appropriate ground, flight, or simulator tests.

Failure condition s should be identified and their eff ects assessed. The maximum allowable probability of the occurrence of each failure condition is determined from the failure condition ’s effects, and when assessing the probabilities of failure condition s, appropriate analysis considerations should be accou nted for. Any analysis must consider: (i) Possible failure condition s and their causes, modes of failure, and damage from sources external to the system.

(ii) The possibility of multiple failures and undetected failures.

(iii) The possibility of requiremen t, design and implementation errors.

(iv) The effect of reasonably anticipated crew errors after the occurrence of a failure or f ailure c ondition.

(v) The effect of reasonably anticipated errors when performing maintenance actions.

Powered by EASA eRules Page 844 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) G ENERAL (vi) The crew alerting c ues, corrective action required, and the capability of detecting faults.

(vii) The resulting effects on the aeroplane and occupants, considering the stage of flight, the sequence of events/failures occurrence when relevant, and operating and environmental conditions.

(2) Planning. This AMC provides guidance on methods of accomplishing the safety objective. The detailed methodology needed to achieve this safety objective will depend on many factors, in particular the degree of systems complexity and integrat ion. For aeroplanes containing many complex or integrated systems, it is likely that a plan will need to be developed to describe the intended process. This plan should include consideration of the following aspects: (i) Functional and physical interrelationships of systems.

(ii) Determination of detailed means of compliance, which should include development assurance activities.

(iii) Means for establishing the accomplishment of the plan.

(3) Availability of Industry Standards and Guidance Materials . There are a variety of acceptable techniques currently being used in industry, which may or may not be reflected in the documents referenced in paragraphs 3.b(2) and 3.b(3). This AMC is not intended to compel the use of these documents during the definition of the particular method of satisfying the objectives of this AMC. However, these documents do contain material and methods of performing the system safety assessment. These methods, when correctly applied, are recognised by EASA as v alid for showing compliance with CS 25.1309(b) . In addition, the Document referenced in paragraph 3.b(3) contains tutorial information on applying specific engineering methods (e.g. Markov analysis, fault tree anal ysis) that may be utilised in whole or in part.

(4) Acceptable Application of Development Assurance Methods . Paragraph 9.b(1)(iii) above requires that any analysis necessary to demonstrate compliance with CS 25.130 9(b) must consider the possibility of development errors. Errors made during the design and development of systems have traditionally been detected and corrected by exhaustive tests conducted on the system and its components, by direct inspection, and by o ther direct verification methods capable of completely characterising the performance of the system. These direct techniques may still be appropriate for systems containing non - complex items (i.e. items that are fully assured by a combination of testing an d analysis) that perform a limited number of functions and that are not highly integrated with other aeroplane systems. For more complex or integrated systems, exhaustive testing may either be impossible because all of the system states cannot be determine d or impractical because of the number of tests that must be accomplished. For these types of systems, compliance may be demonstrated by the use of development assurance.

The level of development assurance (function development assurance level (FDAL)/item development assurance level (IDAL)) should be commensurate with the severity of the failure conditions the system is contributing to.

Guidelines, which may be used for the assignment of development assurance levels to aeroplanes and system functions (FDAL) and to items (IDAL), are described in the Document referenced in 3.b(2) above. Through this Document, EASA Powered by EASA eRules Page 845 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL recognises that credit can be taken from system architecture (e.g. functional or item development independence) for the FDAL/IDAL assignment process .

Guidelines, which may be used for providing development assurance, are described for aeroplane and system development in the Document referenced in 3.b(2), and for software in the Document referenced in 3.a(3) above. (There is currently no agreed develop ment assurance standard for airborne electronic hardware.)

(5) Crew and Maintenance Actions .

(i) Where an analysis identifies some indication to, and/or action by, the flight crew, cabin crew, or maintenance personnel, the following activities should be ac complished: 1 Verify that any identified indications are actually provided by the system. This includes the verification that the elements that provide detection (e.g. sensors, logic) properly trigger the indication under the relevant situations considerin g various causes, flight phases, operating conditions, operational sequences, and environments.

2 Verify that any identified indications will, in fact, be recognised.

3 Verify that any actions required have a reasonable expectation of being accomplished s uccessfully and in a timely manner.

(ii) These verification activities should be accomplished by consulting with engineers, pilots, flight attendants, maintenance personnel, and human factors specialists, as appropriate, taking due consideration of any re levant service experience and the consequences if the assumed action is not performed or performed improperly.

(iii) In complex situations, the results of the review by specialists may need to be confirmed by simulator, ground tests, or flight tests. However, quantitative assessments of the probabilities of crew or maintenance errors are not currently considered feasible. If the failure indications are considered to be recognisable and the required actions do not cause an excessive workload, then for t he purposes of the analysis, such corrective actions can be considered to be satisfactorily accomplished. If the necessary actions cannot be satisfactorily accomplished, the tasks and/or the systems need to be modified.

(6) Significant Latent Failures.

(i) Compliance with CS 25.1309(b)(4) For compliance with CS 25.1309(b)(4), the hereafter systematic approach should be followed: 1. The applicant must first eliminate significant latent failures to the maximum practic al extent utilising the current state - of - the - art technology, e.g. implement practical and reliable failure monitoring and flight crew indication systems to detect failures that would otherwise be latent for more than one flight. Additional guidance is prov ided in AMC 25 - 19 Section 8, Design Considerations Related to Significant Latent Failures.

Powered by EASA eRules Page 846 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 2. For each significant latent failure which cannot reasonably be eliminated, the applicant must minimise the exposure time by design utilising current state - of - the - art technology rather than relying on scheduled maintenance tasks at lengthy intervals, i.e. implementing pilot - initiated checks, or self - initiated checks (e.g. first flight of the day check, power - up built - in tests, other system automated checks).

3. When relying on scheduled maintenance tasks, quantitative as well as qualitative aspects need to be addressed when limiting the latency.

Additional guidance is provided in AMC 25 - 19 Section 10, Identification of Candidate CMRs (CCMRs).

Note: For turbojet thrus t reversing systems, the design configurations in paragraphs 8.b(2) and 8.b(3) of AMC 25.933(a)(1) have traditionally been considered to be acceptable to EASA for compliance with CS 25.1309(b)(4).

(ii) Compliance w ith CS 25.1309(b)(5) When a catastrophic failure condition involves two failures, either one of which is latent for more than one flight, and cannot reasonably be eliminated, compliance with CS 25.1309(b)(5) is re quired. Following the proper application of CS 25.1309(b)(4), the failure conditions involving multiple significant latent failures are expected to be sufficiently unlikely such that the dual - failure situations addressed in CS 25.1309(b)(5) are the only re maining significant latent failures of concern.

These significant latent failures of concern should be highlighted to EASA as early as possible. The system safety assessment should explain why avoidance is not practical, and provide supporting rationale for the acceptability. Rationale should be based on the proposed design being state - of - the - art, past experience, sound engineering judgment, or other arguments, which led to the decision not to implement other potential means of avoidance (e.g. e liminating the significant latent failure or adding redundancy).

Two criteria are implemented in CS 25.1309(b)(5) : limit latency and limit residual probability.

Limit latency is intended to limit the time of opera ting with one evident failure away from a catastrophic failure condition. This is achieved by requiring that the sum of the probabilities of the latent failures, which are combined with each evident failure, does not exceed 1/1 000. Taking one catastrophic failure condition at a time, — in case an evident failure is combined only once in a dual failure combination of concern, the probability of the individual latent failure needs to comply with the 1/1 000 criterion; — in case an evident failure is combined in multiple dual failure combinations of concern, the combined probabilities of the latent failures need to comply with the 1/1 000 criterion.

Limit residual probability is intended to limit the average probability per flight hour of the failure condition giv en the presence of a single latent failure. This is achieved by defining the residual probability to be ‘remote’.

Residual probability is the combined average probability per flight hour of Powered by EASA eRules Page 847 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL all the single active failures that result in the catastrophic fai lure condition assuming one single latent failure has occurred.

These requirements are applied in addition to CS 25.1309(b)(1), which requires that catastrophic failure conditions be shown to be extremely improbable and do not result from a single failure.

Appendix 5 provides simplified examples explaining how the limit latency and limit residual probability analysis might be applied.

For compliance with the 1/1 000 criterion, the probability of the latent failures of concern should be derived from the prob ability of the worst - case flight, i.e. the probability where the evident failure occurs in the last flight before the scheduled maintenance inspection, while the latent failure may have occurred in any flight between two consecutive scheduled maintenance i nspections. When dealing with constant failure rates, the probability of the latent failure should be computed as the product of the maximum time during which the failure may be present (i.e. exposure time) and its failure rate, if this probability is less than or equal to 0.1.

c. Compliance with CS 25.1309(c) .

CS 25.1309(c) requires that information concerning unsafe system operating conditions must be provided to the crew to enable them to take appropriate corrective action in a timely manner, thereby mitigating the effects to an acceptable level. Any system operating condit ion that, if not detected and properly accommodated by flight crew action, would contribute to or cause a hazardous or catastrophic failure condition should be considered to be an ‘unsafe system operating condition’. Compliance with this requirement is usu ally demonstrated by the analysis identified in paragraph 9.b(1) above, which also includes consideration of crew alerting cues, corrective action required, and the capability of detecting faults. The required information may be provided by dedicated indic ation and/or annunciation or made apparent to the flight crew by the inherent aeroplane/systems responses. When flight crew alerting is required, it must be provided in compliance with CS 25.1322 . CS 25.1309(c) als o requires that installed systems and equipment for use by the flight crew, including flight deck controls and information, be designed to minimise flight crew errors that could create additional hazards (in compliance with CS 25.1302 ).

(1) The required information will depend on the degree of urgency for recognition and corrective action by the cr ew. It should be in the form of : (i) a warning, if immediate recognition and corrective or compensatory action by the c rew is required; (ii) a caution if immediate crew awareness is required and subsequent crew action will be required; (iii) an advisory, if crew awareness is required and subsequent crew action may be required; (iv) a message in the other cases.

CS 25.1322 (and AMC 25.1322 ) give further requirements (and guidance) on the characteristics of the information required (visual, aural) based on those different categories.

Powered by EASA eRules Page 848 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (2) When failure monitoring and indication are provided by a system, its reliability should be compatible with the safety objectives associated with the system function for which it provides that indication. For example, if the effects of having a system failure a nd not annunciating that system failure are catastrophic, the combination of the system failure with the failure of its annunciation must be extremely improbable. The loss of annunciation itself should be considered a failure condition, and particular atte ntion should be paid to the impact on the ability of the flight crew to cope with the subject system failure. In addition, unwanted operation (e.g. nuisance warnings) should be assessed. The failure monitoring and indication should be reliable, technologic ally feasible, and economically practical. Reliable failure monitoring and indication should utilise current state - of - the - art technology to maximise the probability of detecting and indicating genuine failures while minimising the probability of falsely de tecting and indicating non - existent failures. Any indication should be timely, obvious, clear, and unambiguous.

(3) In the case of aeroplane conditions requiring immediate crew action, a suitable warning indication must be provided to the crew, if not provided by inherent aeroplane characteristics. In either case, any warning should be rousing and should occur at a point in a potentially catastrophic sequence where the aeroplane's capability and the crew's ability still remain sufficient for effective c rew action.

(4) Unless they are accepted as normal airmanship, procedures for the crew to follow after the occurrence of failure warning should be described in the approved Aeroplane Flight Manual (AFM) or AFM revision or supplement.

(5) Even if operation or performance is unaffected or insignificantly affected at the time of failure, information to the crew is required if it is considered necessary for the crew to take any action or observe any precautions. Some examples include reconfiguring a system, bei ng aware of a reduction in safety margins, changing the flight plan or regime, or making an unscheduled landing to reduce exposure to a more severe failure condition that would result from subsequent failures or operational or environmental conditions. Inf ormation is also required if a failure must be corrected before a subsequent flight. If operation or performance is unaffected or insignificantly affected, information and alerting indications may be inhibited during specific phases of flight where correct ive action by the crew is considered more hazardous than no action.

(6) The use of periodic maintenance or flight crew checks to detect significant latent failures when they occur is undesirable and should not be used in lieu of practical and reliable fail ure monitoring and indications. When this is not accomplished, refer to paragraph 9.b(6) for guidance.

Paragraph 12 provides further guidance on the use of periodic maintenance or flight crew checks. Comparison with similar, previously approved systems is sometimes helpful. However, if a new technical solution allows practical and reliable failure monitoring and indications, this should be preferred in lieu of periodic maintenance or flight crew checks.

(7) Particular attention should be given to the placement of switches or other control devices, relative to one another, so as to minimise the potential for inadvertent incorrect crew action, especially during emergencies or periods of high workload.

Extra protection, such as the use of guarded switches , may sometimes be needed.

Powered by EASA eRules Page 849 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL 10. IDENTIFICATION OF FAILURE CONDITIONS AND CONSIDERATIONS WHEN ASSESSING THEIR EFFECTS.

a. Identification of Failure Conditions .

Failure conditions should be identified by considering the potential effects of failures on the a eroplane and occupants. These should be considered from two perspectives: (1) by considering failures of aeroplane - level functions — failure condition s identified at this level are not dependent on the way the functions are implemented and the systems' arc hitecture.

(2) by considering failures of functions at the system level — these failure condition s are identified through examination of the way that functions are implemented and the systems' architectures. It should be noted that a failure condition migh t result from a combination of lower - level failure condition s. This requires that the analysis of complex, highly integrated systems, in particular, should be conducted in a highly methodical and structured manner to ensure that all significant failure con dition s, that arise from multiple failures and combinations of lower - level failure condition s, are properly identified and accounted for. The relevant combinations of failures and failure condition s should be determined by the whole safety assessment proce ss that encompasses the aeroplane and system level functional hazard assessments and common - cause analyses. The overall effect on the aeroplane of a combination of individual system failure condition s occurring as a result of a common or cascade failure, m ay be more severe than the individual system effect. For example, failure condition s classified as minor or major by themselves may have hazardous effects at an aeroplane level, when considered in combination.

b. Identification of Failure Conditions Using a Functional Hazard Assessment .

(1) Before a detailed safety assessment is proceeded with, a functional hazard assessment (FHA) of the aeroplane and system functions to determine the need for and scope of subsequent analysis should be prepared. This assess ment may be conducted using service experience, engineering and operational judgement, and/or a top - down deductive qualitative examination of each function. An FHA is a systematic, comprehensive examination of aeroplane and system functions to identify pot ential minor, major, hazardous, and catastrophic failure condition s that may arise, not only as a result of malfunctions or failure to function, but also as a result of normal responses to unusual or abnormal external factors. It is concerned with the operational vulnerabilities of systems rather than with a detailed analysis of the actual implementation.

(2) Each system function should be examined with respect to the other functions performed by the system, because the loss or malfunction of all functi ons performed by the system may result in a more severe failure condition than the loss of a single function. In addition, each system function should be examined with respect to functions performed by other aeroplane systems, because the loss or malfuncti on of different but related functions, provided by separate systems may affect the severity of Failure Conditions postulated for a particular system.

(3) The FHA is an engineering tool, which should be performed early in the design and updated as necessary . It is used to define the high - level aeroplane or system safety objectives that must be considered in the proposed system architectures. It should also be used to assist in determining the development assurance levels for the Powered by EASA eRules Page 850 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL systems. Many systems may nee d only a simple review of the system design by the applicant to determine the hazard classification. An FHA requires experienced engineering judgement and early co - ordination between the applicant and the certification authority.

(4) Depending on the exten t of functions to be examined and the relationship between functions and systems, different approaches to FHA may be taken. Where there is a clear correlation between functions and systems, and where system, and hence function, interrelationships are relat ively simple, it may be feasible to conduct separate FHAs for each system, providing any interface aspects are properly considered and are easily understood. Where system and function interrelationships are more complex, a top - down approach, from an aeropl ane - level perspective, should be taken in planning and conducting FHAs However, with the increasing integrated system architectures, this traditional top - down approach should be performed in conjunction with common - cause considerations (e.g.

common resourc es) in order to properly address the cases where one system contributes to several aeroplane - level functions.

c. Considerations When Assessing Failure Condition Effects .

The requirements of CS 25.1309(b) are intend ed to ensure an orderly and thorough evaluation of the effects on safety of foreseeable failures or other events, such as errors or external circumstances, separately or in combination, involving one or more system functions. The interactions of these fact ors within a system and among relevant systems should be considered.

In assessing the effects of a failure condition , factors which might alleviate or intensify the direct effects of the initial failure condition should be considered. Some of these factors include consequent or related conditions existing within the aeroplane that may affect the ability of the crew to deal with direct effects, such as the presence of smoke, acceleration effects, interruption of communication, interference with cabin pressur isation, etc. When assessing the consequences of a given failure condition , account should be taken of the failure information provided, the complexity of the crew action, and the relevant crew training. The number of overall failure condition s involving o ther than instinctive crew actions may influence the flight crew performance that can be expected. Training recommendations may need to be identified in some cases.

(1) The severity of failure condition s should be evaluated according to the following: (i) Effects on the aeroplane, such as reductions in safety margins, degradation in performance, loss of capability to conduct certain flight operations, reduction in environmental protection, or potential or consequential effects on structural integrity. When the effects of a failure condition are difficult to assess, the hazard classification may need to be validated by tests, simulation, or other appropriate analytical techniques.

(ii) Effects on the crewmembers, such as increases above their normal workload that would affect their ability to cope with adverse operational or environmental conditions or subsequent failures.

(iii) Effects on the occupants, i.e., passengers and crewmembers.

Powered by EASA eRules Page 851 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (2) For convenience in conducting design assessments, failure conditions may be classified according to the severity of their effects as ‘no safety effect’, ‘minor’, ‘major’, ‘hazardous’, or ‘catastrophic’. Paragraph 7.a above provides accepted definitions of these terms.

(i) The classification of failure conditions does not depend on whether or not a system or function is the subject of a specific requirement or regulation.

Some ʽrequired’ systems, such as transponders, position lights, and public address syst ems, may have the potential for only minor failure condition s.

Conversely, other systems which are not ʽrequired’, such as auto - flight systems, may have the potential for ‘major’, ‘hazardous’, or ‘catastrophic failure condition s’.

(ii) Regardless of the types of assessment used, the classification of failure conditions should always be accomplished with consideration of all relevant factors; e.g. , system, crew, performance, operational, external. It is particularly important to consider factors that would alleviate or intensify the severity of a failure condition . When flight duration, flight phase, or diversion time can adversely affect the classification of failure conditions, they must be considered to be intensifying factors. Other in tensifying factors include conditions that are not related to the failure (such as weather or adverse operational or environmental conditions), and which reduce the ability of the flight crew to cope with a failure condition. An example of an alleviating f actor would be the continued performance of identical or operationally similar functions by other systems not affected by the failure condition . Another example of an alleviating factor is the ability of the flight crew to recognise the failure condition a nd take action to mitigate its effects.

Whenever this is taken into account, particular attention should be paid to the detection means to ensure that the ability of the flight crew (including physical ability and timeliness of the response) to detect the failure condition and take the necessary corrective action(s) is sufficient. Refer to CS 25.1309(c) and paragraph 9.c of this AMC for more detailed guidance on crew annunciations and crew response evaluation. Combi nations of intensifying or alleviating factors need to be considered only if they are anticipated to occur together.

11. ASSESSMENT OF FAILURE CONDITION PROBABILITIES AND ANALYSIS CONSIDERATIONS.

After the failure condition s have been identified and the s everity of the effects of the failure condition s have been assessed, there is a responsibility to determine how to show compliance with the requirement and obtain the concurrence of EASA. Design and installation reviews, analyses, flight tests, ground test s, simulator tests, or other approved means may be used.

a. Assessment of Failure Condition Probabilities .

(1) The probability that a failure condition would occur may be assessed as probable, remote, extremely remote, or extremely improbable. These terms are defined in paragraph 7. Each failure condition should have a probability that is inversely related to the severity of its effects as described in paragraph 8.

(2) When a system provides protection from events (e.g. , cargo compartment fire, gusts), its reliability should be compatible with the safety objectives necessary for the failure condition associated with the failure of the protection system and the probability of such events. (See paragraph 11g of this AMC and Appendix 4.)

Powered by EASA eRules Page 852 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (3) An assessment to identify and classify failure condition s is necessarily qualitative.

On the other hand, an assessment of the probability of a failure condition may be either qualitative or quantitative. An analysis may range from a simple report that inte rprets test results or compares two similar systems to a detailed analysis that may or may not include estimated numerical probabilities. The depth and scope of an analysis depends on the types of functions performed by the system, the severity of failure condition s, and whether or not the system is complex.

(4) Experienced engineering and operational judgement should be applied when determining whether or not a system is complex. Comparison with similar, previously approved systems is sometimes helpful. Al l relevant systems’ attributes should be considered; however, the complexity of the software and hardware item need not be a dominant factor in the determination of complexity at the system level.

b. Single Failure Considerations.

(1) According to the requ irements of CS 25.1309(b)(1)(ii) , a catastrophic failure condition must not result from the failure of a single component, part, or element of a system. Failure containment should be provided by the system design t o limit the propagation of the effects of any single failure to preclude catastrophic failure condition s. In addition, there must be no common - cause failure, which could affect both the single component, part, or element, and its failure containment provis ions. A single failure includes any set of failures, which cannot be shown to be independent from each other. Common - cause failures (including common mode failures) and cascading failures should be evaluated as dependent failures from the point of the root cause or the initiator. Errors in development, manufacturing, installation, and maintenance can result in common - cause failures (including common mode failures) and cascading failures. They should, therefore, be assessed and mitigated in the frame of the common - cause and cascading failures consideration. Appendix 1 and the Document referenced in paragraph 3.b(3) describe types of common - cause analyses that may be conducted , to assure that independence is maintained. Failure containment techniques available to establish independence may include partitioning, separation, and isolation.

(2) While single failures must normally be assumed to occur, there are cases where it is obvious that, from a realistic and practical viewpoint, any knowledgeable, experienced person would unequivocally conclude that a failure mode simply would not occur, unless it is associated with a wholly unrelated failure condition that would itself be catastrophic. Once identified and accepted, such cases need not be considered failures in the context of CS 25.1309 . For example, with simply loaded static elements, any failure mode, resulting from fatigue fracture, can be assumed to be prevented if this element is shown to meet the damage tolerance r equirements of CS 25.571 .

c. Common Cause Failure Considerations .

An analysis should consider the application of the fail - safe design concept described in paragraph 6b and give special attention to ensure the effective use of design and installation techniques that would prevent single failures or other events from damag ing or otherwise adversely affecting more than one redundant system channel, more than one system performing operationally similar functions, or any system and an associated safeguard. When considering such common - cause failures or other events, consequent ial Powered by EASA eRules Page 853 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL or cascading effects should be taken into account. Some examples of such potential common cause failures or other events would include rapid release of energy from concentrated sources such as uncontained failures of rotating parts (other than engines and propellers) or pressure vessels, pressure differentials, non - catastrophic structural failures, loss of environmental conditioning, disconnection of more than one subsystem or component by over temperature protection devices, contamination by fluids, da mage from localised fires, loss of power supply or return (e.g. mechanical damage or deterioration of connections), excessive voltage, physical or environmental interactions among parts, errors, or events external to the system or to the aeroplane (see Doc um ent referenced in paragraph 3b(3 )).

d. Depth of Analysis .

The following identifies the depth of analysis expected based on the classification of a failure condition .

(1) No Safety Effect Failure Conditions . An FHA, with a design and installation apprais al, to establish independence from other functions is necessary for the safety assessment of these failure condition s. If it is chosen not to do an FHA, the safety effects may be derived from the design and installation appraisal.

(2) Minor Failure Conditi ons . An FHA, with a design and installation appraisal, to establish independence from other functions is necessary for the safety assessment of these failure condition s. Combinations of failure condition effects, as noted in paragraph 10 above, must also b e considered. If it is chosen not to do an FHA, the safety effects may be derived from the design and installation appraisal.

(3) Major Failure Conditions . Major failure conditions must be remote: (i) If the system is similar in its relevant attributes to those used in other aeroplanes and the effects of failure would be the same, then design and installation appraisals (as described in Appendix 1 ), and satisfactory service history of the equipment being analysed, o r of similar design, will usually be acceptable for showing compliance.

(ii) For systems that are not complex, where similarity cannot be used as the basis for compliance, then compliance may be shown by means of a qualitative assessment that shows that the system - level major failure condition s, of the system as installed, are consistent with the FHA and are remote, e.g. redundant systems.

(iii) For complex systems without redundancy, compliance may be shown as in paragraph 11.d(3)(ii) of this AMC. To show that malfunctions are indeed remote in systems of high com plexity without redundancy (for example, a system with a self - monitoring microprocessor), it is sometimes necessary to conduct a qualitative functional failure modes and effects analysis (FMEA) supported by failure rate data and fault detection coverage an alysis.

(iv) An analysis of a redundant system is usually complete if it shows isolation between redundant system channels and satisfactory reliability for each channel. For complex systems where functional redundancy is required, a qualitative FMEA and qu alitative fault tree analysis may be necessary to determine that redundancy actually exists (e.g. no single failure affects all functional channels).

Powered by EASA eRules Page 854 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (4) Hazardous and Catastrophic Failure Conditions .

Hazardous failure condition s must be extremely remote, and catastrophic failure conditions must be extremely improbable: (i) Except as specified in paragraph 11.d(4)(ii) below, a detailed safety analysis will be necessary for each hazardous and catastrophic failure condition identified by the FHA. The analysis will usually be a combination of qualitative and quantitative assessment of the design.

(ii) For very simple and conventional installations, i.e. low complexity and similarity in relevant attributes, it may be possible to assess a hazardous or catastrophi c failure condition as being extremely remote or extremely improbable, respectively, on the basis of experienced engineering judgement, using only qualitative analysis. The basis for the assessment will be the degree of redundancy, the established independ ence and isolation of the channels and the reliability record of the technology involved.

Satisfactory service experience on similar systems commonly used in many aeroplanes may be sufficient when a close similarity is established in respect of both the sy stem design and operating conditions.

(iii) For complex systems where true similarity in all relevant attributes, including installation attributes, can be rigorously established, it may be also possible to assess a hazardous or catastrophic failure condit ion as being extremely remote or extremely improbable, respectively, on the basis of experienced engineering judgement, using only qualitative analysis. A high degree of similarity in both design and application is required to be substantiated.

e. Calculat ion of Average Probability per Flight Hour (Quantitative Analysis) .

(1) The average probability per flight hour is the probability of occurrence, normalised by the flight time, of a failure condition during a flight, which can be seen as an average over al l possible flights of the fleet of aeroplane to be certified. The calculation of the average probability per flight hour for a failure condition should consider: (i) the average flight duration and the average flight profile for the aeroplane type to be ce rtified, (ii) all combinations of failures and events that contribute to the failure condition , (iii) the conditional probability if a sequence of events is necessary to produce the failure condition , (iv) the relevant ʽat risk’ time if an event is only relevant during certain flight phases, and (v) the exposure time if the failure can persist for multiple flights.

(2) The details how to calculate the average probability per flight hour for a failure condition are given in Appendix 3 of this AMC.

(3) If the probability of a subject failure condition occurring during a typical flight of mean duration for the aeroplane type divided by the flight’s mean duration in hours is likely to be significantly different from the predicted average rate of Powered by EASA eRules Page 855 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL occurrence of that failure condition during the entire operational life of all aeroplanes of that type, then a risk mo del that better reflects the failure condition should be used.

(4) It is recognised that, for various reasons, component failure rate data are not precise enough to enable accurate estimates of the probabilities of failure conditions . This results in some degree of uncertainty, as indicated by the wide line in Figure 1, and the expression ʽon the order of’ in the descriptions of the quantitative probability terms that are provided above. When calculating the estimated probability of each failure condition , this uncertainty should be accounted for in a way that does not compromise safety.

f. Integrated Systems.

Interconnections between systems have been a feature of aeroplane design for many years and CS 25.1309(b) re cognises this in requiring systems to be considered in relation to other systems. Providing the interfaces between systems are relatively few and simple, and hence readily understandable, compliance may often be demonstrate d through a series of system safe ty assessments, each of which deals with a particular failure condition (or more likely a group of failure condition s) associated with a system and, where necessary, takes account of failures arising at the interface with other systems.

This procedure has been found to be acceptable in many past certification programmes.

However, where the systems and their interfaces become more complex and extensive, the task of demonstrating compliance may become more complex. It is therefore essential that the means of compliance be considered early in the design phase to ensure that the design can be supported by a viable safety assessment strategy. Aspects of the guidance material covered elsewhere in this AMC and which should be given particular consideration are as f ollows: (1) planning the proposed means of compliance; this should include development assurance activities to mitigate the occurrence of errors in the design, (2) considering the importance of architectural design in limiting the impact and propagation of failures, (3) the potential for common - cause failures and cascade effects and the possible need to assess combinations of multiple lower - level (e.g. major) failure conditions , (4) the importance of multidisciplinary teams in identifying and classifying significant failu re conditions , (5) effect of crew and maintenance procedures in limiting the impact and propagation of failures.

In addition, rigorous and well - structured design and development procedures play an essential role in facilitating a methodical safety assessment process and providing visibility to the means of compliance. Document referenced in paragraph 3b( 2 ) may be helpful in the certification of highly integrated or complex aircraft systems.

g. Operational or Environmental Conditions .

A probability o f one should usually be used for encountering a discrete condition for which the aeroplane is designed, such as instrument meteorological conditions or Category III weather operations. However, Appendix 4 contains allowable probabilities, which may be assi gned to various operational and environmental conditions for use in computing the average probability per flight hour of failure conditions without further Powered by EASA eRules Page 856 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL justification. Single failures, which, in combination with operational or environmental conditions, lead to catastrophic failure conditions, are, in general, not acceptable.

Limited cases that are properly justified may be considered on a case - by - case basis (e.g.

operational events or environmental conditions that are extremely remote).

Appendix 4 is pro vided for guidance and is not intended to be exhaustive or prescriptive.

At this time, a number of items have no accepted standard statistical data from which to derive a probability figure. However, these items are included for either future consideration or as items for which the applicant may propose a probability figure supported by statistically valid data or supporting service experience. The applicant may propose additional conditions or different probabilities from those in Appendix 4 provided they are based on statistically valid data or supporting service experience. The applicant should obtain early concurrence of EASA when such conditions are to be included in an analysis. When combining the probability of such a random condition with that of a s ystem failure, care should be taken to ensure that the condition and the system failure are independent of one another, or that any dependencies are properly accounted for.

h. Justification of Assumptions, Data Sources and Analytical Techniques .

(1) Any a nalysis is only as accurate as the assumptions, data, and analytical techniques it uses. Therefore, to show compliance with the requirements, the underlying assumptions, data, and analytic techniques should be identified and justified to assure that the co nclusions of the analysis are valid. Variability may be inherent in elements such as failure modes, failure effects, failure rates, failure probability distribution functions, failure exposure times, failure detection methods, fault independence, limitatio n of analytical methods, processes, and assumptions. The justification of the assumptions made with respect to the above items should be an integral part of the analysis. Assumptions can be validated by using experience with identical or similar systems or components with due allowance made for differences of design, duty cycle and environment. Where it is not possible to fully justify the adequacy of the safety analysis and where data or assumptions are critical to the acceptability of the Failure Conditio n, extra conservatism should be built into either the analysis or the design. Alternatively any uncertainty in the data and assumptions should be evaluated to the degree necessary to demonstrate that the analysis conclusions are insensitive to that uncerta inty.

(2) Where adequate validation data is not available (e.g., new or novel systems), and extra conservatism is built into the analysis, then the normal post - certification in - service follow - up may be performed to obtain the data necessary to alleviate an y consequence of the extra conservatism. This data may be used, for example, to extend system check intervals.

12. OPERATIONAL AND MAINTENANCE CONSIDERATIONS.

This AMC addresses only those operational and maintenance considerations that are directly relate d to compliance with CS 25.1309 ; other operational and maintenance considerations are not discussed herein. Flight crew and maintenance tasks related to compliance with this requirement should be appropriate and re asonable. However, quantitative assessments of crew errors are not considered feasible. Therefore, reasonable tasks are those for which full credit can be taken because they can realistically be anticipated to be performed correctly when they are required or scheduled. In addition, based on experienced engineering and operational judgement, the discovery of obvious failures during normal operation or maintenance of the Powered by EASA eRules Page 857 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL aeroplane may be assumed, even though identification of such failures is not the primary purpose of the operational or maintenance actions.

a. Flight Crew Action.

When assessing the ability of the flight crew to cope with a failure condition , the information provided to the crew and the complexity of the required action should be considered. When considering the information provided to the flight crew, refer also to paragraph 9.c (compliance with CS 2 5.1309(c) ). Credit for flight crew actions, and considerations of flight crew errors, should be consistent with relevant service experience and acceptable human factors evaluations. If the evaluation indicates that a potential failure condition can be alle viated or overcome without jeopardising other safety - related flight crew tasks and without requiring exceptional pilot skill or strength, credit may be taken for both qualitative and quantitative assessments. Similarly, credit may be taken for correct flig ht crew performance of the periodic checks required to demonstrate compliance with CS 25.1309(b) provided overall flight crew workload during the time available to perform them is not excessive and they do not requ ire exceptional pilot skill or strength. Unless flight crew actions are accepted as normal airmanship, they should be described in the approved Aeroplane Flight Manual in compliance with CS 25.1585. The applicant should provide a means to ensure that the A FM will contain the required flight crew actions that have been used as mitigation factors in the hazard classification or that have been taken as assumptions to limit the exposure time of failures.

b. Maintenance Action.

Credit may be taken for the corre ct accomplishment of reasonable maintenance tasks, for both qualitative and quantitative assessments. The maintenance tasks needed to demonstrate compliance with CS 25.1309(b) should be established. In doing this, the following maintenance scenarios can be used: (1) For failures known to the flight crew, refer to paragraph 12.d.

(2) Latent failures will be identified by a scheduled maintenance task. If this approach is taken, and the failure condition is hazardous o r catastrophic, then a CCMR maintenance task should be established. Some latent failures can be assumed to be identified based upon return to service test on the LRU following its removal and repair (component mean time between failures (MTBF) should be th e basis for the check interval time).

c. Candidate Certification Maintenance Requirements.

(1) By detecting the presence of, and thereby limiting the exposure time to significant latent failures that would, in combination with one or more other specific fa ilures or events identified by safety analysis, result in a hazardous or catastrophic failure condition , periodic maintenance or flight crew checks may be used to help show compliance with CS 25.1309(b) . Where such checks cannot be accepted as basic servicing or airmanship they become CCMRs. AMC 25.19 details the handling of CCMRs.

(2) Rational methods, which usually involve quantitative analysis, or relevant service experience should be used to determine check intervals. This analysis contains inherent uncertainties as discussed in paragraph 11e(3). Where periodic checks become CMRs the se uncertainties justify the controlled escalation or exceptional short - term extensions to individual CMRs allowed under AMC 25.19 .

Powered by EASA eRules Page 858 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPAR T F – EQUIPMENT (CS - 25) GENERAL d. Flight with Equipment or Functions known to be Inoperative .

An applicant may elect to develop a list of equipment and functions that need not be operative for flight, based on stated compensating precautions that should be taken, e.g.

operational or time limitations, flight crew procedures, or ground crew checks. The documents used to demonstrate compliance with CS 25.1309 , together with any other relevant information, should be considered in the development of this lis t. Experienced engineering and operational judgement should be applied du ring the development of this list. When operation is envisaged with equipment that is known to be inoperative, and this equipment affects the probabilities associated with hazardous and/or catastrophic failure conditions, limitations may be needed on the n umber of flights and/or the allowed operation time with such inoperative equipment. These limitations should be established in accordance with the recommendations contained in CS - MMEL.

13. ASSESSMENT OF MODIFICATIONS TO PREVIOUSLY CERTIFICATED AEROPLANES.

The means to assure continuing compliance with CS 25.1309 for modifications to previously certificated aeroplanes should be determined on a case - by - case basis and will depend on the applicable aeroplane certification basis and the extent of the change being considered. The change could be a simple modification affecting only one system or a major redesign of many systems, possibly incorporating new technologies. The minimal effort for demonstrating compl iance to 25.1309 for any modification is an assessment of the impact on the original system safety assessment. The result of this assessment may range from a simple statement that the existing system safety assessment still applies to the modified system i n accordance with the original means of compliance, to the need for new means of compliance encompassing the plan referred to in paragraph 9b. (STC applicants, if the TC holder is unwilling to release or transfer proprietary data in this regard, the STC ap plicant may have to create the System Safety Assessment. Further guidance may be found in paragraph 6 of Document referenced in paragraph 3b( 2 ).) It is recommended that the Agency be contacted early to obtain agreem ent on the means of compliance.

[Amdt 25/ 2] [Amdt 25/4] [Amdt 25/8] [Amdt 25/11] [Amdt 25/12] [Amdt 25/14] [Amdt 25/19] [Amdt 25/24] [Amdt 25/27] Powered by EASA eRules Page 859 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

Appendix 1 – A ssessment methods

ED Decision 2020/001/R Various methods for assessing the causes, severity, and probability of f ailure c onditions are available to support experienced engineering and operational judgement. Some of these methods are structured. The various types of analysis are based on either in ductive or deductive approaches.

Probability assessments may be qualitative or quantitative. Descriptions of some types of analysis are provided below and in Document referenced in paragraph 3b( 3 ).

a. Design Appraisal. This is a qualitative appraisal of th e integrity and safety of the system design.

b. Installation Appraisal. This is a qualitative appraisal of the integrity and safety of the installation.

Any deviations from normal, industry accepted installation practices, such as clearances or tolerances, should be evaluated, especially when appraising modifications made after entry into service.

c. Failure Modes and Effects Analysis. This is a structured, inductive, bottom - up analysis, which is used to evaluate the effects on the system and the aeroplane of each possible element or component failure. When properly formatted, it will aid in identifying latent failures and the possible causes of each failure mode. Docum ent referenced in paragraph 3b(3 ) provides methodology and detailed guidelines, which may be used to perform this type of analysis. A FMEA could be apiece part FMEA or a functional FMEA. For modern microcircuit based LRUs and systems an exhaustive piece part FMEA is not practically feasible with the present state of the art. In that context, a FMEA may be more functional than piece part oriented. A functional oriented FMEA can lead to uncertainties in the qualitative and quantitative aspects, which can be compensated for by more conservative assessment such as: — assuming all failure modes result in the f ailure c onditions of interest, — careful choice of system architecture, — taking into account the experience lessons learned on the use of similar technology.

d. Fault Tree or Dependence Diagram Analysis. Structured, d eductive, top - down analyses that are used to identify the conditions, failures, and events that would cause each defined f ailure c ondition. They are graphical methods of identifying the logical relationship between each particular f ailure c ondition and the primary element or component failures, other events, or combinations thereof that can cause it. A failure modes and effects analy sis may be used as the source document for those primary failures or other events.

e. Markov Analysis. A Markov model (chain) represents various system states and the relationships among them. The states can be either operational or non - operational. The tr ansitions from one state to another are a function of the failure and repair rates. Markov analysis can be used as a replacement for fault tree/dependence diagram analysis, but it often leads to more complex representation, especially when the system has m any states. It is recommended that Markov analysis be used when fault tree or dependence diagrams are not easily usable, namely to take into account complex transition states of systems which are difficult to represent and handle with classical fault tree or dependence diagram analysis.

f. Common - Cause Analysis. The acceptance of adequate probability of failure conditions is often derived from the assessment of multiple systems based on the assumption that failures are independent. Therefore, it is necessar y to recognise that such independence may not exist in the practical sense and specific studies are necessary to ensure that independence can either be assured or considered to be acceptable. These studies may also identify a combination of failures and ef fects that would otherwise not have been foreseen by FMEA or fault tree analysis.

Powered by EASA eRules Page 860 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL The common cause analysis is subdivided into three areas of study: (1) Zonal Safety Analysis. This analysis has the objective of ensuring that the equipment installations wit hin each zone of the aeroplane are at an adequate safety standard with respect to design and installation standards, interference between systems, and maintenance errors. In those areas of the aeroplane where multiple systems and components are installed i n close proximity, it should be ensured that the zonal analysis would identify any failure or malfunction which by itself is considered sustainable but which could have more serious effects when adversely affecting other adjacent systems or components.

(2) Particular Risk Analysis. Particular risks are defined as those events or influences, which are outside the systems concerned. Examples are fire, leaking fluids, bird strike, tire burst, high intensity radiated fields exposure, lightning, uncontained fail ure of high energy rotating machines, etc. Each risk should be the subject of a specific study to examine and document the simultaneous or cascading effects or influences, which may violate independence.

(3) Common Mode Analysis. This analysis is performed to confirm the assumed independence of the events, which were considered in combination for a given f ailure c ondition. The effects of specification, design, implementation, installation, maintenance, and manufacturing errors, environmental factors other t han those already considered in the particular risk analysis, and failures of system components should be considered.

g. Safety Assessment Process. Appendix 2 provides an overview of the s afety a ssessment p rocess.

[Amdt 25/14] [Amdt 25/24] Powered by EASA eRules Page 861 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

Appendix 2 – S afety A ssessment P rocess O verview

ED Decision 2020/001/R In showing compliance with CS 25.1309(b) , the considerations covered in this AMC should be addressed in a methodical and systematic manner, which ensures that the process and its findings are visible and readily assimilated. This appendix is provided primarily for those who are not familiar with the various methods and procedures generally used in the industry to conduct safety assessments.

This gui de and Figures A2 - 1 and A2 - 2 are not certification checklists, and they do not include all the information provided in this AMC. There is no necessity for them to be used or for the Agency to accept them, in whole or in part, to show compliance with any re gulation. Their sole purposes are to assist, by illustrating a systematic approach to safety assessments, to enhance understanding and communication by summarising some of the information provided in this AMC, and to provide some suggestions on documentati on. More detailed guidance can be found in Document referenced in paragraph 3b( 3 ). Docum ent referenced in paragraph 3b(2 ) includes additional guidance on how the safety assessment process relates to the system development process.

a. Define the system and its interfaces, and identify the functions that the system is to perform.

Some functions are intended to be protective, i.e. functions preventing the failures in system X from adversely affecting system Y. As the implementation of the functional requiremen ts becomes more developed, care should be taken to identify all protective functions upon which airworthiness will depend. Determine whether or not the system is complex, similar to systems used on other aeroplanes, or conventional. Whe n multiple systems a nd functions are to be evaluated, consider the relationships between multiple safety assessments.

b. Identify and classify f ailure c onditions. All relevant engineering organisations, such as systems, structures, propulsion, and flight test, should be invol ved in this process. This identification and classification may be done by conducting a n FHA , which is usually based on one of the following methods, as appropriate: (1) If the system is not complex and its relevant attributes are similar to those of syste ms used on other aeroplanes, the identification and classification may be derived from design and installation appraisals and the service experience of the comparable, previously approved systems.

(2) If the system is complex, it is necessary to systematic ally postulate the effects on the safety of the aeroplane and its occupants resulting from any possible failures, considered both individually and in combination with other failures or events.

c. Choose the means to be used to determine compliance with CS 25.1309 . The depth and scope of the analysis depends on the types of functions performed by the system, the severity of system failure conditions, and whe ther or not the system is complex (see Figure A2 - 2). For major failure conditions, experienced engineering and operational judgement, design and installation appraisals and comparative service experience data on similar systems may be acceptable, either on their own or in conjunction with qualitative analyses or selectively used quantitative analyses. For hazardous or catastrophic failure conditions, a very thorough safety assessment is necessary. The early concurrence of EASA on the choice of an acceptable means of compliance should be obtained.

d. Conduct the analysis and produce the data, which are agreed with the certification authority as being acceptable to show compliance. A typical analysis should include the following information to the extent neces sary to show compliance: (1) A statement of the functions, boundaries, and interfaces of the system.

Powered by EASA eRules Page 862 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (2) A list of the parts and equipment of which the system is comprised, including their performance specifications or design standards and development assu rance levels if applicable. This list may reference other documents, e. g., European Technical Standard Orders (E TSOs), manufacturers or military specifications, etc.

(3) The conclusions, including a statement of the f ailure c onditions and their classificat ions and probabilities (expressed qualitatively or quantitatively, as appropriate) that show compliance with the requirements of CS 25.1309 .

(4) A description that establishes correctness and completeness and trace s the work leading to the conclusions. This description should include the basis for the classification of each f ailure c ondition (e.g. analysis or ground, flight, or simulator tests). It should also include a description of precautions taken against commo n - cause failures, provide any data such as component failure rates and their sources and applicability, support any assumptions made, and identify any required flight crew or ground crew actions, including any CCMRs.

e. Assess the analyses and conclusions of multiple safety assessments to ensure compliance with the requirements for all aeroplane - level f ailure c onditions.

f. Prepare compliance statements, maintenance requirements, and flight manual requirements.

Figure A2 - 1: Saf ety Assessment Process Overview Powered by EASA eRules Page 863 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Figure A2 - 2: Depth of Analysis Flowchart Powered by EASA eRules Page 864 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL [Amdt 25/2] [Amdt 25/12] [Amdt 25/14] [Amdt 25/24] Powered by EASA eRules Page 865 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

Appendix 3 – Calculation of the average probability per flight hour

ED Decision 2021/015/R The purpose of this material is to provide guidance for calculating the ʽAverage Probability per Flight Hour’ for a failure condition so that it can be compared with the quantitative criteria of the AMC.

The process of calculating the ʽAverage Probability per Flight Hour’ for a failure condition will be described as a four - step process and is based on the assumption that the life of an aeroplane is a sequence of ʽAverage Flights’.

Step 1: Determination of the ʽAverage Flight’ Step 2: Calculation of the probability of a failure condition for a certain ʽAverage Flight’ Step 3: Calculation of the ʽAverage Probability per Flight’ of a failure condition Step 4: Calculation of the ʽAverage Probability Per Flight Hour’ of a failure co ndition a. Determination of the "Average Flight”. The "Average Probability per Flight Hour" is to be based on an "Average Flight". The average flight duration and average flight profile for the fleet of aeroplane to be certified should be estimated. The av erage flight duration should be estimated based on expectations and historical experience for similar types. The "Average Flight" duration should reflect the best estimate of the cumulative flight hours divided by the cumulative aeroplane flights for the s ervice life of the aeroplane. The "Average Flight" profile should be based on the operating weight and performance expectations for the average aeroplane when flying a flight of average duration in an ICAO standard atmosphere. The duration of each flight p hase (e.g. takeoff, climb, cruise, descent, approach and landing) in the "Average Flight" should be based on the average flight profile. Average taxi times for departure and arrival at an average airport should be considered where appropriate and added to the average flight time. The "Average Flight" duration and profile should be used as the basis for determining the "Average Probability per Flight Hour" for a quantitative safety assessment.

b. Calculation of the Probability of a Failure Condition for a ce rtain ʽAverage Flight’ . The probability of a failure condition occurring on an ʽAverage Flight’ P ( failure condition ) should be Flight determined by structured methods (see Document referenced in paragraph 3.b(3) for example methods) and should consider all significant elements (e.g. combinations of failures and events) that contribute to the failure condition . The following should be considered: (1) The component failure rates utilised in calculating the ʽAverage Probability per Flight Hour’ should be estima tes of the mature constant failure rates after infant mortality and prior to wear - out. For components whose probability of failure may be associated with non - constant failure rates within the operational life of the aeroplane, a reliability analysis may be used to determine component replacement times (e.g. Weibull analysis).

In either case, the failure rate should be based on all causes of failure (operational, environmental, etc.). If available, service history of same or similar components in the same or similar environment should be used.

Ageing and wear of similarly constructed and similarly loaded redundant components, whose failure could lead directly, or in combination with one other failure, to a catastrophic or hazardous failure condition, should b e assessed when determining scheduled maintenance tasks for such components.

The replacement times, necessary to mitigate the risk due to ageing and wear of such components within the operational life of the aeroplane, should be assessed through the same m ethodology like other scheduled maintenance tasks that are required to comply Powered by EASA eRules Page 866 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL with CS 25.1309 (refer to AMC 25 - 19 for guidance) and documented in the Airworthiness Limitations Section of the Instructions for Contin ued Airworthiness, as appropriate.

(2) If the failure is only relevant during certain flight phases, the calculation should be based on the probability of failure during the relevant ‘ at risk ’ time for the ‘ Average Flight ’ .

(3) If one or more failed elemen ts in the system can persist for multiple flights (latent, dormant, or hidden failures), the calculation should consider the relevant exposure times (e.g. time intervals between maintenance and operational checks/ inspections). In such cases the probabilit y of the Failure Condition increases with the number of flights during the latency period.

(4) If the failure rate of one element varies during different flight phases, the calculation should consider the failure rate and related time increments in such a manner as to establish the probability of the failure condition occurring on an ʽAverage Flight’: It is assumed that the ʽAverage Flight’ can be divided into n phases (phase 1, ... , phase n). Let T F the ʽAverage Flight’ duration, T j the duration of phase j and t j the transition point between T and T , j=1, ... ,n . I.e.

j j+1 𝑛 𝑇 = ∑ 𝑇 𝑎𝑛𝑑 𝑡 − 𝑡 = 𝑇 ; 𝑗 = 1 , … , 𝑛 𝐹 𝑗 𝑗 𝑗 − 1 𝑗 𝑗 = 1 Let l (t) the failure rate function during phase j, i.e. for t Î [t ,t ].

j j - 1 j Remark: l (t) may be equal 0 for all t Î [t ,t ] for a specific phase j.

j j - 1 j Let P (Failure) the probability that the element fails during one certain flight (including Flight nonflying time) and P (Failure) the probability that the element fails in phase j.

Phase j Two cases are possible: (i) T he element is checked operative at the beginning of the certain flight. Then 𝑛 𝑛 𝑃 ( 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 ) = ∑ 𝑃 ( 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 ) = ∑ 𝑃 ( 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 | 𝑡 ∈ [ 𝑡 , 𝑡 ] ) 𝐹𝑙𝑖𝑔 ℎ 𝑡 𝑃 ℎ 𝑎𝑠𝑒 𝑗 𝑗 − 1 𝑗 𝑗 = 1 𝑗 = 1 𝑡 𝑖 𝑛 ( ) = 1 − ∏ 𝑒𝑥𝑝 ( − ∫ 𝜆 𝑥 𝑑𝑥 ) 𝑖 𝑖 = 1 𝑡 𝑖 − 1 (ii) The state of the item is unknown at the beginning of the certain flight. Then ( ) ( ) 𝑃 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 = 𝑃 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 𝐹𝑙𝑖𝑔 ℎ 𝑡 𝑝𝑟𝑖𝑜𝑟 𝑡 𝑖 𝑛 + ( 1 − 𝑃 ( 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 ) ) ∙ ( 1 − ∏ 𝑒𝑥𝑝 ( − ∫ 𝜆 ( 𝑥 ) 𝑑𝑥 ) ) 𝑝𝑟𝑖𝑜𝑟 𝑖 𝑖 = 1 𝑡 𝑖 − 1 where P (Failure) is the probability that the failure of the element has occu rred prior prior to the certain flight.

(5) If there is only an effect when failures occur in a certain order, the calculation should account for the conditional probability that the failures occur in the sequence necessary to produce the f ailure c ondition.

Powered by EASA eRules Page 867 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQ UIPMENT (CS - 25) GENERAL c. Calculation of the Average Probability per Flight of a Failure Condition . The next step is to calculate the ʽAverage Probability per Flight’ for the failure condition, i.e. the probability of the failure condition for each flight (which might be different although all flights are ʽAverage Flights’) during the relevant time (e.g. the least common multiple of the exposure times or the aeroplane life) should be calculated, summed up and divided by the number of flights during that period. The principles of ca lculating are described below and also in more detail in the Document referenced in paragraph 3.b(3).

𝑁 ∑ 𝑃 ( 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 𝐶𝑜𝑛𝑑𝑖𝑡𝑖𝑜𝑛 ) 𝐹𝐿𝑖𝑔 ℎ 𝑡 𝑘 𝑘 = 1 𝑃 ( 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 𝐶𝑜𝑛𝑑𝑖𝑡𝑖𝑜𝑛 ) = 𝐴𝑣𝑒𝑟𝑎𝑔𝑒 𝑝𝑒𝑟 𝐹𝑙𝑖𝑔 ℎ 𝑡 𝑁 Where N is the quantity o f all flights during the relevant time, and P is the probability that Flightk the Failure Condition occurs in flight k.

d. Calculation of the Average Probability per Flight Hour of a Failure Condition. Once the "Average Probability per Flight" has been cal culated it should be normalised by dividing it by the "Average Flight" duration TF in Flight Hours to obtain the "Average Probability per Flight Hour". This quantitative value should be used in conjunction with the hazard category/effect established by the FHA to determine if it is compliant for the Failure Condition being analysed.

𝑃 ( 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 𝐶𝑜𝑛𝑑𝑖𝑡𝑖𝑜𝑛 ) 𝐴𝑣𝑒𝑟𝑎𝑔𝑒 𝑝𝑒𝑟 𝐹𝑙𝑖𝑔 ℎ 𝑡 ( ) 𝑃 𝐹𝑎𝑖𝑙𝑢𝑟𝑒 𝐶𝑜𝑛𝑑𝑖𝑡𝑖𝑜𝑛 = 𝐴𝑣𝑒𝑟𝑎𝑔𝑒 𝑝𝑒𝑟 𝐹𝐻 𝑇 𝐹 [Amdt 25/14] [Amdt 25/24] Amdt 25/2 7 ] Powered by EASA eRules Page 868 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

Appendix 4 – Allowable Probabilities

ED Decision 2020/001/R The following probabilities may be used for environmental conditions and operational factors (not caused by aeroplane failures) in quantitative safety analyses: Environmental Factors Conditio n Model or other Justification Probability CS - 25 Appendix C icing conditions 1 - 2 CS - 25 Appendix O icing conditions 10 per flight hour Icing conditions beyond certified conditions No accepted standard data (considered as ‘Severe icing’) - 2 Head wind >25 kt during takeoff and landing AC 120 - 28 10 per flight CS - AWO - 2 Tail wind >10 kt during takeoff and landing AC 120 - 28 10 per flight CS - AWO - 2 Cross wind >20 kt during takeoff and landing AC 120 - 28 10 per flight CS - AWO - 5 Limit des ign gust and turbulence CS 25.341 (Under review by 10 per flight hour Structures Harmonisation Working Group) Air temperature < - 70 ° C No accepted standard data Aeroplane Configurations Configuration Model or other Justification Probability Centre of gravity Standard industry practice Uniform over approved range Landing and Takeoff Weights/Masses Standard industry practice Uniform over approved range Flight Conditions Condition Model or other Justification Probability - 2 Flight condition requiring Stall Warning Assumption 10 per flight - 5 Flight condition resulting in a Stall Assumption 10 per flight - 2 Excessiveness of V MO /M MO Assumption 10 per flight Flight condition greater than or equal to 1.5 g No accepted standard data Flight condition less than or equal to 0 g No accepted standard data Mission Dependencies Event Model or other Justification Probability Any rejected take - off No accepted standard data High energy rejected take - off No accepted standard data Need to jettison fuel No accepted standard data Go - around No accepted standard data Powered by EASA eRules Page 869 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL Other Events Event Model or other Justification Probability Fire in a lavatory not caused by aeroplane No accepted standard data failures Fire in a cargo compartment not caused by No accepted standard data aeroplane failures Notes: 1. If “No a ccepted standard data” appears in the above tables, the applicant must provide a justified value if a probability less than 1 is to be used in the analysis.

2. The probabilities quoted in this Appendix have been found to be appropriate for use in the cont ext of a quantitative safety analysis performed to demonstrate compliance with CS 25.1309 . They may not always be appropriate for use in the context of other requirements.

[Amdt 25/24] Powered by EASA eRules Page 870 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

Appendix 5 – Example of limit latency and residual probability

analysis

ED Decision 2021/015/R The following example illustrates how the quantitative criteria of CS 25.1309 (b)(5) are to be implemented together with CS 25.1309 (b)(1) . The methodology used is based on t he identification of the minimal cut sets associated with the catastrophic top event of the generic system level fault tree provided in Figure A5 - 1.

The term ‘minimal cut set’ refers to the smallest set of primary events whose occurrence is sufficient to c ause a system failure or, in this case, the failure condition of concern.

(1) The list of minimal cut sets should be produced by cut set order. This will group all dual - order cut sets or failure combinations. The entire list of minimal cut sets of the faul t tree in Figure A5 - 1 is provided in Table A5 - 1.

(2) The dual - order minimal cut sets that contain a primary event that is latent for more than one flight are then identified from the list in Table A5 - 1.

(3) Then group those dual - order minimal cut sets: (3. 1) that contain the same active primary event. For each group, sum the remaining latent failure probabilities. For each group, the sum of the latent primary events should be less than 1/1 000.

(3.2) that contain the same latent primary event. For each grou p, assume that the latent primary event has failed and sum the remaining active primary event probabilities. For - 5 each group, the sum of the primary event probabilities should be less than 1 × 10 /FH.

- 9 (4) The sum of all minimal cut sets should be in the order of 1 × 10 /FH.

An alternative method to perform step (3.2) would be to rerun the fault - tree - probability calculation assuming for each model rerun that a different latent primary event has occurred and then verify that - 5 the average probability per fli ght hour of the top event is of the order of 1 × 10 /FH or less.

The results of the limit latency and residual probability analysis are provided in Table A5 - 1.

Powered by EASA eRules Page 871 of 1495 | Jan 2023 Primary e vent Exposure time in Primary probability flight hours e vent name If no value, the failure is detected within on e flight Figure A5 - 1: Fault Tree 2023 - 01 - 18 DITA Exchange ApS Page 872 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL # Probability Event Event Failure rate Exposure Event CS 25.1309(b)(5) (per flight name description (constant, time probability Applicability/ compliance hour) unless (per flight) noted) 1 3.992E - 10 A001 ACT 1 1.000E - 07 2.5 h 2.500E - 07 Not compliant with the limit latency criterion [L001 probability is more L001 LAT 1 4.000E - 06 1 000.0 h 3.992E - 03 frequent than 1.000E - 03].

2 2.000E - 10 A002 ACT 2 2.000E - 05 2.5 h 5.000E - 05 Not compliant with the residual probability criterion [A002 L003 LAT 3 1.000E - 06 10.0 h 1.000E - 05 probability per flight hour (2.000E - 05/FH) is more frequent than 1.000E - 05/FH].

3 1.000E - 10 A004 ACT 4 1.000E - 05 2.5 h 2.500E - 05 Not compliant with the residual probability criterion [while A004 L003 LAT 3 1.000E - 06 10.0 h 1.000E - 05 probability per flight hour is equal to 1.000E - 05/FH, the combined probability per flight hour of A004 and A002 (1.000E - 05/FH + 2.000E - 05/FH) i s more frequent than 1.000E - 05/FH.

Note: Dual - order minimal cut sets #2 and #3 are grouped due to same event L003 appearing under G002 and G004.

4 1.000E - 10 A004 ACT 4 1.000E - 05 2.5 h 2.500E - 05 Compliant with both limit latency and residual probability criteria L005 LAT 5 1.000E - 06 10.0 h 1.000E - 05 [A004 probability per flight hour is equal to 1.000E - 05/FH and combined probability of L005 and L003 (1.000E - 05 + 1.000E - 05) is less frequent than 1.000E - 03].

5 5 .000E - 11 A002 ACT 2 2.000E - 05 2.5 h 5.000E - 05 This dual - order minimal cut set does not contain any basic event being A005 ACT 5 1.000E - 06 2.5 h 2.500E - 06 latent for more than one flight.

Therefore, CS 25.1309(b)(5) is not applicable to this minimal cut set.

6 6.500E - 13 A003 ACT 3 6.500E - 07 2.5 h 1.625E - 06 Compliant with both limit latency and residual probability criteria L004 LAT 4 1.000E - 07 10.0 h 1.000E - 06 [A003 probability per flight hour (6.500E - 07/FH) is less frequent than 1.000E - 05/FH and L004 probability is less frequent than 1.000E - 03] 7 3.991E - 11 A002 ACT 2 2.000E - 05 2.5 h 5.000E - 05 This minimal cut set is more than a dual failure combination.

L001 LAT 1 4.000E - 06 1 000.0 h 3.992E - 03 Therefore, L002 LAT 2 5.000E - 06 100.0 h 4.999E - 04 CS 25.1309(b)(5) is not applicable to this minimal cut set.

Flight time = 2.5 hours P[LAT i] ~ FR * T Table A5 - 1: Minimal Cut Sets Powered by EASA eRules Page 873 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL [Amdt 25/24] [Amdt 25/27]

CS 25.1310 Power source capacity and distribution

ED Decision 2016 / 010/R (See AMC 25.1310) (a) Each installation whose functioning is required for type certification or by operating rules and that requires a power supply is an "essential load" on the power supply. The power sources and the system must be able to supply the following power loads in p robable operating combinations and for probable durations (see AMC 25.1310(a) ): (1) Loads connected to the system with the system functioning normally.

(2) Essential loads, after failure of any one prime mover, pow er converter, or energy storage device.

(3) Essential loads after failure of - (i) Any one engine on two - engine aeroplanes; and (ii) Any two engines on three - or - more engine aeroplanes.

(4) Essential loads for which an alternate source of power is required, after any failure or malfunction in any one - power supply system, distribution system, or other utilisation system.

(b) In determining compliance with sub - paragraphs (a)(2) and (3) of this paragraph, the power loads may be assumed to be reduced under a mon itoring procedure consistent with safety in the kinds of operation authorised. Loads not required in controlled flight need not be considered for the two - engine - inoperative condition on aeroplanes with three or more engines.

[Amdt 25/18]

AMC 25.1310(a) Power source capacity and d istribution

ED Decision 2003/2/RM When alternative or multiplication of systems and equipment is provided to meet the requirements of CS 25.1310(a) , the segregation between ci rcuits should be such as to minimise the risk of a single occurrence causing multiple failures of circuits or power supplies of the system concerned. For example, electrical cable bundles or groups of hydraulic pipes should be so segregated as to prevent d amage to the main and alternat ive systems and power supplies.

CS 25.1315 Negative acceleration

ED Decision 2016/010/R (See AMC 25.1315 ) No hazardous malfunction may occur as a result of the aeroplane being operated at the negative accelerations within the flight envelopes prescribed in CS 25.333 . This must be shown for the greatest duration expecte d for the acceleration.

[Amdt 25/18] Powered by EASA eRules Page 874 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL

AMC 25.1315 Negative a ccelerations

ED Decision 2003/ 2/RM 1 Demonstration of compliance with CS 25.1315 should be made by analysis and/or ground tests, and should be supported by flight tests.

2 Analysis and/or Ground Tests. Appropriate analysis and/or ground tests should be made on components of essential fluid systems and such other components as are likely to be adversely affected by negative acceleration to demonstrate tha t they will not produce a hazardous malfunction.

3 Flight Tests 3.1 The aeroplane should be subjected to – a. One continuous period of at least five seconds at less than zero g, and, separately, b. A period containing at least two excursions to less th an zero g in rapid succession, in which the total time at less than zero g is at least five seconds.

3.2 The tests should be made at the most critical condition from the fuel flow standpoint, e.g.

with fuel flow corresponding to maximum continuous power a nd with the fuel representing a typical operational low fuel condition as for a missed approach.

CS 25.1316 Electrical and electronic system lightning protection

ED Decision 2015 / 019/R (See AMC 20 - 136) (a) Each electrical and electronic system that performs a function whose failure would prevent the continued safe flight and landing of the aeroplane must be designed and installed so that: (1) the function is not adversely affected during and after the time the aeroplane is exposed to lightning; and (2) the system automatically recovers normal operation of that function, in a timely manner, after the aeroplane is exposed to lightning, unless the system’s recovery conflicts with other operational or functio nal requirements of the system that would prevent continued safe flight and landing of the aeroplane.

(b) Each electrical and electronic system that performs a function whose failure would reduce the capability of the aeroplane or the ability of the flight crew to respond to an adverse operating condition must be designed and installed so that the function recovers normal operation in a timely manner after the aeroplane is exposed to lightning.

[Amdt 25/17]

CS 25.1317 High - Intensity Radiated Fields (H IRF) protection

ED Decision 2015/019/R (See AMC 20 - 158) (a) Each electrical and electronic system that performs a function whose failure would prevent the continued safe flight and landing of the aeroplane must be designed and installed so that: (1) The fu nction is not adversely affected during and after the time the aeroplane is exposed to HIRF environment I, as described in Appendix R ; Powered by EASA eRules Page 875 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL (2) The system automatically recovers normal operation of that function, in a t imely manner, after the aeroplane is exposed to HIRF environment I, as described in Appendix R, unless the system’s recovery conflicts with other operational or functional requirements of the system that would prevent continued safe flight and landing of t he aeroplane; and (3) The system is not adversely affected during and after the time the aeroplane is exposed to HIRF environment II, as described in Appendix R .

(b) Each electrical and electronic system that perfo rms a function whose failure would significantly reduce the capability of the aeroplane or the ability of the flight crew to respond to an adverse operating condition must be designed and installed so that the system is not adversely affected when the equi pment providing the function is exposed to equipment HIRF test level 1 or 2, as described in Appendix R .

(c) Each electrical and electronic system that performs a function whose failure would reduce the capability of the aeroplane or the ability of the flight crew to respond to an adverse operating condition must be designed and installed so that the system is not adversely affected when the equipment providing the function is exposed to equipment HIRF test level 3, as described in Appendix R .

[Amdt 25/17]

CS 25.1319 Equipment, systems and network information

protection

ED Decision 2020/006/R (a) Aeroplane equipment, systems and networks, considered separately and in relation to other systems, must be protected from intentional unauthorised electronic interactions (IUEIs) that may result in adverse effects on the safety of the aeroplane. Protection must be ensured by showing that the security risks have been identified , assessed and mitigated as necessary.

(b) When required by paragraph (a), the applicant must make procedures and Instructions for Continued Airworthiness (ICA) available that ensure that the security protections of the aeroplane’s equipment, systems and n etworks are maintained.

[Amdt 25/25]

AMC to CS 25.1319 Equipment, systems and network information

security protection

ED Decision 2020/006/R In showing compliance with CS 25.1319 , the applicant may consider AMC 20 - 42 , which provides acceptable means, guidance and methods to perform security risk assessments and mitigation for aircraft information systems.

The term ‘adverse e ffects on the safety of the aeroplane’ limits the scope of this provision to security breaches that impact on the safety and airworthiness of the aeroplane and its operation, rather than security breaches that may impact on the systems that have no safety effect on the aeroplane. For example, while the manufacturer and the air operator may have real concerns about protecting a device that is used to process passenger credit cards and securing passenger information, EASA does not regard this as being subject to review and approval as part of the certification of the system, but instead as something that the air operator or manufacturer would address as part of their business practices and responsibilities to the customer.

Powered by EASA eRules Page 876 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) GENERAL The term ‘mitigated as necessary’ clarifies that the applicant has the discretion to establish appropriate means of mitigation against security risks.

The term ‘procedures and Instructions for Continued Airworthiness (ICA)’ clarifies that, while the ICA may be one mechanism for providing the necessary instructions to maintain airworthiness, the security protections may go beyond traditional ICA material, and also include other procedures provided to the air operator. This aligns with the existing practices among those applicants for which special conditions (SCs) have been issued to address the protection of the aircraft information systems’ security.

[Amdt 25/25] Powered by EASA eRules Page 877 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBP ART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION

INSTRUMENTS: INSTALLATION

CS 25.1321 Arrangement and visibility

ED Decision 2003/ 2/RM (a) Each flight, navigation, and powerplant instrument for use by any pilot must be plainly visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path.

(b) The flight instruments required by CS 25.1303 must be grouped on the instrument panel and centred as nearly as practicable about the vertical plane of the pilo t’s forward vision. In addition – (1) The instrument that m ost effectively indicates attitude must be on the panel in the top centre position; (2) The instrument that most effectively indicates airspeed must be adjacent to and directly to the left of the instrument in the top centre position; (3) The instrument th at most effectively indicates altitude must be adjacent to and directly to the right of the instrument in the top centre position; and (4) The instrument that most effectively indicates direction of flight must be adjacent to and directly below the instrum ent in the top centre position.

(c) Required powerplant instruments must be closely grouped on th e instrument panel. In addition – (1) The location of identical powerplant instruments for the engines must prevent confusion as to which engine each instrumen t relates; and (2) Powerplant instruments vital to the safe operation of the aeroplane must be plainly visible to the appropriate crewmembers.

(d) Instrument panel vibration may not damage or impair the accuracy of any instrument.

(e) If a visual indicator is provided to indicate malfunction of an instrument, it must be effective under all probable cockpit lighting conditions.

CS 25.1322 Flight Crew Alerting

ED Decision 20 11 / 004 /R (See AMC 25.1322 ) (a) Flight crew alerts must: (1) provide the flight crew with the information needed to: (i) identify non - normal operation or aeroplane system conditions, and (ii) determine the appropriate actions, if any; (2) be readily and easily detectable and intelligible by the fl ight crew under all foreseeable operating conditions, including conditions where multiple alerts are provided; (3) be removed when the alerting condition no longer exists.

Powered by EASA eRules Page 878 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (b) Alerts must conform to the following prioritisation hierarchy based on the urgency of flight crew awareness and response: (1) Warning: For conditions that require immediate flight crew awareness and immediate flight crew response.

(2) Caution: For conditions that require immediate flight crew awareness and subsequent flight crew response.

(3) Advisory: For conditions that require flight crew awareness and may require subsequent flight crew response.

(c) Warning and Caution alerts must: (1) be prioritised within each category, when necessary; (2) provide timely attention - getting cues through at least two different senses by a combination of aural, visual, or tactile indications; (3) permit each occurrence of the attention - getting cues required by sub - paragraph (c)(2) to be acknowledged and suppressed, unless they are required to be continuous.

(d) The alert function must be designed to minimise the effects of false and nuisance alerts. In particular, it must be designed to: (1) prevent the presentation of an alert when it is inappropriate or unnecessary; (2) provi de a means to suppress an attention - getting component of an alert caused by a failure of the alerting function that interferes with the flight crew’s ability to safely operate the aeroplane. This means must not be readily available to the flight crew so th at it could be operated inadvertently or by habitual reflexive action. When an alert is suppressed, there must be a clear and unmistakable annunciation to the flight crew that the alert has been suppressed.

(e) Visual alert indications must: (1) conform to the following colour convention: (i) Red for Warning alert indications.

(ii ) Amber or yellow for Caution alert indications.

(ii i) Any colour except red or green for Advisory alert indications.

(2) use visual coding techniques, together with other alertin g function elements on the flight deck, to distinguish between Warning, Caution and Advisory alert indications, if they are presented on monochromatic displays that are incapable of conforming to the colour convention in paragraph (e)(1).

(f) Use of the co lours red, amber and yellow on the flight deck for functions other than flight crew alerting must be limited and must not adversely affect flight crew alerting.

[Amdt 25/11] Powered by EASA eRules Page 879 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION

AMC 25.1322 Alerting Systems

ED Decision 2011 / 004/R Paragraph 1. Purpose 2. Applicability 3. Related Examples, Regulations, Documents, and Definitions 4. Background 5. Designing a Flight crew Alerting System a. General b. Flight crew Alerting Philosophy c. Design Considerations 6. Alert Functional Elements a. Warning Alerts b. Tim e - Critical Warning Alerts c. Master Visual and Aural Alerts d. Caution Alerts e. Advisory Alerts 7. Alerting System Reliability and Integrity 8. Managing Alerts a. Rules and General Guidelines b. Multiple Aural Alerts c. Multiple Visual Alerts d. Alert Inhibits 9. Clearing and Recalling Visual Alert Messages 10. Interface or Integration with Other Systems 11. Colour Standardisation 12. Minimising the Effects of False and Nuisance Alerts 13. Showing Compliance for Approval of a Flight crew Alerting System 14. Integrating Flight crew Alerting System Elements into the Existing Fleet a. General b. Visual Alerts c. Aural Alerts d. Tactile Alerts 15. Alerts for Head - Up Displays (HUDs) List of Appendices Appendix 1 Examples for Including Visual System Elements in an Alerting System Appendix 2 Examples for Including Aural System Elements in an Alerting System Appendix 3 Regulations Appendix 4 Related Documents Appendix 5 Definitions 1. Purpose This AMC provides an acceptable means of compliance and guidance material for showing compliance with certain requirements of CS - 25, for the design approval of flight crew alerting functions. This AMC addresses the type of alert function elements that should be considered (including visual, aural, and tacti le or haptic elements), alert management, interface or integration of alerts with other systems, and colour standardisation. The appendices to this AMC also provide examples for including visual and aural system elements in an alerting system.

2. Scope a. This AMC is applicable to aeroplane manufacturers, modifiers, avionics manufacturers, EASA type - certification engineers, human factor specialists and test pilots.

Powered by EASA eRules Page 880 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION b. This AMC is applicable to new aeroplanes. It may also be applicable to modified aero planes and to integrating flight crew alerting system elements into existing aeroplanes. It applies to individual aircraft systems that provide flight crew alerting functions that may or may not be integrated with a central alerting system, as well as to s ystems whose primary function is alerting, such as a central alerting system.

3. Related Examples, Certification Specifications, Documents, and Definitions Appendix 1 of this AMC provides examples for including visual system elements in an alerting system . Appendix 2 of this AMC provides examples for including aural system elements in an alerting system. Appendix 3 of this AMC lists the airworthiness and operational certification specifications related to this AMC. Appendix 4 of this AMC lists related AMCs and other documents that are provided for information purposes and are not necessarily directly referenced in this AMC. Appendix 5 provides definitions written to support the content of this AMC and its associated certification specification.

4. Backgrou nd a. While the flight crew is ultimately responsible for the operation of the aeroplane, the provision of an alerting system that aids the flight crew in identifying non - normal operational or aeroplane system conditions and in responding in an appropriat e and timely manner is an essential feature of every flight deck design. In the past, aeroplanes were designed with discrete lights for the alerting function. Now the alerting function can be integrated with other systems, including electronic display syst ems, tactile warning systems, and aural warning or tone generating systems.

b. CS - 25 often provides references to an alert, such as a warning, to provide awareness of a non - normal condition. Many of these certification specifications were written without recognition of a consistent flight deck alerting philosophy, and may use the term “warning” and “alert” in a generic sense. This AMC does not intend to conflict with or replace the intent of those certification specifications. The intent here is to standar dise flight crew alerting terminology used and to provide a means for applicants to show compliance with those certification specifications.

5. Designing a Flight crew Alerting System a. General. The purpose of flight crew alerts on aeroplanes is to attr act the attention of the flight crew, to inform them of specific non - normal aeroplane system conditions or certain non - normal operational events that require their awareness, and, in modern alerting systems, to advise them of possible actions to address th ese conditions. The ability of an alert to accomplish its intent depends on the design of the complete alert function. This includes the sensor and the sensed condition required to trigger an alert, how that information is subsequently processed, including the level of urgency and priority assigned, and the choice of alert presentation elements to express the assigned level of urgency. Conditions that do not require flight crew awarenes s should not generate an alert.

b. Flight crew Alerting Philosophy. When developing a flight crew alerting system, use a consistent philosophy for alerting conditions, urgency and prioritisation, and presentation.

(1) Alerting conditions. Establish how aeroplane system conditions or operational events that require an alert (for example, engine overheating, windshear, etc.), will be determined.

Powered by EASA eRules Page 881 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (2) Urgency and Prioritisation. Establish how the level of urgency (Warning, Caution and Advisory) associated with each alerting condition will be prioritised and cla ssified to meet the requirements listed in CS 25.1322(b) and CS 25.1322(c)(1) . If an alert’s urgency and prioritisation is context sensitive, state what information should be considered (for example, the priority associated with different alerting conditions may vary depending on the state of the aeroplane, phase of flight, system configuration, etc.).

(3) Presentation. Establish a consistent alert presentation scheme (for example, location of the alert on the flight deck, alert combinations [aural, visual, tactile], information presented in the Alert message, and colour and graphical coding standardisation). Also, determine the format in which that alert will be presented ( for example, structure and timing of Alert messages) to support th e alerting function’s purpose.

c. Design Considerations. Consider the following concepts and elements when designing an alerting system: (1) Only non - normal aeroplane system conditions an d operational events that require flight crew awareness to support flight crew decision making and facilitate the appropriate flight crew response should cause an alert. However, conditions that require an alert depend on the specific system and aeroplane design, and overall flight - deck philosophy. For example, the failure of a single sensor in a multi - sensor system may not necessarily result in an alert condition that requires pilot awareness. However, for a single sensor system, such a failure should resu lt in an alert condition that provides the flight crew with the information needed to assure continued safe flight and landing.

(2) All alerts presented to the flight crew, (for example, light, aural annunciation, engine - indication - and - crew - alerting syst em (EICAS) message, master caution) must provide the flight crew with the information needed to identify the non - normal operational or aeroplane system condition and determine the corrective action, if any ( CS 25.1 322(a)(1) ). Appropriate flight crew corrective actions are normally defined by aeroplane procedures (for example, in checklists) and are part of a flight crew training curriculum or considered basic airmanship.

(3) Implement a consistent flight crew alert ing philosophy as described in paragraph 5.b of this AMC.

(4) Include the appropriate combination of alerting system presentation elements, which typically include: (a) Master visual alerts (b) Visual alert information (includes Failure flag indication s) (c) Master aural alerts (d) Voice information (e) Unique tones (unique sounds) (f) Tactile or haptic information (5) Use logic - based integrated alerting systems to ensure that alerting system elements are synchronised and provide the proper alert p resentation format for Powered by EASA eRules Page 882 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION each urgency level. For example, the onset of the Master visual alert should normally occur simultaneously with the onset of the Master aural alert.

(6) Present the alerts according to the urgency and prioritisation philosophy outli ned in paragraph 5.b and described in detail in paragraph 8.a of this AMC.

(7) Visual alerts must conform to the colour convention of CS 25.1322(e) . Paragraph 11 of this AMC provides guidance on the colour convention.

(8) If using aural alerts with multiple meanings, a corresponding visual, tactile, or haptic alert should be provided to resolve any potential uncertainty relating to the aural alert and clearly identify the specific alert cond ition.

6. Alert Functional Elements. The functional elements used in the alerting and information functions for Warning and Caution alerts must provide timely attention - getting cues, resulting in immediate flig ht crew awareness, through at least two different senses ( CS 25.1322(c)(2) ).

Functional elements used for Advisory alerts do not require immediate flight crew awareness and are normally p rovided through a single se nse.

a. Warning Alerts. Several alert functional element combinations are used to comply with CS 25.1322(c)(2) (two - senses requirement). The typical alert - element combinations for Warning alerts (not including Tim e - critical warning alerts) are shown below.

(1) Master visual alert, Visual alert information, and Master aural alert.

(2) Master visual alert, Visual alert information, and Voice information or Unique tone.

Note 1: Voice information may be preceded by a Master aural alert.

Note 2: A tactile alert may be combined w ith a visual or aural alert to meet the CS 25.1322 requirement f or a combination of two senses.

b. Time - Crit ical Warning Alerts. Some Warnings may be so time - critical for the safe operation of the aeroplane that general alerts such as a Master visual alert and a Master aural alert may not provide the flight crew with immediate awareness of the specific alerting condition that is commensurate with the level of urgency of flight crew response necessary. In such cases, Warning elements dedicated to specific alerting conditions should be provided that give the flight crew immediate awareness without further reference to other flight deck indications. Examples of such Time - critical warnings include reactive windshear and ground proximity. The alerting elements for Time - critical warnings should include: — Unique Voice information or Unique tone, or both, for each alertin g cond ition, and — Unique Visual alert information in each pilot’s primary field of view for each alerting condition.

Note: A unique tactile alert sensed by each pilot can also meet the CS 25.1322(c)(2) require ment for one of the two senses.

c. Master Visual and Aural Alerts. A Master visual alert and a Master aural alert may not be warranted if other visual and aural means provide more timely atte ntion - getting characteristics. If a Master visual alert and/or a Master aural alert are used, they should aid in the overall attention - getting characteristics and the desired flight crew response and not distract the flight crew from the time - critical cond ition. For example, unique Visual alert information presented in each pilot’s primary field of view is acceptable in place of a Master visual alert if it provides immediate awareness and sufficient attention - Powered by EASA eRules Page 883 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION getting characteristics. However, an aural alert , such as an aural command to “pull up,” or another sensory cue, would still be req uired to meet CS 25.1322(c)(2) .

d. Caution Alerts (1) The alert elements used for Caution are typically identical to those used for Warnings, as both require immediate flight crew awareness.

(2) Some Caution alerts are related to conditions that are precursors to potential Time - critical warning conditions. In these cases, the alerting system elements associated with the Caution should be consistent with the elements for related Time - critical warnings (described in paragraph 6.b of this AMC). For example, reactive windshear warnings, ground - proximity warnings , and Caution alerts can develop into Time - critical warning alerts.

e. Advisory Alerts (1) The alerting and informing functional elements for advisories must meet the applicable requirements of CS 25.1322 and should include Visual alert information.

Advisory information should be located in an area where the flight crew is expected to periodically scan for information.

(2) Advisory information does not require immediate f light crew awareness.

Therefore, it does not require alerting that uses a combination of two senses. In addition, a Master visual alert or Master aural alert is not typically used since immediate flight crew awareness is not needed.

(3) Aural or visual in formation such as maintenance messages, information messages, and other status messages associated with conditions that do not require an alert may be presented to the flight crew, but the presentation of this information should not interfere with the aler ting function or its use.

7. Alerting System Reliability and Integrity a. The alerting system, considered alone and in relation to other systems, should meet the safety objectives of the relevant system safety standards (for example, CS 25.901(b)(2), CS 25.901(c), and CS 25.1309(b)). The reliability and integrity of the alerting system should be commensurate with the safety objectives associated with the system function, or aeroplane function, f or which the alert is provided.

b. When applying the CS 25.1 309(b) system safety analysis process to a particular system or function that has an associated flight crew alert, assess both the failure of the system or function and a failure of its associated alert (CS 25.1309(d)(4)). This should include assessing the effect of a single (common or cascading mode) failure that could cause the failure of a system function and the failure of any associated alerting function. A failure is defined as: “An occurrence that affects the operation of a component, part, or elemen t such that it can no longer function as intended. This includes both loss of function and malfunction.” Therefore, in conducting the safety analysis, both loss of functions and malfunctions should be considered.

c. Since the flight crew alerting function is often integrated with, or is common to, other systems, the impact of a failure or error in the alerting system must be assessed separately and in relation to other systems as required by CS 25.1309(b). The cascading effects of a failure or error in the alerting function, and in the interfacing system, should be analysed. Give special consideration to avoid alerting that, through misinterpretation, could increase the hazard to the aeroplane (CS 25.1309(c)). For example, there should Powered by EASA eRules Page 884 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION not be a foreseeable way that a fire warning for one engine could be misinterpreted as a fire on a different engine.

d. Assess the reliability of the alerting system by evaluating the reduction in the safety margin if the alerting system fails. The evaluation should address: (1) Loss of the complete alerting function.

(2) A malfunction.

(3) Loss or malfunction of one alert in combination with the system condition for which the alert is necessary.

e. The integrity of the alerting system should be examined because it affect s the flight crew’s trust and response when assessing an alert. Since the individual assessment of a False or Nuisance alert for a given system may lead to a specific consequence, the impact of frequent False or Nuisance alerts increases the flight crew’s workload, reduces the flight crew’s confidence in the alerting system, and affects their reaction in case of a real alert. For example, if False or Nuisance alerts are presented the flight crew may ignore a real alert when it is presented.

8. Managing Ale rts. Prioritise alerts so that the most urgent alert is presented first to the fli ght crew.

a. Rules and General Guidelines (1) All flight deck alerts must be prioritised into Warning, Caution, and Advisory categories ( CS 25.1322(b) ).

(2) To meet their intended function(s), alerts must be prioritised based upon urgency of flight crew awareness and urgency of flight crew response (§ 25.1301(a)).

Normally, this means Time - critical w arnings are first, other Warnings are second, Cautions are third, and Advisories are last ( CS 25.1322(b) ).

(3) Depending on the phase of flight, there may be a need to re - categorise certain alerts from a lower ur gency level to a higher urgency level. Furthermore, prioritisation within alert categories may be necessary if the presentation of multiple alerts simultaneously would cause flight crew confusion, or the sequencing of flight crew response is important. For example, when near threatening terrain, Time - critical warnings must be prioritised before other Warnings within the Warning alert category ( CS 25.1322 (c)(1)). JAA TGL - 12 ( TAWS), also identifies situations where prioritisation within alert categories is necessary.

(4) The prioritisation scheme within each alert category, as well as the rationale, should be documented and evaluated, by following the guidance in paragraph 13, The Showing of Compliance, of this AMC.

(5) Documentation should include the results of analyses and tests that show that any delayed or inhibited alerts do not adversely impact safety.

b. Multiple Aural Alerts (1) Aural alerts should be prioritised so that only one aural alert is presented at a time.

If more than one aural alert needs to be presented at a time, each alert must be clearly distinguishable and intelligible by the flight crew ( CS 25.1322 (a)(2)).

(2) When aural alerts are provided, an active aural alert should finish before another aural alert begins. However, active aural alerts must be interrupted by alerts from Powered by EASA eRules Page 885 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: IN STALLATION higher urgency levels if the d elay to annunciate the higher - priority alert impacts the timely response of the flight crew ( CS 25.1301(a) ). If the condition that triggered the interrupted alert is still active, that alert may be repeated once th e higher - urgency alert is completed. If more than one aural alert requires immediate awareness and the interrupted alert(s) affects the safe operation of the aeroplane, an effective alternative means of presenting the alert to the flight crew must be provi ded to meet the requirements of CS 25.1322 (a)(1) and (a)(2).

c. Multiple Visual Alerts (1) Since two or more visual alerts can occur at the same time, applicants must sho w that each alert and its relative priority are readily and easily detectable and intelligible by the flight crew ( CS 25.1322 (a)(2)).

(2) When multiple alerts exist in a s pecific category (for example, multiple Warning alerts or multiple Caution alerts), a means for the flight crew to determine the most recent or most urgent alert must be provided ( CS 25.1322 (c)(1)). For example, the most recent or highest priority alert may be listed at the top of its own category. If the alert is time - critical and shares a dedicated display region it must have the highest alerting priority to satisfy its in tended function ( CS 25.1301(a) ).

(3) Displays must either conform to the alert colour convention or, in the case of certain monochromatic displays not capable of conforming to the colour conventions, use other visual coding techniques per CS 25.1322(e ) . This is necessary so the flight crew can easily distinguish the alert urgency under all foreseeable operating conditions, including conditions where multiple alerts are provided ( CS 25.1322 (a)(2)).

d. Alert Inhibits (1) Alert inhibit functions must be designed to prevent the presentation of an alert that is inappropriate or unnecessary for a particular phase of operation ( CS 25.1322 (d)(1)). Alert inhibits can also be used to manage the prioritisation of multiple alert conditions. Inhibiting an alert is not the same as clearing or suppressing an a lert that is already displayed.

(2) Alert inhibits should be used in the following conditions: (a) When an alert could cause a hazard if the flight crew was distracted by or responded to the alert.

(b) When the alert provides unnecessary information or awareness of aeroplane conditions.

(c) Whe n a number of consequential alerts may be combined into a single higher - level alert.

(3) Alerts can be inhibited automatically by the alerting system or manually by the flight crew.

(4) For operational conditions not recognised by the alerting system, pr ovide a means for the flight crew to inhibit a potential alert that would be expected to occur as the result of the specific operation (for example, preventing a landing configuration alert for a different landing flap setting). For as long as the inhibit exists, there should be a clear and unmistakable indication that the flight crew manually inhibited that alert.

Powered by EASA eRules Page 886 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 9. Clearing and Recalling Alert Messages. Clearing Alert messages from the current Warning, Caution, and Advisory display allows the flight cr ew to remove a potential source of distraction and makes it easier for the flight crew to detect subsequent alerts.

a. The following guidance should be applied for clearing and recalling or storing Alert messages: (1) If a message can be cleared and the condition still exists, the system should provide the ability to recall any cleared Alert message that has been acknowledged.

(2) Either through a positive indication on the display or through normal flight crew procedures, a means should be provided to i dentify if Alert messages are stored (or otherwise not in view).

b. The Alert message must be removed from the display when the condition no longer exists ( CS 25.1322(a)(3) ).

10. Interface or Integration with Other Systems (Checklist, Synoptics, Switches, Discrete lamps).

a. The colour of all visual alerting annunciations and indications must conform to the colour convention in CS 25.1322 (e). Use consistent wording, position, colour and other shared attributes (for example, graphic coding) for all alerting annunciations and indications.

b. Information displayed in the flight deck associated with the alert condi tion must facilitate the flight crew’s ability to identify the alert ( CS 25.1322 (a)(1)(i)) and determine the appropriate actions, if any ( CS 25.1322 (1)(ii)).

c. Information conveyed by the alerting system should lead the flight crew to the correct checklist procedure to facilitate the appropriate flight crew action. Some flight deck alerting systems automatically display the correct checklist procedure or synoptic display when an alert is presented. Some alerts do not display an associated checklist procedure because the correct flight crew action is covered by training or basic airmanship (f or example, autopilot disconnect and Time - critical warnings). In all cases, the aeroplane or system certification test programme should verify that the alerts provide or direct the flight crew to the correct procedures.

d. If multiple checklists can be di splayed (for example, multiple checklists associated with multiple alerts), the flight crew should be able to readily and easily choose the appropriate checklist and action for each alert. For example, the flight crew must be able to easily distinguish whi ch checklist has priority regarding what the flight crew needs to do first to determine the appropriate actions, if any ( CS 25.1322 (a)(1)(ii)).

11. Colour Standardisation. The objective of colour standardisation is to maintain the effectiveness of visual alerts by enabling the flight crew to readily disting uish between alert categories.

a. Visual alert indications must conform to the following colour c onvention ( CS 25.1322 (e)): (1) Red for Warning alert indications.

(2) Amber or yellow for Caution alert indications.

(3) Any colour except red or green for Advisory alert indications.

Note: Green is usually used to indicate “normal” cond itions; therefore, it is not an appropriate colour for an Advisory alert. An Advisory alert is used to indicate a “non - normal” condition.

Powered by EASA eRules Page 887 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION b. A separate and distinct colour should be used to distinguish between Caution and Advisory alerts. If a distinctive colour is not used to distinguish between Caution and Advisory alerts, other distinctive coding techniques must be used to meet the general r equirements of CS 25.1322 (a)(2) so that the flight crew can readily and easily detect the difference between Caution and Advisory alerts.

c. The colour displayed for the Warning Master visual alert must be the same colour used for the associated Warning alerts and the colour displayed for the Caution Master visual alert must be the same colour used for the associated Caution alerts ( CS 25.1322 (e)(1)).

d. The colours red, amber, and yellow must be used consistently ( CS 25.1322 (e)(1)). This includes alert co lour consistency among propulsion, flight, navigation, and other displays and indications used on the flight deck.

e. For monochromatic displays that are not capable of conforming to the colour convention required by CS 25.1322 (e)(2), use display coding techniques (for example, shape, size, and position) so the flight crew can clearly distinguish between Warning, Caution, and Advisory alerts. This requirement is similar to using selected colour coding on multicolour displays that allows the flight crew to easily distinguish between Warning, Caution, and Advisory alerts ( CS 25.1322 (e)). These coding techniques must also meet the gener al alerting requirement in CS 25.1322 (a)(2) so the alerts are readily and easily detectable and intelligible by the flight crew under all foreseeable operating conditions, including conditions where multiple alerts are provided. The wide use of monochromatic displays on the flight deck with flight crew alerting is normally discouraged, except when an increased safety benefit is demonstrated, for example, a HUD used as a primary flight display.

f. CS 25.1322(f) requires that the use of the colours red, amber and yellow on the flight deck for functions other than flight crew alerting must be limited and must not adversely affect flight crew alerting. Consistent use and standar disation for red, amber, and yellow is required to retain the effectiveness of flight crew alerts. It is important that the flight crew does not become desensitised to the meaning and importance of colour coding for alerts, which could increase the flight crew’s processing time, add to their workload, and increase the potential for flight crew confusion or errors.

g. Where red, amber and yellow are proposed for non - flight crew alerting functions, substantiate that there is an operational need to use these colours to provide safety related awareness information. Examples of acceptable uses of red, amber, or yellow for non - alerting functions include: — Weather radar display (for areas of severe/hazardous weather conditions that should be avoided); — TAWS terrain display (for local terrain relative to the current alt itude).

12. Minimising the Effects of False and Nuisance Alerts. As much as possible, the alerting functions or system should be designed to avoid False alerts and Nuisance alerts, while providing reliable alerts to the flight crew when needed. The effects of Nuisance and False alerts distract the flight crew, increase their potential for errors, and increase their workload. CS 25.1322(d) requires that an alert function be designed to minimise the effects of False and Nuisance alerts.

Specifically, a flight crew alerting system must be designed to: a. Prevent the presentation of an alert when it is inappropriate or unnecessary.

b. Provide a means to suppress an attention - getting component of an alert caused by a failure of the alerting system that interferes with the flight cr ew’s ability to safely operate Powered by EASA eRules Page 888 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUI PMENT (CS - 25) INSTRUMENTS: INSTALLATION the aeroplane. This means must not be readily available to the flight crew so that it can be operated inadvertently or by habitual, reflexive action.

c. Permit each occurrence of attention - getting cues for Warning and Cauti on alerts to be acknowledged and then suppressed, unless the alert is required to be continuous ( CS 25.1322(c) ). Reaching forward and pressing a switch light is a common, acceptable means of suppressing the attenti on - getting components of an aural alert, a flashing master warning, or a caution light.

d. Remove the presentation of the alert when the condition no longer exists ( CS 25. 1322 (a)(3)).

e. Pulling circuit breakers is not an acceptable primary means for the flight crew to suppress a False alert.

13. The Showing Of Compliance a. Certification evaluations may be different from project to project because of the complexity, de gree of integration, and specifics of the proposed alerting function or system. We recommend developing a plan to establish how compliance with the rules will be shown and to document how issues will be identified, tracked, and resolved throughout the life cycle of the type investigation programme. We also recommend including the Agency early in the developmental process to discuss the acceptability of any proposed flight deck design and alerting philosophy and the conditions that should be alerted to the f light crew. Typically, the certification programme is used for this purpose. For addressing human factors and pilot interface issues, in addition to the guidance in this AMC, compliance with CS 25.1302 and associated AMC must be shown.

b. When following the guidance in this AMC, document any divergence from this AMC, and provide the rationale for decisions regarding novel or unusual features used in the design of the alerting system. This will facilitate the certification evaluation because it will enable the Agency to focus on areas where the proposed system diverges from the AMC and has new or novel features.

c. In accordance with the certification programme, provide an evaluation of the alerting system. In this case an evaluation is an assessment of t he alerting system conducted by an applicant, who then provides a report of the results to the Agency. Evaluations are different from tests because the representation of the alerting system does not necessarily conform to the final documentation and the Ag ency may or may not be present. Evaluations by the applicant may contribute to a finding of compliance, but they do not constitute a complete showing of compliance by themselves.

(1) The evaluation should include assessments of acceptable performance of t he intended functions, including the human - machine interface, and acceptability of alerting system failure scenarios. The scenarios should reflect the expected operational use of the system. Specific aspects that should be included during the evaluation(s) are: (a) Visual, aural, and tactile/haptic aspects of the alert(s).

(b) Effectiveness of meeting intended function from the human/machine integration, including workload, the potential for flight crew errors, and confusion.

(c) Normal and emergency inhibition and suppression logic and accessibility of related controls.

Powered by EASA eRules Page 889 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (d) Proper integration with other systems, including labelling. This may require testing each particular alert and verifying that the appropriate procedures are provided.

(e ) Acceptability of operation during failure modes per CS 25.1309.

(f) Compatibility with other displays and controls, including multiple Warnings.

(g) Ensuring that the alerting system by itself does not issue Nuisance alerts or interfere with other systems.

(h) Inhibiting alerts for specific phases of flight (for example, take - off and landing) and for specific aeroplane configurations (for example, abnormal flaps and gear).

(2) The validation of the performance and integrity aspects will typi cally be accomplished by a combination of the following methods: — Analysis — Laboratory test — Simulation — Flight test (3) Evaluate the alerts in isolation and combination throughout the appropriate phases of flight and manoeuvres, as well as representative env ironmental and operational conditions. The alerting function as a whole needs to be evaluated in a representative flight deck environment. Representative simulators can be used to accomplish the evaluation of some human factors and workload studies. The le vel and fidelity of the simulator should be commensurate with the certification credit being sought. The simulator should represent the flight deck configuration and be validated by the Agency. The assessment of the alerts may be conducted in a laboratory, simulator, or the actual aeroplane. Certain elements of the alerting system may have to be validated in the actual aeroplane. The evaluation should be conducted by a representative population of pilots with various backgrounds and expertise.

(4) Evaluati ons should also verify the chromaticity (red looks red and amber looks amber) and discriminability (colours can be distinguished from each other) of the colours being used, under the expected lighting levels. Evaluations may also be useful to verify the di scriminability of graphic coding used on monochromatic displays. These evaluations can be affected by the specific display technology being used, so a final evaluation with production representative hardware is sometimes needed.

14. Integrating Flight cre w Alerting System Elements into the Existing Fleet a. General (1) This material provides recommendations to applicants on how to retrofit existing aeroplanes so they comply with CS 25.1322 without major modifications to the curre nt flight crew alerting system.

(2) System upgrades to existing aeroplanes should be compatible with the original aeroplane’s flight crew alerting philosophy. The existing alerting system might no t be able to facilitate the integration of additional systems and associated alerts due Powered by EASA eRules Page 890 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION to limitations in the system inputs, incompatible technologies between the aeroplane and the system being added, or economic considerations.

(a) We discourage incorpor ating a new additional master visual function into the flight crew alerting system. If it is not feasible to include additional systems and associated alerts in the existing master visual function, an additional master visual function may be installed, pro vided that it does not delay the flight crew’s response time for recognising and responding to an alert.

(b) Where possible, new alerts should be integrated into the existing flight crew alerting system. If these alerts cannot be integrated, individual an nunciators or an additional alerting display system may be added.

(c) Not all alerts associated with failure flags need to be integrated into the central alerting system. However, for those alerts requiring immediate flight crew awareness, the alert needs to meet the attention - getting requirements of CS 25.1322 (c)(2) as well as the other requirements in CS 25.1322 . Thus, a Master visual alert or Master aural alert may not be initiated, but an a ttention - getting aural or tactile indication must still accompany an attention - getting visual failure flag to meet the atten tion - getting requirement of CS 25.1322 (a)(1), which requires attention - getting cues through at least two different senses for Warning and Caution alerts.

b. Visual Alerts. Following the guidance in paragraphs 5 an d 6 of this AMC, determine whether or not the added system features will require activation of an aeroplane Master visual alert.

c. Aural Alerts (1) Using the guidance in this AMC, determine if an added system will require activating an aural alert.

(2) The new aural alert should be integrated into the existing aural alerting system and functions. If this is not possible, a separate aural alerting system may be installed, provided that a prioritisation scheme between existing aural alerts and the new aur al alerts is developed so that each alert is recognised and can be acted upon in the time frame appropriate for the alerting situation. This may require a demonstration of any likely combination of simultaneous alerts. After the new and existing alerts hav e been merged, follow the guidance in this AMC for determining how to prioritise the alerts.

d. Tactile Alerts (1) Using the guidance in this AMC, determine if an added system will require activating a tactile alert.

(2) If possible, incorporate the new tactile alert into the existing alerting system. If this is not possible, a separate tactile alerting system may be installed, provided that the following elements are included: (a) A prioritisation scheme between existing tactile aler ts and the new tactile alerts should be developed so that each alert is recognised and can be acted upon in the time frame appropriate for the alerting situation. After the new and existing alerts have been merged, follow the guidance in this AMC for deter mining how to prioritise the alerts.

Powered by EASA eRules Page 891 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (b) A means to ensure that an individual alert can be understood and acted upon. This may require a demonstration of any likely combination of simultaneous alerts.

15. Alerts for Head - Up Displays (HUDs) a. HUDs have visual characteristics that merit special considerations for alerting. First, most HUDs are single - colour (monochromatic) displays and are not capable of using different colours, such as red, amber and yellow to signify alert information. Second, HUDs are located in the pilot’s forward field of view, separated from the instrument panel, and focused at optical infinity. As a result, many visual indications on the instrument panel are not visible to the pilot while viewing the HUD, and the timely detection o f visual alerts displayed on the instrument panel may not be possible. Therefore, even though HUDs are not intended to be classified as integrated caution and warning systems, they do need to display certain alerts, such as Time - critical warnings, to perfo rm their role as a primary flight display (PFD). Monochromatic HUDs are not required to use red and amber to signify Warning and Caution alerts, but do need to provide the equivalent alerting functionality (for example, attention - getting, clearly understan dable, not confusing) as current head - down disp lay (HDD) PFDs ( CS 25.1322(e) ).

b. Alerting functions presented in the HUD should not adversely affect the flight crew’s use of the HUD by obstructing the flight crew ’s outside view through the HUD.

c. Time - critical warnings that are displayed on the HDD PFD also need to be presented on the HUD to ensure equivalent timely pilot awareness and response (for example, ACAS II, windshear, and ground - proximity warning annun ciations) ( CS 25.1301(a) ). Otherwise, the physical separation of the HUD and head - down fields of view and the difference in accommodation (that is, focal distance) would hinder timely pilot awareness of visual alerts displayed head - down.

d. While a pilot is using the HUD, if the master alerting indications are not visible or attention - getting, the HUD needs to display alerts that provide the pilot with timely notification of Caution conditions, Warning c onditions, or both.

e. CS 25.1322(e) requires visual alert indications on monochromatic displays to use coding techniques so the flight crew can clearly distinguish between Warning, Caution, and Advisory alerts. S ince monochromatic HUDs are incapable of using colours to distinguish among Warning, Caution, and Advisory information, other visual display features (coding techniques) are necessary, such as shape, location, texture, along with the appropriate use of att ention - getting properties such as flashing, outline boxes, brightness, and size.

The use of these visual display features should be consistent within the set of flight deck displays, so that the intended meaning is clearly and unmistakably conveyed. For ex ample, Time - critical warnings might be boldly displayed in a particular central location on the HUD, while less critical alerts, if needed, would be displayed in a different manner.

f. For multi - colour HUDs, the display of Warning and Caution alerts shoul d be consistent with HDD PFD presentations.

g. Pilot flying and pilot monitoring roles should account for the use of HUDs to ensure timely awareness of certain alerts, especially because of field of view factors.

(1) For single - HUD installations, when th e pilot flying is using the HUD, the other pilot should be responsible for monitoring the head - down instruments and alerting systems for system failures, modes, and functions that are not displayed on the HUDs.

Powered by EASA eRules Page 892 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (2) For dual - HUD installations there needs t o be greater reliance on master alerting indications that are capable of directing each pilot’s attention to non - HUD alerts when both HUDs are in use. If master alerting indications do not provide sufficient attention to each pilot while using the HUD, the n each HUD should provide annunciations that direct the pilot’s attention to HDDs. The types of information that should trigger the HUD master alerting display are any Cautions or Warnings not already duplicated on the HUD from the HDD.

[Amdt 25/11] Powered by EASA eRules Page 893 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION

Appe ndix 1 – Examples for Including Visual System Elements in an

Alerting System

ED Decision 2015/019 /R This appendix includes detailed guidance and examples to help applicants with a means of compliance and design for visual system elements in an alerting sy stem. They are based on the Agency’s experience with existing and proposed alerting systems that comply with CS 25.1322 . The extent to which this guidance and these examples are applied to a specific type investiga tion programme will vary, depending on the types of alerts presented, and the level of integration associated with an alerting system. The visual elements of an alerting system typically include a Master visual alert, Visual alert information, and Time - cri tical warning visual information.

1. Master Visual a. Location. Master visual alerts for Warnings (master warning) and Cautions (master caution) should be located in each pilot’s primary field of view. Appendix 5 of this A M C includes a definition of pilo t primary field of view.

b. Onset/Duration/Cancellation (1) The onset of a Master visual alert should occur: (a) in a timeframe appropriate for the alerting condition and the desired response, (b) simultaneously with the onset of its related Master aural alert or Unique tone, and its related Visual alert information. Any delays between the onset of the Master visual alert and its related Master aural alert or Unique tone, and its Visual alert information should not cause flight crew distraction or co nfusion, (c) simultaneously at each pilot’s station (Warnings, Cautions).

(2) The Master visual alert should remain on until it is cancelled either manually by the flight crew, or automatically when the alerting condition no longer exists.

(3) After the Master visual alert is cancelled the alerting mechanisms should automatically reset to annunciate any subsequent fault condition.

c. Attention - Getting Visual Characteristics. In addition to colour, steady state or flashing Master visual alerts may be used , as long as the method employed provides positive attention - getting characteristics. If flashing is used, all Master visual alerts should be synchronised to avoid any unnecessary distraction. AMC 25 - 11 , Electronic Flight Deck Displays, provides additional guidance for using flashing alerts.

d. Brightness (1) Master visual alerts should be bright enough to attract the attention of the flight crew in all ambient light conditions.

(2) Manual dimming should not be pro vided unless the minimum setting retains adequate attention - getting qualities when flying under all ambient light conditions.

Powered by EASA eRules Page 894 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION e. Display and Indicator Size and Character Dimensions (1) Design all character types, sizes, fonts, and display backgrounds so that the alerts are legible and understandable at each pilot’s station. These elements should provide suitable attention - getting characteristics.

(2) We recommend that the alerts subtend at least 1 degree of visual angle.

f. Colour (1) Standardcolour con ventions must be followed for the Master visual alerts ( CS 25.1322(d) ): — Red for Warning — Amber or yellow for Caution (2) Master visual alerts for conditions other than Warnings or Cautions (for example, Air Traffic Control (ATC) Datalink alerts) must meet the requirements in CS 25.1322(f) and follow the guidance in this AMC. We recommend using a colour other than red, amber, or yellow.

g. Test function. To comply with the sa fety requirements of CS 25.1309 , include provisions to test/verify the operability of the Master visual alerts.

2. Visual Information a. Quantity and Location of Displays (1) To determine the quantity of displays that provide Warning, Caution, and Advisory alerts, take into account the combination of ergonomic, operational, and reliability criteria, as well as any physical space constraints in the flight deck.

(2) The visual alert information should be located so that both pilots are able to readily identify the alert condition.

(3) All Warning and Caution visual information linked to a Master visual alert should be grouped together on a single dedicated display area. There may be a separate area for each pilot. Advisory alerts should be presented on the same display area as Warning and Caution information. The intent is to provide an intuitive and consistent location for the display of information.

b. Format and Content (1) Use a consistent philosophy for the format and content of the visual information to clearly indicate both the alert meaning and condition. The objectives of the corresponding text message format and content are to direct the flight crew to the correct checklist procedure, and to minimis e the risk of flight crew error.

(2) The alerting philosophy should describe the format and content for visual information. Use a consistent format and content that includes the following three elements: — The general heading of the alert (for example, HYD, FUEL) — The specific subsystem or location (for example, L - R, 1 - 2) — The nature of the condition (for example, FAIL, HOT, LOW) Powered by EASA eRules Page 895 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (3) For any given message, the entire text should fit within the available space of a single page. This encourages shor t and concise messages. Additional lines may be used provided the Alert message is understandable.

(4) If alerts are presented on a limited display area, use an overflow indication to inform the flight crew that additional alerts may be called up for revie w. Use indications to show the number and urgency levels of the alerts stored in memory.

(5) A “Collector message” can be used to resolve problems of insufficient display space, prioritisation of multiple alert conditions, alert information overload, and d isplay clutter. Use Collector messages when the procedure or action is different for the multiple fault condition than the procedure or action for the individual messages being collected. For example, non - normal procedures for loss of a single hydraulic sy stem are different than non - normal procedures for loss of two hydraulic systems. The messages that are “collected” (for example, loss of each individual hydraulic system) should be inhibited so the flight crew will only respond to the correct non - normal pr ocedure pertaining to the loss of more than one hydraulic system.

(6) An alphanumeric font should be of a sufficient thickness and size to be readable when the flight crew are seated at the normal viewing distance from the screen.

Note 1: Minimum character height of 1/200 of viewing distance is acceptable (for example, a viewing distance of 36 inches requires a 0.18 inch character height on the screen) (See DOD - CM - 400 - 18 - 05) Note 2: Arial and sans serif fonts are acceptable for visual alert text. The size o f numbers and letters required to achieve acceptable readability depends on the display technology used. Stroke width between 10% and 15% of character height appears to be best for word recognition on text displays. Extensions of descending letters and asc ending letters should be about 40% of letter height.

Note 3: Different fonts can be used to differentiate between new and previously acknowledged Visual alert information.

c. Colour. The presentation of Visual alert information must use the following sta ndard colour conventions (§ 25.1322(e)): — Red for Warning alerts — Amber or yellow for Caution alerts — Any colour except red, amber, yellow, or green for Advisory alerts (1) Red must be used for indicating non - normal operational or non - normal aircraft system c onditions that require immediate flight crew awareness and an immediate action or decision.

(2) Amber or yellow must be used for indicating non - normal operational or non - normal aircraft system conditions that require immediate flight crew awareness and les s urgent subsequent flight crew response (compared to a Warning alert).

(3) Advisories may use any colour except red or green for indicating non - normal operational or non - normal system conditions that require flight crew awareness and may require subsequen t flight crew response.

Powered by EASA eRules Page 896 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Note: Use of red, amber, or yellow not related to Caution and Warning alerting functions must be limited to prevent diminishing the attention - getting characteristics of true Warnings and Cautions ( CS 25.1322(f) ).

d. Luminance (1) The Visual alert information should be bright enough so that both pilots are able to readily identify the alert condition in all ambient light conditions.

(2) The luminance of the Visual alert information display ma y be adjusted automatically as ambient lighting conditions change inside the flight deck. A manual override control may be provided to enable the pilots to adjust display luminance.

3. Time - Critical Warning Visual Information a. Location. Time - critical warning visual information should appear in each pilot’s primary field of view. Appendix 5 of this AMC includes a definition for pilot primary field of view.

Note: The primary flight display (PFD) is used as a practical and preferred display for displaying the Time - critical warning alerts since the pilot constantly scans the PFD.

Integrating time - critical information into the PFD depends on the exact nature of the Warning. For example, a dedicated location on the PFD may be used both as an att ention - getting function and a visual information display by displaying alerts such as “WINDSHEAR,” “SINK RATE,” “PULL UP,” “TERRAIN AHEAD,” and “CLIMB, CLIMB.” In addition, graphic displays of target pitch attitudes for Airborne Alert and Collision Avoidan ce System (ACAS) II Resolution Advisories and Terrain may also be included.

b. Format (1) The corresponding visual and aural alert information should be consistent.

(2) Time - critical warning visual information may be presented as a text message (for examp le, “WINDSHEAR”). Certain Time - critical warning information, including guidance, may be presented graphically (for example, graphics representing an ACAS II Resolution Advisory).

(3) Text messages and graphics for Time - critical warning information must be red ( CS25.1322(e)(1)(i) ). When displaying Time - critical warnings on monochromatic displays, other graphic coding means must be used ( CS25.1322(e) ).

(4) The information must be removed when corrective actions (e.g. sink rate has been arrested, aeroplane climbed above terrain, etc.) have been taken, and the alerting condition no longer exists ( CS 25.1322(a)(3) ).

c. Size. To immediately attract the attention of the flight crew and to modify their habit pattern for responding to Warnings that are not time - critical. We recommend that a display for Time - critical warnings subtend at least 2 square degrees of visual angle.

4. Fail ure Flags. Failure flags indicate failures of displayed parameters or their data source. Failure flags are typically associated with only single instrument displays. The same colours used for displaying flight crew alerts are used for displaying failure fl ags. In the integrated environment of the flight deck it is appropriate to display instrument failure flags in a colour consistent with the alerting system, as part of the alerting function (see paragraph 5b in the body of this AMC).

[Amdt 25/11] [Amdt 25/ 17] Powered by EASA eRules Page 897 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION

Appendix 2 – Examples for Including Aural System Elements in an

Alerting System

ED Decision 2011/004/R 1. General a. Detailed guidance and examples are included in this appendix to help applicants with a means of compliance, requirements, and deta iled design of an alerting system. They are based on the Agency’s experience with existing and proposed alerting systems that should comply with CS 25.1322 . The extent to which this guidance and these examples are applied to a specific type investigation programme will vary, depending on the types of alerts that are presented, and the level of integration associated with an alerting system. The aural elements of an alerting system include: — Unique tones, including Ma ster aural alerts — Unique Voice information (callouts) b. Each sound should differ from other sounds in more than one dimension (frequency, modulation, sequence, intensity) so that each one is easily distinguishable from the others.

2. Master Aural Alert and Unique Tones a. Frequency (1) Use frequencies between 200 and 4500 Hertz for aural signals.

(2) Aural signals composed of at least two different frequencies, or aural signals composed of only one frequency that contains different characteristics (spacing), are acceptable.

(3) To minimise masking, use frequencies different from those that dominate the ambient background noise.

b. Intensity (1) The aural alerting must be audible to the flight crew in the worst - case (ambient noise) f light conditions whether or not the flight crew are wearing headsets (taking into account their noise attenuation and noise cancelling characteristics) ( CS 25.1322(a)(2) ). The aural alerting should not be so loud a nd intrusive that it interferes with the flight crew taking the required action.

(2) The minimum volume achievable by any adjustment (manual or automatic) should be adequate to ensure it can be heard by the flight crew if the level of flight deck noise sub sequently increases.

(3) We recommend automatic volume control to maintain an acceptable signal - to - noise ratio.

c. Number of Sounds (1) Limit the number of different Master aural alerts and unique tones, based on the ability of the flight crew to readily obtain information from each alert and tone.

While different studies have resulted in different answers, in general these studies conclude that the number of unique tones should be less than 10.

(2) Provide one unique tone for master warning and one unique tone for master caution alerts.

Powered by EASA eRules Page 898 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (3) We do not recommend a Master aural alert for advisories because immediate flight crew attention is not needed for an Advisory alert.

d. Onset/Duration (1) The onset of the Master aural alert or unique tone should occur in a timeframe appropriate for the alerting condition and the desired response. Any delays between the onset of the Master aural alert or unique tone and its related visual alert should not cause flight crew distraction or confusion.

(2) We recommend ramping the onset and offset of any aural alert or unique tone to avoid startling the flight crew.

(a) A duration for onsets and offsets of 20 - 30 milliseconds is acceptable.

(b) An onset level of 20 - 30 decibels above the ambient noise level is acceptable.

(3) If more than one source of the Master aural alert or unique tone is provided, the Master aural alert or unique tone for the same condition should occur simultaneously at each pilot’s station. Any timing differences should not be distracting nor should they interfere with identifying the aural alert or unique tone.

(4) Signal duration of the Master aural alert and unique tones should vary, depending on the alert urgency level and the type of response desired.

(5) Unique tones associated with Time - critic al warnings and Cautions should be repeated and non - cancelable until the alerting condition no longer exists (for example, stall warning), unless it interferes with the flight crew’s ability to respond to the alerting condition.

(6) Unique tones associated with Warnings and Cautions should be repeated and non - cancelable if the flight crew needs continuous awareness that the condition still exists, to support them in taking corrective action. The aural warning requirements listed in CS 25.1303(c)(1) and CS 25.729(e) m ust be followed.

(7) Unique tones associated with Warnings and Cautions should be repeated and cancelable by the flight crew if the flight crew does not need a co ntinuous aural indication that the condition still exists (for example, Fire Bell or Abnormal Autopilot Disconnect) and if a positive acknowledgement of the alert condition is required.

(8) Unique tones associated with Warnings and Cautions should not be r epeated if the flight crew does not need continuous aural indication that the condition still exists.

(9) Unique tones that are not associated with a Warning or a Caution (for example, certain advisories, altitude alert, or selective calling (SELCAL)) shou ld be limited in duration.

(10) Master aural alerts for Warnings and Cautions should be repeated and non - cancelable if the flight crew needs continuous awareness that the condition still exists, to support the flight crew in taking corrective action ( CS 25.729(e)(2) ). The requirements for aural Warnings in CS 25.729(e) must be followed.

(11) Master aural alerts for Warnings and Cautions should be repeated until the flight c rew acknowledges the warning condition or the warning condition no longer exists.

Powered by EASA eRules Page 899 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUM ENTS: INSTALLATION e. Cancellation (1) For Caution alerts, if the flight crew does not need continuous aural indication that the condition still exists, the Master aural alert and unique tone should continue through one presentation and then be automatically cancelled.

(2) If there is any tone associated with an Advisory alert, it should be presented once and then be automatically cancelled.

(3) Provide a means to reactivate cancell ed aural alerts (for example, the aural alert associated with a gear override).

(4) When silenced, the aural alerts should be automatically re - armed. However, if there is a clear and unmistakable annunciation in the pilot’s forward field of view that the a ural alerts have been silenced, manual re - arming is acceptable.

3. Voice Information. For a Time - critical warning, use Voice information to indicate conditions that demand immediate flight crew awareness of a specific condition without further reference t o other indications in the flight deck. A second attention - getting sensory cue, such as a visual cue, is still required ( CS 25.1322(c)(2) ). Additional reasons for using Voice information include: a. Limiting the n umber of unique tones.

b. Transferring workload from the visual to the auditory channel.

c. Enhancing the identification of an abnormal condition and effectively augmenting the visual indication without replacing its usefulness.

d. Providing information to the flight crew where a voice message is preferable to other methods.

e. Assuring awareness of an alert no matter where the pilot’s eyes are pointed.

f. Voice Characteristics (1) General.

(a) The voice should be distinctive and intelligible .

(b) The voice should include attention - getting qualities appropriate for the category of the alert, such as voice inflection, described below.

(2) Voice Inflection. Voice inflection may be used to indicate a sense of urgency.

However, we do not recommend using an alarming tone indicating tension or panic. Such a tone may be inappropriately interpreted by flight crews of different cultures. Depending on the alerting condition, advising and commanding inflections may be used to facilitate corrective action, but the content of the message itself should be sufficient.

(3) Voice Intensity.

(a) Aural voice alerting must be audible to the flight crew in the worst - case (ambient noise) flight conditions whether or not the flight crew is wearing headsets (taking int o account the headsets’ noise attenuation characteristics) ( CS 25.1301(a) ). Aural voice alerting should not be so loud and intrusive that it interferes with the flight crew taking the required action.

The minimum v olume achievable by any adjustment (manual or automatic) (if provided) of aural voice alerts should be adequate to ensure it can be Powered by EASA eRules Page 900 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION heard by the flight crew if the level of flight deck noise subsequently increases.

(b) We recommend automatic volume control to maintain an acceptable signal - to - noise ratio.

g. Onset and Duration (1) The onset of Voice information should occur: (a) In a timeframe appropriate for the alerting condition and the desired response.

(b) Simultaneously with the onset of its related V isual alert information. Any delays between the onset of the Voice information and its related visual alert should not cause flight crew distraction or confusion.

(c) Simultaneously at each pilot’s station, if more than one source of the Voice information is provided for the same condition, so that intelligibility is not affected.

(2) The duration of Voice information associated with Time - critical warnings should continue until the alerting condition no longer exists (for example, terrain warning). The Voic e information should be repeated and non - cancelable during this time.

(3) Voice information associated with Time - critical warnings and Cautions shouldnot be repeated if it interferes with the flight crew’s ability to respond to the alerting condition (for example, windshear warning, or ACAS II resolution advisory).

(4) To support the flight crew in taking corrective action Voice information associated with Warnings should be repeated and non - cancelable if the flight crew needs continuous awareness that the condition still exists.

(5) Voice information associated with Warnings should be repeated and cancelable if the flight crew does not need continuous aural indication that the condition still exists (for example, Cabin Altitude Warning or Autopilot Disconnect).

(6) Reset the alerting mechanisms after cancelling them so they will annunciate any subsequent fault condition.

(7) For voice alerts associated with a Caution alert, the corresponding Voice information should either: (a) Be limited in duration (for example, ACAS II Traffic Advisory or Windshear Caution), or (b) Be continuous until the flight crew manually cancels it or the Caution condition no longer exists.

h. Voice Information Content (1) The content should take into account the flight crew’ s ability to understand the English language.

(2) When practical, Voice information should be identical to the alphanumeric text message presented on the visual information display. If that is not possible, the Voice information and alphanumeric messages s hould at least convey the same information, so it is readily understandable and initiates the proper pilot response.

Powered by EASA eRules Page 901 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (3) For Time - critical warnings, the content and vocabulary of Voice information must elicit immediate (instinctive) directive corrective ac tion ( CS 25.1322(a)(2) ). In order to do this, it should identify the condition triggering the alert. In some cases, it may also be necessary to provide guidance or instruction information.

(4) For Warning and Cauti on alerts, the content of Voice information must provide an indication of the nature of the condition triggering the alert ( CS 25.1322(a)(2) ). The Voice information should be descriptive and concise.

(5) The conten t should be consistent with any related visual information display (for example, Aural: “Pull up”; Visual: “Pull up” on the PFD.)

(6) Structure Voice information that uses more than one word so if one or more words are missed the information will not be mi sinterpreted (for example, avoid the word “don’t” at the beginning of a voice message).

(7) Design Voice information so the flight crew can easily distinguish one spoken word message from another to minimise confusion.

[Amdt 25/11] Powered by EASA eRules Page 902 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION

Appendix 3 – Regulations

ED Decision 2016/010/R The following related documents are provided for information purposes and are not necessarily directly referenced in this AMC. The full text of CS - 25 can be downloaded from the Internet at http://easa.europa.eu/agency - measures/certification - specifications.php .

CS - 25 Paragraph Subject CS 25.207 Stall warning CS 25.253(a)(2) High - speed characteristics CS 25.672(a) Stability - augmentation and automatic and power - operated systems CS 25.679(a) Control system gust locks CS 25.699 Lift and drag device indicator CS 25.703 Take - off warning system CS 25.729(e) Extending and retracting mechanisms CS 25.783(e) Fuselage Doors CS 25.812(f)(2) Emergency lighting CS 25.819(c) Lower deck service compartments CS 25.841(b)(6) Pressurised cabins CS 25.854(a) Lavatory fire protection CS 25.857(b)(3), (c)(1), (e)(2) Cargo compartment classification CS 25.859(e)(3) Combustion heater fire protection CS 25.863(c) Flammable fluid fire protection CS 25.1019(a)(5) Oil strainer or filter CS 25.1165(g) Engine ignition systems CS 25.1203(b)(2), (b)(3), (f)(1) Fire - detector system CS 25.1302 Installed systems and equipment for use by the flight crew CS 25.1303(c)(1) Flight and navigation instruments CS 25.1305(a)(1), (a)(5), (c)(7) Powerplant instruments CS 25.1309(a), (b), (c), (d)(4) Equipment, systems, and installations CS 25.1322 Flight crew Alerting CS 25.1326 Pitot heat indication systems CS 25.1329 Flight guidance system CS 25.1331(a)(3) Instruments using a power supply CS 25.1353(c)(6)(ii) Electrical equipment and installations CS 25.1419(c) Ice protection CS 25.1 517 Rough air speed, V RA CS 25.1549 Powerplant and auxiliary power unit instruments CS 25J1305 APU Instruments CS - 25 Appendix I, I 25.6 Automatic Take - off Thrust Control System (ATTCS) Powerplant controls CS - AWO 153 Audible warning of automatic pilot disengagement CS - AWO 253 Audible warning of automatic pilot disengagement CS - AWO 352 Indications and warnings [Amdt 25/11] [Amdt 25/12] [Amdt 25/18] Powered by EASA eRules Page 903 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION

Appendix 4 – Related Documents

ED Decision 2016/010/R 1. FAA Reports. A paper copy of the following reports may be ordered from the National Technical Information Service, 5285 Port Royal Road, Springfield, VA 22161 .

a. Report DOT/FAA/RD - 81/38, II, “Aircraft Alerting Systems Standardisation Study, Volume II, Aircraft Alert ing Systems Design Guidelines.” b. Report DOT/FAA/CT - 96/1, GAMA Report No. 10, “Recommended Guidelines for Part 23 Cockpit/Flight Deck Design” (September 2000), Section 4, Definitions, Primary Field of View.

2. ACs. An electronic copy of the following AC s can be downloaded from the Internet at http://rgl.faa.gov . A paper copy may be ordered from the U.S. Department of Transportation, Subsequent Distribution Office, M - 30, Ardmore East Business Center, 3341 Q 7 5th Avenue, Landover, MD 20795. .

Number Title AC 20 - 69 Conspicuity of Aircraft Malfunction Indicators AC 20 - 88A Guidelines on the Marking of Aircraft Powerplant Instruments (Displays) AC 25 - 7C Flight Test Guide for Certification of Transport Category Airplanes AC 25 - 11A Electronic Flight Deck Displays AC 25 - 23 Airworthiness Criteria for the Installation Approval of a Terrain Awareness and Warning System (TAWS) for Part 25 Airplanes AC 25.703 - 1 Takeoff Configuration Warning Systems AC 25.78 3 - 1A Fuselage Doors and Hatches AC 25.1309 - 1A System Design and Analysis AC 25.1329 - 1B Approval of Flight Guidance Systems AC 25.1523 - 1 Minimum Flightcrew 3. Technical Standard Order (TSO). TSO C - 151b, “Terrain Awareness and Warning Systems,” can be downloaded from the Internet at http://rgl.faa.gov .

4. European Aviation Safety Agency (EASA) Documents. Copies of the following documents can be f ound on the EASA website at http://www.easa.eu.int/agency - measures/certification - specifications.php .

Number Title AMC 25 - 11 Electronic Display Systems AMC 25.1302 Installed Systems and Equipment for Use by the Flightcrew AMC 25.1309 System Design and Analysis AMC 25.1322 Alerting Systems 5. Civil Aviation Authority Document. Patterson, R.D. “Guidelines for Auditory Warning Systems on Civil Aircraft.” Civil Aviation Authority paper 82017. London: Civil Aviation Authority, 1982.

6. Other Related Documents a. Abbott, K.; Slotte, S.M.; and Stimson, D.K. Federal Aviation Administration Human Factors Team Report: The Interfaces Between Flightcre ws and Modern Flight Deck Systems . June 18, 1996. Federal Aviation Administration, Aircraft Certification Service, Transport Airplane Directorate, 1601 Lind Avenue, SW, Renton, WA 98057 - 3356.

http://www.faa.gov/education_research/training/aqp/library/media/interfac.pdf .

Powered by EASA eRules Page 904 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION b. DOD - CM - 400 - 18 - 05, Department of Defense User Interface Specifications for the Defense Information Infrastructure , Defense Informati on Systems Agency, February 1998. E - mail: cio - pubs@disa.mil. The Defense Information Systems Agency website is restricted to visitors from .gov and .mil domains.

c. Edworthy, J. and Adams. A. Warning Design: A Research Perspective . : Taylor and Francis, 1 996. Mortimer House, 37 - 41 Mortimer Street, London, W1T 3JH.

http://www.taylorandfrancis.com .

d. Kuchar, J.K. “Methodology for alerting - system performance evaluation.” Journal of Guidance, Contro l, and Dynamic s, 19, pp. 438 - 444 (1996). AIAA, 1801 Alexander Bell Drive, Suite 500, Reston, VA 20191. http://www.aiaa.org/content .

e. Parasuraman, R. and Riley, V. “Human and Automation: use, misuse , disuse, abuse.” Human Factors: The Journal of the Human Factors and Ergonomics Society , Volume 39, Number 2, June 1997, pp. 230 - 253. Human Factors and Ergonomics Society, , PO Box 1369, Santa Monica, CA 90406 - 1369. http://hfes.publisher.ingentaconnect.com/ .

f. SAE ARP 4033. Pilot - System Integration , August 1, 1995. SAE International, 400 Commonwealth Drive, Warrendale, PA 15096 http://www. sae.org .

g. Satchell, P. Cockpit Monitoring and Alerting System . Aldershot, England : Ashgate, 1993.

Summ House, 170 Finchley Road, , . http://www.ashgate.com .

[Amdt 25/11] [Amdt 25/18] Powered by EASA eRules Page 905 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION

Appendix 5 – Definitions

ED Decision 2011/004/R Definitions are written to support the content of this AMC and its associated certification specification.

Elsewhere, terms such as “warning” may be used in a manner that is not consistent with the definitions below. Ho wever, the intent of this section is to facilitate standardisation of these terms.

Term Definition Advisory The level or category of alert for conditions that require flight crew awareness and may require subsequent flight crew response.

Alert A generic term used to describe a flight deck indication meant to attract the attention of and identify to the flight crew a non - normal operational or aeroplane system condition. Alerts are classified at levels or categories corresponding to Warning, Caution , and Advisory. Alert indications also include non - normal range markings (for example, exceedances on instruments and gauges.)

Alert inhibit Application of specific logic to prevent the presentation of an alert. Alerts can be inhibited automatically by th e alerting system or manually by the flight crew.

Alert message A visual alert comprised of text, usually presented on a flight deck display. Note: Aural Alert messages are referred to as “Voice Information.” Alerting function The aeroplane function that provides alerts to the flight crew for non - normal operational or aeroplane system conditions. This includes Warning, Caution, and Advisory information.

Alerting philosophy The principles, guidance, and rules for implementing alerting functions within a f light deck. These typically consider: 1. The reason for implementing an alert.

2. The level of alert required for a given condition.

3. The characteristics of each specific alert.

4. Integration of multiple alerts.

Attention - getting cues Perceptual signals (visual, auditory, or tactile/haptic) designed to attract the flight crew’s attention in order to obtain the immediate awareness that an alert condition exists.

Caution The level or category of alert for conditions that require immediat e flight crew awareness and a less urgent subsequent flight crew response than a warning alert.

Collector message An Alert message that replaces two or more related Alert messages that do not share a common cause or effect. Example: A “DOORS” alert Collector message is displayed when more than one entry, cargo, or service access door is open at the same time.

Communication A type of message whose initiating conditions are caused by incoming message communications, primarily data link conditions. Tra ditionally, this type of message is not a flight crew alert and does not indicate a non - normal system or operational condition.

(1) Comm High A communication message which requires immediate flight crew awareness and immediate flight crew response.

Note : At this time there are no communication messages defined that require immediate flight crew response.

(2) Comm Medium An incoming communication message that requires immediate flight crew awareness and subsequent flight crew response.

(3) Comm Low An incoming communication message which requires flight crew awareness and future flight crew response.

False alert An incorrect or spurious alert caused by a failure of the alerting system including the sensor.

Powered by EASA eRules Page 906 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Failure An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended. This includes both loss of function and malfunction.

Failure flag One local visual means of indicating the failure of a displayed parameter.

Flashing Short term f lashing symbols (approximately 10 seconds) or flash until acknowledged.

Flight crew response The activity accomplished due to the presentation of an alert such as an action, decision, prioritisation, or search for additional information.

Master aural ale rt An overall aural indication used to attract the flight crew’s attention that is specific to an alert urgency level (for example, Warning or Caution).

Master visual alert An overall visual indication used to attract the flight crew’s attention that is s pecific to an alert urgency level (for example, Warning or Caution).

Normal condition Any fault - free condition typically experienced in normal flight operations.

Operations are typically well within the aeroplane flight envelope and with routine atmospheric and environmental conditions.

Nuisance alert An alert generated by a system that is functioning as designed but which is inappropriate or unnecessary for the particular condition.

Primary field of view Primary Field of View is based upon the optimum vertical and horizontal visual fields from the design eye reference point that can be accommodated with eye rotation only. The description below and Figure A5 - 1 provide an example of how this may apply to head - down displays.

With the normal line - of - sight established at 15 degrees below the horizontal plane, the values for the vertical (relative to normal line - of - sight forward of the aircraft) are +/ - 15 degrees optimum, with +40 degrees up and - 20 degrees down maximum.

For the horizontal visual fiel d (relative to normal line - of - sight forward of the aircraft), the values are +/ - 15 degrees optimum, and +/ - 35 degrees maximum.

Figure A5 - 1. Primary Field of View Powered by EASA eRules Page 907 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Status A specific aircraft system condition that is recognised using a visual indication, but does not require an alert and does not require flight crew response. These types of messages are sometimes used to determine aeroplane dispatch capability for subsequent flights.

Tactile/haptic An indication means where the stimulus is via physical touch, force feedback, or information vibration (for example, a stick shaker).

Time - critical warning A subset of warning. The most urgent warning level to maintain the immediate safe operation of the aeroplane. Examples of Time - critical warni ngs are: Predictive and Reactive Windshear Warnings, Terrain Awareness Warnings (TAWS), Airborne Collision Avoidance System (ACAS) II Resolution Advisories, Overspeed Warnings, and Low Energy Warnings.

Umbrella message An Alert message that is presented i n lieu of two or more Alert messages that share a common cause. Example: A single Engine Shutdown message in lieu of the multiple messages for electrical generator, generator drive, hydraulic pump and bleed air messages, which would otherwise have been dis played. This is different than a Collector message. A Collector message replaces two or more related Alert messages that do “not share” a common cause or effect.

Unique tone (unique An aural indication that is dedicated to specific alerts (for exam ple, fire bell and sound) overspeed).

Visual alert A visual indication that presents the flight crew with data on the exact nature of information the alerting situation. For Advisory level alerts it also provides awareness.

Voice information A means for informing the flight crew of the nature of a specific condition by using spoken words.

Warning The level or category of alert for conditions that require immediate flight crew awareness and immediate flight crew response.

[Amdt 25/11]

CS 25.1323 Airspeed indicating system

ED Decision 2016 / 010 /R (See AMC 25.1323) For each airspeed indicating system, the following apply: (a) Each airspeed indicating instrument must be approved and must be calibrated to indicate true airspeed (at sea - level with a standard atmosphere) with a minimum practicable instrument calibration error when the corresponding pitot and static pressures are applied.

(b) Each system must be calibrated to determine the system error (that is, the relation between IAS and CAS) in flight and during the accelerated takeoff ground run. The ground run calibration must be determined – (1) From 0·8 of the minimum value of V , to the maximum value of V , considering the 1 2 approved ranges of altitude and weight; and (2) With the wing - flaps and power se ttings corresponding to the values determined in the establishment of the take - off path under CS 25.111 assuming that the critical engine fails at the minimum value of V .

(c) The airspeed error of the installation , excluding the airspeed indicator instrument calibration error, may not exceed 3% or five knots, whichever is greater, t hroughout the speed range, from – Powered by EASA eRules Page 908 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (1) V to 1·23 V with wing - flaps retracted; and MO SR1 (2) 1·23 VS to V with wing - flaps in the land ing position.

R0 FE (d) From 1·23 V to the speed at which stall warning begins, the IAS must change perceptibly with SR CAS and in the same sense, and at speeds below stall warning speed the IAS must not change in an incorrect sense. (See AMC 25.1323(d) .)

(e) From V to V + ⅔ (V – V ) the IAS must change perceptibly with CAS and in the same MO MO DF MO sense, and at higher speeds up to VDF the IAS must not change in an incorrect sense. (See AMC 25.1323(e) ) (f) There must be no indication of air - speed that would cause undue difficulty to the pilot during the take - off between the initiation of rotation and the achievement of a steady climbing condition.

(g) The effects of airspeed indicating system lag may not introduce significant takeoff indicated airspeed bias, or significant errors in takeoff or accelerate - stop distances.

(h) Each system must be arranged, so far as practicable, to prevent malfunction or serious error due to the entry of moisture, dirt, or other substances. (See AMC 25.1323(h) .)

(i) Reserved (j) Where duplicate airspeed indicators are required, their respective pitot tubes must be far enough apart to avoid damage to both t ubes in a collision with a bird.

[Amdt 25/16] [Amdt 25/18]

AMC 25.1323(d) Airspeed indicating s ystem

ED Decision 2003/ 2/RM An acceptable means of compliance when demonstrating a percep tible speed change between 1.23 V to stall warning speed is for the rate of change of IAS with CAS to be not less than 0.75."

SR

AMC 25.1323(e) Airspeed indicating s ystem

ED Decision 2003/ 2/RM An acceptable means of compliance when demonstrating a perceptible speed change between V to MO V + 2/3 (V - V ) is for the rate of change of IAS with CAS to be not less than 0.50."

M O DF MO

AMC 25.1323(h) Airspeed indicating s ystem

ED Decision 2003/2/RM The design and installation of the pitot system should be such that positive drainage of moisture is provided, chafing of the tubing and excessive distortion at bends is avoided, and the lag and the possibility of moisture blockage in the tubing should be kept to an acceptable minimum.

CS 25.1324 Flight instrument external probes

ED Decision 2015/008/R ( See AMC 25.1324 ) Each flight instrument external probes systems, including, but not necessarily limited to, pitot tubes, pitot - static tubes, static probes, angle of attack sensors, side slip vanes, and temperature probes, must Powered by EASA eRules Page 909 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION be heated or have an equivalent means of preventing malfunction in the heavy rain conditions defined in Table 1 of this paragraph, in the icing conditions as defined in Appendices C and P, and the following icing conditions specified in Append ix O: (a) For aeroplanes certificated in accordance with CS 25.1420(a)(1) , the icing conditions that the aeroplane is certified to safely exit following detection; (b) For aeroplanes certificated in accordance wi th CS 25.1420(a)(2) , the icing conditions that the aeroplane is certified to safely operate in and the icing conditions that the aeroplane is certified to safely exit following detection; (c) For aeroplanes certificated in accordance with CS 25.1420(a)(3) , all icing conditions.

Table 1 – Rain test conditions Altitude Range Liquid Water Content Horizontal Extent Droplet MVD (ft) (m) (g/m3) (km) (NM) (μm) 1 100 50 0 to 10 000 0 to 3 000 500 to 2 000 6 5 3 15 1 0.5 [Amdt 25/16]

AMC 25.1324 Flight instrument external probes

ED Decision 2018/0 0 5 /R CS 25.1324 requires each flight instrument external probes systems, including, but not necessarily limited to Pitot tubes, Pitot - static tubes, static probes, angle of attack sensors, side slip vanes and temperature probes, to be heated or have an equivalent means of preventing malfunction in the heavy rain conditions of table 1 of CS 25.1324 and in the icing conditions as defined in the Appendices C and P, and in Appendix O (or a port ion of Appendix O ) of CS - 25.

It is unlikely that the icing conditions critical to the equipment will be encountered during flight tests.

Consequently, it is anticipated that tests should be conducted in wind tunne l simulated icing environment to supplement the icing flight test data (natural or tanker) as necessary.

The following AMC provides some guidance related to the test setup and the conditions to be tested.

Note: Engine sensors such as pressure/temperature probes must meet CS - E certification specifications. However, when the signals from these sensors are used by the aeroplane system(s), the aeroplane manufacturer must ensure that the involved engine sensor meets CS 25.1324 specifications. Coordination of this activity should be ensured with the engine manufacturer.

1. Acronyms SAT: Static Air Temperature LWC: Liquid Water Content MVD: Median Volume Diameter IWC: Ice Water Content MMD: Median Mass Dimension L(i): “Liquid” supercooled water conditions Powered by EASA eRules Page 910 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTAL LATION M(i): Mixed phase icing conditions: icing conditions that contain both supercooled water and ice crystals.

G(i): Glaciated conditions: icing conditions totally composed of ice crystals.

R(i): Rain conditions SD: supercooled droplet SLD: supercooled large drop WC: water content 2. Wind Tunnels All conditions must be appropriately corrected to respect the similarity relationship between actual and wind tunnel conditions (due to pressure and scale differences for example). It is the applicant responsibility to determine and justify the various derivations and corrections to be made to the upstream conditions in order to determine actual test conditions (local and scaled).

When the tests are conducte d in non - altitude conditions, the system power supply and the external aerodynamic and atmospheric conditions should be so modified as to represent the required altitude condition as closely as possible.

The icing wind tunnel calibration should have been v erified, in accordance with SAE ARP 5905 with an established programme to maintain calibration of the facility. Calibration records should be examined to ensure the local liquid water concentration at the location of the probe complies with values required in the test specification.

3. Test setup The test setup installation in the wind tunnel must be shown to be equivalent to the installation on the aircraft. In particular, the probe must be installed in such a way that the heat sink capacity of the mount i s equal to or greater than the aircraft installation.

Surface temperature measurements of the probe mounting are typically made during icing wind tunnel tests to verify thermal analysis and to allow extrapolation to conditions not reachable due to the win d tunnel limitations.

4. Local conditions The Water Content (WC) values provided in this AMC or in the Appendices C, O and P to CS - 25 are upstream values, independent of the aircraft installation. Local WC values (at the probe location) need to be derived from the upstream values according to the streamline behaviour around the aircraft. Overconcentration of the WC at the probe location may occur due to the aerodynamic effects of the fuselage in particular.

Local conditions should be determined based on man y parameters which could include: — Aircraft specific — Aircraft fuselage shape — Probe location on aircraft fuselage (X, Y, Z coordinates) — Aircraft speed and altitude (Climb, Cruise, Descent …) — Environmental Conditions specific — Type (SD, SLD, Crystals, Ra in) — Size (from 0 to 2 000 micron) Powered by EASA eRules Page 911 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION — Density — Probe specific: — mast/strut length Concerning the type and size of the particles, the local WC should be computed considering the full distribution of the particles sizes that is actually present in the real atmosphere, even if the wind tunnel tests are then performed at a given single size (20 micron for supercooled droplets, 150 micron for ice crystals, 500 to 2 000 micron for rain drops). The local conditions may also be affected by the “bouncing effect” an d “shattering effect” for solid particles or the “splashing effects” for large liquid particles. As no model exists today to represent ice particles trajectories and these particular effects, an assessment based on the best available state of the art shall be made.

5. Operational Conditions The conditions are to be tested at several Mach and Angle of Attack (AoA) values in order to cover the operational flight envelope of the aircraft. It is the applicant responsibility to select and justify, for each of th e conditions listed in each Cloud Matrix below, the relevant operational conditions to be tested (Mach, AoA and Mode…).

It is expected that several operational conditions will be identified for each environmental conditions but exhaustive testing is not i ntended.

6. Power supply The heating power supply used during the tests should be the minimum value expected at the probe location on the aircraft. It is commonly accepted to test the probe at 10 % below the nominal rated voltage.

7. Flight deck indicatio n When a flight instrument external probe heating system is installed, CS 25.1326 requires an alert to be provided to the flight crew when that flight instrument external probe heating system is not operating or no t functioning normally.

All performances of the probe ice protection system, in particular the icing tests described in this AMC are expected to be demonstrated with equipment selected with heating power set to the minimum value triggering the flight deck indication.

8. Test article selection To be delivered, an article has to meet an Acceptance Test Procedure (ATP) established by the equipment supplier. The ATP is a production test performed on each item to show it meets the performance specification. Both the performance of the ice protection system and the icing tests described hereafter are expected to be demonstrated with an equipment selected at the lowest value of the ATP with respect to the acceptability of the heating performance. This can be accomp lished by adjusting the test voltage, heating cycles and/or any other applicable parameters, to simulate the lowest performing probe. Note that this has to be applied in addition to the power supply reduction mentioned in paragraph 6 above.

9. Mode of Oper ation The modes of operation of the probe are to be assessed in the two following tests. However, depending on the mode of operation of the heating systems, other intermediate modes may have to be tested (e.g. if heating power is varied as a function of the outside temperature, etc.)

Powered by EASA eRules Page 912 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION a. Anti - icing test: During this test, the icing protection of the probe (typically resistance heating) is assumed to be switched “on” prior exposure to icing conditions.

b. De - icing test: During this test, th e icing protection of the probe (typically resistance heating) should be ‘off’ until 0.5 inch of ice has accumulated on the probe. For ice crystal tests in de - icing mode, since no accretion is usually observed, an ‘off’ time duration should be agreed befor e the test. In the past, a 1 - minute time duration without heating power has been accepted. This mode need not be tested if, in all operational scenarios (including all dispatch cases), the probe heating systems are activated automatically at aircraft power ‘On’ and cannot be switched to manual operation later during the flight. Furthermore, in assessing whether or not this mode needs to be tested, any failure conditions that are not demonstrated to be extremely improbable, and that may lead to probe heating supply interruptions, should be considered.

10. Supercooled Liquid (SL) Conditions The following proposed test points are intended to provide the most critical conditions of the complete CS - 25 Appendix C icing env elope, however, a Critical Points Analysis (CPA) may be used to justify different values.

10.1 Stabilized conditions Table 1: Stabilized Liquid icing test conditions (*) (*) Test SAT Altitude Range LWC Duration MVD # (°C) (g/m ) (min) (μm) SL1 − 20 0 to 22000 ft. 0 to 6706 m 0.22 to 0.3 15 15 to 20 SL2 − 30 0 to 22000 ft. 0 to 6706 m 0.14 to 0.2 15 15 to 20 SL3 − 20 4000 to 31000 ft. 1219 to 9449m 1.7 to 1.9 5 15 to 20 SL4 − 30 4000 to 31000 ft. 1219 to 9449 m 1 to 1.1 5 15 to 20 (*) Note: The upstream LWC values of the table are based on CS - 25 Appendix C and correspond to a droplet diameter of 20 μm or 15 μm. Considering that the local collection efficiency is function of the MVD and the probe locat ion with respect to the boundary layer, and that the upstream LWC value is higher for an MVD of 15 μm as compared to 20 μm, the applicant shall establish the conditions leading to the highest local LWC at probe location and test accordingly.

It is accepta ble to run the tests at the highest determined local LWC but using a droplet diameter of 20 μm since most of the wind tunnel are calibrated for that value.

10.2 - Cycling conditions A separate test should be conducted at each temperature condition of Tabl e 2 below, the test being made up of repetitions of either the cycle: a. 28 km in the conditions of column (a) appropriate to the temperature, followed by 5 km in the conditions of column (b) appropriate to the temperature, for a duration of 30 minutes, or b. 6 km in the conditions of column (a) appropriate to the temperature, followed by 5 km in the conditions of column (b) appropriate to the temperature, for a duration of 10 minutes.

Powered by EASA eRules Page 913 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMEN T (CS - 25) INSTRUMENTS: INSTALLATION Table 2: Cycling Liquid icing test conditions Test SAT Altitude Range LWC MVD # (°C ) (g/m³) (μm) (ft) (m) (a) (b) SL6 − 10 17 000 5182 0.6 2.2 SL7 − 20 20 000 6096 0.3 1.7 SL8 − 30 25 000 7620 0.2 1.0 11. Supercooled Large Drop Liquid Conditions Based on the design of the probe, the drop size may not be a significant factor to consider as compared to the other parameters and in particular the Liquid Water Content (LWC). The SLD LWC defined in Appendix O (b etween 0.18 and 0.44 g/m ) is largely covered by the Appendix C continuous maximum LWC (between 0.2 and 0.8 g/m ) and the Appendix C intermittent maximum LWC (between 0.25 and 2.9 g/m ).

Testing SLD conditions may not be necessary if it can be shown that t he Supercooled Liquid Conditions of Appendix C are more critical. If some doubt exists, t he applicant shall propose a set of critical test points to cover adequately the Icing Environment defined in the Appendix O .

For showing compliance with the CS - 25 certification specifications relative to SLD icing conditions represented by Appendix O , the applicant may use a comparative analysis .

AMC 25.1420(f) provides guidance for comparative analysis.

12. Mixed Phase (M) and Glaciated (G) Conditions The applicant should propose a set of critical test points to cover adequately the Icing Environment as proposed in Appendix P of CS - 25.

Testing should be performed at representative altitude as the effect of alti tude on probe behaviour is not yet fully understood, unless demonstration can be made that application of scaling laws leads to conservative approach of testing.

The following considerations shall be taken into account.

12.1 Glaciated Conditions As indicat ed in the Appendix P , the total water content (TWC) in g/m3 has been assessed based upon the adiabatic lapse defined by the convective rise of 90 % relative humidity air from sea level to higher altitudes and scale d by a factor of 0.65 to a standard cloud length of 17.4 nautical miles (NM).

In service occurrences show that several pitot icing events in Glaciated Conditions, above 30 000 ft are outside of the Appendix P domain in term of altitude and outside air tem perature. In that context, the Appendix P , Figure 1 (Convective cloud ice crystal envelope) should be enlarged to encompass ISA +30°C conditions. Furthermore, a reported event occurred at a temperature of – 70 °C. Testing may not be possible at such a low temperature due to simulation tool limitations. However, the presence of Ice Crystals has been observed, and it is anticipated that an extrapolation of existing test data at higher temperature should allow assessin g the predicted performance of the probe heating down to this minimum temperature.

In addition, based on several sources of information including the EUROCAE WG - 89, the Agency is of the opinion that the standard cloud of 17.4 NM and the associated average Powered by EASA eRules Page 914 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION TWC concentration values provided by Appendix P may not provide the most conservative conditions for Flight Instrument External Probes testing.

The ‘max’ or ‘peak’ TWC concentration values should be considered ins tead of the ‘17.4 NM’ values provided by the Appendix P . These ‘max’ or ‘peak’ values are available in FAA document DOT/FAA/AR - 09/13. They correspond to the ‘17.4 NM’ values multiplied by a factor of 1.538 (1/0.65) . The ‘max’ concentration values (TWC) are provided below: 12.2 Mixed Phase Conditions In service occurrences show several pitot icing events in Mixed phase conditions, between 20 000 and 30,000 feet, outside of the Appendix P domain in term of altitude and outside air temperature.

Based on several sources of information including the EUROCAE WG - 89, the Agency is of the opinion that the ‘2.6 NM’ TWC concentration values should be considered instead of the ‘17.4 NM’ values, as the CS - 25 Appendix C Intermittent conditions provide data for a 2.6 NM cloud.

The ‘2.6 NM’ values are given by the ‘17.4 NM’ values scaled by the F factor for 2.6 NM clouds which is 1.175 and are provided below: Powered by EASA eRules Page 915 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION It is commonly recognised that below - 40°C no liquid conditions exist anymore. Therefore testing in mixed phase conditions does not need to consider temperatures below - 40°C.

12.3 Ice Particles Several methods of generating ice particles are used in testing and produce a wide range of particle sizes. Some methods of generating ice particles results in irregular shapes which are difficult to quantify in terms of mean particle diameter. It is acceptable to specify ice particle sizes based on the available range of ice parti cle generation techniques in the MMD range of 50 to 200 μm as provided in Appendix P to CS - 25. Higher values may be used if justified.

For mixed phase icing, the heat requirements are driven primarily by the quanti ty of ice collected in the probe rather than the size of the ice particles. Supercooled liquid droplet MVD size of 20 μm should be used.

12.4 Duration For each condition a minimum of two minutes exposure time should be tested. This is the minimum time nee ded to reach a steady state and stabilised condition.

12.5 Total Air Temperature probe design consideration It is recognised that due to the intrinsic function of the total air temperature probes it may not be possible to design the temperature sensor with sufficient heating capability to ensure both adequate protection across the complete icing environment of CS - 25 Appendix P and accurate temperature measurements. In this case, it may be acceptable that the tempera ture probe is not fully protected over a portion of the Appendix P icing environment provided that the malfunction of the probe will not prevent continued safe flight and landing. System safety assessments must include common mode failure conditions. Mitig ation for potential icing related failures at the aircraft level should be accomplished as required by the Air Data System and/or by the primary data consumers.

Examples of mitigation methods include comparing air data from multiple sources and from source s of dissimilar technologies.

Powered by EASA eRules Page 916 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 13. Rain (R) Conditions Flight instrument external probes must be evaluated in the heavy rain conditions provided in Table 1 of CS 25.1324 . A test temperature below 10°C is considered acceptable. Testing may be performed at a higher tempe rature if it can be demonstrated that the increase in evaporation rate due to the higher ambient temperature does not decrease the severity of the test.

The efficiency of the drainage of the probe may depend on the aircraft airspeed. The applicant should, therefore, consider testing conditions including, at a minimum, low and high airspeed values in the rain conditions envelope.

14. Pass/fail criteria The pass/fail criteria of a given test are as follows: The output of the probe should quickly stabilize to the correct value after the start of an anti - icing test or once the icing protection is restored in a de - icing test. This value has to be agreed before the test between the applicant and the Agency, and it must stay correct as long as the icing protection is maintained. The measurement is considered to be correct if any observed fluctuation, when assessed by the applicant, has no effect at the aircraft level.

In addition, for pitot probes and especially during ice crystal or mixed phase conditions tests, it should be observed that the measured pressure is not ‘frozen’ (pressure signal without any noise, i.e. completely flat), which would indicate an internal blockage resulting in a captured pressure measurement.

After each test, any water accumulating in the probe connection line should be collected and assessed. The amount of water trapped in the probe (i.e. in the line conveying the air to the electronics) should not interfere with the output correctness when the probe is installed on th e aeroplane.

[Amdt 25/16] [Amdt 25/18] [Amdt 25/21]

CS 25.1325 Static pressure systems

ED Decision 2015 / 008/R (a) Each instrument with static air case connections must be vented to the outside atmosphere through an appropriate piping system.

(b) Each stat ic port must be designed and located so that: (1) the static pressure system performance is least affected by airflow variation, or by moisture or other foreign matter, and (2) the correlation between air pressure in the static pressure system and true am bient atmospheric static pressure is not changed when the aeroplane is exposed to icing conditions. The static pressure system shall comply with CS 25.1324 .

(c) The design and installation of the static pressure system must be such that – (1) Positive drainage of moisture is provided; chafing of the tubing and excessive distortion or restriction at bends in the tubing is avoided; and the materials used are durable, suitable for the purpose intended, and protected against corrosion; and (2) It is airtight except for the port into the atmosphere. A proof test must be conducted to demonstrate the integrity of the static pressure system in the following manner: Powered by EASA eRules Page 917 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (i) Unpressurised aeroplanes . Evacuate the static pressure system to a pressure differential of approximately 33.86 HPa, (1 inch of mercury) or to a reading on the altimeter, 305 m (1 000 ft) above the aeroplane elevation at the time of the test.

Without additional pumping for a period of 1 minute, the loss of in dicated altitude must not exceed 30 m (100 ft) on the altimeter.

(ii) Pressurised aeroplanes . Evacuate the static pressure system until pressure differential equivalent to the maximum cabin pressure differential for which the aeroplane is type certificate d is achieved. Without additional pumping for a period of 1 minute, the loss of indicated altitude must not exceed 2% of the equivalent altitude of the maximum cabin differential pressure or 30 m (100 ft), whichever is greater.

(d) Each pressure altimeter must be approved and must be calibrated to indicate pressure altitude in a standard atmosphere, with a minimum practicable calibration error when the corresponding static pressures are applied.

(e) Each system must be designed and installed so that the er ror in indicated pressure altitude, at sea - level, with a standard atmosphere, excluding instrument calibration error, does not result in an error of more than ±9 m (±30 ft) per 185 km/hr (100 knots) speed for the appropriate configuration in the speed rang e between 1·23 V with wing - flaps extended and 1·7 V with SR0 SR1 wing - flaps retracted. However, the error need not be less than ±9 m (±30 ft).

(f) If an altimeter system is fitted with a device that provides corrections to the altimeter indication, the devic e must be designed and installed in such manner that it can be bypassed when it malfunctions, unless an alternate altimeter system is provided. Each correction device must be fitted with a means for indicating the occurrence of reasonably probable malfunct ions, including power failure, to the flight crew. The indicating means must be effective for any cockpit lighting condition likely to occur.

(g) Except as provided in sub - paragraph (h) of this paragraph, if the static pressure system incorporates both a primary and an alternate static pressure source, the means for selecting one or the other source must be designed so that – (1) When either source is selected, the other is blocked off; and (2) Both sources cannot be blocked off simultaneously.

(h) For un - pressurised aeroplanes, sub - paragraph (g)(1) of this paragraph does not apply if it can be demonstrated that the static pressure system calibration, when either static pressure source is selected, is not changed by the other stat ic pressure source being open or blocked.

[Amdt 25/16]

CS 25.1326 Flight instrument external probes heating systems alert

ED Decision 2015 / 008/R (See AMC 25.1326 ) If a flight instrument external probe heating syst em is installed, an alert must be provided to the flight crew when the f light instrument external probe heating system is not operating or not functioning normally. The alert must comply with the following requirements: (a) The alert provided must conform to the Caution alert indications.

Powered by EASA eRules Page 918 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (b) The alert provided must be triggered if either of the following conditions exists: (1) The flight instrument external probe heating system is switched ‘off’.

(2) The flight instrument external probe heating system is switched ‘on’ and is not functioning normally.

[Amdt 25/16]

AMC 25.1326 Flight instrument extern al probes heating systems

alert

ED Decision 2015/008/R CS 25.1326 requires that if a flight instrument external probe heating system is installed, an alert must be provided to the flight crew when the flight instrument external probes heating system is not operating or not functioning normally.

It is expected that prob e heating system failures are indicated to the flight crew if such failures have an impact on the performance of the heating system to the extent of having an “effect on operational capability or safety” (see CS 25 .1309 ).

In accordance with CS 25.1309(c) and CS 25.1322(b) , a Caution category of alert is required by CS 25.1326 for immediate crew awareness and subsequent crew action.

It should be assumed that icing conditions exist during the failure event. The decision to provide heating system failure indication should not be based on the numerical probability of the failure event.

If the failure could potentially have hazardous or c atastrophic consequences, then this failure must be indicated.

The reliability of the system performing the probe heating system failure detection and alerting should be consistent with the safety effect induced by the failure. Refer to AMC 25.1309 , chapter 9(c) for more detailed guidance.

[Amdt No: 25/16]

CS 25.1327 Direction Indicator

ED Decision 2003/ 2/RM (See AMC 25.1327 ) (a) Each magnetic direction indicator must be installed so that its accuracy is not excessively affected by the aeroplane’s vibration or magnetic fields.

(b) The magnetic direction indicator required by CS 25.1303(a)(3) may not have a deviation, after compe nsation, in normal level flight, greater than 10 degrees on any heading.

(c) Direction indicators required by CS 25.1303(b)(6) must have an accuracy adequate for the safe operation of the aeroplane.

AMC 25.1327 Direction Indicator

ED Decision 2018 / 005/R T his AMC addresses the accuracy of stabilised magnetic heading systems, required for safe operation of the aeroplane. These systems include means to compensate or correct for errors induced by stable magnetic effects in the aeroplane. Additional effects due to electromagnetic transients and Powered by EASA eRules Page 919 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION configuration changes are not normally “compensated” by the magnetic heading system and are also included in this AMC.

Should the correction become unavailable (either intentionally or unintentionally), the effects of th e resulting heading indication should be considered for safe operation of the aeroplane. This AMC addresses the condition where correction is available and the condition where correction is not available (or failed).

In most circumstances, heading informa tion is not directly used as the primary means of navigation.

This condition should permit the applicant to show that the accuracy adequate for the safe operation of the aeroplane may be different than what is defined in this AMC.

1. After correction the cumulative deviation on any heading should not exceed 5°, based on the following: a. A change in deviation due to the equipment of the heading system components, the total of which should not exceed 2°.

b. A change in deviation due to the current flow i n any item of electrical equipment and its associated wiring is permissible, but should not exceed 1°. The total cumulative effect for all combinations of equipment, with all combinations of electri cal load, should not exceed 2°.

c. A change in deviation d ue to the movement of any component, (e.g. controls or undercarriage) in normal flight is permiss ible, but should not exceed 1°.

2. If correction fails or is not available, the change in deviation due to the proximity of all equipment containing magnetic m aterial should not exceed 2°.

3. For magnetic heading indications obtained via geographic (true) heading, the accuracy of the heading indication should account for the accuracy of the magnetic variation data based on geographic position. This variation may change over time.

Acceptable accuracy values have been found to be: 2 degrees (Latitudes between 50°S and 50°N) 3 degrees (Latitudes between 50°N and 73°N) 3 degrees (Latitudes between 50°S and 60°S) 5 degrees (Latitudes between 73°N and 79°N) 8 degrees (Latitudes between 79°N and 82°N) The applicant may propose different accuracy values after consultation with the EASA.

In areas of known magnetic unreliability (e.g. the magnetic poles), the magnetic variation error can be very large, so the magnetic heading indications (if output) shoul d not be relied upon.

4. For geographic (true) heading indications (such as those provided by Inertial Reference Units), the accuracy should be better or equal to 1°.

Note: On aeroplanes with a short cruising range, the above limits may be extended after consultation with EASA. For aeroplanes that do not depend on direction or heading information for navigation (VOR, ILS, FMS, GPS), the above limits may be extende d after consultation with EASA.

[Amdt 25/21] Powered by EASA eRules Page 920 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION

CS 25.1329 Flight Guidance System

ED Decision 20 07 / 020/R (See AMC Nos. 1 and 2 to CS 25.1329 ) (a) Quick disengagement controls for the autopilot and autothrust functions must be provided for each pilot. The autopilot qu ick disengagement controls must be located on both control wheels (or equivalent). The autothrust quick disengagement controls must be located on the thrust control levers. Quick disengagement controls must be readily accessible to each pilot while operati ng the control wheel (or equivalent) and thrust control levers.

(b) The effects of a failure of the system to disengage the autopilot or autothrust functions when manually commanded by the pilot must be assessed in accordance with the specifications of CS 25.1309 .

(c) Engagement or switching of the flight guidance system, a mode, or a sensor must not produce a transient response affecting the control or flight path of the aeroplane any greater than a minor transient.

(d) Under normal conditions, the disengagement of any automatic control functions of a flight guidance system must not produce a transient response affecting the control or flight path of the aeroplane any greater than a minor transient.

(e) Under rare - normal or non - normal conditions, the disengagement of any automatic control functions of a flight guidance system must not produce a transient response affecting the control or flight path of the aeroplane any greater than a significant transient.

(f) The function and direction of motion of each command reference control (e.g., heading select, vertical speed) must be readily apparent or plainly indicated on, or adjacent to, each control if necessary to prevent inappropriate use or confusion.

(g) Under any condition of flight appropriate to it s use, the flight guidance system must not: — produce unacceptable loads on the aeroplane (in accordance with CS 25.302 ), or — create hazardous deviations in the flight path.

This applies to both fault - free operation a nd in the event of a malfunction, and assumes that the pilot begins corrective action within a reasonable period of time.

(h) When the flight guidance system is in use, a means must be provided to avoid excursions beyond an acceptable margin from the speed range of the normal flight envelope. If the aircraft experiences an excursion outside this range, the flight guidance system must not provide guidance or control to an unsafe speed.

(i) The flight guidance system functions, controls, indications, and aler ts must be designed to minimise flight crew errors and confusion concerning the behaviour and operation of the flight guidance system. Means must be provided to indicate the current mode of operation, including any armed modes, transitions, and reversions. Selector switch position is not an acceptable means of indication. The controls and indications must be grouped and presented in a logical and consistent manner. The indications must be visible to each pilot under all expected lighting conditions.

(j) Fo llowing disengagement of the autopilot, a warning (visual and aural) must be provided to each pilot and be timely and distinct from all other cockpit warnings.

(k) Following disengagement of the autothrust function, a caution must be provided to each pilot .

Powered by EASA eRules Page 921 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (l) The autopilot must not create an unsafe condition when the flight crew applies an override force to the flight controls.

(m) During autothrust operation, it must be possible for the flight crew to move the thrust levers without requiring excessive force. The autothrust response to flight crew override must not create an unsafe condition.

[Amdt 25/4]

AMC No. 1 to CS 25.1329 Flight Guidance System

ED Decision 2020/024/R 1 PURPOSE This AMC provides interpretative material and acceptable mea ns of compliance with the specifications of CS 25.1329 for Flight Guidance Systems. These means are intended to provide guidance to supplement the engineering and operational judgment that must form the basis of a ny compliance demonstration.

2 RELATED CERTIFICATION SPECIFICATIONS CSs The following are related CS standards: CS 25.115 Take - off flight path CS 25.302 Interaction of systems and structures CS 25.671 Control systems, General CS 25.672 Stability augmentation and automatic and power - operated systems CS 25.677 Trim systems CS 25.777 Cockpit controls CS 25.779 Motion and effect of cockpit controls CS 25.781 Cockpit control knob shape CS 25.901 Powerplant, General, Installation – CS 25. 903 Powerplant, General, Engines CS 25.1301 Equipment, General, Function and installation – CS 25.1309 Equipment, systems, and installations CS 25.1322 Flight Crew Alerting System CS 25.1419 Ice protection CS 25.1420 Supercooled large drop icing condition CS 25.1581 Aeroplane Flight Manual, General CS - AWO All Weather Operations 3 RELATED ADVISORY MATERIAL EASA Acceptable Means of Compliance (AMC) and FAA Advisory Circulars (FAA AC).

The following guidance and advisory materials are related to this AMC: AMC 20 - 115 Software Considerations for Airborne Systems and Equipment Certification AMC 25.1309 System Design and Analysis AMC 25.1322 Alerting Systems AMC 25.1581 Aeroplane Flight Manual AMC 25 - 11 Electronic Display Systems Powered by EASA eRules Page 922 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION FAA A C 20 - 129 Airworthiness Approval of Vertical Navigation (VNAV) Systems for use in the U.S.

National Airspace System (NAS) and Alaska FAA AC 25 - 7 C Flight Test Guide for Certification of Transport Category Airplanes FAA AC 25 - 12 Airworthiness Criteria for the Approval of Airborne Windshear Warning Systems in Transport Category Airplanes FAA AC 120 - 28D Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout FAA AC 120 - 29A Criteria for Approval of Category I and Category II Weather Minima for Approach FAA AC 120 - 41 Criteria for Operational Approval of Airborne Wind Shear Alerting and Flight Guidance Systems 4 RELATED DOCUMENTS JAA documents: JAR - OPS 1 Commercial Air Transportation (Aeroplanes) Industry documents.

The following are related Industry Standards that may be useful in the design process: SAE ARP5366 Autopilot, Flight Director and Autothrust Systems SAE ARP4754 A/ Guidelines for development of civil aircraft and systems EUROCAE ED - 79A SAE ARP4100 Flight Deck and Handling Qualities Standards for Transport Aircraft SAE ARP4761 Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment RTCA DO - 160G/ Environmental Conditions and Test Procedures for Airborne Equipment EUROCAE ED - 14G RTCA DO - 254/ Design Assurance Guidance for Airborne Electronic Hardware EUROCAE ED - 80 DOT/FAA/CT - 96/1 Human Factors Design Guide for Acquisition of Commercial - Off - the - Shelf Subsystems, Non - Developmental Items, and Developmental Systems.

5 DEFINITIONS AND ACRONYMS The following definitions apply to the specifications of CS 25.1329 and the guidance material provided in this AMC. They should not be assumed to apply to the same or similar terms used in other regulations or AMC material. Terms for which standard dictionary definitions apply are not defined in this AMC.

5.1 Definitions Abnormal See Non - normal Condition Advisory EASA: Crew awareness is required and subsequent crew action may be required. (AMC 25.1322) Alert A generic term used to describe a flight deck indication meant to attract the attention of the flight crew to a non - normal operational or aeroplane system condition without implying the degree or level of urgency for recognition and corrective action by the crew. Warnings, Cautions and Advisories are considered to be Alerts.

Powered by EASA eRules Page 923 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION EASA definition: A signal to the crew in tended to draw their attention to the existence of an abnormality, system fault or aircraft condition and to identify it. (AMC 25.1322) Analysis The terms “analysis” and “assessment” are used throughout. Each has a broad definition and the two terms a re to some extent interchangeable.

However, the term analysis generally implies a more specific, more detailed evaluation, while the term assessment may be a more general or broader evaluation but may include one or more types of analysis (AMC 25.1309).

Arm A condition where the intent to transition to a new mode or state has been established but the criteria necessary to make that transition has not been satisfied.

Assessment See the definition of analysis above (AMC 25.1309).

Autopilot The autopilot function provides automatic control of the aeroplane, typically in pitch, roll, and yaw. The term includes the sensors, computers, power supplies, servo - motors/actuators and associated wiring, necessary for its function. It includes any indications and c ontrollers necessary for the pilot to manage and supervise the system. Any part of the autopilot that remains connected to the primary flight controls when the autopilot is not in use is regarded as a part of the primary flight controls.

Autothrust The autothrust function provides automatic control of the thrust of the aeroplane. The term includes the sensors, computers, power supplies, servo - motors/actuators and associated wiring, necessary for its function. It includes any indications and control lers necessary for the pilot to manage and supervise the system. Any part of the autothrust that remains connected to the engine controls when the autothrust is not in use is regarded as a part of the engine control system.

Caution A flight deck indicati on that alerts the flight crew to a non - normal operational or aeroplane system condition that requires immediate crew awareness.

Subsequent pilot corrective compensatory action will be required.

Cognitive Task An analysis that focuses on the ment al processes, skills, strategies, and use of Analysis information required for task performance.

Complex A system is Complex when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods (AMC 25.1309).

Con formal Positioned and scaled with respect to the outside view Control Wheel A Flight Guidance System (FGS) function which, when engaged, enables the Steering pilot/first officer to manually fly the aeroplane by positioning the flight (CWS) control surface s using the autopilot servos. The positions of the flight deck controls (e.g., control column, control wheel) are determined by the FGS, which converts them into autopilot servo commands. The autopilot servos, in turn, drive the appropriate flight contro l surfaces.

Conventional A system is considered to be Conventional if its functionality, the technological means used to implement its functionality, and its intended usage are all the same as, or closely similar to, that of previously approved systems t hat are commonly - used (AMC 25.1309).

Engage A steady state that exists when a flight crew request for mode or system functionality has been satisfied.

Error An omission or incorrect action by a crewmember or maintenance personnel, or a mistake in requirements, design, or implementation (AMC 25.1309).

Failure An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).

Powered by EASA eRules Page 924 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS : INSTALLATION NOTE: Errors may cause failures, but are not considered to be failures (AMC 25.1309).

Failure A condition having an effect on the aeroplane and/or its occupants, either Condition direct or consequential, which is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events (AMC 25.1309) Fail A system capable of completing an operation, following the fa ilure of any Operational single element or component of that system, without pilot action.

System Fail Passive A system which, in the event of a failure, results in: System (a) no significant deviation in the aircraft flight path or attitude and (b) no out - of - trim condition at disengagement that is not easily controlled by the pilot.

Flight Director A visual cue or set of cues that are used during manual control of the aeroplane as command information to direct the pilot how to manoeuvre the aeroplane, usually in pitch, roll and/or yaw, to track a desired flight path. The flight director, displayed on the pilot's primary head down attitude indicator (ADI) or head up display (HUD), is a component of the flight guidance system and is integrated with airborne attitud e, air data and navigation systems.

Flight A system consisting of one or more of the following elements: Guidance (a) autopilot, System (b) flight director, (c) automatic thrust control, and any interactions with stability augmentation and trim systems .

Flight An aircraft area navigation system and associated displays and I/O device(s) Management having complex multi - waypoint lateral (LNAV) and vertical (VNAV) navigation System capability (or equivalent), data entry capability, data base memory to stor e route and instrument flight procedure information, and display readout of navigation parameters. The Flight Management System provides guidance commands to the FGS for the purpose of automatic navigation and speed control when the FGS is engaged in an a ppropriate mode or modes (e.g., VNAV, LVAV, RNAV).

Head - Up A transparent optical display system located level with and between the pilot Display (HUD) and the forward windscreen. The HUD displays a combination of control, performance, navigation, and com mand information superimposed on the external field of view. It includes the display element, sensors, computers and power supplies, indications and controls. It is integrated with airborne attitude, air data and navigation systems, and as a display of co mmand information is considered a component of the light guidance system.

Inadvertent A condition or action that was not planned or intended.

Latent Failure A failure is latent until it is made known to the flight crew or maintenance personnel. A signif icant latent failure is one, which would in combination with one or more specific failures, or events result in a Hazardous or Catastrophic Failure Condition (AMC 25.1309).

Limit Flight This envelope is the most outside flight envelope, generally associated with Envelope aeroplane design limits Mode A mode is system configuration that corresponds to a single (or set of) FGS behaviour(s).

Non - normal A condition or configuration of the aeroplane that would not normally be Condition experienced dur ing routine flight operations - usually due to failures or non - routine operating conditions (e.g., excessive out - of - trim due to fuel imbalance or under certain ferry conditions).

Powered by EASA eRules Page 925 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Normal Any fault free condition typically experienced in normal fl ight operations.

Condition Operations typically well within the aircraft flight envelope, and with routine atmospheric and environmental conditions.

Normal Flight The range of altitude and operating speeds that are defined by the aeroplane Envelope manufacturer as consistent with conducting flight operations for which the aeroplane is designed. This envelope is generally associated with practical, routine operation and/or prescribed conditions, whether all - engine or engine inoperative.

Override An action taken by the flight crew intended to prevent, oppose or alter an operation being conducted by a flight guidance function, without first disengaging that function.

Rare Normal A fault - free condition that is experienced infrequently by the aeroplane due Condition to significant environmental conditions (e.g., significant wind, turbulence, or icing, etc.)

Redundancy The presence of more than one independent means for accomplishing a given function or flight operation (AC/AMC 25.1309).

Select The flight crew action of requesting functionality or an end state condition.

Significant See “transient.” transient Stability Automatic systems, which provide or enhance stability for specific Augmentation aerodynamic characteristics of an aeroplane (e.g., Yaw Damper, Longitudinal System Stability Augmentation System, Mach Trim).

System A combination of components, parts, and elements that are inter - connected to perform one or more specific functions (AMC 25.1309).

Transient A disturbance in the control or flight pat h of the aeroplane that is not consistent with response to flight crew inputs or current environmental conditions.

Minor transient: A transient that would not significantly reduce safety margins, and which involves flight crew actions that are well within their capabilities involving a slight increase in flight crew workload or some physical discomfort to passengers or cabin crew.

Significant transient: A transient that would lead to a significant reduction in safety margins, a significant increase in fligh t crew workload, discomfort to the flight crew, or physical distress to passengers or cabin crew, possibly including non - fatal injuries.

NOTE: The flight crew should be able to respond to any significant transient without: exceptional piloting skill, aler tness, or strength, forces greater than those given in CS 25.143(cd), and accelerations or attitudes in the aeroplane that might result in further hazard to secured or non - secured occupants.

Warning A flight deck indication that alerts the flight crew to a non - normal operational or aeroplane system requiring immediate recognition. Immediate corrective or compensatory action by the flight crew is required.

5.2 Acronyms AC Advisory Circular (FAA) ACAS Airborne Collision Avoidance System AMC Accep table Means of Compliance AFM Aeroplane Flight Manual AGL Above Ground Level Powered by EASA eRules Page 926 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION AIM Airman’s Information Manual ARP Accepted and Recommended Practice ATC Air Traffic Control AWO All Weather Operations CG Centre of Gravity CDI Course Deviation Indicator CWS Control Wheel Steering DA Decision Altitude DA(H) Decision Altitude (Height) DME Distance Measuring Equipment EFIS Electronic Flight Instrument System EVS Enhanced Vision System FAA Federal Aviation Administration FCOM Flight Crew Operations Manual F/D Flight Director FGS Flight Guidance System FLCH Flight Level Change FMA Flight Mode Annunciator FMS Flight Management System GA Go - around GLS GNSS Landing System GNSS Global Navigation Satellite System GPWS Ground Proximity Warning System HDD Head Down Display HUD Head - Up Display IAS Indicated Air Speed ICAO International Civil Aviation Organization ILS Instrument Landing System IMA Integrated Modular Avionics IMC Instrument Meteorological Conditions JAA Joint Aviation Authorities LNAV Lateral Navigation LOC Localizer MDA(H) Minimum Descent Altitude (Height) MLS Microwave Landing System MSL Mean Sea Level MSP Mode Select Panel MUH Minimum Use Height NAV Navigation ND Navigation Display NDB Non Directional Beacon NPA Notice of Proposed Amendment NPRM Notice of Proposed Rulemaking PF Pilot Flying PFD Primary Flight Display PNF Pilot Not Flying Powered by EASA eRules Page 927 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION RNAV Area Navigation RNP Required Navigation Performance RTO Rejected Takeoff RVSM Reduced Vertical Separation Margin SAE Society of Automotive Engineering SVS Synthetic Vision System TCAS Traffic Collision Alert System TCS Touch Control Steering TO Takeoff TOGA Takeoff or Go - around VMC Visual Meteorological Conditions VNAV Vertical Navigation VOR VHF Omni Range WAT Weight Altitude Temperature 6 BACKGROUND This advisory material replaces material previously provided in AMC 25.1329 for Automatic Pilots. The automatic control and guidance systems in current aircraft have evolved to a level that dictates a revisio n to current advisory material.

There have been dramatic changes in technology and system design, which have resulted in much higher levels of integration, automation, and complexity. These changes have also redefined the allocation of functions and interfaces between systems. Relatively simple, dedicated systems have been replaced with digital multi - function systems with more modes, and automatic changes in modes of operati on. The introduction of fly - by - wire flight control systems has created new interface considerations for the FGS elements. These new systems are capable of providing better performance, increased safety and decreased workload. But if designed without consid eration for the criteria in this AMC, these systems could also be confusing and not immediately intuitive for the flight crew. Significant operational experience has been gained on new generation systems and guidance material is provided herein based on th at experience.

This advisory material is provided for Flight Guidance Systems, which include any autopilot functions, flight director functions, automatic thrust control functions and any interactions with stability a ugmentation and trim functions.

7 GENER AL The FGS is primarily intended to assist the flight crew in the basic control and tactical guidance of the aeroplane. The system may also provide workload relief to the pilots and may provide a means to fly a flight path more accurately to support specif ic operational requirements (e.g.

RVSM, RNP, etc.).

The applicant should establish, document and follow a design philosophy that supports the intended operational use regarding the FGS behaviour; modes of operation; pilot interface with controls, indicatio ns, and alerts; and mode functionality.

Description of the FGS behaviour and operation should be addressed from flight crew and maintenance perspectives in appropriate documentation and training material.

Subsequent sections of this advisory material provi de interpretative material and acceptable means of compliance with CS 25.1329 and the applicability of other CS - 25 rules to FGS (e.g., CS Powered by EASA eRules Page 928 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 25.1301 , CS 25.1309 ). The demonstr ated means of compliance may include a combination of analysis, laboratory testing, flight - testing, and simulator testing. The applicant should coordinate with the authorities early in the certification programme, via a certification plan, to reach agreeme nt on the methods to be used to demonstrate compliance.

7.1 Flight Guidance System Functions The following functions, when considered separately and together, are considered elements of a Flight Guidance System: — Flight guidance and control (e.g., autopilot , flight director displayed head - down or head - up); — Autothrottle/autothrust systems; — Interactions with stability augmentation and trim systems; and — Alerting, status, mode annunciation, and situation information associated with flight guidance and control fu nctions.

The FGS includes those functions necessary to provide guidance and control in conjunction with an approach and landing system, such as: — the Instrument Landing System (ILS), — the Microwave Landing System (MLS) or — the Global Navigation Satellite System (GNSS) Landing System (GLS).

The FGS also includes those functions necessary to provide guidance and control in conjunction with a Flight Management System (FMS). The FGS does no t include the flight planning and the generation of flight path and speed profiles tied to waypoints and other flight planning aspects of the Flight Management System (FMS). However, it does include the interface between the FMS and FGS necessary for the e xecution of flight path and speed commands.

7.2 FGS Components For the purpose of this AMC the term “FGS” includes all the equipment necessary to accomplish the FGS function, including the sensors, computers, power supplies, servo - motors/actuators, and ass ociated wiring. It includes any indications and controllers necessary for the pilot to manage and supervise the system.

Any part of the FGS that remains mechanically connected to the primary flight controls or propulsion controls when the Flight Guidance S ystem is not in use is regarded as a part of the primary flight controls and propulsion system, and the provisions for such systems are applicable.

7.3 Compliance with CS 25.1329 Table 7.3 - A lists the relevant para graphs of CS 25.1329 and provides an indication where acceptable means of compliance with each paragraph may be found within this AMC.

Powered by EASA eRules Page 929 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION TABLE 7.3 - A.

Where Means of Compliance Can Be Found in this AMC Section / Rule Text Where Accept able Means of Paragraph Compliance Found in this AMC CS 25.1329(a) Quick disengagement controls for the autopilot and Section 8.1, Autopilot autothrust functions mu st be provided for each pilot. Engagement/Disengagement The autopilot quick disengagement controls must be and Indications located on both c ontrol wheels (or equivalent). The Section 8.3, Autothrust autothrust quick disengagement controls must be Engagement/Disengagement located on the thrust control levers. Quick and Indications disengagement controls must be readily accessible to each pilot while operating the control wheel (or equivalent ) and thru st control levers.

CS 25.1329(b) The effects of a failure of the system to disengage the Section 8.1, Autopilot autopilot or autothrust functions when manually Engagement/Disengagement commanded by the pilot must be assessed in and Indications accordance with the specifications of CS 25.1309. Section 8.3, Autothrust Engagement/Disengagement and Indications Section 13 .6, Safety Assessment – Failure to Disengage the FGS CS 25.1329(c) Engagement or switching of the flight guidance system, Section 8, FGS Engagement, a mode, or a sensor must not produce a transient Disengagement, and Override response affecting the control or flight path of the Section 13, Safety Assessment aeroplane any greater than a minor transient.

CS 25.1329(d) Under normal conditions, the disengagement of any Section 8, FGS Engagement, automatic control functions of a flight guidanc e system Disengagement, and Override must not produce a transient response affecting the Section 13, Safety Assessment control or flight path of the aeroplane any greater than a minor transient.

CS 25.1329(e) Under rare - normal o r non - normal conditions the Section 8, FGS E ngagement, disengagement of any automatic control functions of a Disengagement, and Override flight guidance system must not produce a transient Section 9.3.3, Awareness of response affecting the control or flight path of the Potential Significant Transient aeroplane any greater than a significant transient. Condition (“Bark before Bite”) CS 25.1329 (f) The function and direction of motion of each command Section 9, Controls, Indications reference control (e.g., heading select, vertical speed) and Alerts must be readily apparent or plainly indicated on, or adjacent to, each control if necessary to prevent inappropriate use or confusion.

CS 25.1329(g) Under any condition of flight appropriate to its use, the Section 10 , Performance of Flight Guidance System must not: Function — produce unacceptable loads on the aeroplane (in Section 13 , Safety Assessment accordance with CS 25.302), or Section 14, Compliance Demonstration using Flight T est — create hazardous deviations in the flight path.

and Simulation This applies to both fault - free operation and in the event of a malfunction, and assumes tha t the pilot begins corrective action within a reasonable period of time.

CS 25.1329(h) When the flight guidance system is in use, a means must Section 10.4 , Speed Protection be provided to avoid excursions beyond an acceptable margin from the speed range of the normal flight Powered by EASA eRules Page 930 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Section / Rule Text Where Accept able Means of Paragraph Compliance Found in this AMC envelope. If the aircraft experiences an excursion outside this range, the flight guidance system must not provide guidance or control to an unsafe speed.

CS 25.1329(i) The FGS functions, controls, indications, and alerts must Section 9, Controls Indications be designed to minimize flight crew errors and and Alerts confusion concerning the beha viour and operation of the FGS. Means must be provided to indicate the current mode of operation, including any armed modes, transitions, and reversions. Selector switch position is not an accep table means of indication. The controls and indications must be grouped and presented in a logical and consistent manner. The indications must be visible to each pilot under all expected lighting conditions.

CS 25.1329(j) Following disengagement of the autopilot, a warning Section 8.1.2.1, Autopilot (visual and aural) must be provided to each pilot and be Disengagement Alerts timely and distinct from all other cockpit warnings. Section 13 , Safety Assessment C S 25.1329 (k) Following disengagement of the autothrust function, a Section 8.3.2, Autothrust caution must be provided to each pilot. Disengagement Section 13 , Safety Assessment CS 25.1329 (l) The autopilot must not create an unsafe condition when Section 8.4.1, Flight Crew the flight crew applies an override force to the flight Override of the FGS – Autopilot controls. Section 13 , Safety Assessment CS 25.1329(m) During autothrust operation, it must be possible for the Section 8.4.2, Flight Cre w flight crew to move the thrust levers wit hout requiring Override of the FGS - excessive force. The autothrust response to flight crew Autothrust override must not create an unsafe condition. Section 13 , Safety Assessment 8 Flight Guidance System Engagement, Disengagement and Override The characteristics of the FGS during engagement, disengagement and override have caused som e concern with systems on some aeroplanes. The following criteria should be ad dressed in the design of a FGS.

8.1 Autopilot Engagement/Disengagement and Indications Autopilot engagement and disengagement should be accomplished in a manner consistent with other flight crew procedures and tasks, and should not require undue attention.

8.1.1 Autopilot Engagement Each pilot should be able to select the autopilot function of the flight guidance system with a single switch action. The single swit ch action should engage pitch and roll axes. The autopilot system should provide positive indication to the flight crew that the system has been engaged. The selector switch position is not acceptable as a means of indication (reference CS 25.1329(i) ).

NOTE: If an operational need is identified for split - axis engagement, then annunciation or indication should be provided for each axis.

Powered by EASA eRules Page 931 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION For aeroplanes with more than one autopilot installed, each autopilot may be in dividually selected and should be so annunciated. It should not be possible for multiple autopilots to be engaged in different modes.

The engagement of the autopilot should be free of perceptible transients. Under dynamic conditions, including manoeuvring flight, minor transients are acceptable.

Without a flight director engaged, the initial lateral and vertical modes should be consistent with minimal disturbance from the flight path. For example, the lateral mode at engagement may roll the aeroplane to win gs level and then hold the aeroplane heading/track or maintain the existing bank angle (if in a normal range).

A heading/track pre - select at engagement function may be provided if precautions are taken to ensure that selection reflects the current intent o f the flight crew. The modes at engagement should be annunciated and any associated selected target values should be displayed.

With a flight director engaged, the autopilot should engage into a mode consistent (i.e., the same as, or if that is not possibl e, then compatible with) the active flight director mode of operation. Consideration should be given to the mode into which the autopilot will engage when large commands are present on either or both flight directors. For example, consideration should be g iven whether to retain the active flight director mode or engage the autopilot into the basic mode, and the implications for current flight path references and targets. The potential for flight crew confusion and unintended changes in flight path or modes should be considered.

Regardless of the method used, the engagement status (and changes in status) of the autopilot(s) should be clearly indicated and should not require undue attention or recall.

For modes that use multiple autopilots, the additional autopilots may engage automatically at selection of the mode or after arming the mode. A means should be provided to determine that adequate autopilot capability exists to support the intended operation (e.g., "Land 2" and "Land 3" are used in s ome aircraft).

NOTE: The design should consider the possibility that the pilot may attempt to engage the autopilot outside of the normal flight envelope. It is not required that the autopilot should compensate for unusual attitudes or other situations outs ide the normal flight envelope, unless that is part of the autopilot’s intended function.

8.1.2 Autopilot Disengagement In consequence of specifications in CS 25.1329(d) , under normal conditions, automatic or manu al disengagement of the autopilot must be free of significant transients or out - of - trim forces that are not consistent with the manoeuvres being conducted by the aeroplane at the time of disengagement. If multiple autopilots are engaged, any disengagement of an individual autopilot must be free of significant transients and should not adversely affect the operation of the remaining engaged autopilot(s) CS 25.1329(d) ).

Under non - normal or rare - normal conditions (see CS 25.1329(e) ), disengagement of the autopilot may result in a significant transient. The flight crew should be able to respond to a significant transient without: — exceptional piloting skill, alertness, or strength , Powered by EASA eRules Page 932 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION — forces greater than those given in CS 25.143(d) , and — accelerations or attitudes in the aeroplane that might result in a hazard to secured or non - secured occupants.

The flight crew should be made aware (via a suit able alerting or other indication) of conditions or situations (e.g., continued out - of - trim) that could result in a significant transient at disengagement. (See Section 9.3.3 on Awareness of Potential Significant Transient Condition (“Bark before Bite”)).

8.1.2.1 Autopilot Disengagement Alerts (see CS 25.1329(j) ) Since it is necessary for a pilot to immediately assume manual control following disengagement of the autopilot (whether manual or automatic) , a visual and aural warning must be given ( CS 25.1329(j) ).

Visual warning: a timely visual warning, distinct from all other cockpit warnings, must be provided and must be located in the primary field of view for bo th pilots. See CS 25.1329(j) .

Aural warning: a timely aural warning must be provided and must be distinct from all other cockpit warnings. See CS 25.1329(j) . Even when the autopilot is disengaged by a pilot, it should sound for long enough to ensure that it is heard and recognised by the pilot and other flight crew members (at least a single cycle), but not for so long that it adversely affects communication between crew mem bers or that it is a distraction. The aural warning should continue until silenced by one of the following means: — Activation of an autopilot quick disengagement control; — Re - engagement of the autopilot; or — Another acceptable means.

Multiple - autopilot system : Disengagement of an autopilot within a multiple - autopilot system (e.g., downgraded capability), requiring immediate flight crew awareness and possible timely action, should cause a Caution level alert to be issued to the flight crew.

Disengagement of an autopilot within a multiple - autopilot system, requiring only flight crew awareness, should cause a suitable advisory to be issued to the flight crew.

Disengagement of an autopilot within a multiple - autopilot system (e.g., downgraded capability), requiring immediate flight crew awareness and possible timely action, should cause a Caution level alert to be issued to the flight crew.

Disengagement of an autopilot within a multiple - autopilot system, requiring only flight crew awareness, should cause a suitable advisory to be issued to the flight crew.

8.1.2.2 Quick Disengagement Control (see CS 25.1329(a) ) The purpose of the “Quick Disengagement Control” is to ensure the capability for each pilot to manually disengage th e autopilot quickly with a minimum of pilot hand/limb movement. The “Quick Disengagement Control” must be located on ea ch control wheel or equivalent CS 25.1329(a) Powered by EASA eRules Page 933 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION and should be within easy reach of one or more fin gers/thumb of the pilot’s hand when the hand is in a position for normal use on the control wheel or equivalent. The “Quick Disengagement Control” sho uld meet the following criteria : (a) Be accessible and operable from a normal hands - on position without re quiring a shift in hand position or grip on the control wheel or equivalent; (b) Be operable with one hand on the control wheel or equivalent and the other hand on the thrust levers; NOTE: When establishing location of the quick disengagement control, consideration should be given to: — its accessibility with large displacements of, or forces on, the control wheel (or equivalent), and — the possible need to operate the quick disengagement control with the other hand.

(c) Be easily located by the pilot without having to first locate the control visually; (d) Be designed so that any action to operate the “Quick Disengagement Control” should not cause an unintended input to the control wheel or equivalent; and (e) Be designed to minimize inadvertent operation and interference with other nearby control wheel (or equivalent) switches/dev ices (e.g., radio control, trim).

8.1.2.3 Alternative Means of Autopilot Disengagement When a CS 25.1309 assessment shows a need for an alternative means of disengagement, the following should be addressed: — Indepen dence, — The alternate means should be readily accessible to each pilot, — Latent failure/reliability of the alternate means.

The following means of providing an alternative disengagement have been found to be acceptable: — Selection of the engagement control t o the “off” position.

— Disengage bar on mode selector panel.

— Trim switch on yoke.

NOTE: Use of circuit breakers as a means of disengagement is not considered to be acceptable.

8.1.2.5 Flight Crew Pitch Trim Input If the autopilot is engaged and the pilot a pplies manual pitch trim input, either the autopilot should disengage with no more than a minor transient, or pitch trim changes should be inhibited (see CS 25.1329(l) ).

Powered by EASA eRules Page 934 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 8.2 Flight Director Engagement/Disengageme nt and Indications Engagement and disengagement should be accomplished consistent with other flight crew procedures and tasks and should not require undue attention.

8.2.1 Flight Director Engagement A means should be provided for each pilot to select (i.e., turn on) and deselect the flight director for display on their primary flight display (e.g., attitude display). The selection status of the flight director and the source of flight director guidance should be cl ear and unambiguous. Failure of a selected flight director should be clearly annunciated.

A flight director is considered “engaged” if it is selected and displaying guidance cues.

NOTE: The distinction is made between “engaged” and “selected” because the flight director might be selected, but not displaying guidance cue(s) (e.g., the cue(s) are biased out of view).

If there are multiple flight directors, and if required for crew awareness, indications should be provided to denote which flight director is e ngaged (e.g., FD1, FD2, HUD source). For aeroplanes with multiple flight directors installed, both flight directors should always be in the same armed and active FGS modes. The selection status of each flight director should be clear and unambiguous for ea ch pilot. In addition, indications should be provided to denote loss of flight director independence (i.e., first officer selection of captain’s flight director).

A flight director should engage into the current modes and targets of an already engaged auto pilot or flight director, if any. With no autopilot engaged, the basic modes at engagement of the flight director functions should be established consistent with typical flight operations.

NOTE: The engagement of the pitch axis in Vertical Speed or Fligh t Path Angle, and engagement of the lateral axis in Heading Hold, Heading Select or Bank Angle Hold have been found to be acceptable.

Since the HUD can display flight guidance, the HUD guidance mode should be indicated to both pilots and should be compatible with the active head - down flight director mode.

Engagement during manoeuvring flight should be considered.

NOTE: The design should consider the safety consequences if it is possible for the flight director to engage outside of the normal flight envelope. It is not required that the flight director should compensate for unusual attitudes or other situations outside the normal flight envelope, unless that is part of the flight director’s intended function.

8.2.1.1 Guidance Cue(s) The flight direct or command guidance cue(s) will typically be displayed when the flight director is selected and valid command guidance is available or if it is automatically providing guidance as per paragraph 8.2.1.2 below. The flight director guidance cue(s) should be r emoved when guidance is determined to be invalid. The display of guidance cue(s) (e.g., flight director bars) is sufficient indication that the flight director is engaged.

Powered by EASA eRules Page 935 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATI ON 8.2.1.2 Reactive Windshear Flight Director Engagement For aeroplanes equipped with a flight director windshear guidance system, flight director engagement should be provided, consistent with the criteria contained in FAA AC’s 25 - 12 and 120 - 41.

8.2.2 Flight Director Disengagement There may be a means for each pilot to readily deselect hi s or her on - side flight director function. Flight crew awareness of disengagement and de - selection is important. Removal of guidance cue(s) alone is not sufficient indication of de - selection, because the guidance cue(s) may be removed from view for a numbe r of reasons, including invalid guidance, autopilot engagement, etc. Therefore, the flight director function should provide clear and unambiguous indication (e.g., switch position or status) to the flight crew that the function has been deselected.

8.3 Aut othrust Engagement/Disengagement and Indications The autothrust function should be designed with engagement and disengagement characteristics that provide the flight crew positive indication that the system has been engaged or disengaged. Engagement and di sengagement should be accomplished in a manner consistent with other flight crew procedures and tasks and should not require undue attention.

8.3.1 Autothrust Engagement The autothrust engagement controls should be accessible to each pilot. The autothrust function must provide the flight crew positive indication that the system has been engaged.

The autothrust function should be designed to prevent inadvertent engagement and inadvertent application of thrust, for both on - ground and in - air operations (e.g., provide separate arm and engage functions).

The autothrust normally should be designed to preclude inadvertent engagement.

However, intended modes such as a “wake up” mode to protect for unsafe speeds may be acceptable (see Section 10.4.1 on Low Speed Prot ection). If such automatic engagement occurs, it should be clear to the flight crew that automatic engagement has occurred, the automatic engagement should not cause any unsafe condition (e.g., unsafe pitch attitudes or unsafe pitching moments), to show co mpliance with CS 25.1329(c) , and the reason for automatic engagement should be clear and obvious to the flight crew.

NOTE: The design should consider the possibility that the pilot may attempt to engage the autoth rust function outside of the normal flight envelope or at excessive (or too low) engine thrust. It is not expected that the autothrust feature should compensate for situations outside the normal flight envelope or normal engine operation range, unless that is part of the intended function of the autothrust system.

8.3.2 Autothrust Disengagement Autothrust disengagement should not cause any unsafe condition (e.g., pitch attitude, pitching moment, or significant thrust transient), to show compliance with CS 25.1329(d) , and the disengagement should not preclude, inhibit, or interfere with timely thrust changes for go - around, landing, or other manoeuvres requiring manual thrust changes.

Powered by EASA eRules Page 936 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION The autothrust normally should be designed to preclude inadvertent disengagement during activation of autothrust modes of operation.

Following disengagement of the autothrust function, positive indication of disengagement should include at least a visual flight crew alert and deletion of a utothrust ‘engaged’ status annunciations (to show compliance with CS 25.1329(k) ). For automatic disengagement, visual indications should persist until cancelled by flight crew action. For manual disengagement, if a n aural is provided, visual indications should persist for some minimum period. If an aural is not provided, the visual indications should persist until cancelled by flight crew action.

For aural indication, if provided, an aural alert of sufficient durati on and volume should be provided to assure that the flight crew has been alerted that disengagement has occurred. An extended cycle of an aural alert is not acceptable following disengagement if such an alert can significantly interfere with flight crew co ordination or radio communication. Disengagement of the autothrust function is considered a Caution alert.

8.3.2.1 Autothrust Quick Disengagement Control Autothrust quick disengagement controls must be provided for each pilot on the r espective thrust control lever as stated in CS 25.1329(a) . A single - action, quick disengagement switch should be incorporated on the thrust control so that switch activation can be executed when the pilot’s other h and is on the flight controls. The disengagement control should be positioned such that inadvertent disengagement of the a utothrust function is unlikely.

Positioning the control on the outboard side has been shown to be acceptable for multiengine aircraft. Thrust lever knob - end - mounted disengagement controls available on both sides to facilitate use by either pilot have been shown to be preferable to those positioned to be accessible by the pilot’s palm.

8.4 Flight Crew Override of the FGS The following sec tions discuss criteria related to the situation where the flight crew overrides the FGS.

8.4.1 Autopilot 1) The autopilot should disengage when the flight crew applies a significant override force to the controls. The applicant should interpret “significant” as a force that is consistent with an intention to overpower the autopilot by either or both pilots. The autopilot should not disengage for minor application of force to the controls (e.g., a pilot gently bumping the control column while ente ring or exiting a pilot seat during cruise).

NOTE: 111 N (25 lbf) at the control column or wheel has been determined to be a significant override force level for other than approach operations on some aircraft types. To reduce nuisance disengagement, high er forces have been found acceptable for certain approach, landing, and go - around operations on some aircraft types.

The force to disengage an autopilot is not necessarily the force required at the column to oppose autopilot control (e.g., cause elevator movement). The corresponding forces for a side stick or centre stick controller may be different.

Powered by EASA eRules Page 937 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Under normal conditions, a significant transient should not result from autopilot disengagement when the flight crew applies an override force to the controls (to show compliance with CS 25.1329(d) .

Sustained or incremental application of force below the disengagement threshold should not result in a hazardous condition (e.g., the automatic trim running that results in unacceptable aeroplane motion if the autopilot were to automatically disengage, or when manually disengaged).

2) If the autopilot is not designed to disengage in response to any override force, then the response shall be shown to be safe ( CS 25.1329(l) ).

a) The sustained application of an override force should not result in a potential hazard when the flight crew manually disengages the autopilot or abruptly releases the force on the controls. During sustained appl ication of an override force, the automatic trim should not run to oppose the flight crew commands in any manner that would result in unacceptable aeroplane motion. Mitigation may be accomplished through the provision of an appropriate alert and flight cre w procedure.

NOTE : The term ‘sustained application of override force’ is intended to describe a force that is applied to the controls, which may be small, slow, and sustained for some period of time. This may be due to an inadvertent crew action or may be an intentional crew action meant to ‘assist’ the autopilot in a particular manoeuvre. (See Chapter 14, Compliance Demonstration Using Flight Test and Simulation, paragraph 14.1.5, Flight Crew Override of the Flight Guidance System, of this AMC for more inf ormation.)

b) Transients resulting from an override force: Under normal conditions, a significant transient should not result from manual autopilot disengagement after the flight crew has applied an override force to the controls ( CS 25.1239(d) ).

NOTE 1 : t he term ‘ override force ’ is intended to describe a pilot action that is intended to prevent, oppose or alter an operation being conducted by a flight guidance function, without first disengaging that function. One possible reason for this action could be an avoidance manoeuvre (such as responding to a n ACAS/TCAS Resolution Advisory) that requires immediate action by the flight crew and would typically involve a rapid and forceful input from the flight crew.

NOTE 2 : For control wheel steering considerations, refer to Section 11.6.

8.4.2 Autothrust It should be possible for the pilot to readily override the autothrust function and set thrust by moving the thrust levers (or equivalent) with one hand . CS 25.1329(m) requires that the autothrust response to a flight crew override must not create an unsafe condition.

Autothrust functions may be designed to safely remain engaged during pilot override. Alternatively, autothrust functi ons may disengage as a result of pilot Powered by EASA eRules Page 938 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INS TRUMENTS: INSTALLATION override, provided that the design prevents unintentional autothrust disengagement and adequately alerts the flight crew to ensure pilot awareness.

8.5 FGS Engagement Mode Compatibility The philosophy used for the mod e at engagement of the autopilot, flight director, and autothrust functions should be provided in flight crew training material.

It should not be possible to select incompatible FGS command or guidance functions at the same time (e.g., commanding speed through elevator and autothrust at the same time).

9 Controls, Indications and Alerts The human - machine interface with the FGS is a key to ensuring safe, effective and consistent FGS operation. The manner in which FGS information is depicted to fligh t crews is essential to the flight crew awareness, and therefore, the safe operation of the FGS.

The controls, indications, and alerts must be so designed as to minimize flight crew errors and confusion ( CS 25.1329 (i) ). Indications and alerts should be presented in a manner compatible with the procedures and assigned tasks of the flight crew and provide the necessary information to perform those tasks. The indications must be grouped and presented in a logical and c onsistent manner and be visible from each pilot’s station under all expected lighti ng conditions ( CS 25.1329(i) ). The choice of colours, fonts, font size, location, orientation, movement, graphical layout and other characteristics such as steady or flashing should all contribute to the effectiveness of the system. Controls, indications, and alerts should be implemented in a consistent manner.

It is recommended that the applicant evaluate the adequacy and effectivene ss of the information provided by the FGS interface (i.e., controls, indications, alerts, and displays) to ensure flight crew awareness of FGS behaviour and operation. See Section 14, Compliance Demonstration using Flight Test and Simulation, for more disc ussion of appropriate analyses (which may include, for example, cognitive task analysis as a basis for evaluation).

9.1 FGS Controls The FGS controls should be designed and located to provide convenient operation to each crewmember and they must be designe d to minimize crew errors, confusion and inadver tent operation ( CS 25.1329(i) ). To achieve this, CS 25,1329(f) requires that command reference controls to select target values (e.g., heading select, vertical speed) should operate as specified in CS 25.777(b) and 25.779(a) for cockpi t controls. The function and direction of motion of each control must be readily apparent or plainly indicated on, or adjacent to, each control if needed to prevent inappropriate use or confusion ( CS 25,1329(f) ). CS 25.781 also provides requirements for the shapes of the knobs. The design of the FGS should address the following specific considerations: — Differentiation of knob shape and position. (Errors have included confusi ng speed and heading knobs on the mode selector panel.)

— Design to support correct selection of target values. (Use of a single control (e.g., concentric controls) for selecting multiple command reference targets has resulted in erroneous target value selec tion.)

— Commonality of control design across different aircraft to prevent negative transfer of learning with respect to operation of the controls. (Activation of the wrong thrust function has occurred due to variation of TOGA and autothrust Powered by EASA eRules Page 939 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION disengagement f unction between aeroplane types - negative transfer of learning with respect to operation of the controls.)

— Positioning of individual FGS controls, FMAs, and related primary flight display information so that, as far as reasonably practical, items of relate d function have similarly related positions. (Misinterpretation and confusion have occurred due to the inconsistent arrangement of FGS controls with the annunciations on the FMA.)

— Design to discourage or avoid inadvertent operation; e.g., engagement or dis engagement (to show compliance with CS 25.777(a) ).

9.2 Flight Guidance Mode Selection, Annunciation, and Indication Engagement of the Flight Guidance System functions must be suitably annunciated to each pilot (to show compliance with CS 25.1329(i) ), as described in Section 8, Flight Guidance System Engagement, Disengagement, and Override. The FGS mode annunciations must effectively and unambiguously indicate the active and armed modes of operation ( CS 25.1329(i) ). The mode annunciation should convey explicitly, as simply as possible, what the FGS is doing (for active modes), what it will be doing (for armed modes), and target informa tion (such as selected speed, heading, and altitude) for satisfactory flight crew awareness.

Mode annunciation must indicate the state of the system and not just switch position or selection ( CS 25.1329(i) ). Mode a nnunciation should be presented in a manner compatible with flight crew procedures / tasks and consistent with the mode annunciation design for the specific aircraft type (i.e., compatible with other flight deck systems mode annunciations).

Operationally r elevant mode changes and, in particular, mode reversions and sustained speed protection, should be clearly and positively annunciated to ensure flight crew awareness. Altitude capture is an example of an operationally relevant mode that should be annunciat ed because pilot actions may have different effects on the aeroplane.

Annunciation of sustained speed protection should be clear and distinct to ensure flight crew awareness. It should be made clear to the pilot if a mode has failed to arm or engage (espec ially due to invalid sensor data). FGS sub - modes (e.g., sub - modes as the FGS transitions from localizer capture to localizer track) that are not operationally relevant need not be annunciated.

In - service experience has shown that mode annunciation alone ma y be insufficient (unclear or not compelling enough) to communicate mode changes to the flight crew, especially in high workload situations. Therefore, the safety consequences of the flight crew not recognizing mode changes should be considered. If necessa ry, an appropriate alert should be used.

Mode annunciations should be located in the forward field of view (e.g., on the primary flight display). Mode selector switch position or status is not acceptable as the sole means of mode annunciation ( CS 25.1329(i) ). Modes and mode changes should be depicted in a manner that achieves flight crew attention and awareness. Aural notification of mode changes should be limited to special considerations. Colours, font type, font size, location, highlighting, and symbol flashing have historical precedent as good discriminators, when implemented appropriately. The fonts and font size should be chosen so that annunciation of FGS mode and status information is readable and understanda ble, without eye strain, when viewed by the pilot seated at the design eye position.

Powered by EASA eRules Page 940 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Colour should be used in a consistent manner and assure compatibility with the overall use of colour on the flight deck. Specific colours should be used such that the FGS displays are consistent with other flight deck systems, such as a Flight Management System. The use of monochrome displays is not precluded, provided that the aspects of flight crew attention and awareness are satisfied. The use of graphical or symbolic (i .e., non - textual) indications is not precluded. Implementation of such discriminators should follow accepted guidelines as described in applicable international standards (e.g., AMC 25 - 11) and should be evaluated for their consistency with and integration with the flight deck design. Engaged modes should be annunciated at different locations and with different colours than armed modes to assist in mode recognition. The transition from an armed mode to an engaged mode should provide an additional attention - g etting feature, such as boxing and flashing on an electronic display (per AMC 25 - 11) for a suitable, but brief, period (e.g., ten seconds), to assist in flight crew awareness.

The failure of a mode to engage/arm when selected by the pilot should be apparent.

Mode information provided to the pilot should be sufficiently detailed, so that the consequences of the interaction (e.g., ensuing mode or system configuration that has operational relevance) can be unambiguously determined. The FGS interface sho uld provide timely and positive indication when the flight guidance system deviates from the pilot's direct commands (e.g., a target altitude, or speed setting) or from the pilot's pre - programmed set of commands (e.g., waypoint crossing). The interface sho uld also provide clear indication when there is a difference between pilot - initiated commands (e.g., pilot engages positive vertical speed and then selects an altitude that is lower than the aircraft altitude). The default action taken by the FGS should be made apparent.

The operator should be provided with appropriate description of the FGS modes and their behaviour.

9.3 Flight Guidance Alerting (Warning, Caution, Advisory, and Status) Alerting information should follow the provisions of CS 25.1322 and associated advisory material. Alerts for FGS engagement and disengagement are described in Section 8, Flight Guidance System Engagement, Disengagement, and Override.

There should be some method for the flight crew to determine and monitor the availability or capability of the Flight Guidance System (e.g., for dispatch), where the intended operation is predicated on the use of the FGS. The method of monitoring provided should take account of the hazard resulting from t he loss of the autopilot function for the intended operation.

9.3.1 Alerting for Speed Protection To assure crew awareness, an alert should be provided when a sustained speed protection condition is detected. This is in addition to any annunciations associated with mode reversions that occur as a consequence of invoking speed protection (see Section 10.4, Speed Protection). Low speed protection alerting should include both an aural and a visual component. High - speed protection alerts nee d only include a visual alert component because of existing high - speed aural alert requirements, but does not preclude giving an earlier alert.

Alerting for speed protection should be consistent with the protection provided and with the other alerts in the flight deck. Care should be taken to set appropriate values for indicating speed protection that would not be considered a nuisance for the flight crew.

Powered by EASA eRules Page 941 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBP ART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 9.3.2 Loss of Autopilot Approach Mode The loss of the approach mode requires immediate flight crew awa reness. This may be accomplished through autopilot disengagement and related warning (as required by CS 25.1329(j) and specified in 8.1.2.1 of this AMC). If the autopilot remains engaged and reverts to a non - approa ch mode, an appropriate aural warning and/or visual alert should be provided.

9.3.3 Awareness of Potential Significant Transient Condition (“Bark before Bite”) There have been situations where an autopilot is engaged, operating normally, and controlling u p to the limit of its authority for an extended period of time, and the flight crew was unaware of the situation. This service experience has shown that, without timely flight crew awareness and action, this situation can progress to a loss of control afte r autopilot disengagement, particularly in rare normal or non - normal conditions. However, with adequate flight crew awareness and pilot action, loss of control may be prevented.

To help ensure crew awareness and timely action, appropriate alert(s) (general ly caution or warning) should be provided to the flight crew for conditions that could require exceptional piloting skill or alertness for manual control following autopilot disengagement (e.g., significantly out of trim). The number and type of alerts req uired would be determined by the unique situations that are being detected and by the crew procedures required to address those situations. Any alert should be clear and unambiguous, and be consistent and compatible with other flight deck alerts. Care shou ld be taken to set appropriate thresholds for these alerts such that they are not considered a nuisance for the flight crew.

Situations that should be considered for an alert include: Sustained Lateral Control Command: If the autopilot is holding a sustain ed lateral control command, it could be indicative of an unusual operating condition (e.g., asymmetric lift due to icing, fuel imbalance, asymmetric thrust) for which the autopilot is compensating. In the worst case, the autopilot may be operating at or ne ar its full authority in one direction. If the autopilot were to disengage while holding this lateral trim, the result would be that the aeroplane would undergo a rolling moment that could possibly take the pilot by surprise. Therefore, a timely alert shou ld be considered to permit the crew to manually disengage the autopilot and take control prior to any automatic disengagement which might result from the condition.

Sustained Longitudinal Out of Trim: If the autopilot is holding sustained longitudinal trim , it could be indicative of an unusual operating condition (e.g., an inoperative horizontal stabilizer) for which the autopilot is compensating. If the autopilot were to disengage while holding this longitudinal trim, the result would be that the aeroplane would undergo an abrupt change in pitch that could possibly take the pilot by surprise. Therefore, a timely alert should be considered to permit the crew to manually disengage the autopilot and take control prior to any automatic disengagement, which migh t result from the condition.

Bank and Pitch Angles Beyond Those Intended for Autopilot Operations: Most autopilots are designed with operational limits in both the pitch and roll axes, such that those predetermined limits will not be purposely exceeded. If the aeroplane exceeds those limits, it could be indicative of a situation (which may not be covered by items 1. or 2.) that requires the pilot to intervene. Therefore, a timely alert Powered by EASA eRules Page 942 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION should be considered to bring this condition to the attention of the fli ght crew to and permit the crew to manually disengage the autopilot and take control prior to any automatic disengagement, which might result.

It is preferable that the autopilot remains engaged during out - of - trim conditions.

However, if there is an automa tic disengagement feature due to excessive out - of - trim, an alert should be generated and should precede any automatic disengagement with sufficient margin to permit timely flight crew recognition and manual disengagement. See also Section 8.4, Flight Crew Override of the FGS, for related material.

NOTE: This section is not intended to require alerting for all instances of automatic autopilot disengagement. It is intended only for conditions, which, if not addressed, would lead to such disengagement, which, could result in a significant transient for which the pilot may be unprepared. The intent is to provide crew awareness that would allow the flight crew to be prepared with hands on controls and take appropriate corrective action before the condition resul ts in a potentially hazardous aeroplane configuration or state.

NOTE: This section describes alerting requirements for conditions resulting in unintended out - of - trim operation. There are FGS functions that can intentionally produce out - of - trim operation ( e.g. parallel rudder operation in align or engine failure compensation modes, pitch trim operation during the approach/landing to provide trim up/flare spring bias, or pitch trim operation for certain types of Speed/Mach trim systems). It is not the intent of this section to require alerts for functions producing intentional out - of - trim conditions. Other system indications (e.g., mode and status annunciations) should be provided to make the crew aware of the operation of these functions where appropriate.

9 .3.4 Failures Affecting Flight Director Guidance Wherever practicable a failure should cause the immediate removal from view of the guidance information. If the guidance information is retained but a warning given instead, it should be such that the pilot cannot fail to observe it whilst using the guidance information.

9.4 FGS Considerations for Head - Up Displays (HUD) Head - up displays (HUD) have unique characteristics compared to flight displays installed on the instrument panel. Most of these HUD differenc es are addressed during HUD certification whether or not the HUD provides flight guidance functions. The intent of this section is to address how such HUD differences may affect FGS functions.

9.4.1 Characteristics of HUD Guidance If the HUD is designed a s a supplemental use display system, it does not replace the requirement for standard Head Down Display (HDD) of flight instrument data.

The HUD is intended for use during takeoff, climb, cruise, descent, approach and landing under day, night, VMC and IMC conditions. When it can be reasonably expected that the pilot will operate primarily by reference to the HUD, it should be shown that the HUD is satisfactory for manually controlling the aeroplane and for monitoring the performance of the FGS system.

Durin g take off and landing in certain light and visibility conditions, HUD symbology can be extremely dominant in comparison to external visual references. When Powered by EASA eRules Page 943 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION visual references are relatively dim, extremely active symbology dynamics and guidance cue gains ca n lead the pilot to make excessively strong corrections. It should be shown that if HUD guidance cues are followed, regardless of the appearance of external visual references, they do not cause the pilot to take unsafe actions.

Generally the criteria for t he mechanization of guidance displayed on the HUD would be no different than guidance displayed on the head - down display. See Section 10, Performance of Function, for flight director performance criteria.

However, unlike head - down displays, HUD’s are capab le of displaying certain symbology conformal to the outside scene, including guidance cues. Consequently, the range of motion of this conformal symbology, including the guidance, can present certain challenges in rapidly changing and high crosswind conditi ons. In certain cases, the motion of the guidance and the primary reference cue may be limited by the field of view. It should be shown that, in such cases, the guidance remains usable and that there is a positive indication that it is no longer conformal with the outside scene. It should also be shown that there is no interference between the indications of primary flight information and the flight guidance cues.

In take off, approach, and landing FGS modes, the flight guidance symbology should have priori ty.

Additionally, HUD guidance is often used in cases, like the low visibility approach, where the pilot will need to reference both the information displayed on the HUD and outside references. Consequently, it should be shown that the location and presen tation of the HUD information does not distract the pilot or obscure the pilot’s outside view. For example, it would be necessary for the pilot to track the guidance to the runway without having the view of runway references or hazards along the flight pat h obscured by the HUD symbology.

9.4.2 HUD Flight Guidance System Display The HUD display should present flight guidance information in a clear and unambiguous manner. Display clutter should be minimized. The HUD guidance symbology should not excessively interfere with pilots’ forward view, ability to visually manoeuvre the aeroplane, acquire opposing traffic, and see the runway environment. Some flight guidance data elements are essential or critical and should not be removed by any de - clutter function.

9.4.3 Head - Up/Head - Down Display Compatibility The HUD FGS symbology should be compatible and consistent with symbology on other FGS displays such as head - down EFIS instruments. The FGS - related display parameters should be consistent to avoid misinterpretation of similar information, but the display presentations need not be identical. The HUD and head - down primary flight display formats and data sources need to be compatible to ensure that the same FGS - related information presented on bo th displays have the same intended meaning.

While not all information displayed on the HUD is directly related to the FGS, the pilot is likely to use most of the displayed information while using the HUD - displayed guidance and FGS annunciations. Therefore, when applicable, the guidelines below for the presentation of FGS - related display information should be followed as much as possible. Certain deviations from these guidelines may be appropriate due to conflict with other information display characteristic s or Powered by EASA eRules Page 944 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION requirements unique to head - up displays. These may include minimization of display clutter, minimization of excessive symbol flashing, and the presentation of certain information conformal to the outside scene.

(a) Symbols should be the same format (e .g., a triangle - shaped pointer head - down appears as a triangle pointer head - up; however, some differences in HUD symbology such as the flight director “circle” versus head - down flight director “bars” or “wedge” have been found acceptable); (b) Information (symbols) should appear in the same general location relative to other information; (c) Alphanumeric readouts should have the same resolution, units, and labelling (e.g., the command reference indication for “vertical speed” should be displayed in the same foot - per - minute increments and labelled with the same characters as the head - down displays); (d) Analogue scales or dials should have the same range and dynamic operation (e.g., a Glideslope Deviation Scale displayed head - up should have the same displayed range as the Glideslope Deviation Scale displayed head - down, and the direction of movement should be consistent); (e) FGS modes (e.g. autopilot, flight director, autothrust) and status state transitions should be displayed on the HUD, and except for the u se of colour, should be displayed using consistent methods (e.g., the method used head - down to indicate a flight director mode transitioning from armed to captured should also be used head - up); and (f) Information sources should be consistent between the H UD and the head - down displays used by the same pilot.

(g) When FGS command information (i.e., flight director commands) are displayed on the HUD in addition to the head - down displays, the HUD depiction and guidance cue deviation “scaling” needs to be cons istent with that used on the head - down displays. This is intended to provide comparable pilot performance and workload when using either head - up or head - down displays.

(h) The same information concerning current HUD system mode, reference data, status sta te transitions, and alert information that is displayed to the pilot flying on the HUD, should also be displayed to the pilot not flying using consistent nomenclature to ensure unambiguous awareness of the HUD operation.

9.4.4 Alerting Issues Although HUD’ s are typically not classified as integrated caution and warning systems, they may display warnings, cautions, and advisories as part of their FGS function. In this regard, HUD’s should provide the equivalent alerting functionality as the head - down primar y flight display(s). Warnings that require continued flight crew attention on the PFD also should be presented on the HUD (e.g., ACAS/TCAS, Windshear, and Ground Proximity Warning annunciations). If master alerting indications are not provided within the peripheral field of view of the pil ot while using the HUD, the HUD should provide annunciations that inform the pilot of Caution and/or Warning conditions (ARP - 5288, V12).

Powered by EASA eRules Page 945 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION For monochrome HUD’s, appropriate use of attention - getting properties such as flashi ng, outline boxes, brightness, size, and/or location are necessary to adequately compensate for the lack of colour normally assigned to distinguish and call attention to Cautions and warnings.

For multi - colour HUD’s, the use of red, amber, or yellow for sy mbols not related to Caution and warning functions should be avoided, so that the effectiveness of distinguishing characteristics of true warnings and cautions is not reduced.

Single HUD installations rely on the fact that the non - flying pilot will monitor the head - down instruments and alerting systems, for failures of systems, modes, and functions not associated with primary flight displays.

Dual HUD installations require special consideration for alerting systems. It must be assumed that both pilots will be head - up simultaneously, full, or part - time, especially when the HUD is being used as the primary flight reference, or when the HUD is required equipment for the operation being conducted. If master alerting indications are not provided within the perip heral field of view of each pilot while using the HUD, then each HUD should provide annunciations that direct the pilot’s attention to head - down alerting displays. The types of information that must trigger the HUD master alerting display are any Cautions or warnings not already duplicated on the HUD from head - down primary displays, as well as any Caution level or warning level engine indications or system alerts.

NOTE: The objective is to not redirect attention of the pilot flying to other display when a n immediate manoeuvre is required (resolution advisory, windshear).

If a Ground Proximity Warning System (GPWS), wind shear detection system, a wind shear escape guidance system, or a Airborne Collision Avoidance System (ACAS) / Traffic alert and Collision Avoidance System (TCAS) is installed, then the guidance, warnings and annunciations required to be a part of these systems, and normally required to be in the pilot’s primary field of view, should be displayed on the HUD.

9.4.5 Upset/Unusual Attitude Reco very Guidance Upsets due to wake turbulence or other environmental conditions may result in near instantaneous excursions in pitch and bank angles and a subsequent unusual attitude.

If the HUD is designed to provide guidance for recovery from upsets or unu sual attitudes, recovery steering guidance commands should be distinct from, and not confused with, orientation symbology such as horizon “pointers.” For example, a cue for left stick input should not be confused with a cue indicating direction to the near est horizon. Guidance should be removed if cues become invalid at extreme attitudes, such as zenith, nadir, or inverted. For extreme attitudes it is acceptable to transition to the HDD, provided that the cues to transition from the HUD are clear and unambi guous.

If the HUD is designed to provide orientation only during ups ets or unusual attitudes, cues should be designed to prevent them from being mistaken as flight control input commands.

Powered by EASA eRules Page 946 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 10 PERFORMANCE OF FUNCTION The FGS is expected to perform its intended function throughout the aeroplane’s normal flight envelope. There are considerations for the FGS when operating at the limits of its performance capabilities and when operating under significant environmental conditions. The following sections pro vide acceptable means of compliance criteria and interpretive material for these considerations.

Where system tolerances have a significant effect on autopilot authority limits, consideration should be given to the effect on autopilot performance. Factors to be considered include but are not limited to tolerances of: servo authority, servo clutch setting, “cam - out” settings, control friction, and sensor tolerances.

10.1 Normal Performance The FGS should provide guidance or control, as appropriate, for the i ntended function of the active mode(s), in a safe and predictable manner within the aeroplane’s normal flight envelope.

The FGS should be designed to operate in all aeroplane configurations for its intended use within the aeroplane’s normal flight envelope to provide acceptable performance for the following types of environmental conditions: — Winds (light and moderate) — Wind gradients (light and moderate) NOTE: In the context of this AMC, ‘wind gradient’ is considered a variation in wind velocity as a function of altitude, position, or time.

— Gusts (light and moderate) — Turbulence (light and moderate) — Icing - all icing conditions covered by Appendix C to CS - 25 and applicable icing conditions covered by Appendix O t o CS - 25, with the exception of ‘asymmetric icing’ discussed under ‘Rare Normal Conditions’ in Section 10.2 below. For showing compliance with the CS - 25 certificati on specifications relative to SLD icing conditions represented by Appendix O, the applicant may use a comparative analysis. AMC 25.1420(f) provides guidance for comparative analysis.

NOTE: Representative levels of the environmental effects should be estab lished consistent with the aeroplane’s intended operation.

Any performance characteristics that are operationally significant or operationally limiting should be identified with an appropriate statement or limitation in the Aeroplane Flight Manual (AFM) (R ef. CS 25.1581 ).

The FGS should perform its intended function during routine aeroplane configuration or power changes, including the operation of secondary flight controls.

Evaluation of FGS performance for complia nce should be based on the minimum level of performance needed for its intended functions. Subjective judgment may be applied to account for experience acquired from similar equipment and levels that have been established as operationally acceptable by the end - user.

There are certain operations that dictate a prescribed level of performance. When the FGS is intended for operations that require specific levels of performance, the use of FGS should be shown to meet those specific levels of performance (e.g., Low Visibility Powered by EASA eRules Page 947 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Operations – Category II and III operations, Reduced Vertical Separation Minimums (RVSM), Required Navigation Performance (RNP)).

The FGS performance of intended functions should at least be equivalent to that expected of a pilot for a simil ar task. The AMC No.2 to CS 25.1329 provides for establishing the general behaviour of the FGS. When integrated with navigation sensors or flight management systems, the FGS should satisfy the flight technical erro r tolerances expected for the use of those systems in performing their intended functions.

The autopilot should provide smooth and accurate control without perceptible sustained nuisance oscillation.

The flight director, in each available display presentat ion (e.g., single cue, cross - pointer, flight path director) should provide smooth and accurate guidance and be appropriately damped, so as to achieve satisfactory control task performance without pilot compensation or excessive workload.

The autothrust fun ction should provide smooth and accurate control of thrust without significant or sustained oscillatory power changes or excessive overshoot of the required power setting.

The automatic pitch trim function should operate at a rate sufficient to mitigate ex cessive control surface deflections or limitations of control authority without introducing adverse interactions with automatic control of the aircraft. Automatic roll and yaw trim functions, if installed, should operate without introducing adverse interac tions with automatic control of the aircraft.

10.2 Performance in Rare Normal Conditions The FGS will encounter a wide range of conditions in normal operations, some of which may be infrequent, but levy a greater than average demand on the FGS capabilities .

Certain environmental conditions, as listed below, are prime examples. FGS performance during such rare normal conditions should be assessed. Such conditions may degrade FGS performance, but must be safe for FGS operation. The relative infrequency of suc h conditions may also be a factor in the flight crew’s ability to detect and mitigate, in a timely manner, any limited capability of the FGS to cope with them. The FGS should be limited from operating in environmental conditions in which it cannot be safel y operated.

This does not mean that the FGS must be disengaged when rare normal conditions, which may degrade its performance or capability, are encountered. Actually, the FGS may significantly help the flight crew during such conditions. However, the desi gn should address the potential for the FGS to mask a condition from the flight crew or to otherwise delay appropriate flight crew action. See Section 9.3, Flight Guidance Alerting for discussion of alerting under such conditions.

Operations in rare normal environmental conditions may result in automatic or pilot - initiated autopilot disengagement close to the limit of autopilot authority. Autopilot disengagement in rare normal conditions should meet the safety criteria for autopilot disengagement found in S ection 8.1 and the criteria for flight guidance alerting in Section 9.3.

For rare normal conditions, the FGS should provide guidance or control, as appropriate for the intended function of the active mode(s), in a safe and predictable manner, both within the normal flight envelope and for momentary excursions outside the normal flight envelope.

Powered by EASA eRules Page 948 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION The following rare normal environmental conditions should be considered in the design of the FGS: — Significant winds — Significant wind gradients — Windshear (e.g., microburst) NOTE: For the purpose of this AMC, “windshear” is considered a wind gradient of such a magnitude that it ma y cause damage to the aircraft. The FGS may also provide suitable auto pilot control during windshear. Refer to FAA Advi sory Circulars AC 25 - 12 and AC 120 - 41 for windshear guidance system requirements.

— Large gusts (lateral, longitudinal, and vertical dimensions) — Severe and greater turbulence — Asymmetric icing 10.3 Performance in Non - Normal Conditions The FGS will occasionall y be operating when the aeroplane transitions outside of the normal flight envelope of the aeroplane, when other aeroplane systems experience failure conditions (e.g., inoperative engine, loss of hydraulics) or when the aeroplane experiences certain extrao rdinary conditions such as significant fuel imbalance, non - standard flap/slat or ferry configurations. Under such circumstances, the FGS characteristics and flight crew interaction with the FGS should be shown to be safe.

10.4 Speed Protection (see 25.1329(h) ) The requirement for speed protection is based on the premise that reliance on flight crew attentiveness to airspeed indications, alone, during FGS operation is not adequate to avoid unacceptable speed excursio ns outside the speed range of the normal flight envelope. Many existing FGS systems have no provisions to avoid speed excursions outside the normal flight envelope. Some FGS systems will remain engaged until the aircraft slows to stall conditions and also to speeds well above V /M .

MO MO The intent of the rule is for the FGS to provide a speed protection function for all operating modes, such that the airspeed can be safely maintained within an acceptable margin of the speed range of the normal flight envelope .

For compliance with the intent of the rule, other systems, such as the primary Flight Control System or the FMS when in a VNAV mode, may be used to provide equivalent speed protection functionality.

If the FGS is providing speed protection function, the following are acceptable means to comply with this rule: — The FGS may detect the speed protection condition, alert the flight crew and provide speed protection control or guidance.

— The FGS may detect the speed protection condition, alert the flight crew and then disengage the FGS.

— The FGS may detect the speed protection condition, alert the flight crew, and remain engaged in the active mode without providing speed protection control or guidance.

Powered by EASA eRules Page 949 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: IN STALLATION NOTE: If compliance with this requirement is based on use of al erting alone, the alerts should be shown to be appropriate and timely to ensure flight crew awareness and enable the pilot to keep the aeroplane within an acceptable margin from the speed range of the normal flight envelope. See Section 9.3.1 for additiona l discussion of speed protection alerting.

The design should consider how and when the speed protection is provided for combinations of autopilot, flight directors, and autothrust operation.

Care should be taken to set appropriate values for transitioning into and out of speed protection that the flight crew does not consider a nuisance.

The speed protection function should integrate pitch and thrust control. Consideration should be given to automatically activating the autothrust function when speed protec tion is invoked. If an autothrust function is either not provided or is unavailable, speed protection should be provided through pitch control alone.

The role and interaction of autothrust with elements of the FMS, the primary flight control system, and th e propulsion system, as applicable, should be accounted for in the design for speed protection.

Consideration should be given to the effects of an engine inoperative condition on the performance of speed protection.

10.4.1 Low Speed Protection When the FGS is engaged in any modes (with the possible exception of approach as discussed in Section 10.4.1.1) for which the available thrust is insufficient to maintain a safe operating speed, the low speed protection function should be invoked to avoid unsafe speed excursions.

Activation of speed protection should take into account the phase of flight, factors such as turbulence and gusty wind conditions, and be compatible with the speed schedules. The low speed protection function should activate at a suitable marg in to stall warning consistent with values that will not result in nuisance alerts.

Consider the operational speeds, as specified in the Aeroplane Flight Manual (AFM), for all - engine and engine - inoperative cases during the following phases of flight: — Takeoff.

— During departure, climb, cruise, descent and terminal area operations aeroplanes are normally operated at or above the minimum manoeuvring speed for the given flap configuration.

NOTE: For high altitude operations, it may be desirable to incorporate low speed protection at the appropriate engine out drift - down speed schedule if the FGS (or other integrated sensors/systems) can determine that the cause of the thrust deficiency is due to an engine failure.

— Approach.

NOTE: A low speed alert and a transition to the speed protection mode at approximately 1.2VS, or an equivalent speed defined in terms of VSR, for the landing flap configuration has been found to be acceptable.

— The transition from approach to go - around and go - around climb.

Powered by EASA eRules Page 950 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 10.4.1. 1 Low Speed Protection during Approach Operations Speed protection should not interfere with the landing phase of flight.

It is assumed that with autothrust operating normally, the combination of thrust control and pitch control during the approach will be sufficient to maintain speed and desired vertical flight path. In cases where it is not, an alert should be provided in time for the flight crew to take appropriate corrective action.

For approach operations with a defined vertical path (e.g., ILS, MLS, GLS, LNAV/VNAV), if the thrust is insufficient to maintain both the desired flight path and the desired approach speed, there are several ways to meet the intent of low speed protection: (a) The FGS may maintain the defined vertical path as the aeroplane d ecelerates below the desired approach speed until the airspeed reaches the low speed protection value. At that time the FGS would provide guidance to maintain the low speed protection value as the aeroplane departs the defined vertical path. The FGS mode r eversion and low speed alert should be activated to ensure pilot awareness.

NOTE: The pilot is expected to take corrective action to add thrust and return the aeroplane to the defined vertical path or go - around as necessary.

(b) The FGS may maintain the de fined vertical path as the aeroplane decelerates below the desired approach speed to the low speed protection value. The FGS will then provide a low speed alert while remaining in the existing FGS approach mode.

NOTE: The pilot is expected to take correcti ve action to add thrust to cause the aeroplane to accelerate back to the desired approach speed while maintaining the defined vertical path or go - around as necessary.

(c) The FGS may maintain the defined vertical path as the aeroplane decelerates below the desired approach speed until the airspeed reaches the low speed protection value. The FGS will then provide a low speed alert and disengage.

NOTE: The pilot is expected to take corrective action when alerted to the low speed condition and the disengagemen t of the autopilot, to add thrust and manually return the aeroplane to the desired vertical path or go - around as necessary.

The FGS design may use any one or a combination of these ways to provide acceptable low speed protection.

If the speed protection is invoked during approach such that vertical flight path is not protected, the subsequent behaviour of the FGS after speed protection should be ca refully considered. Activation of low speed protection during the approach, resuming the approach mode and reac quiring the defined vertical path, may be an acceptable response if the activation is sufficiently brief and not accompanied by large speed or path deviations.

Powered by EASA eRules Page 951 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 10.4.1.2 Windshear The interaction between low speed protection and windshear recovery guidance is a special case. Windshear recovery guidance that meets the criteria found in FAA Advisory Circulars AC 25 - 12 and AC 120 - 41 provides the necessary low speed protection when it is activated, and is considered to be acceptable for compliance with CS 25.1329(h) . The autopilot should be disengaged when the windshear recovery guidance activates, unless autopilot operation has been shown to be safe in these conditions and provides effective automatic windshear recovery that meets the criteria found in the advisory circulars referenced above.

10.4.2 High Speed Protection CS 25.1329(h) states that the means must be provided to avoid excursions beyond an acceptable margin from the speed range of the normal flight envelope VMO and MMO mark the upper speed limit of the normal flight envelope. This is not intended to require, or preclude, high - speed protection based on aeroplane configurations (e.g., flaps).

The following factors shoul d be considered in the design of high - speed protection: 1. The duration of airspeed excursions, rate of airspeed change, turbulence, and gust characteristics.

(a) Operations at or near VMO/MMO in routine atmospheric conditions (e.g., light turbulence) are safe. Small, brief excursions above VMO/MMO, by themselves, are not unsafe.

(b) The FGS design should strive to strike a balance between providing adequate speed protection margin and avoiding nuisance activation of high - speed protection.

NOTE: The following factors apply only to designs that provide high - speed protection through FGS control of airspeed.

2. FGS in altitude hold mode: (a) Climbing to control airspeed is not desirable, because departing an assigned altitude can be disruptive to ATC and potentially hazardous (for example, in RVSM airspace). It is better that the FGS remain in altitude hold mode.

(b) The autothrust function, if operating normally, should effect high - speed protection by limiting its speed reference to the normal speed enve lope (i.e., at or below VMO/MMO).

(c) The basic aeroplane high - speed alert should be sufficient for the pilot to recognize the overspeed condition and take corrective action to reduce thrust as necessary. However, if the airspeed exceeds a margin beyond VM O/MMO (e.g., 11 km/h (6 kt)), the FGS may transition from altitude hold to the overspeed protection mode and depart (climb above) the selected altitude.

3. During climbs and descents: (a) When the elevator channel of the FGS is not controlling airspeed, the autothrust function (if engaged) should reduce thrust, as needed to Powered by EASA eRules Page 952 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUI PMENT (CS - 25) INSTRUMENTS: INSTALLATION prevent sustained airspeed excursions beyond VMO/MMO (e.g., 11 km/h (6 kt)), down to the minimum appropriate value.

(b ) When thrust is already the minimum appropriate value, or the autothrust function is not operating, the FGS should begin using the elevator channel, as needed, for high - speed protection.

(c) If conditions are encountered that result in airspeed excursions above VMO/MMO, it is preferable for the FGS to smoothly and positively guide or control the aeroplane back to within the speed range of the normal flight envelope.

10.5 Icing Considerations The FGS typically will be designed to provide acceptable performa nce in all standard aeroplane configurations. Operating an aeroplane in icing conditions can have significant implications on the aerodynamic characteristics of the aeroplane (e.g., ice accretion on wings, tail, and engines) and, consequently, on FGS perfo rmance. Ice accretion may be slow, rapid, symmetric, or asymmetric. During autopilot operation, the flight crew may not be aware of the gradual onset of icing conditions or the affect that the accumulation of ice is having on the handling qualities of the aeroplane.

Means should be provided to alert the flight crew as described in Section 9.3.

The implication of icing conditions on speed protection should be assessed. If the threshold of the stall warning system is adjusted due to icing conditions, appropri ate adjustments should also be made to the FGS low speed protection threshold.

11 CHARACTERISTICS OF SPECIFIC MODES There are certain operational modes of the FGS that have been implemented in different ways in different aeroplanes and systems. The followi ng sections provide guidance and interpretative material that clarifies the operational intent for these modes and provide criteria that have been shown to be acceptable in current operations. The guidance in this section does not preclude other mode imple mentations.

Pilot understanding of the mode behaviour is especially important to avoid potential confusion and should be clearly annunciated as described in Section 9.2, Flight Guidance Mode Selection, Annunciation, and Indication.

11.1 Lateral Modes This section discusses modes that are implemented in many flight guidance systems that are used primarily for lateral/directional control of the aeroplane. The criteria below identify acceptable mode operation based on past operational experience gained from th e use of these modes.

11.1.1 Heading or Track Hold In the Heading or Track Hold mode, the FGS should maintain the aeroplane heading or track. For the situation when the aeroplane is in a bank when the Heading or Track Hold mode is engaged, the FGS should roll the aeroplane to a wings - level condition and maintain the heading or track when wings - level is achieved (typically less than 5 degrees of bank angle).

Powered by EASA eRules Page 953 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 11.1.2 Heading or Track Select In the Heading or Track Select mode, the FGS should expeditiously acquire and maintain a ‘selected’ heading or track value consistent with occupant comfort.

When the mode is initially engaged, the FGS should turn the aeroplane in a direction that is the shortest heading (or track) change to acquire the new heading (or tr ack). Once the heading/track select mode is active, changes in the selected value should result in changes in heading/track. The FGS should always turn the aeroplane in the same direction as the sense of the selected heading change (e.g., if the pilot tur ns the heading select knob clockwise, the aeroplane should turn to the right), even if the shortest heading (or track) change is in the opposite direction (ref. CS 25.779(a)(1) ). Target heading or track value shoul d be presented to the flight crew.

11.1.3 Lateral Navigation Mode (LNAV) In the LNAV mode, the FGS should acquire and maintain the lateral flight path commanded by a flight management function (that is, FMS or equivalent).

If the aeroplane is not established on the desired lateral path or within the designed path capture criteria when LNAV is selected, the FGS LNAV mode should enter an armed state. The FGS should transition from the armed state to an engaged state at a point where the lateral flig ht path can be smoothly acquired and tracked.

For an FGS incorporating the LNAV mode during the takeoff or go - around phase, the design should specify manoeuvring capability immediately after takeoff, and limits, should they exist. After takeoff or go - arou nd, manoeuvring should be based upon aircraft performance with the objective to prevent excessive roll attitudes where wingtip / runway impact becomes probable, yet satisfy operational requirements where terrain and / or thrust limitations exist.

11.2 Vert ical Modes This section discusses modes that are implemented in many flight guidance systems that are used primarily for pitch control of the aeroplane. The criteria identified reflect operational experience gained from the use of these modes.

To avoid unc onstrained climbs or descents, for any altitude transitions when using applicable vertical modes, the altitude select controller should be set to a new target altitude before the vertical mode can be selected. If the design allows the vertical mode to be s elected before setting the target altitude, then consideration should be given to the potential vulnerability of unconstrained climb or descent leading to an altitude violation or Controlled Flight into Terrain. Consideration should also be given to approp riate annunciation of the deviation from previously selected altitude and / or subsequent required pilot action to reset the selected altitude.

11.2.1 Vertical Speed Mode In the Vertical Speed mode, the FGS should smoothly acquire and maintain a selected v ertical speed.

Consideration should be given to: — the situation where the selected value is outside of the performance capability of the aeroplane, or Powered by EASA eRules Page 954 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION — use of vertical speed mode without autothrust, potentially leading to a low - speed or high - speed condition, and corresponding pilot awareness vulnerabilities. See Section 10.4 , Speed Protection, for discussion of acceptable means of compliance when dealing with such situations.

11.2.2 Flight Path Angle Mode In the Flight Path Angle mode, the FGS should smoothly acquire and maintain the selected flight path angle.

Consideration should be given to: — the situation where the selected value is outside of the performance capability of the aeroplane, or — use of flight path angle mo de without autothrust, potentially leading to a low - speed or high - speed condition, and corresponding pilot awareness vulnerabilities. Acceptable means of compliance have included a reversion to an envelope protection mode or a timely annunciation of the si tuation.

11.2.3 Airspeed (IAS)/Mach Hold (Speed on elevator) In the Airspeed/Mach Hold mode, the FGS should maintain the airspeed or Mach at the time of engagement.

11.2.4 Airspeed (IAS)/Mach Select Mode (Speed on elevator) In the Airspeed/Mach Select mode , the FGS should acquire and maintain a selected airspeed or Mach. The selected airspeed or Mach may be either pre - selected or synchronized to the airspeed or Mach at the time of engagement.

11.2.5 Flight Level Change (FLCH) (Speed on elevator) In the FLCH mode, the FGS should change altitude in a coordinated way with thrust control on the aeroplane. The autopilot/flight director will typically maintain speed control through elevator. The autothrust function, if engaged, will control the thrust to the appro priate value for climb or descent.

11.2.6 Altitude Capture Mode The Altitude Capture mode should command the FGS to transition from a vertical mode to smoothly capture and maintain the selected target altitude with consideration of the rates of climb and descent experienced in service.

In - service experience has shown that certain implementations have the potential to cause pilot confusion that may lead to altitude violations. Accordingly, the following are guidelines for the Altitude Capture mode: (a) The Altitude Capture mode should be automatically armed to ensure capture of the selected altitude. Note: If the altitude capture mode is armed at all times, annunciation of the armed status is not required. If the FGS is in Altitude Capture, it should be annunciated.

(b) The Altitude Capture mode should engage from any vertical mode if the computed flight path will intercept the selected altitude and the altitude capture criteria are satisfied, except as specified during an approach (e.g., when the glidepa th for approach mode is active).

Powered by EASA eRules Page 955 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (c) Changes in the climb/descent command references, with the exception of those made by the flight crew using the altitude select controller, should not prevent capture of the target altitude.

(d) The Altitude Capture mode should smoothly capture the selected altitude using an acceptable acceleration limit with consideration for occupant comfort.

(e) The acceleration limit may, under certain conditions, result in an overshoot.

To minimize the altitude overshoot, the normal acceleration limit may be increased, consistent with occupant safety.

(f) During Altitude Capture, pilot selection of other vertical modes should not prevent or adversely affect the level off at the target altitude at the time of capture. One means of comp liance is to inhibit transition to other pilot - selectable vertical modes (except altitude hold, go - around, and approach mode) during altitude capture, unless the target altitude is changed. If glidepath capture criteria are satisfied during altitude captur e, then the FGS should transition to glidepath capture.

(g) The FGS must be designed to minimize flight crew confusion concerning the FGS operation when the target altitude is changed during altitude capture.

It must be suitably annunciated and appropriate for the phase of flight ( CS 25.1329(i) ).

(h) Adjusting the datum pressure at any time during altitude capture should not result in loss of the capture mode. The transition to the pressure altitude should be accomp lished smoothly.

(i) If the autothrust function is active during altitude capture the autopilot and autothrust functions should be designed such that the FGS maintains the reference airspeed during the level - off manoeuvre. For example, if the autopilot cha nges from speed mode to an altitude capture or control mode, then autothrust should transition to a speed mode to maintain the reference airspeed.

11.2.7 Altitude Hold Mode The Altitude Hold mode may be entered either by flight crew selection or by transit ion from another vertical mode.

When initiated by an automatic transition from altitude capture the Altitude Hold mode should provide guidance or control to the selected altitude. The automatic transition should be clearly annunciated for flight crew aware ness.

When initiated by pilot action in level flight, the Altitude Hold mode should provide guidance or control to maintain altitude at the time the mode is selected.

When initiated by pilot action when the aeroplane is either climbing or descending, the F GS should immediately initiate a pitch change to arrest the climb or descent, and maintain the altitude when level flight (e.g., <1 m/s (<200 ft/min)) is reached.

The intensity of the levelling manoeuvre should be consistent with occupant comfort and safet y.

Automatic transition into the Altitude Hold mode from another vertical mode should be clearly annunciated for flight crew awareness.

Powered by EASA eRules Page 956 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Any aeroplane response due to an adjustment of the datum pressure should be smooth.

11.2.8 Vertical Navigation Mode (VN AV) In the VNAV mode, the FGS should acquire and maintain the vertical commands provided by a flight management function (that is, FMS or equivalent).

If the aeroplane is not on the desired FMS path when the VNAV mode is selected, the FGS VNAV mode should go into an armed state, or provide guidance to smoothly acquire the FMS path. The flight crew should establish the aeroplane on a flight profile to intercept the desired FMS path. The FGS should transition from the armed state to an engaged state at a poin t where the FGS can smoothly acquire and track the FMS path.

When VNAV is selected for climb or descent, the autothrust function (if installed) should maintain the appropriate thrust setting. When levelling after a VNAV climb or descent, the autothrust fun ction should maintain the target speed.

If the aircraft is flying a vertical path (e.g., VNAV Path) the deviation from that path should be displayed in the primary field of view (i.e., the PFD, ND, or other acceptable display).

The FGS should preclude a VN AV climb unless the Mode Selector Panel altitude window is set to an altitude above the current altitude.

Except when on a final approach segment to a runway: — The FGS should preclude a VNAV descent unless the Mode Selector Panel altitude window is set to an altitude below the current altitude.

— The FGS should not allow the VNAV climb or descent to pass through a Mode Selector Panel altitude.

(See Section 11.5, Special Considerations for VNAV Approach Operations related to selecting a Target Altitude.)

11.3 Multi - axis Modes This section discusses modes that are implemented in many flight guidance systems that are used in an integrated manner for pitch, lateral/directional control and thrust management of the aeroplane. The criterion identified reflects operational experience gained from the use of these modes.

11.3.1 Takeoff Mode In the take off mode, the vertical element of the FGS should provide vertical guidance to acquire and maintain a safe climb out speed after initial rotation for takeoff . If no rotation guidance is provided, the pitch command bars may be displayed during takeoff roll but should not be considered as providing rotation guidance unless it is part of the intended function.

If rotation guidance is provided, consideration shoul d be given to the need to show that the use of the guidance does not result in a tail strike and should be consistent with takeoff methods necessary to meet takeoff performance requirements up to 11 m (35 ft) AGL.

The Autothrust function should increase an d maintain engine thrust to the selected thrust limits (e.g., full T/O, de - rate).

Powered by EASA eRules Page 957 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION The FGS design should address all engine and engine - inoperative conditions consistent with the following takeoff system performance after lift - off: (a) Takeoff system operati on should be continuous and smooth through transition from the runway portion of the takeoff to the airborne portion and reconfiguration for en route climb. The pilot should be able to continue the use of the same primary display(s) for the airborne porti on as for the runway portion. Changes in guidance modes and display formats should be automatic.

(b) The vertical axis guidance of the takeoff system during normal operation should result in the appropriate pitch attitude, and climb speed for the aeroplane considering the following factors: — Normal rate rotation of the aeroplane to the commanded pitch attitude, at V - 18.5 km/h (10 kt) for all engines and VR - 9.3 km/h (5 kt) R for engine out, should not result in a tail - strike.

— The system should provide commands that lead the aeroplane to smoothly acquire a pitch attitude that results in capture and tracking of the All - Engine Takeoff Climb Speed, V + X. X is the All - Engine Speed Additive from the AFM (normally 18.5 km/h (10 kt) or higher). If pitch limited condi tions are encountered a higher climb airspeed may be used to achieve the required takeoff path without exceeding the pitch limit.

(c) For engine - out operation, the system should provide commands that lead the aeroplane to smoothly acquire a pitch attitude that results in capture and tracking of the following reference speeds: — V , for engine failure at or below V . This speed should be attained by 2 2 the time the aeroplane has reached 11m (35 ft) altitude.

— Airspeed at engine failure, for failures between V and V + X.

2 2 — V + X, for failures at or above V + X. Alternatively, the airspeed at 2 2 engine failure may be used, provided it has been shown that the minimum takeoff climb gradient can still be achieved at that speed.

If implemented, the lateral element of the takeoff mode should maintain runway heading/track or wings level after lift - off and a separate lateral mode annunciation should be provided.

11.3.2 Go - Around Mode The vertical element of the FGS Go - around mode should initially rotate the aeroplane, or pro vide guidance to rotate the aeroplane, to arrest the rate of descent. The autothrust function, if installed, should increase thrust and either, maintain thrust to specific thrust limits, or maintain thrust for an adequate, safe climb.

The FGS should acquir e and maintain a safe speed during climb out and aeroplane configuration changes. Typically, a safe speed for go - around climb is V , but a different speed may be found safe for windshear recoveries (see FAA Advisory Circular AC 25 - 12). The lateral element of the FGS should maintain heading/track or wings level.

Powered by EASA eRules Page 958 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION The autothrust function should not exceed thrust limits (e.g., full go - around thrust or de - rated go - around thrust limits) nor reduce thrust, for winds, below the minimum value required for an adequat e, safe climb or reduce thrust lever position below a point that would cause a warning system to activate. The initial go - around manoeuvre may require a significant change in pitch attitude. It is acceptable to reduce thrust to lower the pitch attitude for comfort of the occupants when a safe climb gradient has been established. It should be possible for the pilot to re - select the full thrust value if needed.

The go - around mode should engage even if the MSP altitude is at or below the go - around initiation p oint. The aeroplane should climb until another vertical mode is selected or the MSP altitude is adjusted to an altitude above the present aircraft altitude.

The FGS design should address all engine and engine - out operation. The design should consider an en gine failure resulting in a go - around, and the engine failure occurring during an all engine go - around.

Characteristics of the go - around mode and resulting flight path should be consistent with manually flown go - around.

11.3.3 Approach Mode In the Approach mode, the FGS should capture and track a final approach lateral and vertical path (if applicable) from a navigation or landing system (e.g., ILS, MLS, GLS, RNP).

The FGS should annunciate all operationally relevant approach mode annunciations. Mo des that are armed, waiting for capture criteria to be satisfied, should be indicated - in addition to the active pre - capture mode. A positive indication of the capture of the previously armed mode should be provided.

The FGS may have sub - modes that become active without additional crew selection. An assessment of the significance of these sub - mode transitions to the flight crew should be made. If assessed to be significant (e.g., Flare), positive annunciation of the transition should be provided.

Glideslop e capture mode engagement may occur prior to localizer capture.

However, it is the flight crew’s responsibility to ensure proper safe obstacle/terrain clearance when following vertical guidance when the aeroplane is not established on the final lateral pa th.

Additional guidance and criteria is contained in CS - AWO.

11.4 Autothrust Modes This section discusses modes that are implemented in many flight guidance systems that are used primarily for controlling the engines on the aeroplane. The criterion identif ied reflects operational experience gained from the use of these modes.

11.4.1 Thrust Mode In the Thrust mode, the FGS should command the autothrust function to achieve a selected target thrust value.

Powered by EASA eRules Page 959 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 11.4.2 Speed Mode In the Speed mode, the FGS should command the autothrust function to acquire and maintain the selected target speed value - assuming that the selected speed is within the speed range of the normal flight envelope. The autothrust system may fly a higher airspeed than the selected tar get speed during takeoff, or during approach when operating in winds or turbulent conditions.

11.4.3 Retard Mode If such a mode is installed on a specific aircraft, it should work in a similar manner for both automatic and manual landings, when the autothr ust function is engaged.

11.5 Special Considerations for VNAV Approach Operations related to selecting a Target Altitude For approach operations, the FGS vertical modes should allow the pilot to set the target altitude to a missed approach value prior to c apturing the final approach segment. This should be possible for capturing from both above and below the final approach segment.

For VNAV Path operations, it should be possible to define a descent path to the final approach fix and another path from the fi nal approach fix to the runway with the target altitude set for the missed approach altitude. Appropriate targets and descent points should be identified by the FMS.

11.6 Control Wheel Steering (Control Steering through the Autopilot) In the Control Wheel Steering (CWS) mode, the FGS allows the flight crew to manoeuvre the aeroplane through the autopilot. This has implications for control harmony, stability, and crew awareness that need to be thoroughly addressed.

If provided, a CWS mode should meet the fol lowing requirements: (a) It should be possible for the pilot to manoeuvre the aeroplane using the normal flight controls with the CWS mode engaged and to achieve the maximum available control surface deflection without using forces so high that the control lability specifications of CS 25.143 (d) are not met.

(b) The maximum bank and pitch attitudes that can be achieved without overpowering the automatic pilot should be limited to those necessary for the normal operation of the aeroplane.

NOTE: Typically 35 degrees in roll and +20 degrees to - 10 degrees in pitch (c) It should be possible to perform all normal manoeuvres smoothly and accurately without nuisance oscillation. It should be possible also to counter all normal changes of trim due to ch ange of configuration or power, within the range of flight conditions in which control wheel steering may be used, without encountering excessive discontinuities in control force which might adversely affect the flight path.

(d) The stall and stall recover y characteristics of the aeroplane should remain acceptable. It should be assumed that recovery is made with CWS in use unless automatic disengagement of the automatic pilot is provided.

(e) In showing compliance with CS 25.143 (g) , account should be taken of such adjustments to trim as may be carried out by the automatic pilot in the course of manoeuvres that can reasonably be expected. Some alleviation may be acceptable Powered by EASA eRules Page 960 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION in the case of unusually prolonged manoeuvres, provided that the reduced control force s would not be hazardous.

(f) If the use of this mode for takeoff and landing is to be permitted, it should be shown that: i) Sufficient control, both in amplitude and rate is available without encountering force discontinuities; ii) Reasonable mishandling is not hazardous (e.g., engaging the automatic pilot while the elevators or ailerons are held in an out - of - trim position); iii) Runaway rates and control forces are such that the pilot can readily overpower the automatic pilot with no significant deviatio n in flight path; and iv) Any lag in aircraft response induced by the CWS mode is acceptable for the intended manoeuvre.

(g) It should not be possible to revert to the CWS mode by applying an input to the control column or wheel unless the autopilot is in a capture mode (e.g., altitude capture, localizer capture). When the force is released, the autopilot should return to the previously engaged capture mode or to the track mode.

NOTE: CWS, if it is provided, is considered to be an autopilot mode, as it is a specific function of the FGS. However, during CWS operation, it is the pilot and not the autopilot that is in control of the aircraft. Operationally, CWS is identical to the pilot flying the aeroplane during manual flight. In both cases, it is the pilot who is in actual control of the flight path and speed of the aeroplane.

The only difference is the mechanization of how the actual flight control surfaces are moved. No “automatic” FGS commands are involved during CWS operation. Therefore, sections in this AMC such as those which discuss Speed Protection and performance objectives should be applied to only those autopilot modes with which the FGS is in control of the flight path of the aeroplane and should not be applied to CWS.

NOTE: The terminology “Contr ol Wheel Steering” is currently used by industry to describe several different types of systems. This section is meant to apply only toward those systems that are implemented in a manner as described above. For comparison, several other functions that are similar in nature, but functionally very different, to CWS are described below. This section does not apply to functions of these types.

— Touch Control Steering (TCS) is a function that is available on many business and commuter aircraft. With TCS, a pilot is able to physically disengage the autopilot servos from the flight control system, usually by pushing and holding a button on the control wheel, without causing the autopilot system itself to disengage or lose its currently selected modes. The pilot may then manoeuvre the aeroplane as desired using the aircraft’s flight control system (i.e., the autopilot servos are not part of the control loop). The pilot is then able to reconnect the autopilot servos to the flight control system by releasing the TCS but ton. Using the new orientation of the aircraft as a basis, the autopilot will then reassume control the aeroplane using the same mode selections as were present before the selection of TCS. This type of system on some aircraft is also sometimes referred to as Control Wheel Steering.

Powered by EASA eRules Page 961 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION — Also different from CWS is what is referred to as a “supervisory override” of an engaged autopilot. With this function, a pilot is able to physically overpower an engaged autopilot servo by applying force to the flight deck cont rols. With a supervisory override, the autopilot does not automatically disengage due to the pilot input. This allows the pilot to position the aeroplane as desired using the flight deck controls without first disengaging the autopilot. When the pilot rele ases the controls, the autopilot reassumes control of the aeroplane using the same mode selections as were present before the supervisory override.

— The descriptions of TCS and supervisory override are intended to be generic.

Specific implementations on var ious aircraft may vary in some aspects.

11.7 Special Considerations for the Integration of Fly - By - Wire Flight Control Systems and FGS Speed protection features may be implemented in the fly - by - wire flight control system.

However, if speed protection is als o implemented within the FGS, it should be compatible with the envelope protection features of the fly - by - wire flight control system. The FGS speed protection (normal flight envelope) should operate to or within the limits of the flight control system (lim it flight envelope).

Information should be provided to the flight crew about implications on the FGS following degradation of the fly - by - wire flight control systems.

12 FLIGHT GUIDANCE SYSTEM INTEGRATION Throughout the preceding sections of the document, flight guidance systems and functions have been considered as being separate and distinct from other systems and functions on the aircraft. It is recognized that in complex aircraft designs, the flight guidance functions are closely integrated wi th other avionics functions, and that the physical integration of these systems, may have a bearing on how aeroplane level safety is assessed. The following paragraphs provide guidance on the likely FGS system integration issues found in more complex aircr aft system designs, and the interfaces which should be considered within the bounds of demonstrating the intended function, performance and safety of the FGS.

12.1 System Integration Issues Integration of other aircraft systems with the FGS has the potent ial of reducing the independence of failure effects and partitioning between functions. This is particularly the case where hardware and software resources are shared by different systems and functions (e.g., aircraft data highway and Integrated Modular A vionics (IMA) architectures). In addition to considering the reliability and integrity aspects of the FGS as a separate system, it may be necessary to address the effects of FGS failures with respect to fault propagation, detection, and isolation within ot her systems. The overall effect on the aircraft of a combination of individual system failure conditions occurring as a result of a common or cascade failure, may be more severe than the individual system effect. For example, failure conditions classified under CS 25.1309 as Minor or Major by themselves may have Hazardous effects at the aircraft level, when considered in combination. With regard to isolation of failures, and particularly combination failures, the a bility of the alerting system to provide clear and unambiguous information to the flight crew, becomes of significant importance. See also Section 13, Safety Assessment.

Complex and highly integrated avionics issues present greater risk for development err or.

With non - traditional human - machine interfaces, there is also the potential for Powered by EASA eRules Page 962 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION operational flight crew errors. Moreover, integration of systems may result in a greater likelihood of undesirable and unintended effects.

Within the FGS, where credit is taken for shared resources or partitioning schemes, these should be justified and documented within the System Safety Analysis. When considering the functional failures of the system, where such partitioning schemes cannot be shown to provide the necessary isolation, possible combination failure modes should be taken into account. An example of this type of failure would be multi - axis active failures, where the control algorithms for more than one axis are hosted on a single processing element.

Further, the functional integration of control functions such as control surface trimming, yaw channel, and stability augmentation, while not strictly FGS, should be considered.

12.2 Functional Interfaces In its simplest form, the FGS may be considered as interfacing with sensors that provide the necessary inputs to enable computation of its various functions. Typically, these sensors will include air and inertial data, engine control, and navigation sensors such as ILS, VOR, and DME. In the case of engine control, a f eedback loop may also be provided.

The FGS may also be considered as providing inner loop closure to outer loop commands.

The most common interface is with the FMS, which provides targets for lateral and vertical navigation in the form of steering orders.

In demonstrating the intended function and performance of both the FGS and systems providing outer loop commands, the applicant needs to address potential inconsistencies between limits of the two (e.g., with basic FGS pitch and bank angle limits). Failure to address these points can result in discontinuities, mode switching, and reversions, leading to erroneous navigation and other possible safety issues (e.g., buffet margin at high altitude). Similar issues arise in the inner loop, across the functional i nterface between FGS and flight controls. In fly - by - wire aircraft, the loss of synchronization between the two can result in mode anomalies and autopilot disengagement.

The applicant should demonstrate the intended function and performance of the FGS acros s all possible functional interfaces. The alerting system should also be assessed to ensure that accurate and adequate information is provided to the flight crew when dealing with failures across functional interfaces.

13 SAFETY ASSESSMENT CS 25.1309 defines the basic safety specifications for airworthiness approval of aeroplane systems and AMC 25.1309 provides an acceptable means of demonstrating compliance with this rule. This section provides additional guidance and interpretive material for the application of CS 25.1309 to the approval of FGS.

A Safety Analysis document should be produced to identify the Failure Conditions, classify their hazard level according to the gui dance of AMC 25.1309 , and establish that the Failure Conditions occur with a probability corresponding to the hazard classification or are mitigated as intended. The safety assessment should include the rationale a nd coverage of the FGS protection and monitoring philosophies employed. The safety assessment should include an appropriate evaluation of each of the identified FGS Failure Conditions and an analysis of the exposure to common mode/cause or cascade failures in accordance with AMC 25.1309 .

Additionally, the safety assessment should include justification and description of any functional partitioning schemes employed to reduce the effect/likelihood of failures of integrated components or functions.

Powered by EASA eRules Page 963 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUM ENTS: INSTALLATION There may b e situations where the severity of the effect of a failure condition identified in the safety analysis needs to be confirmed. Laboratory, simulator or flight test, as appropriate, may accomplish the confirmation.

It is recommended that the Safety Analysis plan is coordinated with the regulatory authority early in the certification program.

13.1 FGS Failure Conditions One of the initial steps in establishing compliance with CS 25.1309 for a system is to identify the Failure Conditions that are associated with that system. The Failure Conditions are typically characterized by an undesired change in the intended function of the system. The Failure Condition statements should identify the impacted functionality, the effect on the aeroplane and/or its occupants, specify any considerations relating to phase of flight and identify any flight crew action, or other means of mitigation, that are relevant.

Functionality - the primary functions of a FGS may include: — automatic control of the aeroplane’s flight path utilizing the aeroplane’s aerodynamic control surfaces, — guidance provided to the flight crew to achieve a particular desired flight path or manoeuvre, through information presented on a h ead - down or head - up display system, and — control of the thrust applied to the aeroplane.

Dependent upon the functionality provided in a specific FGS, the failure conditions could potentially impact the following: — the control of the aeroplane in the pitch, r oll and directional axes, — the control of thrust, — the integrity and availability of guidance provided to the flight crew, — the structural integrity of the aeroplane, — the ability of the flight crew to cope with adverse operating conditions, — the flight crew’s performance and workload, — the safety of the occupants of the aeroplane.

NOTE: The safety assessment of a FGS for use in supporting takeoff, approach and landing operations in low visibility conditions is further addressed in CS - AWO.

13.2 Type and Severity of Failure Conditions The type of the FGS Failure Conditions will depend, to a large extent, upon the architecture, design philosophy and implementation of the system. Types of Failure Conditions can include: — Loss of function – where a control or display element no longer provides control or guidance — Malfunction – where a control or display element performs in an inappropriate manner which can include the following sub - types: Powered by EASA eRules Page 964 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION a) Hardover – the control or display goes to full displacement in a brief period of time – the resultant effect on the flight path and occupants of the aeroplane are the primary concern.

b) Slowover - the control or display moves away from the correct control or display value over a relatively long period of time – the potentia l delay in recognizing the situation and the effect on the flight path are the primary concern.

c) Oscillatory - the control or display is replaced or augmented by an oscillatory element – there may be implications on structural integrity and occupant well being.

Failure Conditions can become apparent due to failures in sensors, primary FGS elements (e.g., autopilot, flight director, HUD), control and display elements (e.g., servos, primary flight displays), interfacing systems or basic services (e.g., elec trical and hydraulic power).

The severity of the FGS Failure Conditions and their associated classifications will frequently depend on the phase of flight, aeroplane configuration and the type of operation being conducted. The effect of any control system variability (e.g., tolerances and rigging) on Failure Condition should be considered. The severity of the Failure Conditions can also be mitigated by various design strategies (see Section 13.3).

Appendix A presents some considerations for use when assessi ng the type and severity of condition that results from functional failures. The classifications of Failure Conditions that have been identified on previous aeroplane certification programs are identified.

The classifications of Failure Conditions should be agreed with the authority during the CS 25.1309 safety assessment process.

With exception of the Catastrophic failure condition, the classification of failure conditions leading to the imposition of airframe loa ds should be assessed in accordance with CS 25.302 . This requires that the structure be able to tolerate the limit load multiplied by a factor of safety associated with the probability of occurrence of the failure mode. The assessment needs to take into account loads occurring during the active malfunction, recovery or continuation of the flight with the system in the failed state.

Complex integrated systems may require that the total effect resulting from single fa ilure be assessed. For example, some failures may result in a number of Failure Conditions occur which, if assessed individually may be considered a Major effects, but when considered in combination may be Hazardous. Special consideration concerning comple x integration of systems can be found in Section 12, Flight Guidance System Integration.

13.3 Failure Condition – Mitigation The propagation of potential Failure Conditions to their full effect may be nullified or mitigated by a number of methods. These me thods could include, but are not limited to, the following: — failure detection and monitoring, — fault isolation and reconfiguration, — redundancy, — authority limiting, and — flight crew action to intervene.

Powered by EASA eRules Page 965 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Means to assure continued performance of any system design mitigation methods should be identified. The mitigation methods should be described in the Safety Analysis/Assessment document or be available by reference to another document (e.g., a System Description document).

The design of typical FGS a llows for the de - selection of control and guidance elements.

The long - term effects on occupants and any structural implication of oscillatory failures can be mitigated by de - selection.

13.4 Validation of Failure Conditions The method of validating of Fail ure Conditions will depend on the effect of the condition, assumptions made and any associated risk. The severity of some Failure Conditions may be obvious and other conditions may be somewhat subjective. If flight crew action is used to mitigate the propa gation of the effect of a Failure Condition, the information available to the flight crew to initiate appropriate action (e.g., motion, alerts, and displays) and the assumed flight crew response should be identified. It is recommended that there be early c oordination with the regulatory authority to identify any program necessary to validate any of these assumptions.

The validation options for Failure Conditions include: — Analysis — Laboratory Testing — Simulation — Flight Test It is anticipated that the majority of Failure Condition can be validated by analysis to support the probability aspect of the CS 25.1309 assessment. The analysis should take account of architectural strategies (e. g., redundant channels, high integrity components, rate limit/magnitude limiting, etc.).

It may be necessary to substantiate the severity of a Failure Condition effect by ground simulation or flight test. This is particularly true where pilot recognition o f the failure condition requires justification or if there is some variability in the response of the - 7 aeroplane. Failure Conditions that are projected to be less probable than 10 per flight hour, independent of effect severity, need not be demonstrated i n flight - test.

Section 14 – Compliance Demonstration using Flight Test and Simulation - provides guidance on the assessment of ‘traditional’ Failure Conditions. New and novel functionality may require additional assessment methods to be agreed with the aut hority.

13.5 Specific Considerations The following paragraphs identify specific considerations that should be given to potential Failure Conditions for various phases of flight.

13.5.1 FGS Function during Ground Operations The potential hazard that may res ult due to inappropriate autopilot, autothrust or other system control action during maintenance operations, while the aeroplane is parked at the gate or during taxi operations should be assessed. System interlocks or crew or maintenance procedures and pla cards may mitigate these hazards.

Powered by EASA eRules Page 966 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 13.5.2 FGS Operations in close proximity to the ground The response of the aeroplane to failures in an automatic flight control system could have implications on the safety of operations when the aeroplane is close to th e ground. For the purpose of this advisory circular, close to the ground can be assumed to be less than 150 m (500 ft) above the lift - off point or touchdown zone or a runway. A specific safety assessment is required if approval is sought for automatic flig ht control operation where the autopilot is engaged, or remains engaged in close proximity to the ground.

NOTE: Operation in low visibility conditions requires additional consideration and CS AWO Subparts should be used for those additional considerations .

13.5.2.1 Takeoff If approval is sought for engagement of the autopilot below 150 m (500 ft) after lift - off, an assessment of the effect of any significant FGS failure conditions on the net vertical flight path, the speed control and the bank angle of the aeroplane should be conducted. An Autopilot Minimum Engage Altitude after Takeoff will be established based, in part, on the characteristics of the aeroplane in response to the failures and the acceptability of flight crew recognition of the condition.

A pilot assessment of certain Failure Conditions may be required (see Section 14 – Compliance Demonstration using Flight Test and Simulation). The minimum engagement altitude/height after takeoff based upon the assessment should be provided in the AFM.

13.5. 2.1.1 Vertical Axis Assessment The operational objective during the initial climb is to maintain an appropriate climb profile to assure obstacle clearance and to maintain an appropriate speed profile during climbout (refer to Section 11 , Characteristics of Specific Modes).

FGS Failure Conditions should be assessed for the potential for: — a significant reduction in the net takeoff flight path below 150 m (500 ft), — a significant increase in pitch attitude that results in the aeroplane speed dropping to unacceptable values.

- 7 Failures Conditions with a probability greater than 1 x 10 per flight hour that have an effect requiring the pilot to intervene should be evaluated for a potential AFM limitations or procedures.

13.5.2 .1.2 Lateral Axis Assessment The operational objective during the initial climb is to maintain an appropriate heading or track to provide separation from potential adjacent runway operations.

FGS failure conditions should be assessed for the potential for producing a bank angle that results in significant deviation from the runway track or intended track.

Powered by EASA eRules Page 967 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION - 7 Failures Conditions with a probability greater than 1 x 10 per flight hour that have an effect requiring pilot action should be evaluated for a potential AFM limitations or procedures.

13.5.2.2 Approach If the autopilot is to remain engaged below 150 m (500 ft) above the touchdown zone during approach, an assessment of the effect of any significant FGS failure conditions on the net vertical flight path, the speed control and the bank angle of the aeroplane should be conducted. The lowest point on the approach appropriate for the use of the autopilot will be established based on the characteristics of the aeroplane in response to the failure c onditions and the acceptability of flight crew recognition of the condition.

A number of approach operations may be conducted using automatic flight control. These can include, but not be limited to, the following: — ILS, MLS, GLS, — RNAV (e.g., LNAV and VNAV) , — NAV (e.g., VOR, LOC, Backcourse), — Open loop flight path management (e.g., Vertical Speed, Flight Path Angle, Track or Heading Select).

Some operations may be conducted with a single autopilot channel engaged and some operations may be conducted with mult iple autopilots engaged.

The engagement of multiple autopilots may have the effect of mitigating the effect of certain failure conditions. The effectiveness of these mitigation methods should be established.

The type of operation and the prevailing visibil ity conditions will determine the decision altitude/decision height (DA(H)), or minimum descent altitude or height (MDA(H)), for a particular flight operation. The operation may continue using automatic flight control if the visual requirements are met.

Th e lowest altitude at which the autopilot should remain engaged could vary with the type of operation being conducted. The resultant flight path deviation from any significant failure condition would impact the autopilot minimum operational use height.

Asse ssment of certain failure conditions may be required (see Section 14 – Compliance Demonstration using Flight Test and Simulation). The minimum use height for approach should be provided in the AFM.

13.5.2.2.1 Vertical Axis Assessment The operational object ive during the approach is to maintain an appropriate descent profile to assure obstacle clearance and to maintain an appropriate speed profile.

FGS Failure Conditions should be assessed for the potential for: — a significant reduction in the approach flight path when below 150 m (500 ft) above touchdown, Powered by EASA eRules Page 968 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION — a significant increase in pitch attitude that results in the aeroplane speed dropping to unacceptable values.

- 7 Failures Conditions with a probability greater than 1 x 10 per flight hour that have an effect requiring pilot action should be evaluated for potential AFM limitations or procedures.

13.5.2.2.2 Lateral Axis Assessment The operational objective during the approach is to maintain an appropriate track to provide alignment with the runway centreline, or intended flight path, to support the landing.

FGS Failure Conditions should be assessed for the potential for producing a bank angle that results in significant deviation from the runway track or intended track.

- 7 Failures with a probability greater than 1 x 10 per flight hour that have an effect requiring pilot action should be evaluated for appropriate AFM limitations or procedures.

13.5.3 Cruise Operations The primary concern during cruise operations is the effect the aeroplane response to Failure Conditions may have on the occupants. At a minimum, the accelerations and attitude resulting from any condition should be assessed. The mitigation of the effect of a Failure Condition by the flight crew may not be as immediate as during takeoff and landing operations. Section 14 provides guidance and considerations for this phase of flight.

13.5.4 Asymmetric Thrust during Autothrust Operation During autothrust operation, it is possible that a failure (e.g., engine failure, throttle lever jam, or thr ust control cable jam) could result in significant asymmetric thrust failure condition that may be aggravated by the continued use of the autothrust system. Because the FGS could potentially compensate for the asymmetric condition with roll (and possibly y aw) control, the pilot may not immediately be aware of the developing situation. Therefore, an alert should be considered as a means of mitigation to draw the pilot’s attention to an asymmetric thrust condition during FGS operation.

13.6 Failure to Disenga ge the FGS The requirement for quick disengagement for the autopilot and autothrust functions is intended to provide a routine and intuitive means for the flight crew to quickly disengage those functions. The implication of failures that preclude the quick disengagement from functioning should be assessed consistent with the guidelines of AMC 25.1309 .

The CS 25.1309 assessment should consider the effects of failure to disengage the autopilot and/or autothrust functions during the approach using the quick disengagement controls. The feasibility of the use of the alternative means of disengagement defined in Section 8. 1.2.3 should be assessed.

If the assessment asserts that the aircraft can be landed manually with the autopilot and/or autothrust engaged, this should be demonstrated in Flight Test.

Powered by EASA eRules Page 969 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 14 COMPLIANCE DEMONSTRATION USING FLIGHT TEST AND SIMULATION The valida tion of the performance and integrity aspects FGS operation will typically be accomplished by a combination of the following methods: — Analysis — Laboratory Test — Simulation — Flight Test The criteria to be used for establishing compliance with CS 25.1301 , 25.1309 and 25.1329 may be found in Sections 8, 9, 10, 11, 12, and 13 of this document. The type and extent of the various validation m ethods may vary dependent upon the FGS functionality, certification considerations, the applicant’s facilities, and various practicality and economic constraints.

This section focuses on compliance demonstration by flight test or simulation with flight cre w participation. The section includes the evaluation necessary to confirm acceptable performance of intended functions, including the human - machine interface, and the acceptability of failure scenarios. The specific requirements for flight or simulator eva luation will consider the specifics of the applicant’s design, the supporting engineering analysis and the scope and depth of the applicants laboratory testing.

The certification flight test program should investigate representative phases of flight and ai rcraft configurations used by the FGS. The program should evaluate all of the FGS modes throughout appropriate manoeuvres and representative environmental conditions, including turbulence. Combinations of FGS elements (e.g., autopilot engaged and autothrus t disengaged) should be considered. Certain failure scenarios may require flight or simulator demonstration.

The aeroplane should contain sufficient instrumentation such that the parameters appropriate to the test are recorded (e.g. normal acceleration, ai rspeed, height, pitch and roll angles, autopilot engagement state). The flight test instrumentation should not affect the behaviour of the autopilot or any other system.

Figure 14 - 1 depicts the relationship between this section and the rest of the document .

An important part of the pilot in the loop evaluation is validation of human factors. A thorough evaluation of the human - machine interface is required to ensure safe, effective, and consistent FGS operation. Portions of this evaluation will be conducted during flight test. Representative simulators can be used to accomplish the evaluation of human factors and workload studies.

The level and fidelity of the simulator used should be commensurate with the certification credit being sought and its use should be agreed with the regulatory authority.

If the FGS includes takeoff and/or approach modes, the criteria in CS - AWO Subparts 1, 2, 3 and 4 should be considered for applicability in developing the overall and integrated flight test and simulation requirement s. AMC No.2 to CS 25.1329 contains procedures that may be used to show compliance.

Powered by EASA eRules Page 970 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Figure 14 - 1 14.1 Performance Demonstration (Fault Free) – CS 25.1301 The Certification Plan should identify the specific functionality provided by the FGS. The flight test and/or simulator program will typically assess this functionality under representative operational con ditions including applicable aeroplane configurations and a representative range of aeroplane weight, centre of gravity and operational envelope.

The performance of the FGS system in each of its guidance and control modes should be evaluated. The acceptab ility of the performance of the FGS may be based on test pilot assessment, taking into account the experience acquired from similar equipment capabilities, and the general behaviour of the aeroplane. The level of acceptable performance may vary according t o aeroplane type and model. The FGS should be evaluated for its low and high manoeuvring capability. AMC No.2 to CS 25.1329 may provide additional information on FGS test procedures.

The acceptability of mode contr ols and annunciations, any associated alerts and general compatibility with cockpit displays should be evaluated. The FGS should be free from unexpected disengagement and confusion resulting from changing FGS modes.

Additional considerations relating to t he assessment of Human Factors is provided in Section 14.5.

Powered by EASA eRules Page 971 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 14.1.1 Normal Performance Normal performance is considered to be performance during operations well within the aeroplane’s flight envelope and with routine atmospheric and environmental conditions . Normal performance should be demonstrated over a range of conditions that represent typical conditions experienced in operational use.

The FGS should be evaluated to determine the acceptability of the following characteristics: — The stability and trackin g of automatic control elements — The flyability and tracking of guidance elements — The acquisition of flight paths for capture modes — Consistency of integration of modes (Section 12) Performance should be assessed in the presence of errors that can reasonably be expected in operation (e.g., mis - selection of approach speed).

14.1.2 Rare Normal Performance Rare normal performance is considered to be performance of the system under conditions that are experienced infrequently by the aeroplane during operational u se. These conditions may be due to significant environmental conditions (e.g., significant wind, turbulence, etc.) or due to non - routine operating conditions (e.g., out - of - trim due to fuel imbalance or under certain ferry configurations, or extremes of wei ght and c.g. combinations). Specific rare normal conditions are discussed below The test program should assess the FGS performance in more challenging operational environments e.g., winds, wind gradients, various levels of turbulence.

Rare environmental co nditions may require the FGS to operate at the limits of its capabilities. The intent of the evaluation is to assess the performance of the FGS under more demanding conditions that may be experienced infrequently in - service.

Due to the severity of some env ironmental conditions, it is not recommended, or required, that the FGS flight evaluations include demonstration in severe and extreme turbulence, or include flights into a microburst. These conditions are more appropriately addressed by simulator evaluati on.

The FGS should be evaluated to determine the acceptability of the following characteristics: — The stability of automatic control elements and ability to resume tracking following any upset — The flyability of guidance elements and ability to resume tracking following any upset — The acceptability of mode transitions and overall cockpit system integration.

Powered by EASA eRules Page 972 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 14.1.2.1 Icing Considerations The implications of continued use of the automatic flight control elements of the FGS in icing conditions should be a ssessed. Ice accumulation on the aeroplane wings and surfaces can progressively change the aerodynamic characteristics and stability of the aeroplane. Even though the FGS may perform safely under these conditions, its continued use may mask this change whi ch in turn can lead to pilot handling difficulties and potential loss of control, should the autopilot become disengaged (either automatically or manually).

A test program should assess the potential vulnerability of the FGS to icing conditions by evaluati ng autopilot performance during ice shape tests or during natural icing tests. Sufficient autopilot testing should be conducted to ensure that the autopilot's performance is acceptable.

In general, it is not necessary to conduct an autopilot evaluation tha t encompasses all weights, centre of gravity positions (including lateral asymmetry), altitudes and deceleration device configurations. However, if the autopilot performance with ice accretion shows a significant difference from the non - contaminated aeropl ane, or testing indicates marginal performance, additional tests may be necessary.

FGS performance and safety in icing conditions should be demonstrated by flight test and/or simulation tests, supported by analysis where necessary.

If significant autopilot inputs are required to compensate for the icing conditions, then the acceptability of the indication of a significant out of trim condition should be made and the subsequent response of the aeroplane when the autopilot disengages (man ual or automatic) should be determined (Refer to Sections 8.1.2 and 9.3.3).

If the aeroplane is configured with a de - icing system, the autopilot should demonstrate satisfactory performance during the shedding of ice from the aeroplane.

Where degradation is noted which is not significant enough to require changes to the autopilot system or to de - icing/anti - icing systems, appropriate limitations and procedures should be established and presented in the AFM.

14.1.2. 2 Windshear If the FGS provides windshear esc ape guidance, performance demonstration requirements should be conducted consistent with FAA AC 25 - 12.

14.1.2.3 Indication and Response to an Out of Trim Condition An assessment should be performed to determine the acceptability of the out of trim annuncia tion and subsequent response to disengagement (Refer to Section 9.3.3).

14.1.3 Specific Performance Conditions The following paragraphs identify specific performance conditions requiring evaluation by flight test and/or simulation.

14.1.3.1 Low Speed Prote ction Powered by EASA eRules Page 973 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION The FGS should be assessed for the acceptability of the low speed protection performance under the following conditions: — High Altitude Cruise with a simulated engine failure.

— Climb to Altitude Capture at Low Altitude with a simulated engine failure d uring capture — Vertical Speed with insufficient climb power — Approach with speed abuse 14.1.3.2 High - speed Protection The FGS should be assessed for the acceptability of the high - speed protection performance under the following conditions: — High altitude leve l flight with Autothrust function — High altitude level flight without Autothrust function — High altitude descending flight with Autothrust function 14.1.3.3 Go - around The objective of the go - around mode (refer to Section 11.3.2) is to quickly change the flig ht path of the aeroplane from approach to landing to a safe climbout trajectory. The mode has specific utility in low visibility conditions when operations are predicated on a decision altitude/height (DA/H) and a go - around is necessary if visual reference s are not acquired at the DA/H.

Therefore, the assessment of the go - around mode may be conducted in conjunction with the evaluation of the FGS to support low visibility operations, using additional criteria contained in FAA AC 120 - 28D, AC 120 - 29A and CS AW O Subparts 2 or 3.

The flight evaluation should be conducted to assess the rotation characteristics of the aeroplane and the performance of the aeroplane in acquiring and maintaining a safe flight path. The acceptability of the operation if contact is made with the runway during the missed approach or balked landing should be established.

A demonstration program should be established that confirms acceptable operation when the following factors are considered: — Aeroplane weight and CG — Various landing configurations — Use of manual thrust or autothrust — Consequences of thrust de - rates with selection of Go around mode — An Engine Failure at the initiation of Go - around — An Engine failure during GA – after go - around power is reached — Initiation altitude (e.g., in ground effect or not, during flare) The following characteristics should be evaluated: — The pitch response of the aeroplane during the initial transition — Speed performance during aeroplane reconfiguration and climbout Powered by EASA eRules Page 974 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTAL LATION — Integrated autopilot and autothrust operation — Transition to Missed Approach Altitude — Lateral performance during an engine failure Where height loss during a go - around manoeuvre is significant or is required to support specific operational approval, demonstrated values for various initiation heights should be included in the AFM.

14.1.3.4 Steep Approach (Special Authorization) Typical approach operations include glidepath angles between 2.5 and 3.5 degrees. Application for approval to conduct operations on glidepath angles of greate r than 3.5 degrees requires additional evaluation. For such an approval, the FGS flight test and simulator demonstration should include: — Approach path capture, tracking and speed control — Recovery of the system from abuse cases e.g. glidepath angle and spee d — Assessment of autopilot disengagement transient — Demonstration of go - around mode from a Steep Approach For autopilot use at approach angles greater than 4.5 degrees the applicant is recommended to contact EASA for the applicable Special Condition criteria 14.1.4 Flight Director / HUD Considerations The guidance aspect of an FGS may be provided by a head down Flight Director (F/D) or by a Head - Up Display (HUD) system. F/D’s can utilize various guidance cues (e.g., cross pointer, single cue, flight path vect or, etc.) whilst HUD’s typically use a symbology linked to a flight path vector. The guidance elements may have a fixed aeroplane reference (e.g., the traditional F/D) or may use a moving reference such as a flight path vector. Various new display mediums are evolving (e.g., EVS and SVS) that may integrate guidance elements with situational elements.

The flight test or simulator program should demonstrate that the F/D or HUD guidance elements provide smooth, accurate and damped guidance in all applicable mo des, so as to achieve satisfactory control task performance without pilot compensation or excessive workload.

The flight director guidance should provide adequate performance for operations with: — stability augmentation off — alternate fly - by - wire control modes (e.g., direct law), if any — an engine inoperative.

Some pilot compensation may be acceptable for these conditions Flight directors designed to work with a non - stationary tracking reference (such as a flight path angle or flight path vector whi ch are commonly used with HUD guidance) should be evaluated in conditions which bring these guidance symbols to the field of view limits of the display. Crosswinds, and certain combinations of airspeed, gross weight, centre of gravity and flap/slat/gear co nfigurations might cause such conditions. At these limits, the dynamics of the guidance response to Powered by EASA eRules Page 975 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION pilot control inputs can differ with potentially adverse affects on tracking performance, pilot compensation and workload.

Movement of the flight director a nd its tracking reference should also be demonstrated not to interfere with primary instrument references throughout their range of motion. The pilot’s ability to interpret the guidance and essential flight information should not be adversely affected by t he movement dynamics or range of motion.

14.1.4.1 Specific Demonstrations for Head - Up Display These demonstrations are intended to show compliance with the following paragraphs of this AMC: — Section 8.2 Flight Director Engagement/Disengagement and Indicatio ns, with its subparagraphs — Section 9.2 Flight Guidance Mode Selection, Annunciation and Indication — Section 9.4 FGS Considerations for Head - Up Displays (HUD) — Section 10.1 Normal Performance (specifically criteria for flight director guidance) When the pilot flying (PF) is using the HUD, the HUD is where the pilot is looking for the basic flight information and the pilot is less likely to be scanning the head down instruments. Therefore: — It should be demonstrated that the location and presentation of the HUD information (e.g., guidance, flight information and alerts/annunciations) does not distract the pilot or obscure the pilot’s outside view. For example, the pilot should be able to track the guidance to the runway without having the view of runway reference s or hazards along the flight path obscured by the HUD symbology.

— It should be demonstrated that pilot awareness of primary flight information, annunciations and alerts is satisfactory when using any HUD display mode. Some display modes that are designed t o minimize “clutter” could degrade pilot awareness of essential information. For example, a “digital - only” display mode may not provide sufficient speed and altitude awareness during high - speed descents.

— It should be demonstrated that the pilot could posit ively detect cases when conformal symbology is field of view limited.

— Approach mode guidance, if provided, should be satisfactory throughout the intended range of conditions, including at the minimum approach speed and maximum crosswind, with expected gust components, for which approval is sought.

— It should be demonstrated that visual cautions and warnings associated with the flight guidance system can be immediately detected by the pilot flying while using the HUD.

— It should be demonstrated that the pilot flying can immediately respond to windshear warnings, ground proximity warnings, ACAS/TCAS warnings, and other warnings requiring immediate flight Powered by EASA eRules Page 976 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION control action, such as a go - around, while using the HUD without having to revert to a head down flight displ ay.

In certain phases of flight, it is important from a flight crew coordination standpoint that the pilot not flying (PNF) be aware of problems with the HUD used by the PF. Therefore it should also be demonstrated that the PNF could immediately be made aw are of any visual cautions and warnings associated with the HUD for applicable phases of flight.

If approach mode guidance is provided, satisfactory performance should be demonstrated throughout the intended range of operating conditions for which approval is sought e.g. at the minimum approach speed and maximum crosswind, with expected gust components.

If recovery guidance is provided, it should be demonstrated that the pilot could immediately detect and recover from unusual attitudes when using the HUD. S pecialized unusual attitude recovery symbology, if provided, should be shown to provide unequivocal indications of the attitude condition (e.g., sky/ground, pitch, roll, and horizon) and to correctly guide the pilot to the nearest horizon. The stroke prese ntation of flight information on a HUD may not be as inherently intuitive for recognition and recovery as the conventional head down attitude display (e.g., contrasting colour, area fill, shading vs. line strokes). The HUD display design needs to be able t o compensate for these differences to provide adequate pilot recognition and recovery cues.

14.1.4 .2 Simulator Demonstration for Head - Up Display (HUD) If a pilot - in - the - loop flight simulation is used for some demonstrations, then a high fidelity, engineeri ng quality facility is typically required. The level of simulator may vary with the functionality being provided and the types of operation being conducted. Factors for validation of the simulation for demonstration purposes include the following: — guidance and control system interfaces — motion base suitability — adequacy of stability derivative estimates used — adequacy of any simplification assumptions used for the equations of motion; — fidelity of flight controls and consequent simulated aircraft response to control inputs — fidelity of the simulation of aircraft performance — adequacy of flight deck instruments and displays — adequacy of simulator and display transient response to disturbances or failures (e.g., engine failure, auto - feather, electrical bus switching) — visual reference availability, fidelity, and delays — suitability of visibility restriction models such as appropriate calibration of visual references for the tests to be performed for day, night, and dusk conditions as necessary Powered by EASA eRules Page 977 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMEN T (CS - 25) INSTRUMENTS: INSTALLATION — fidelity of any other significant factor or limitation relevant to the validity of the simulation.

Adequate correlation of the simulator performance to flight test results should be made.

14.1.5 Flight Crew Override of the Flight Guidance System A flight evaluation s hould be conducted to demonstrate compliance with Section 8.4. The flight evaluation should consider the implication of system configuration for various flight phases and operations.

14.1.5.1 Autopilot Override Effect of flight crew override should be asse ssed by applying an input on the cockpit controller (control column, or equivalent) to each axis for which the FGS is designed to disengage, i.e. the pitch and roll yoke, or the rudder pedals (if applicable).

If the autopilot is designed such that it does not automatically disengage due to a pilot override, verify that no unsafe conditions are generated due to the override per Section 8.4. The evaluation should be repeated with progressively increasing rate of force application to assess FGS behaviour.

The effects of speed and altitude should be considered when conducting the evaluation.

If the design of the autopilot provides for multiple channel engagement for some phases of flight that results in a higher override force, these conditions should be evaluat ed.

14.1.5.2 Autothrust Override The capability of the flight crew to override the autothrust system should be conducted at various flight phases. The evaluation should include an override of the autothrust system with a single hand on the thrust levers wh ile maintaining control of the aeroplane using the opposite hand on the control wheel (or equivalent). This action should not result in an unsafe condition per Section 8.4, either during the override or after the pilot releases the thrust levers. If the au tothrust system automatically disengages due to the override, the alerts that accompany the disengagement should be assessed to ensure flight crew awareness.

14.1.5.3 Pitch Trim System Evaluation during an Autopilot Override The effect of flight crew overr ide during automatic control on the automatic trim systems should be conducted. The pilot should then apply an input to the pitch cockpit controller (i.e., control column or sidestick) below that which would cause the autopilot to disengage and verify that the automatic pitch trim system meets the intent in Section 8.4.

If the system design is such that the autopilot does not have an automatic disengagement on override feature, the pilot should initiate an intentional override for an extended period of time . The autopilot should then be disengaged, with the Quick Disconnect Button, and any transient response assessed in compliance with Section 8.4. The effectiveness and timeliness of any Alerts used to mitigate the effects of the override condition should be assessed during this evaluation.

Powered by EASA eRules Page 978 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 14.2 Failure Conditions Requiring Validation – CS 25.1309 The Safety Assessment process identified in Section 13 should identify any Failure Condition responses that would require pilot evaluation to assess the severity of the effect, the validity of any assumptions used for pilot recognition and mitigation. The classification of a Failure Condition can vary according to flight condition and may need to be confirmed by simulator or flight test.

This section provides guidance on the test criteria, including recognition considerations, for flight evaluation of these Failure Conditions. In addition, certain probable failures should be demonstrated to assess the performance of the FGS an d the adequacy of any applicable flight crew procedures.

AMC No. 2 to CS 25.1329 , Flight Testing of Flight Guidance Systems, provides guidance on test methods for particular types of Failure Condition that have bee n identified by the Safety Assessment.

14.2.1 Validation Elements The Safety Assessment described in Section 13 establishes the FGS Failure Condition for which appropriate testing should be undertaken. Assessment of Failure Conditions has four elements: — Failure Condition insertion — Pilot recognition of the effects of the Failure Condition — Pilot reaction time; i.e., the time between pilot recognition of the Failure Condition and initiation of the recovery — Pilot recovery 14.2.1.1 Failure Condition Failure Conditions of the autopilot including, where appropriate, multi - axis failures and automatic - trim failures, should be simulated such that when inserted represents the overall effect of each Failure Condition.

Where necessary, Flight Director Failure Conditions should be validated in accordance with the criteria for the respective phase of flight.

The flight conditions under which the failure condition is inser ted should be the most critical (e.g., centre of gravity, weight, flap setting, altitude, speed, power or thrust). If an autothrust system is installed, the tests should be performed with the autothrust system engaged or disengaged whichever is the more adverse case.

14.2.1.2 Pilot Reco gnition The pilot may detect a Failure Condition through aeroplane motion cues or by cockpit flight instruments and alerts. The specific recognition cues will vary with flight condition, phase of flight and crew duties.

a) Hardover – the recognition point should be that at which a pilot operating in non - visual conditions may be expected to recognize the need to take action. Recognition of the effect of the failure may be through the behaviour of the aeroplane (e.g., in the pitch axis by aircraft motion and associated normal acceleration cues and in the roll axis by excessive bank angle), or an appropriate alerting system.

Powered by EASA eRules Page 979 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Control column or wheel movements alone should not be used for recognition. The recognition time should not normally be less than 1 second . If a recognition time of less than 1 second is asserted, specific justification will be required (e.g. additional tests to ensure that the time is representative in the light of the cues available to the pilot).

b) Slowover – this type of Failure Condit ions is typically recognized by a path deviation indicated on primary flight instruments (e.g., CDI, altimeter and vertical speed indicator). It is important that the recognition criteria are agreed with the regulatory authority. The following identify ex amples of recognition criteria as a function of flight phase: — En - route cruise – recognition through the Altitude Alerting system can be assumed for vertical path deviation. The lateral motion of the aeroplane may go unrecognised for significant period of time unless a bank angle alerting system is installed.

— Climb and Descent – recognition through increasing/decreasing vertical speed and/or pitch or roll attitude or heading can be assumed.

— On an Approach with vertical path reference - A displacement recogn ition threshold should be identified and selected for testing that is appropriate for the display(s) and failure condition(s) to be assessed.

NOTE: (1) For an ILS or GLS approach in a significant wind gradient, a value of 1 dot is considered a reasonable v alue for crew recognition. In smooth atmospheric conditions with steady state tracking, with the vertical flight path typically maintained at less than a fraction of a needle width, a detection and recognition threshold even below 1/2 dot may be suitable.

(2) For RNAV systems, which do not use dots, some multiple of needle width, related to an established crew monitoring tolerance of normal performance may be appropriate (e.g., x needle widths of deviation on the VNAV scale).

(3) Credit may be taken for exc essive deviation alerts, if available.

— On an Approach without vertical path reference – criteria similar to the climb/descent condition can be assumed.

c) Oscillatory – it is assumed that oscillatory failures that have structural implications are addressed under CS 25.302 . It can be assumed that the flight crew will disengage the automatic control elements of the FGS that have any adverse oscillatory effect and will not follow any adverse oscillatory guidance. Howev er, if there are any elements of the FGS that can not be disconnected in the presents of an oscillatory Powered by EASA eRules Page 980 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Failure Condition, the long term effects on crew workload and the occupants will need to be evaluated.

14.2.1.3 Pilot Reaction Time The pilot reaction t ime is considered to be dependent upon the pilot attentiveness based upon the phase of flight and associated duties. The following assumptions are considered acceptable: (a) Climb, Cruise, Descent and Holding – Recovery action should not be initiated until three seconds after the recognition point (b) Manoeuvring Flight - Recovery action should not be initiated until 1 second after the recognition point (c) Approach - the demonstration of malfunctions should be consistent with operation in no n - visual conditions. The pilot can be assumed to be carefully monitoring the aeroplane performance and will respond rapidly once the malfunction has been recognized. A reaction time of 1 second between recognition point and initiation of recovery is appro priate for this phase of flight.

NOTE: (i) For the final phase of landing (e.g., below 25 m (80 ft)), the pilot can be assumed to react upon recognition without delay.

(ii) For phases of flight where the pilot is exercising manual control using control whe el steering, if implemented, the pilot can be assumed to commence recovery action at the recognition point.

14.2.1.4. Pilot Recovery Pilot recovery action should be commenced after the reaction time.

Following such delay the pilot should be able to return the aeroplane to its normal flight attitude under full manual control without engaging in any dangerous manoeuvres during recovery and without control forces exceeding the values given in CS 25.143 (d) . During the recovery the pilot may overpower the auto matic pilot or disengage it.

For the purpose of determining the minimum height at which the autopilot may be used during an approach, or for height loss assessments, a representative recovery appropriate to the aeroplane type and flight condition should be performed. This manoeuvre should not lead to an unsafe speed excursion to resume a normal flight path. An incremental normal acceleration in the order of 0.5 g is considered the maximum for this type of manoeuvre.

14.2.2 Takeoff The primary concern for t he takeoff phase of flight is the effect of the worst case Failure Condition, identified by the Safety Assessment, on the net flight of the aeroplane after takeoff and the aeroplane’s attitude and speed during climbout.

The effects should be evaluated in t he pitch up, pitch down and bank as applicable.

If the FGS provides on runway guidance for takeoff, the effect of the failures on that takeoff guidance should be assessed in accordance with CS AWO Subpart 4.

Powered by EASA eRules Page 981 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 14.2.3 Climb, Cruise, Descent and Holding Where the Safety Analysis identifies a Failure Condition requiring flight/simulator evaluation with pilot assessment, the height loss should be established in accordance with the method described in the flight test procedures – see AMC No.2 to CS 25.1329 , section 4.2.3.3.

14.2.4 Manoeuvring Where the Safety Analysis identifies a Failure Condition that has a dynamic effect on the roll control of the aeroplane, the Failure Condition should be introduced at the bank angle for normal operation. The bank angle should not exceed 60 degrees when the pilot recognition and recover times identified above are applied.

14.2.5 Approach A discussion of the operational considerations for approach operations is contained in Sectio n 14.3. This section identifies test criteria to support those considerations. The safety assessment process should identify the demonstration of specific Failure Conditions during the approach.

The fault demonstration process during approach should inclu de the four phases identified in Section 14.2.1. The Failure Condition should be inserted at a safe but representative height. The deviation profile should be identified and applied as indicated in the later sections.

14.2.5.1 Approach with Vertical Path R eference Approach with vertical path reference includes xLS and RNAV operations.

a) xLS (ILS, MLS, GLS) ILS and MLS operations are typically conducted on instrument approach procedures designed in accordance with United States TERPS or ICAO PANS - OPS criter ia, or equivalent. These criteria together with ICAO Annex 14 are generally intended to take into account obstacles beneath a reference obstacle identification surface.

It is expected that the same or equivalent criteria will be applied to GLS operations. Hence, in assessing the implication of the effect of failures during autopilot operations a reference 1:29 slope penetration boundary has been applied against the deviation profile to identify an appropriate altitude for continued autopilot operation.

The 1:29 slope has been found to provide an acceptable margin above obstacles on an approach.

The worst case Failure Condition identified by the Safety Assessment (see Section 13.4) should be demonstrated against the deviation profile criteria and a Minimum Us e Height (MUH) established (See AMC No.2 to CS 25.1329 , Section 4.2.3.2).

b) RNAV For RNAV coupled approach operations, a vertical flight path similar to an xLS flight path will be used (e.g., 3o path starting 15 m (50 ft) above the threshold). However, due to sensor characteristics it is assumed that RNAV operations will be conducted with a DA(H) or MDA(H) that is higher than an equivalent MUH on an xLS approach to Powered by EASA eRules Page 982 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION the same runway. Further, for this type of operat ion it should be noted that the MUH is always in the visual segment of the approach, where it is assumed that the failure recognition and recovery are conducted with the pilot having established outside visual reference.

In order to derive only one MUH value for simplicity of use, it is assumed that the effects of failure on the autopilot in RNAV operation are no worse than for the xLS operation, and no further determination or demonstration is required. However, the applicant should show that due accoun t has be taken in the Safety Assessment of the differences between the RNAV and xLS inputs to the autopilot (e.g.

barometric altitude input, FMS position and guidance commands, and their failure effects). If these effects can be bounded or otherwise reconc iled, then the xLS demonstrated MUH might also be considered applicable to RNAV operations.

If these effects cannot be bounded or accounted for within those for the xLS operation, the MUH should be determined in accordance with an Approach Without Vertical Path Reference – see below.

14.2.5.2 Approach Without Vertical Path Reference For an approach without vertical path reference (e.g., VOR, NDB, localizer only) the FGS mode of operation is typically vertical speed/flight path angle (i.e. a cruise mode). Th e worst case Failure Condition for this type of mode should be demonstrated in the approach configuration, and an appropriate height loss established in accordance with the method described in AMC No.2 to CS 25.132 9 , Section 4.2.3.3.

14.2.5.3 Steep Approach In support of an approval to use the FGS on glidepath angles of greater than 3.5 degrees (see Section 14.1.3.4) an assessment should be made of the effects of failure conditions for this type of operation. For th e use of autopilot, an appropriate MUH should be established in accordance with the deviation profile method described in Section 14.2.5. For this assessment, the obstacle plane associated with a nominal 3 - degree glidepath angle (1:29 slope) should be adju sted according to the maximum approach angle, for which approval is sought.

14.2.6 Specific Conditions The following are failure conditions that should be considered as part of the FGS evaluation program: — Engine Failure during approach - continue approach to DA(H)/MDA(H) — The effect of potential fuel imbalance — Aeroplane System Failures (as necessary – requiring specific flight evaluation), e.g., — Hydraulics — Electrical — Flight Controls Powered by EASA eRules Page 983 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION — FGS related Sensors The probability of failure of a FGS element to disenga ge when the quick disengagement control is operated should be shown to be acceptable by the Safety Analysis process. If credit is to be taken for acceptable continued manual operation with the FGS elements remaining engaged i.e. without operating any of th e other disengagement controls, then a flight demonstration should be conducted though approach, landing and rollout.

14.3 Criteria Supporting the Operational Use of an Autopilot The criteria contained in this section are intended to identify how the funct ional capability of the FGS, established during the certification, can be utilized to support typical flight operations. The criteria are based on experience gained from certification programs and functionality provided by traditional systems. A FGS provid ing non - traditional functionality, using new or novel technology, and/or implementation techniques, may require additional criteria to be established.

14.3.1 Autopilot Operations in close proximity the ground The minimum engagement point for the autopilot after takeoff and the minimum use of the autopilot during approach should take into consideration the effect of: — Failures and their effects (i.e., Failure Conditions), — Fault - free performance, — Any specific operational considerations and/or mitigation.

During low visibility operations, multiple redundant autopilot channels may be used and the effect of any autopilot failures on the flight path may be eliminated, or substantially minimized, by the protection provided be that redundancy. The following considerations apply primarily to single channel operations where performance or integrity aspects may require further consideration. See also Section 13.5.2, which identifies specific considerations relating to autopilot operatio ns close to the ground in the presence of failures.

14.3.1.1 Autopilot Engagement Altitude or Height after Takeoff – Failure Effects The potential deviation of the aeroplane from the desired flight path due to the effect of a Failure Condition may necessi tate delaying the engagement of an autopilot to an acceptable height above the departure runway.

To support this determination, if an autopilot Failure Condition, or Failure Conditions, are identified that will cause a significant deviation below the inten ded vertical flight path, the worst - case deviation profile should be identified. This profile and the recovery of the aeroplane should not result in penetration of the net flight path as defined in CS 25.115 . If th e Failure Condition(s) has a neutral effect on the flight path but has implications for speed control during takeoff, the acceptability of cues for the flight crew detection of the condition should be made.

The effect of any Failure Condition relating to t he bank angle of the aeroplane should also be assessed. In all of the above, account should be taken of operating the aeroplane at the WAT limit.

The minimum engagement height will typically be established based on the greater of the following consideratio ns: Powered by EASA eRules Page 984 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION — The lowest altitude or height where the flight crew could reasonably be assumed to engage the autopilot. Consideration should be given to normal flight crew tasks during rotation and lift - off (typically 30 m (100 ft) or greater).

— Any allowance for the acceptability of the performance of the autopilot during the basic engagement/mode transition.

— The lowest altitude or height consistent with the response of the aeroplane to any identified autopilot Failure Condition(s).

— Activation of stall identification system (e.g. stick pusher) armed (if installed).

If the response to the worst - case failure condition causes a significant transition below the intended vertical flight path, the deviation information should be provided in the AFM.

14.3.1.2 Autopilot Engage ment during Approach The potential deviation of the aeroplane from the desired flight path due to the effect of a Failure Condition may necessitate the disengagement of an autopilot at an appropriate height on the approach to landing.

The operational minim um engagement height will be established based on the following considerations: — the altitude or height at which the performance of the automatic control is no longer acceptable, — the lowest altitude or height consistent with the response of the aeroplane to a subsequent autopilot failure, — any specific operational consideration.

The following paragraphs provide assessment criteria for operations that have guidance to the runway threshold, and for those that do not.

14.3.1.2.1 Approach with Vertical Path Refer ence – Failure Effects Approaches with vertical path reference can include xLS (i.e., ILS, MLS and GLS) or RNAV. Operations using xLS, can be assumed to be conducted with respect to a flight path prescribed or established as an integral part of navigation service provided by the State of the airport. RNAV approach operations will be conducted using an onboard database that provides a navigation flight path to the runway.

The operational consideration for this type of operations relates an assessment of the adequacy of continued use of the autopilot in maintaining the desired vertical flight path. Considerations include the lowest altitude consistent with the response of the aeroplane to an autopilot failure.

To support this determination, if an autopilot Fai lure Condition, or Failure Conditions, is identified that causes a significant transition below the intended vertical flight path, the worst - case deviation profile should be identified using the method identified in Section 14.2.5.1. If the Failure Conditi on(s) has a neutral effect on the flight path, the acceptability of cues for the flight crew detection of the condition should be made. The effect of Powered by EASA eRules Page 985 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION any Failure Condition relating to the bank angle of the aeroplane should be assessed.

For the purpose of t he airworthiness assessment, the vertical flight path an xLS and RNAV approach can be assumed to be a flight path of three degrees that passes through the runway threshold at an altitude of 15 meters (50 ft).

Considerations for steep approaches are provide d in a preceding section.

The vertical flight path control for an xLS approach will be made with reference to the path defined by the navigation service. The RNAV vertical flight path will typically be conducted with reference to barometric altitude.

An ap propriate adjustment to the minimum use height may be appropriate to take into account the vertical accuracy of RNAV operations.

NOTE: Any operational considerations such as temperature effect compensation should be considered as part of the operational a uthorization.

The Minimum Use Height can be determined using the method identified in AMC No.2 to CS 25.1329 , Section 4.2.3.2.

14.3.1.2.2 Approach without Vertical Path Reference Flight operations with no vertical path reference are conducted with an appropriate visual segment for final approach path. In the interest of providing appropriate automatic control to assist in a stabilized approach, the minimum use of the autopilot should be consistent with the performance needed for the descent (e.g., vertical speed/flight path angle) and the pilot detection and recovery from an autopilot failure.

To support this determination, if an autopilot Failure Condition, or Failure Conditions, is identified that causes a significant transition below the intended vertical flight path, the worst - case deviation profile should be identified. If the Failure Condition(s) has a neutral effect on the flight path but has implications for speed control during takeoff, the acceptabi lity of cues for the flight crew detection of the condition should be made. The effect of any Failure Condition relating to the bank angle of the aeroplane should be assessed.

For FGS that are failure protected (i.e., fail passive), the minimum engagement height will typically be no lower than 15 m (50 ft) above runway elevation. However, when determining this limitation, account should be taken of the handling task presented to the pilot when regaining manual control, especially in limiting crosswind condi tions.

For FGS that are not failure protected (i.e., not fail - passive), the demonstrated minimum use height will typically be established based on the greater of the following considerations: a. 15 m (50 ft) above runway elevation b. Two times the Height L oss for the aeroplane as a result of any identified autopilot Failure Condition(s) using the method identified in AMC No.2 to CS 25.1329 , Section 4.2.3.3.

14.3.1.3 Circling Approach Powered by EASA eRules Page 986 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION For the purposes of this AMC, circling approaches may be considered to have three visual segments associated with the approach; a segment at or above the minimums prescribed by the procedure that parallel the runway in the opposite direction of the landing runway, a turning segmen t to align with the runway that can be level or partially descending, and a final descending segment to landing. Operationally, the autopilot may remain engaged even after leaving the minimum altitude (MDA(H)) for safety and flight crew workload relief re asons. This operational procedure should be balanced against unacceptable performance or failure characteristics. As this procedure is in the visual segment, no specific constraints for the use of the autopilot are considered necessary for this phase of fl ight unless specific unacceptable performance or failure characteristics related to circling approach are identified during the certification program.

14.3.2 Climb, Cruise, Descent, and Holding The value of the use of the autopilot in providing flight crew workload relief in climb, cruise, descent and holding phases of flight should be balanced against the failure characteristics of the autopilot. No specific constraints for the use of the autopilot are considered necessary for these phases of flight unless specific unacceptable performance or failure characteristics are identified during the certification program, related to climb, cruise, descent or holding.

14.3.3 Manoeuvring No specific constraints for the use of the autopilot are considered necessary fo r manoeuvring flight unless unacceptable performance or failure characteristics are identified during the certification program. Section 14.2.4 provides assessment criteria for manoeuvring flight for autopilot failures.

14.4 Automatic Disengagement of the Autopilot Automatic disengagement of the FGS will occur for several reasons such as system failures, sensor failures, unusual accelerations, etc. The automatic disengagement characteristics of the FGS should be investigated throughout the flight envelope. These disengagement cases should be analysed to determine the ones requiring demonstration during the test program. For each disengagement, the transients, warnings, and pilot workload for recovery should be evaluated, and compliance with CS 25.1329 (d) and (e) should be verified. The use of simulation is recommended for all conditions that are expected to result in significant transients.

14.5 Assessment of Human Factors Considerations The evaluation, demonstration and testing should assess the acceptability of the human - machine interface with the FGS and the potential for flight crew errors and confusion concerning the behaviour and operation of the FGS, based on the criteria described in earlier Sections.

The eval uation of normal and non - normal FGS operations should include the representative range of conditions in terms of crew mental or physical workload, required crew response timeliness, or potential for confusion or indecision. The set of test cases should rep resent operationally relevant scenarios and the assumptions about pilot training and skill level should be documented.

Powered by EASA eRules Page 987 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Flight evaluation during certification is a final assessment and is intended to validate the design. Prior evaluations are typically cond ucted in a variety of ways and at different levels of fidelity in order to finalize the design. These may include: — Engineering evaluations and task analyses, including cognitive and physical tasks; — Mock - up evaluations and demonstrations; — Part - task evaluati ons and demonstrations; — Simulator evaluations, demonstrations, and tests; and — Engineering flight evaluations, demonstrations, and tests.

The data and/or experience from such evaluations may be useful for credit to establish FGS compliance with regulations having human factors considerations. In some cases, certification credit or demonstration of compliance using simulations cannot be granted due to inability to find simulation conformity. In such cases, certification authorities may consider that less flig ht testing may be required to show compliance if the simulation evaluations have added confidence with respect to the reduced potential for crew error and confusion and other human factors attributes of the pilot/FGS interface. Also, applicants have succes sfully used comparisons to previously certificated designs to obtain such credit (although such credit is not assured). Additional testing may be warranted, e.g., for new FGS flight crew interface designs or functions.

In many cases the evaluation, demonst ration and test scenarios, including failures and environmental events, will determine whether the data should be obtained in simulation or in flight, because of safety considerations or unavailability of the necessary environmental conditions. In some of these cases a very high fidelity simulation will be needed. In addition to the simulation validation considerations identified in Section 14.1.4.2, the simulation used may need to include the following features, depending on the functionality of the FGS: — Physical implementation of flight deck controls, displays, indicators and annunciators for all flight crew positions that are relevant to the objectives of the evaluation.

— Adequate emulations of relevant equipment (hardware and software function, includi ng capability to introduce failures) should be incorporated in the simulation.

— Weather simulation including gusts, turbulence, windshear and visibility.

— Representation of the operational environments, including interaction with air traffic services, day/n ight operations, etc, as relevant to the functions and pilot tasks being evaluated — Data collection capabilities Simulator evaluations and tests are intended to generate objective and/or subjective data. It may not always be possible or necessary to obtain quantifiable measurements of flight crew performance, even with high fidelity flight or simulation evaluation, demonstration, or test scenarios. In these cases, evaluation procedures should be based on the use of structured, subjective methods such as rati ng scales, questionnaires and/or interviews. When there is dependence on this type of data, evaluations should consider multiple data collection techniques with an appropriate number of pilot evaluators.

In order to provide sound evaluations, pilots should be trained appropriately on the FGS system operation and procedures. They should also have experience in the kinds of Powered by EASA eRules Page 988 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS : INSTALLATION operation and aircraft types for which the FGS is intended, be familiar with the intended function of the FGS, its operational and design philosophy, and how this philosophy fits with the overall flight deck and its operational and design philosophy.

Rationale should be provided for decisions regarding new or unique features in a design.

It should be confirmed that the data resulting from t he evaluations support acceptability of any new or unique features.

The certification planning documentation should describe the means to show compliance of the Human Factors - related considerations of the FGS, with this AMC.

15 AEROPLANE FLIGHT MANUAL (AFM ) The following sections provide guidance on material to be provided in the Aeroplane Flight Manual (AFM) to ensure that the appropriate information related to FGS operation is translated into air carrier operations. For additional guidance, note that AMC 25.1581 addresses requirements of the AFM for Large Aeroplanes and distinguishes between those aircraft that are used in Commercial Air Transportation and those that are not.

The terminology used in the AFM should be consistent with the intended operat ional use.

Appropriate AFM information related to low - visibility operations is addressed in CS - AWO Subparts 1 - 4.

15.1 Information Supporting Operational Use of the Autopilot The airworthiness certification process will assess the effect of autopilot Failur e Conditions as identified in Sections 13 and 14. If a specific Minimum Use Height (MUH) is necessary, then the height should be provided in the Limitations section of the AFM. If the design is such that the effects of Failure Condition(s) do not require e stablishment of a MUH, then the pertinent deviation profile or height loss information should be provided in the Normal or Non - normal section of the AFM, as applicable.

If MUH or a Height Loss value is applicable, it should be specified as follows: (a) Tak eoff - Autopilot Engagement Altitude or Height.

NOTE: If minimum engagement altitude(s) or height(s) are not specified, then “maximum displacement deviation” information from a pertinent takeoff flight path and approach profile should be provided in the AF M Normal Procedures section, or in the associated Flight Crew Operation Manuals (FCOM).

(b) Cruise – Height Loss (c) Approach - MUH or Height Loss i) Approach – with Vertical Path Reference — the MUH should be determined based on clearance above a 1:29 plane using the Deviation Profile Method.

ii) Approach – without Vertical Path Reference — the Height Loss should be determined using the Height Loss Method 15.2 Limitations The Limitations section of the AFM presents those FGS operating limitations appropriate to the aeroplane model as established in the course of the type certification process, and Powered by EASA eRules Page 989 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION as necessary (Ref. CS 25.1581(a)(1) and CS 25.1583 ). FGS operational limitations (should any exist) should specify, any configuration/envelope restrictions, if and as applicable.

15.3 Non - normal/Emergency Procedures The AFM should include Non - normal or Emergency procedures appropriate to the FGS identified during the certification program (Ref. CS 25.1581(a)(1) , CS 25.1585(a)(2) and CS 25.1585(a)(3) ).

15.4 Normal Procedures The normal procedures for use of the FGS should be documented in the AFM or FCOM, as appropriate. These procedures should be demonstrated during the type certification process.

In lieu of specification of mi nimum engagement altitude(s) or height(s) (see Section 15.1 above)), the AFM may alternately specify “maximum displacement deviations” from a specified takeoff flight path, or from a specified approach profile. This information may be based on typical depa rture or approach flight paths suited for the aircraft type and for failure conditions that are determined applicable to the type of FGS system and modes suitable for use.

The flight manual should include any necessary procedures for the use of the flight guidance system in icing conditions (including severe icing conditions). In particular, the procedures should include any necessary changes in operating speeds required either operationally or as a result of relevant design features of the speed protection function of the FGS; e.g., variations in minimum speeds as a function of de/anti - icing system selection; speed increments during approach and landing in turbulence.

15.4.1 Aircraft with Published Flight Crew Operation Manuals The AFM’s for aircraft for wh ich the manufacturer has published a FCOM should contain essential information on normal operating procedures that are considered “peculiar” to the operation of the FGS for the aircraft type or are otherwise necessary for safe operation (Ref. CS 25.1581(a)(2) and CS 25.1585(a)(1) ). FGS description and integration with the overall flight deck design philosophy; specification and operational procedures that are normally associ ated with flight guidance systems should be made available for inclusion in the FCOM.

If applicable, a FCOM may contain the “maximum displacement deviation” information described in Section 15.1, above, in either numeric or graphic form.

15.4.2 Aircraft without Published FCOM’s For aircraft that rely on the AFM as the sole operating manual, the AFM must contain operating information sufficient for flight crew reference (Ref.

CS 25.1581(a)(2) ). FGS descrip tion and integration with the overall flight deck design philosophy, specification and operational procedures that are normally associated with flight guidance systems should be made available so that an appropriately trained flight crew may operate the FG S under normal conditions.

[Amdt 25/4] [Amdt 25/11] [Amdt 25/12] [Amdt 25/16] [Amdt 25/18] [Amdt 25/ 26 ] Powered by EASA eRules Page 990 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION

Appendix A – Safety Assessment

ED Decision 2007/020/R A1 General This section provides material that may be useful in supporting the safety assessment activities identified in Section 13.

A2 Identification of Failure Conditions The following “failures” should be considered for applicability when establishing Failure Conditions as indicated in Section 13 : — Loss of autopilot in single or multiple axes — Loss of guidance in single or multiple axes — Loss of thrust control — Partial loss or degradation of autopilot function — A failure resulting in unintended autopilot commands in a single axis or multiple axes simultaneously (e.g., hardover, slowover, and oscillatory failure modes) — A failure resulting in unint ended guidance commands in a single axis or multiple axes — A failure resulting in unintended thrust control — A sustained out - of - trim condition with the autopilot engaged without a warning — An autopilot disengagement in an out - of - trim condition — Autopilot disen gagement without a warning — Inability to disengage the autopilot or autothrust function — Un - commanded engagement of an autopilot or autothrust — Jamming or loading of primary flight controls — Un - intended thrust asymmetry A typical Failure Condition statement ma y be of the form: ‘{Failure}’ during ‘{Phase of Flight}’ that ‘{Effect}’ when ‘{Mitigation Consideration}’ Failure Conditions may result from failures within the FGS or from failure associated with aircraft interfacing systems or components (e.g., naviga tion receivers, attitude heading reference systems, flight management systems, hydraulics, electrical systems, etc.).

A3 Considerations when Assessing the Severity of Failure Condition Effects The Failure Condition definition is complete (as defined in AMC 25.1309) when the effects resulting from “failure” are identified. A complete definition of the Failure Condition and its effect will then support the subsequent Failure Condition classification.

When assessing the effect that results from a failure, the following items should be considered for various phases of flight: — The impact of the loss of control, or unintended control, on the structural integrity of the aeroplane as a result of simple loading or as a result of excitation of aerodynamic or structura l modes, both at the time of occurrence and while the flight continues.

Powered by EASA eRules Page 991 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION — Implications of the aeroplane response in terms of attitude, speed, accelerations, flight path, and the impact on the occupants and on flight crew performance.

— Degradation in the stabi lity or other flying qualities of the aeroplane.

— The duration of the condition.

— The aircraft configuration.

— The aircraft motion cues that will be used by the flight crew for recognition.

— Availability, level, and type of alerting provided to the flight crew.

— Expected flight crew corrective action on detection of the failure.

Failure Conditions may include the following characteristics: — “Hardover” effects - typically considered to significant and are readily detectable by the flight crew based on t he resulting aircraft motion or guidance cues.

— “Slowover” effects - typically not readily detected by the flight crew. The effect may involve departures from intended flight path that are not initially detectable by aircraft motion alone, and may only be d etectable by motion cues when a significant flight path deviation has occurred or by the provision of an appropriate flight crew alert.

— “Oscillatory” effects – typically a repetitive motion or guidance condition not related to intended guidance or control. The magnitude, period and duration of the condition and any mitigation considerations will determine the final effect.

— “Loss of” effects – typically the removal of control, guidance or functionality that may have an immediate effect or may not be immediat ely apparent to the flight crew.

Section 14 provides guidance on crew recognition considerations.

A4 Failure Condition Classification The following are examples of the type of Failure Condition effects that have been identified in previous aeroplane certification programs. The specific number and type of Failure Condition may vary with aeroplane type, aeroplane system architecture and FGS system design philosophy (e.g., failure detection, redundancy management, failure annunciation, etc.).

A 4.1 Catastrophic Failure Conditions The following effects have been assessed Catastrophic in previous aeroplane certification programs: — A load on any part of the primary structure sufficient to cause a structural failure preventing safe flight and landing (Refer to CS 25.302).

— Unrecoverable loss of flight path control.

— Exceedance of V /M .

DF DF — Flutter or vibration that causes a structural failure preventing safe flight and landing (Refer to CS 25.302).

— A temporary loss of control (e.g., stall) where the fligh t crew is unable to prevent contact with obstacles or terrain.

— Deviations in flight path from which the flight crew are unable to prevent contact with obstacles, terrain, or other aircraft.

Powered by EASA eRules Page 992 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION A4.2 Hazardous Failure Conditions The following effects have been assessed Hazardous in previous aeroplane certification programs: — Exceedance of airspeed halfway between VMO and VDF or a Mach number halfway between MMO and MDF.

— A stall, even if the flight crew is able to recover safe flight path control.

— A load factor l ess than zero.

— Bank angles of more than 60 degrees en route or more than 30 degrees below a height of 300 m (1000 ft). above an applicable airport elevation.

— Degradation of the flying qualities of the aeroplane that excessively increases flight crew worklo ad.

— Failure that could result in a RTO and high speed overrun (e.g., 110 km/h (60 kt)).

— A flight path deviation that requires a severe manoeuvre to prevent contact with obstacle, terrain or other aircraft.

NOTE: Severe manoeuvre includes risk of serious injury or death of a small number of occupants.

A4.3 Major Failure Conditions The following effects have been assessed Major in previous aeroplane certification programs: A flight path deviation, a required recovery manoeuvre, which may result in p assenger injuries (e.g., consideration should be given to phases of flight where the occupants may reasonably be moving about the aeroplane or be serving or consuming hot drinks).

Degradation of the flying qualities of the aeroplane that significantly incr ease flight crew workload.

[Amdt 25/4]

AMC No.2 to CS 25.1329 Flight Testing of Flight Guidance Systems

ED Decision 2007/020/R 1. General Some aspects of a Flight Guidance System (FGS) design may be validated by laboratory testing or by simulation, other aspects may necessitate test pilot expertise and subjective judgment in a representative aircraft environment. The purpose of this AMC is to provide FGS flight test procedures without specifying the test means to be used, i.e. actual airc raft or representative flight simulator.

A flight test program should be established that confirms the performance of the FGS for the modes of operation and the operational capabilities supported by its design. The operational implications of certain failu res and Failure Conditions may require flight evaluation. The pilot interface with FGS controls and displays in the cockpit should also be assessed.

The scope of the flight demonstration program will be dependent on the operational capability being provide d including any new and novel features. Early coordination with the regulatory authorities is recommended to reduce certification risks associated with the flight demonstration program.

Powered by EASA eRules Page 993 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION The intent of the flight demonstration program is to confirm that the operation of the FGS is consistent with its use for the intended flight operations of the aeroplane type and configuration.

The modes of the FGS should be demonstrated in representative aeroplane configurations and under a representative range of flight co nditions.

The following are specific test procedure that can assist in that demonstration program. The procedures should be read in conjunction with Sections 10, 11 and 14 of AMC No. 1 to CS 25.1329 .

2. Protection Features Protection feature are included in the design of an FGS to assist the flight crew in ensuring that boundaries of the flight envelope or operational limits are not exceeded leading to an unsafe condition. The means to alert the flight crew to a co ndition or for the system to intervene to preclude the condition may vary but certain operational scenarios can be used to assess the performance of the system in providing the protection function. The following procedures can be used to evaluate the prote ction functions of an FGS.

2.1 Low Speed Protection The low speed protection feature in an FGS is intended to prevent loss of speed to an unsafe condition (Refer to AMC No. 1 to CS 25.1329 – Section 10.4.1). This may be accomplished by a number of means b ut should be evaluated under a number of scenarios.

There are four cases that should be considered when evaluating when the Low Speed Protection function of a FGS: 1. High Altitude Cruise Evaluation.

(a) At high altitude at normal cruise speed, engage the FGS into an Altitude Hold mode and a Heading or LNAV mode.

(b) Engage the autothrust into a speed mode.

(c) Manually reduce one engine to idle thrust.

(d) As the airspeed decreases, observe the FGS behaviour in maintaining altitude and heading/c ourse.

(e) When the Low Speed Protection condition becomes active, note the airspeed and the associated aural and visual alerts including possible mode change annunciations for acceptable operation.

2. Altitude Capture Evaluation at Low Altitude.

(a) At ab out 1000 m (or 3000 ft) MSL and 460 km/h (or 250 kt), engage the FGS into Altitude Hold and a Heading or LNAV mode.

(b) Engage the autothrust into a speed mode.

(c) Set the Altitude Pre - selector to 2500 m (or 8000 ft) MSL.

(d) Make a flight level change to 2500 m (or 8000 ft) with a 460 km/h (250 kt) climb at maximum climb power.

(e) When the FGS first enters the altitude capture mode, retard an engine to idle power.

Powered by EASA eRules Page 994 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (f) As the airspeed decreases, observe the aeroplane trajectory and behaviour.

(g) When the Low Speed Protection condition becomes active, note the airspeed and the associated aural and visual alerts including possible mode change annunciations for acceptable operations.

3. High Vertical Speed Evaluation.

(a) Engage the FGS in Vertical Speed Mode with a very high rate of climb.

(b) Set the thrust to a value that will cause the aeroplane to decelerate at about 1.8 km per second (1 knot per second).

(c) As the airspeed decreases, observe the aeroplane trajectory and behaviour.

(d) When the Low Speed Protection condition becomes active, note the airspeed and the associated aural and visual alerts including possible mode change annunciations for acceptable operation.

4. Approach Evaluation.

(a) Conduct an instrument approach with vertical pat h reference.

(b) Couple the FGS to the localizer and glideslope (or LNAV/VNAV, etc.).

(c) Cross the Final Approach Fix/Outer Marker at a high - speed (approximately Vref + 74 km/h (40 kt)) with the thrust at idle power until low speed protection activates.

( d) As the airspeed decreases, observe the aeroplane trajectory and behaviour.

(e) When the Low Speed Protection condition becomes active, note the airspeed and the associated aural and visual alerts including possible mode change annunciation for acceptabl e operation.

(f) Note the pilot response to the alert and the recovery actions taken to recover to the desired vertical path and the re - capture to that path and the acceleration back to the desired approach speed.

NOTE : If the FGS remains in the existing m ode with reversion to Low Speed Protection, the FGS should provide a suitable alert to annunciate the low speed condition. In this case, note the pilot response to the alert and the recovery actions taken to maintain the desired vertical path and to accele rate back to the desired approach speed.

2.2 High - speed Protection The high - speed protection feature in an FGS is intended to prevent a gain in airspeed to an unsafe condition (Refer to AMC No. 1 to CS 25.1329 – Section 10.4.2). This may be accomplished by a number of means but should be evaluated under a number of scena rios.

There are three cases that should be considered when evaluating the High - speed protection function of a FGS: 1. High Altitude Level Flight Evaluation with Autothrust function (a) Select Autothrust Off (if an automatic wake - up function is provided; ot herwise, select Autothrust on).

(b) Engage the FGS in altitude hold.

Powered by EASA eRules Page 995 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION (c) Select a thrust level that will result in acceleration beyond VMO/MMO.

(d) As the airspeed increases, observe the behaviour of the High - speed protection condition and any autothrust r eactivation and thrust reduction, as applicable.

(e) Assess the performance of the FGS to control the airspeed to VMO/MMO, or other appropriate speed.

2. High Altitude Level Flight Evaluation without Autothrust function (a) Select a thrust value that will result in acceleration beyond VMO/MMO.

(b) As the airspeed increases, observe the basic aeroplane overspeed warning activate between VMO + 1 and VMO + 11 km/h (6 kt).

(c) Observe the high - speed protection condition become active as evidenced by the unique visual alert and note possible FGS mode change.

(d) Maintain the existing thrust level and observe the aeroplane depart the selected altitude.

(e) After sufficient time has elapsed to verify and record FGS behaviour has elapsed, reduce the thrust as neces sary to cause the aeroplane to begin a descent.

(f) Observe the FGS behaviour during the descent and subsequent altitude capture at the original selected altitude.

3. High Altitude Descending Flight Evaluation with Autothrust function (a) Select Autothrust Off (with automatic wake - up function) with thrust set to maintain airspeed 10% below VMO/MMO with the FGS engaged in altitude hold.

(b) Select vertical speed mode that will result in acceleration beyond VMO/MMO.

(c) As the airspeed increases obs erve the autothrust function reactivate and reduce thrust towards idle.

(d) Observe the activation of FGS high - speed protection condition.

(e) Observe the reduction in pitch.

GENERAL NOTE : If the FGS remains in the existing mode with reversion to High Spee d Protection, the FGS should provide a suitable alert to annunciate the high - speed condition. In this case, note the pilot response to the alert and the recovery actions taken to maintain the desired vertical path and to decelerate back to the desired spee d.

3. Environmental Conditions Some environmental conditions have created operational problems during FGS operations. It should be the objective of the flight demonstration program to expose the FGS to a range of environmental conditions as the opportunit y presents itself. These include winds, windshear, mountain - wave, turbulence, icing, etc. However, some specific test conditions may have to be created to emulate operational conditions that are not readily achieved during normal flight test.

Powered by EASA eRules Page 996 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 3.1 Icing The accumulation of ice on the wing and airframe can have an effect on aeroplane characteristics and FGS performance. FGS operations may mask the onset of an aeroplane configuration that would present the pilot with handling difficulties when resumin g manual control, particularly following any automatic disengagement of the FGS.

During the flight test program the opportunity should be taken to evaluate the FGS during natural icing conditions including the shedding of the ice, as applicable.

It is reco mmended that the opportunity should be taken to evaluate the operation of the FGS during basic aeroplane evaluation with ‘ice shapes’.

The following conditions should be considered for evaluating FGS performance under ‘icing conditions’: (a) "Holding ice" as defined by CS - 25 Appendix C (b) Medium to light weight, symmetric fuel loading (1) High lift devices retracted configuration: Slow down at 1.8 km per second (1 knot per second) to automatic autopilot disengage, stall warning or entry into speed protect ion function.

Recovery should be initiated a reasonable period after the onset of stall warning or other appropriate warning. The aeroplane should exhibit no hazardous characteristics.

(2) Full Instrument Approach: If the autopilot has the ability to fly a coupled instrument approach and go - around, it should demonstrate the following: (i) Instrument approach using all normal flap selections.

(ii) Go - around using all normal flap selections.

(iii) Glideslope capture from above the glidepath.

(3) If the aerop lane accretes or sheds ice asymmetrically it should be possible to disengage the autopilot at any time without unacceptable out of trim forces.

(4) General manoeuvrability including normal turns, maximum angle of bank commanded by the FGS in one direction and then rapid reversal of command reference to the maximum FGS angle of bank in the other direction.

4. Failure Conditions This section contains criteria relating to aeroplane system Failure Conditions identified for validation by a system Safety Assessm ent.

4.1 Test Methods The test method for most Failure Conditions will require some type a fault simulation technique with controls that provide for controlled insertion and removal of the type of fault identified as vulnerability. The insertion point wi ll typically be at a major control or guidance point on the aeroplane (e.g., control surface command, guidance command, thrust command).

Powered by EASA eRules Page 997 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION The implication of the effect of the Failure Condition on various flight phases should be assessed and the demonstration condition established. This assessment should identify the parameters that need to be measured and the instrumentation required.

The role of any monitoring and alerting in the evaluation should be identified.

The alertness of the crew to ce rtain aeroplane response cues may vary with phase of flight and other considerations. Guidance on this is provided below.

The ‘success criteria’ or operational implications should be identified and agreed with the regulatory authority prior to the conduct of the test. Guidance on this is provided below.

4.2 Fault Recognition and Pilot Action The Safety Assessment process may identify a vulnerability to the following types of Failure Condition: — hardover — slowover — oscillatory The various types of effect will cause differing response in the aeroplane and resultant motion and other cues to the flight crew to alert them to the condition. The flight crew attention may be gained by additional alerting provided by systems on the aeroplane.

The recognitio n is then followed by appropriate action including recovery.

The assessment of the acceptability of the Failure Condition and the validation of the Safety Assessment assumptions are complete when a stable state is reached as determined by the test pilot.

T he following paragraphs provide guidance for specific phases of flight.

4.2.1 Takeoff This material addresses the use of an FGS after rotation for takeoff.

Section 13 of AMC No. 1 to CS 25.1329 identifies the key considerations for this phase of flight to be the effect on the net flight path and the speed control after lift - off. Automatic control is not typically provided for the takeoff roll. It may however be selected soon after lift - off. Failure Conditions may be introduced with this engagement.

For the initial lift - off through flap retraction, it can be assumed that the flight crew is closely monitoring the aeroplane movements and a maximum crew response time after recognition would be 1 second.

4.2.2 Climb, Cruise, Descent and Holding and Manoeuvring The demonstration of applicable failure conditions during these phases of flight would include the potential for occupants to be out of their seats and moving about the cabin.

4.2.3 Approach There are two types of approach operations to consider – an appr oach with and without vertical path reference. The approach with vertical path reference will be assessed against ground - based criteria using a deviation profile assessment. A height loss assessment is used for approaches without vertical path reference.

Powered by EASA eRules Page 998 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 4 .2.3.1 Fault Demonstration Process The worst - case malfunction has first to be determined, based on factors such as: i) Failure Conditions identified by the system safety assessment.

ii) System characteristics such as variations in authority or monitor oper ation.

iii) Mitigation provided by any system alerts.

iv) Aircraft flight characteristics relevant to failure recognition.

Once the worst - case malfunction has been determined, flight tests of the worst - case malfunction should be flown in representative conditions (e.g.

coupled to an ILS), with the malfunction being initiated at a safe height. The pilot should not initiate recovery from the malfunction until 1 second after the recognition point. The delay is intended to simulate the variabi lity in response to effectively a “hands off” condition. It is expected that the pilot will follow through on the controls until the recovery is initiated.

4.2.3.2 Assessment – Approach with Vertical Path Reference Figure 1 provides a depiction of the devi ation profile method. The first step is to identify the deviation profile from the worst - case malfunction. The next step is to ‘slide’ the deviation profile down the glidepath, until it is tangential to the 1:29 line or the runway. The Failure Condition co ntribution to the Minimum Use Height may be determined from the geometry of the aircraft wheel height determined by the deviation profile, relative to the 1:29 line intersecting a point 4.5 m (15 ft) above the threshold. The method of determination may be graphical or by calculation.

NOTE: The Minimum Use Height is based on the recovery point because: i) It is assumed that in service the pilot will be “Hands off” until the autopilot is disengaged at the Minimum Use Height in normal operation.

ii) The test t echnique assumes a worst case based on the pilot being “Hands off” from the point of malfunction initiation to the point of recovery.

iii) A failure occurring later in the approach than the point of initiation of the worst case malfunction described above is therefore assumed to be recovered earlier and in consequence to be less severe.

4.2.3.3 Assessment – Approach without Vertical Path Reference Figure 2 provides a depiction of the height loss method. A descent path of three degrees, with nominal approach speed, should be used unless the autopilot is to be approved for significantly steeper descents. The vertical height loss is determined by the deviation of the aircraft wheel height relative to the nominal wheel flight path.

Powered by EASA eRules Page 999 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATI ON Figure FT - 1: Deviat ion Profile Method Powered by EASA eRules Page 1000 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION Figure FT - 2: Height Loss Method Powered by EASA eRules Page 1001 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION 4.3 Autopilot Override The initial tests to demonstrate compliance should be accomplished at an intermediate altitude and airspeed e.g. 4500 m (15000 ft) MSL and 460 km/h (250 kt). With the autopilot engaged in altitude hold, the pilot should apply a low force (sustained and incremental) to the control wheel (or equivalent) and verify that the automatic trim system does not produce motion resulting in a hazardous condition. The pilot should then gradua lly increase the applied force to the control wheel (or equivalent) until the autopilot disengages. When the autopilot disengagement occurs, observe the transient response of the aeroplane. Verify that the transient response is in compliance with Section 8 .4 of AMC No. 1 to CS 25.1329 .

Disengagement caused by flight crew override should be verified by applying an input on the control wheel (or equivalent) to each axis for which the FGS is designed to disengage, i.e. the pitch and roll yoke, or the rudder pe dals (if applicable). The inputs by the pilot should build up to a point where they are sharp and forceful, so that the FGS can immediately be disengaged for the flight crew to assume manual control of the aeroplane.

If the autopilot is designed such that it does not automatically disengage during an autopilot override and instead provides a flight deck Alert to mitigate any potentially hazardous conditions, the timeliness and effectiveness of this Alert. The pilot should follow the evaluation procedure i dentified above until such time as an Alert is provided.

At that time, the pilot should respond to the Alert in a responsive manner consistent with the level of the alert (i.e., a Caution, a Warning) and with the appropriate flight crew procedure defined f or that Alert. When the autopilot is manually disengaged, observe the transient response of the aeroplane and verify that the transient response is in compliance with AMC No. 1 to CS 25.1329 Section 8.4.

After the initial tests have been successfully comp leted, the above tests should be repeated at higher altitudes and airspeeds until reaching MMO at high cruise altitudes.

[Amdt 25/4]

CS 25.1331 Instruments using a power supply

ED Decision 2003/ 2/RM (a) For each instrument required by CS 25.1303(b) that uses a power supply, the following apply: (1) Each instrument must have a visual means integral with the instrument, to indicate when power adequate to sustain pro per instrument performance is not being supplied. The power must be measured at or near the point where it enters the instruments. For electric instruments, the power is considered to be adequate when the voltage is within approved limits.

(2) Each instrum ent must, in the event of the failure of one power source, be supplied by another power source. This may be accomplished automatically or by manual means. The failure of one power source must not affect the same instrument of both pilot stations.

(3) If an instrument presenting flight and/or navigation data receives information from sources external to that instrument and loss of that information would render the presented data unreliable, a clear and unambiguous visual warning must be given to the Powered by EASA eRules Page 1002 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INS TRUMENTS: INSTALLATION crew whe n such loss of information occurs that the presented data should not be relied upon. The indication must be incorporated in the instrument.

(b) As used in this paragraph, ‘instrument’ includes devices that are physically contained in one unit, and devices that are composed of two or more physically separate units or components connected together (such as a remote indicating gyroscopic direction indicator that includes a magnetic sensing element, a gyroscopic unit, an amplifier, and an indicator connected to gether).

CS 25.1333 Instrument systems

ED Decision 2016/010/R (See AMC 25.1333) (a) For systems that operate the instruments required by CS 25.1303(b) , which are located at each pilot’s station, means must be prov ided to connect the required instruments at the first pilot’s station to operating systems, which are independent of the operating systems at other flight crew stations, or other equipment.

(b) Equipment, systems, and installations must be designed so tha t sufficient information is available to assure control of the aeroplane in airspeed, altitude, direction and attitude by one of the pilots without additional flight crew action after any single failure or combination of failures that is not assessed to be extremely improbable (see AMC 25.1333(b) ); and (c) Additional instruments, systems, or equipment may not be connected to the operating systems for the instruments required by CS 25.1303(b) , unless provisions are m ade to ensure the continued normal functioning of the required instruments in the event of any malfunction of the additional instruments, systems, or equipment which is not sh own to be extremely improbable.

[Amdt 25/18]

AMC 25.1333(b) Instruments systems

ED Decision 2003/ 2/RM 1. Attitude displays systems. If three displays are used to show compliance with CS 25.1333(b) , the reliability and independence of those displays should be confirmed by a suitable assessment in accordance with CS 25.1309 . Each display should have independent sensors and power supplies.

If a total failure of the generated electrical power causes the loss of both main instruments, th e power supply to the third (standby) attitude indicator and its appropriate lighting should be such that the display is usable from each pilot’s station for a time duration in accordance with AMC 25.1351(d) .

Note : the time for which the display remains usable will be stated in the Aeroplane Flight Manual (AFM).

2. Airspeed, altitude, and direction display systems. The reliability and independence of the displays used to show compliance with CS 25.1333(b) should be sufficient to ensure continued safe flight and landing appropriate to the inten ded operation of the aeroplane.

Historically, “sufficient information” to control attitude, airspeed, altitude, and direction has been provided by specific indicators of the st ate of each parameter. However, since control is considered to be the ability to change or maintain a given parameter to a desired value, it is assumed that these parameters will be available without flight crew action.

Powered by EASA eRules Page 1003 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) INSTRUMENTS: INSTALLATION There may be alternate parameters in the cockpit that provide equivalent means to control attitude, airspeed, altitude and direction, without displaying those parameters directly (for example, without display of standby airspeed, by using a suitable angle - of - attack display). For these altern ate cases, compliance to CS 25.1333(b) must be sho wn by analysis and flight test.

CS 25.1337 Powerplant instruments

ED Decision 2003/ 2/RM (a) Instruments and instrument lines (1) Each powerplant instrument line must meet the requirements of CS 25.993 and CS 25.1183 .

(2) Each line carrying flammable fluids under pressure must – (i) Have restricting orifices or other safety devices at the source of pressure to prevent the escape of excessive fluid if the line fails; and (ii) Be installed and located so that the escape of fluids would not create a hazard.

(3) Each powerplant instrument that utilises flammable fluids must be installed and located so that the escape of fluid would not create a hazard.

(b) Fuel quantity indicator . There must be means to indicate to the flight - crew members, the quantity, in litres, (gallons), or equivalent units , of usable fuel in each tank during flight. In addition – (1) Each fuel quantity indicator must be calibrated to read ‘zero’ during level flight when the quantity of fuel remaining in the tank is equal to the unusable fuel supply determined under CS 25.959 ; (2) Tanks with interconnected outlets and airspaces may be treated as one tank and need not have separate indicators; and (3) Each exposed sight gauge, used as a fuel quantity indicator, must be protected again st damage.

(c) Fuel flow meter system . If a fuel flow meter system is installed, each metering component must have a means for bypassing the fuel supply if malfunction of that component severely restricts fuel flow.

(d) Oil quantity indicator . There must be a stick gauge or equivalent means to indicate the quantity of oil in each tank. If an oil transfer or reserve oil supply system is installed, there must be a means to indicate to the flight crew, in flight, the quantity of oil in each tank.

(e) Turbo - propeller blade position indicator. Required turbo - propeller blade position indicators must begin indicating before the blade moves more than 8 ° below the flight low pitch stop. The source of indication must directly sense the blade position.

Powered by EASA eRules Page 1004 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT

ELECTRICAL SYSTEMS AND EQUIPMENT

CS 25.1351 General

ED Decision 2016 / 010/R (See AMC 25.1351) (a) Electrical system capacity . The required generating capacity, and number and kinds of power sources must – (1) Be determined by an electrical load analysis; and (2) Meet the requirements of CS 25.1309 .

(b) Generating system . The generating system includes electrical power sources, main power busses, transmission cables, and associated control, regulation, and protective devices. It must be designed so that – (1) Power sources function properly when independent and when connected in combina tion; (2) No failure or malfunction of any power source can create a hazard or impair the ability of remaining sources to supply essential loads; (3) The system voltage and frequency (as applicable) at the terminals of all essential load equipment can be m aintained within the limits for which the equipment is designed, during any probable operating condition; (4) System transients due to switching, fault clearing, or other causes do not make essential loads inoperative, and do not cause a smoke or fire haza rd; (5) There are means accessible where necessary, in flight, to appropriate crew members for the individual and rapid disconnection of each electrical power source (see AMC 25.1351(b)(5) ); and (6) There are mean s to indicate to appropriate crew members the generating system quantities essential for the safe operation of the system, such as the voltage and current supplied by each generator (see AMC 25.1351(b)(6) ).

(c) Ext ernal power . If provisions are made for connecting external power to the aeroplane, and that external power can be electrically connected to equipment other than that used for engine starting, means must be provided to ensure that no external power supply having a reverse polarity, a reverse phase sequence (including crossed phase and neutral), open circuit line, incorrect frequency or voltage, can supply power to the aeroplane’s electrical system.

(d) Operation without normal electrical power. (See AMC 25.1351(d) .) The following apply: (1) Unless it can be shown that the loss of the normal electrical power generating system(s) is Extremely Improbable, alternate high integrity electrical power system(s), independent of the normal electrical power generating system(s), must be provided to power those services necessary to complete a flight and make a safe landing.

Powered by EASA eRules Page 1005 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT (2) The services to be powered must include – (i) Those required for immediate s afety and which must continue to operate following the loss of the normal electrical power generating system(s), without the need for flight crew action; (ii) Those required for continued controlled flight; and (iii) Those required for descent, approach an d landing.

(3) Failures, including junction box, control panel or wire bundle fires, which would result in the loss of the normal and alternate systems must be shown to be Extremely Improbable.

[Amdt 25/18]

AMC 25.1351(b)(5) Generating System

ED Decision 2 003/ 2/RM 1 The disconnect means required by CS 25.1351(b)(5) should be accessible to the appropriate flight - crew members in their normal seated positions.

2 The power source controls should be considered as cockp it controls and therefore also comply with CS 25.777 .

3 It may not be necessary to provide disconnection controls for all power sources, for example RAT generators or engine control dedicated generators. Where it is necessary to isolate the alternate power source when normal generator power is restored, such isolation should be possible.

AMC 25.1351(b)(6) Generating System

ED Decision 2003/2/RM Each source of electrical supply (e.g. generators and batteries) should be provided with means to give the flight crew immediate warning of the failure of its output. These warning means are additional to the system indication requirements of CS 25.1351(b)(6) . For multiphase systems the warning should also indicate the loss of any phase.

AMC 25.1351(d) Operation without Normal Electrical Power

ED Decision 2020/024/R 1 Provision should be made to ensure adequate e lectrical supplies to those services, which are necessary to complete the flight and make a safe landing in the event of a failure of all normal generated electrical power. All components and wiring of the alternate supplies should be physically and electr ically segregated from the normal system and be such that no single failure, including the effects of fire, the cutting of a cable bundle, the loss of a junction box or control panel, will affect both normal and alternate supplies.

2 When ensuring the adeq uacy of electrical supplies relative to alternate power source duration and integrity, special consideration should be given to aeroplanes such as those with fly - by - wire, for which the total loss of electrical supplies could result in an immediate loss of control.

3 In considering the services which should remain available following the loss of the normal generated electrical power systems, consideration should be given to the role and flight conditions of the aeroplane and the possible duration of flight t ime to reach an airfield and make a safe landing.

Powered by EASA eRules Page 1006 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT 4 The services required by CS 25.1351(d)(1) may differ between aeroplane types and roles and should be agreed with the Agency. These should normally include – a. A ttitude information; b. Radio communication and intercommunication; c. Navigation; d. Cockpit and instrument lighting; e. Heading, airspeed and altitude, including appropriate pitot head heating; f. Adequate flight controls; g. Adequate engine control; and Restart capability with critical type fuel (from the standpoint of flame - out and restart capability) and with the aeroplane initially at the maximum certificated altitude; h. Adequate engine instrumentation; i. Such warning, cautions and indic ations as are required for continued safe flight and landing; j. Any other services required for continued safe flight and landing.

5 Consideration should also be given to the equipment and the duration of services required to make a controlled descent and forced landing in the event of failure and inability to restart all engines.

6 Alternate Power Source Duration and Integrity 6.1 Time Limited . Where an alternate power source provided to comply with CS 25.1351(d) is time limited (e.g. battery), the required duration will depend on the type and role of the aeroplane. Unless it can be shown that a lesser time is adequate, such a power source should have an endurance of at least 60 minutes, at least 30 minu tes of which is available under IMC. An endurance of less than 30 minutes under IMC would not normally be acceptable. The endurances, with any associated procedures, should be specified in the Flight Manual. The endurance time should be determined by calcu lation or test, due to allowance being made for – a. Delays in flight crew recognition of failures and completion of the appropriate drill where flight crew action is necessary. This should be assumed to be 5 minutes provided that the failure warning syst em has clear and unambiguous attention - getting characteristics and where such a delay is acceptable and compatible with the crew’s primary attention being given to other vital actions.

b. The minimum voltage acceptable for the required loads, the battery s tate of charge, the minimum capacity permitted during service life and the battery efficiency at the discharge rates and temperatures likely to be experienced. Unless otherwise agreed, for the purpose of this calculation, a battery capacity at normal ambie nt conditions of 80% of the nameplate rated capacity, at the one - hour rate, and a 90% state of charge, may be assumed (i.e. 72% of nominal demonstrated rated capacity at +20°C). The allowance for battery endurance presumes that adequate requirements for pe riodic battery maintenance have been agreed.

c. For those aeroplanes where the battery is also used for engine or APU starting on the ground, it should be shown that following engine starts, the charge rate of the battery is such that the battery is mainta ined in a state of charge that will ensure Powered by EASA eRules Page 1007 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTR ICAL SYSTEMS AND EQUIPMENT adequate alternate power source duration should a failure of generated power occur shortly after take - off.

NOTE: This may normally be achieved by ensuring that, following battery - powered starting, the battery char ge current has fallen to a declared level prior to take - off.

d. For those aeroplanes where the battery is used for in - flight starting of the engines or APU, it may be necessary to include limitations on the number of attempted starts, or to provide a separ ate dedicated battery for such purposes.

6.2 Non - Time Limited . Where an alternate electrical supply is provided by a non time limited source, e.g. APU, ram air turbine, pneumatic or hydraulic motor, due account should be taken of any limitation imposed by aeroplane speed, attitude, altitude etc., which may affect the capabilities of that power source. In considering the power source, account should be taken of the following: a. Auxiliary Power Unit (APU). An APU capable of continuous operation throughout an adequate flight envelope may be considered an acceptable means of supplying electrical power to the required services provided that its air start capability is adequate and may be guaranteed. Where, however the APU is dependent for its starting current on a battery source, which is supplying critical loads, such starting loads may prejudice the time duration of the flight if APU start is not achieved.

It may be necessary therefore to include limitations on the number of attempted starts or to provide a sep arate battery for APU starting, if this method of supplying electrical power is adopted. Consideration should also be given to the equipment, services and duration required prior to the APU generator coming online. Common failures, which could affect the o peration of all engines and the APU, should be taken into consideration, e.g. fuel supply.

b. Ram Air Turbine (RAT). A ram air turbine may be utilised to provide an alternate electrical power source, but due consideration must be given to ensuring that the means of bringing the unit into use are not dependent on a source which may have been lost as a result of the original failure. This will normally necessitate independent, duplicate means of deployment. Particular attention should be given to ensuring tha t the RAT and its means of deployment satisfy the overall reliability requirements.

The continuity of electrical power to those services which must remain operative without crew action prior to the RAT being brought into operation, may necessitate the use of a battery, unless the operation of the emergency power source is automatic and is supplying power within a timespan so as not to jeopardise the continued safety of the aeroplane in the event of failure of normal generated electrical power.

c. Pneumatic or Hydraulic Motor Drive Power Source. A pneumatic or hydraulic motor driven electrical power source may be utilised subject to the same constraints on activation as the ram air turbine (see 6.2(b)). Care should be taken in ensuring that the operation of t he pneumatic or hydraulic system is not prejudiced by faults leading to, or resulting from, the original failure, including the loss of, or inability to restart all engines.

Powered by EASA eRules Page 1008 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT d. Regaining of Main Generators . In the event of a major loss of electrical power, provision may be made for regaining the output of one or more generators using separate control and switching arrangements on the generator side of the normal generator line contactor. Such a system would not normally be acceptable on aeroplanes with less than three engine - driven generators, as the probability of the loss of all engine - driven generators is unlikely to meet the requirements of CS 25.1351(d) . To comply with CS 25.1351(d)(2) the system should be designed such that the loss of both the main and alternate means of control and distribution is Extremely Improbable. Consideration should be given to the serv ices and duration required prior to the activation of the system and to enable a descent and forced landing to be made, in the event of the inability to restart all engines.

e. Usage of a battery system to ensure continuity of electrical power. This subpar agraph applies if a battery system is used to ensure the continuity of electrical power when the non - time - limited alternate electrical power source(s) is(are) not providing electrical power. When establishing the minimum battery endurance requirements, the following conditions should be considered: — It should be shown that following the loss of normal electrical power, and during the time periods when the non - time limited alternate electrical power source(s) does(do) not provide electrical power (per design) , the battery system provides an adequate electrical power supply to those services which are necessary to make a controlled descent and landing, stop and complete a safe evacuation of the aeroplane ( CS 25.1351(d) and 25.1362 ).

— The applicant should take into account the transient time period between the loss of normal electrical power and the non - time limited alternate electrical power source being operational, as well as ot her time period(s) when the non - time limited alternate electrical power source is not available.

For example, the time period between when the RAT electrical generator goes off - line and when the aeroplane is stopped on ground and a safe evacuation of the a eroplane is performed.

— The most critical configuration, from a battery system point of view, should be considered. The loss of normal electrical power is usually associated with one of the following conditions: either the all - engine out case or the loss of power coming from the primary power centre. In the second case, the proximity of a battery to the power centre should be taken into account. Any battery located near this power centre should be considered as part of the normal electrical power generating system (ref. CS 25.1351(d)(1) .

— The time periods corresponding to the intended usage of the battery system in the emergency scenario will need to be substantiated, with a due margin taken for any uncertainty. Any pe rmanent load on the battery system (i.e. a hot bus) will also have to be accounted for.

— For determining the capacity of the battery system, Section 6.1(b) of this AMC, on time - limited power sources, applies.

— The capability of the backup battery system to p rovide adequate power for the required minimum duration should be demonstrated by actual testing or demonstrated equivalent means.

Powered by EASA eRules Page 1009 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT — Instructions for Continued Airworthiness for the battery system should be provided. These instructions should ensure that ade quate battery power is available between maintenance cycles. There should be a means for the flight crew or maintenance personnel to determine the actual battery system charge state prior to take - off.

[Amdt 25/26]

CS 25.1353 Electrical equipment and instal lations

ED Decision 2016 / 010 /R (See AMC 25.1353) (a) Electrical equipment and controls, must be installed so that operation of any one unit or system of units will not adversely affect the simultaneous operation of any other electrical unit or system essential to the safe operation. Any electrical interference likely to be present in the aero plane must not result in hazardous effects upon the aeroplane or its systems except under extremely remote conditions. (See AMC 25.1353(a) .)

(b) Electrical Wiring Interconnection System components must meet the req uirements of 25.1703 , 25.1707 , 25.1711 and 25.1717 .

(c) Storage batteries must be design ed and installed as follows: (1) Safe cell temperatures and pressures must be maintained during any probable charging or discharging condition. No uncontrolled increase in cell temperature may result when the battery is recharged (after previous complete d ischarge) – (i) At maximum regulated voltage or power; (ii) During a flight of maximum duration; and (iii) Under the most adverse cooling condition likely to occur in service.

(2) Compliance with sub - paragraph (1) of this paragraph must be shown by test un less experience with similar batteries and installations has shown that maintaining safe cell temperatures and pressures presents no problem.

(3) No explosive or toxic gases emitted by any battery in normal operation, or as the result of any probable malfu nction in the charging system or battery installation, may accumulate in hazardous quantities within the aeroplane.

(4) No corrosive fluids or gases that may escape from the battery may damage surrounding aeroplane structures or adjacent essential equipmen t.

(5) Each nickel cadmium battery installation must have provisions to prevent any hazardous effect on structure or essential systems that may be caused by the maximum amount of heat the battery can generate during a short circuit of the battery or of ind ividual cells.

(6) Nickel cadmium battery installations must have – (i) A system to control the charging rate of the battery automatically so as to prevent battery overheating or; (ii) A battery temperature sensing and over - temperature warning system with a means for disconnecting the battery from its charging source in the event of an overtemperature condition; or Powered by EASA eRules Page 1010 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT (iii) A battery failure sensing and warning system with a means for disconnecting the battery from its charging source in the event of batt ery failure. (See AMC 25.1353(c)(6)(ii) and (iii) .)

(d) Reserved (e) Electrical bonding must provide an adequate electrical return path under both normal and fault conditions, on aeroplanes having earthed electri cal systems (see CS 25.899 ).

[Amdt 25/5] [Amdt 25/18]

AMC 25.1353(a) Electrical equipment and i nstallations

ED Decision 2003/ 2/RM The possible sources of interference to be considered should include – a. Conducted and radiated interference caused by electrical noise generation from apparatus connected to the busbars, b. Coupling between electrical cables or between cables and aeria l feeders, c. Malfunctioning of electrically - powered apparatus, d. Parasitic currents and voltages in the electrical distribution and earth systems, including the effects of lightning currents or static discharge, e. Difference frequencies between gener ating or other systems, and f. The requirements of CS 25.1309 should also be satisfied.

AMC 25.1353( c)(6)(ii) and (iii) Electrical equipment and i nstallations

ED Decision 2003/2/RM Where temperature sensing and over - temperature warning devices are installed to comply with CS 25.1353(c)(6)(ii) or (iii) , their correct operations should be verified at agreed maintenance intervals in addition to compliance with CS 25.1309(a) and (b) .

CS 25.1355 Distribution system

ED Decision 2016 / 010/R (See AMC 25.1355) (a) The distribution system includes the distribution busses, their associated feeders, and each control protective dev ice.

(b) Reserved.

(c) If two independent sources of electrical power for particular equipment or systems are required for certification, or by operating rules, in the event of the failure of one power source for such equipment or system, another power sou rce (including its separate feeder) must be automatically provided or be manually selectable to maintain equipment or system operation.

(See AMC 25.1355(c) and AMC 25.1310( a) .)

[Amdt 25/18] Powered by EASA eRules Page 1011 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT

AMC 25.1355(c) Distribution s ystem

ED Decision 2003/2/RM The arrangement, protection and control of the feeders from the busbars to the distribution points, and the divisions of loads among the feeders, should be such that no single fault occurring in any feeder or associated control circuit will hazard the aero plane.

CS 25.1357 Circuit protective devices

ED Decision 2016/010 /R (See AMC 25.1357) (a) Automatic protective devices must be used to minimise distress to the electrical system and hazard to the aeroplane in the event of wiring faults or serious malfunc tion of the system or connected equipment. (See AMC 25.1357(a) .)

(b) The protective and control devices in the generating system must be designed to de - energise and disconnect faulty power sources and power transmi ssion equipment from their associated busses with sufficient rapidity to provide protection from hazardous over - voltage and other malfunctioning.

(c) Each re - settable circuit protective device must be designed so that, when an overload or circuit fault exists, it will open the circuit irrespective of the position of the operating control.

(d) If the ability to reset a circuit breaker or replace a fuse is essential to safety in flight, that circuit breaker or fuse must be located and identified so t hat it can be readily reset or replaced in flight.

Where fuses are used, there must be spare fuses for use in - flight equal to at least 50% of the number of fuses of each rating required for complete circuit protection.

(e) Each circuit for essential loads must have individual circuit protection. However, individual protection for each circuit in an essential load system (such as each position light circuit in a system) is not required.

(f) For aeroplane systems for which the ability to remove or reset power during normal operations is necessary, the system must be designed so that circuit breakers are not the primary means to remove or reset system power, unless specifically designed for use as a switch. (see AMC 25. 1357(f) ).

(g) Automatic reset circuit breakers may be used as integral protectors for electrical equipment (such as thermal cutouts) if there is circuit protection to protect the cable to the equipment.

[Amdt 25/5] [Amdt 25/18]

AMC 25.1357(a) Circuit prote ctive d evices

ED Decision 2003/2/RM No hazard should result from the effects of variations in ambient temperatures on either the protective device or the equipment it protects. See also CS 25.1309 .

Powered by EASA eRules Page 1012 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT

AMC 25.1357(f ) System Power Removal

ED Decision 2008/006/R 1 Subparagraph 25.1357(f) requires that circuit breakers are not used as the primary means to remove or reset system power for those aeroplane systems for which the ability to remove or reset power during norma l operation is necessary.

2 It is not the intent of the requirement that every electrically powered system in the aeroplane has a means to remove power other than a circuit breaker. The phrase “normally requiring power removal” is used to distinguish betw een aeroplane systems normally turned on and off during normal operations, and those systems normally powered at all times, such as flight deck multi - function displays or t he flight - management computer. But if, for example, the flight - management computer d id require power cycling regularly, for whatever reason, this system would be required to have a means to do this other than using the circuit breakers.

3 Systems requiring power removal during normal operations should be designed so that power is removed from the system as closely as practical to the source of power instead of simply deactivating the outputs of the systems power supplies.

4 A separate, or integrated, power switch may be used to show compliance with CS 25.1357(f) . If an integrated switch is used (that is, a switch that controls power to multiple aeroplane systems), then it must be shown that removing or resetting power for those multiple systems will not adversely affect safe flight.

5 A swi tch - rated circuit breaker can be used if it is shown to be appropriately rated for the number of switch cycles expected to be executed during the service life of the system or of the circuit breaker.

[Amdt 25/5]

CS 25.1360 Precautions against injury

ED Dec ision 2016 / 010/R (See AMC 25.1360) (a) Shock . The electrical system must be designed so as to minimise the risk of electric shock to crew, passengers and servicing personnel and also to maintenance personnel using normal precautions. (See AMC 25.1360(a) and CS 25.899 .)

(b) Burns . The temperature of any part, which has to be handled during normal operation by the flight crew, must not be such as to cause dangerous inadverte nt movement, or injury to the crewmember. (See AMC 25.1360(b) .)

[Amdt 25/18]

AMC 25.1360(a) Precaution against i njury

ED Decision 2007 / 010/R 1 Where there may be a hazard during maintenance or servicing, aeroplan e panels, etc., carrying voltages of above 50V RMS, should be marked with the voltage.

2 Where socket outlets are provided, these should be labelled as to use and with the output voltage or voltages. Where the output voltage exceeds 100 volts d.c. and/or 50 volts a.c. RMS either the output should be electrically isolated from the aeroplane str ucture, or means shall be provided to prevent inadvertent contact with live parts.

[Amdt 25/3] Powered by EASA eRules Page 1013 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT

AMC 25.1360(b) Precau tion against i njury

ED Decision 2007 / 010/R 1 For equipment which has to be handled during normal operation by the flight or cabin crew, a temperature rise of the order of 25°C, for metal parts, should not be exceeded. For other equipment, mounted in parts of the aeroplane normally accessible to passengers or crew, or which may come into contact with objects such as clothing or paper, the sur face temperature should not exceed 100°C, in an ambient temperature of 20°C.

2 The heating surfaces of properly installed cooking apparatus are excluded from these requirements.

3 The provision of guards around hot surfaces is an acceptable method of com plying with these requirements.

[Amdt 25/3]

CS 25.1362 Electrical supplies for emergency conditions

ED Decision 2003/ 2/RM (See AMC 25.1362 ) A suitable supply must be provided to those services, which are required, in order that emergency procedures may be carried out, after an emergency landing or ditching. The circuits for these services must be so designed, protected and installed such that the risk of their causing a fire, under these conditions, is minimised.

AMC 25.1362 Electrical supplies for emergency c onditions

ED Decision 2003/ 2/RM 1 The emergency services which may require a supply include fuel shut - off valves, hydraulic shut - off va lves and engine / APU fire extinguisher systems.

2 An appropriate design and/or unambiguous AFM procedures should be provided in order to prevent disconnection of the electrical supply to the required services before the emergency procedures are fully com pleted.

CS 25.1363 Electrical system tests

ED Decision 2003/ 2/RM (See AMC 25.1363 ) (a) Tests must be made to determine that the performance of the electrical supply systems me ets the requirements of this CS - 25 under all the appropriate normal and failure conditions. When laboratory tests of the electrical system are conducted – (1) The tests must be performed on a mock - up using the same generating equipment used in the aeroplane; (2) The equipment must simulate the electrical characteristics of the distribution wiring and connected loads to the extent necessary for valid test results; and (3) Laboratory generator drives must simulate the actual prime movers on the aeroplane with respect to their reaction to gener ator loading, including loading due to faults.

(b) For each flight condition that cannot be simulated adequately in the laboratory or by ground tests on the aeroplane, flight tests must be made.

Powered by EASA eRules Page 1014 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT

AMC 25.1363 Electrical systems t ests

ED Decision 2003/ 2/RM 1 In carrying out the tests due account should be taken of load switching and flight crew operation of the system.

2 Laboratory or Ground Tests 2.1 All tests should be carried out with all equipment as representative as possible of the actual aeroplane. In particular, the simulation should include the correct representation of aeroplane cables in size, length and impedance, the correct ground (airframe) impedance and relative ground plane location and their location to other cables or systems that could inf luence performance. System loads and the generator drive system should also be correctly simulated.

2.2 The tests may be carried out on representative laboratory rigs or in an actual aeroplane, as appropriate.

2.3 Test procedures should be prepared to co ver each test condition in the programme.

3 Aeroplane Flight Tests 3.1 If not adequately simulated by laboratory or ground testing, flight tests should be carried out as necessary.

3.2 Temperature tests should be carried out on equipment to establish the adequacy of the cooling media under all ground and flight conditions.

3.3 Measurements should be made to ensure that all equipment, particularly the aeroplane battery, is operating within its specified environmental conditions.

3.4 Test procedures shoul d be prepared to cover the conditions of the tests.

CS 25.1365 Electrical appliances, motors and transformers

ED Decision 2017 / 01 5/R (See AMC 25.1365 ) (a) Domestic appliances must be so designed and installed that in the event of failures of the electrical supply or control system, the requirements of CS 25.1309(b) and (c) will be satisfied.

(b) The installation of g alleys and cooking appliances must be such as to minimise the risk of overheat , fire, burns, or spilled liquids to the aeroplane, passengers, and crew (See AMC 25.1365(b)).

(c) Domestic appliances, particularly those in galley areas, must be so installed o r protected as to prevent damage or contamination of other equipment or systems from fluids or vapours which may be present during normal operation or as a result of spillage, where such damage or contamination may hazard the aeroplane.

(d) Unless it can b e shown that compliance with CS 25.1309(b) is provided by the circuit protective device required by CS 25.1357(a) , electric motors and transformers etc. (including those installed in domestic systems, such as galle ys and toilet flush systems) must be provided with a suitable thermal protection device if necessary to prevent them overheating such as to create a smoke or fire hazard under normal operation and failure conditions.

[Amdt 25/2] [Amdt 25/19] Powered by EASA eRules Page 1015 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT

AMC 25.1365 El ectrical appliances, motors and transformers

ED Decision 2003/ 2/RM 1. Heated Domestic Appliances (Galley Equipment) In showing compliance with CS 25.1365(a) , the following should be taken into consideration: 1.1 The design and installation of heated domestic appliances should be such that no single failure (e.g. welded thermostat or contactor, loss of water supply) can result in dangerous overheating and consequent risk of fire or smoke or injury to occupants.

An acceptable method of achieving this is by the provision of a means independent of the normal temperature control system, which will automatically interrupt the electrical power supply to the unit in the event of an overheat condition occurring. The me ans adopted should be such that it cannot be reset in flight.

1.2 The design and installation of microwave ovens should be such that no hazard could be caused to the occupants or the equipment of the aeroplane under either normal operation or single failu re conditions.

1.3 Heated liquid containers, e.g. water boilers, coffee makers should, in addition to overheat protection, be provided with an effective means to relieve overpressure, either in the equipment itself or in its installations.

1.4 When consi dering failures of domestic appliances, the effect of the loss of the water supply to a water heater, with the electrical supply maintained, should be taken into account.

NOTES: Due account should be taken of the possible effects of lime scale deposit bo th in the design and maintenance procedures of water heating equipment.

The design of galley and cooking appliance installations should be such as to facilitate cleaning to limit the accumulation of extraneous substances, which may constitute a fire risk.

2. Electric Overheat Protection Equipment In showing compliance with CS 25.1365(d) , the following should be taken into consideration: a. Failures of any automatic control systems, e.g. automatic timer systems, which may cause the motor to run continuously; b. Short circuit failures of motor windings or transformer windings to each other or to the motor or transformer frame; c. Open circuit of one or more phases on multi - phase motors; d. Motor seizures; e. The proximity of flammable materials or fluids; f. The proximity of other aeroplane installations; g. Spillage of fluids, such as toilet waste; h. Accumulation of combusti ble material; and i. Cooling air discharge under normal operating or failure conditions.

Powered by EASA eRules Page 1016 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT 3. Water Systems 3.1 Where water is provided in the aeroplane for consumption, or use by the occupant, the associated system should be designed so as to ensure tha t no hazard to the aeroplane could result from water coming into contact with electrical or other systems.

3.2 Service connections (filling points) should be of a different type from those used for other services, such that water could not inadvertently b e introduced into the systems for other services.

AMC 25.1365(b) Installation of Cooktops

ED Decision 2017/015/R The following acceptable means of compliance are applicable to cooktops with electrically powered heating elements. Use of other types of heat sources, such as gas, is unlikely to be acceptable. If such a design is desired, EASA should be contacted for adv ice.

(1) Suitable means, such as conspicuous element ‘on’ indicators, physical barriers, or handholds, should be installed to minimise the potential of inadvertent personnel contact with hot surfaces of both the cooktop and cookware. Conditions of turbul ence should also be considered.

(2) Sufficient design means should be provided to restrain cookware, including their contents, in place on the cooktop against flight loads and turbulence.

(a) Restraints should be provided to preclude hazardous movement of cookware and contents thereof. These restraints should accommodate the cookware that is approved for use with the cooktop.

(b) Restraints should be designed to be easily used and effective in service. The cookware restraint system should also be desig ned in a way that it may not be easily disabled, thus rendering it unusable.

(c) Appropriate placarding should be installed prohibiting the use of cookware not approved for use with the cooktop.

(3) Appropriate placarding should be installed prohibitin g the use of cooktops (i.e. power on any heating surface) during taxiing, take - off, and landing.

(4) Suitable means should be provided to address the possibility of a fire starting on the cooktop or in its immediate vicinity. The following two means are acceptable: (a) Appropriate placarding should be installed that prohibits any heating surface from being powered when the cooktop is unattended (Note: this would prohibit a single person from cooking on the cooktop and intermittently serving food to pass engers while any surface is powered). A fire detector should be installed in the vicinity of the cooktop, which provides a warning audible throughout the passenger cabin; moreover, a fire extinguisher of appropriate size and extinguishing agent should be i nstalled in the immediate vicinity of the cooktop. Access to the extinguisher should not be blocked by a possible fire on or around the cooktop. One of the fire extinguishers required by CS 25.851 may be used to satisfy this requirement if it is located in the vicinity of the cooktop and the total complement of extinguishers remains evenly distributed throughout the cabin. If this is not possible, then the extinguisher in the cooktop area should be additional to those required by CS 25.851; or Powered by EASA eRules Page 1017 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) ELECTRICAL SYSTEMS AND EQUIPMENT (b) An automatic (e.g. thermally activated) system should be installed to extinguish a fire at the cooktop and immediately adjacent surfaces. The agent used in the system should be an approved flooding agent suitable for use in an occupied area. The fire suppr ession system should have an appropriately located manual activation control. Activation of the fire suppression system (automatic or manual) should also automatically shut off power to the cooktop.

(5) The surfaces of the galley surrounding the cooktop, which would be exposed to a fire on the cooktop surface or in cookware on the cooktop, should be constructed of materials that comply with the flame penetration resistance requirements of Appendix F, Part III. During the selection of all galley materials in the vicinity of the cooktop, consideration should be given to ensure that the flammability resistance characteristics of the materials will not be adversely affected by the use of cleaning agents and utensils used to remove cooking stains.

(6) The coo ktop should be ventilated with a system independent of the aeroplane cabin and cargo ventilation system. Maintenance procedures and time intervalsshould be established for inspection and cleaning or replacement of ventilation system components to prevent t he accumulation of flammable oils creating a fire hazard. These procedures and time intervals should be included in the instructions for continued airworthiness as required by CS 25.1529.

The ventilation system ducting should be protected by a flame arrest er (Note: the applicant may find additional useful information in Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) No 85, Revision E, ARP85E ‘Air Conditioning Systems for Subsonic Airplanes’ of 1 August 1991).

(7) Means should b e provided to contain spilled foods or fluids in a manner that will prevent the creation of a slipping hazard to occupants as well as the loss of structural strength due to aeroplane corrosion.

(8) Cooktop installations should provide adequate space for the user to immediately escape a hazardous cooktop condition.

(9) A means to shut off power to the cooktop should be provided at the galley containing the cooktop and in the cockpit. If one (or more) dedicated switch(es) is (are) provided in the cockpit, smoke or fire emergency procedures should be provided in the AFM to cover their use.

(10) The cooktop should have either a lid that will completely enclose the cooking surface, or an appropriately located fire blanket of a size sufficient to completely cover the cooking surface should be provided. If a lid is installed, there should be a means to automatically shut off power to the cooktop when the lid is closed. The fire blanket material should be demonstrated to meet the European Standard (EN) 1869:199 7, Fire blankets, or equivalent.

[Amdt 25/19] Powered by EASA eRules Page 1018 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) LIGHTS

LIGHTS

CS 25.1381 Instrument lights

ED Decision 2003/ 2/RM (a) The instrument lights must – (1) Provide sufficient illumination to make each instrument, switch and other device necessary for safe operation easily readable unless sufficient illumination is available from another source; and (2) Be installed so that – (i) Their direct rays are shielded from the pilot’s eyes; and (ii) No objectionable reflections are visible to the pilot.

(b) Unl ess undimmed instrument lights are satisfactory under each expected flight condition, there must be a means to control the intensity of illumination.

CS 25.1383 Landing lights

ED Decision 2003/ 2/RM (a) Each landing light must be approved, and must be inst alled so that – (1) No objectionable glare is visible to the pilot; (2) The pilot is not adversely affected by halation; and (3) It provides enough light for night landing.

(b) Except when one switch is used for the lights of a multiple light installation at one location, there must be a separate switch for each light.

(c) There must be a means to indicate to the pilots when the landing lights are extended.

CS 25.1385 Position light system installation

ED Decision 2003/2/RM (a) General . Each part of each position light system must meet the applicable requirements of this paragraph and each system as a whole must meet the requirements of CS 25.1387 to 25. 1397 .

(b) Forward position lights . Forward position lights must consist of a red and a green light spaced laterally as far apart as practicable and installed forward on the aeroplane so that, with the aeroplane in the normal flying position, the red light is on the left side, and the green light is on the right side. Each light must be approved.

(c) Rear position light. The rear position light must be a white light mounted as far aft as practicable on the tail or on each wing tip, and must be approved.

(d ) Light covers and colour filters. Each light cover or colour filter must be at least flame resistant and may not change colour or shape or lose any appreciable light transmission during normal use.

Powered by EASA eRules Page 1019 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) LIGHTS

CS 25.1387 Position light system dihedral angles

ED Decision 2003/2/RM (a) Except as provided in sub - paragraph (e) of this paragraph, each forward and rear position light must, as installed, show unbroken light within the dihedral angles described in this paragraph.

(b) Dihedral angle L (left) is formed by two intersecting vertical planes, the first parallel to the longitudinal axis of the aeroplane, and the other at 110 ° to the left of the first, as viewed when looking forward along the longitudinal axis.

(c) Dihedral angle R (right) is formed by two in tersecting vertical planes, the first parallel to the longitudinal axis of the aeroplane, and the other at 110 ° to the right of the first, as viewed when looking forward along the longitudinal axis.

o (d) Dihedral angle A (aft) is formed by two intersecting vertical planes making angles of 70 to the right and to the left, respectively, to a vertical plane passing through the longitudinal axis, as viewed when looking aft along the longitudinal axis.

(e) If the rear position light when mounted as far aft as p racticable in accordance with CS 25.1385(c) , cannot show unbroken light within dihedral angle A (as defined in sub - paragraph (d) of this paragraph), a solid angle or angles of obstructed visibility totalling not mo re than 0·04 steradians is allowable within that dihedral angle, if such solid angle is within a cone whose apex o is at the rear position light and whose elements make an angle of 30 with a vertical line passing through the rear position light.

CS 25.138 9 Position light distribution and intensities

ED Decision 2003/ 2/RM (a) General . The intensities prescribed in this paragraph must be provided by new equipment with light covers and colour filters in place. Intensities must be determined with the light so urce operating at a steady value equal to the average luminous output of the source at the normal operating voltage of the aeroplane. The light distribution and intensity of each position light must meet the requirements of sub - paragraph (b) of this paragr aph.

(b) Forward and rear position lights. The light distribution and intensities of forward and rear position lights must be expressed in terms of minimum intensities in the horizontal plane, minimum intensities in any vertical plane, and maximum intensi ties in overlapping beams, within dihedral angles L, R and A, and must meet the following requirements: (1) Intensities in the horizontal plane. Each intensity in the horizontal plane (the plane containing the longitudinal axis of the aeroplane and perpen dicular to the plane of symmetry of the aeroplane) must equal or exceed the values in CS 25.1391 .

(2) Intensities in any vertical plane. Each intensity in any vertical plane (the plane perpendicular to the horizon tal plane) must equal or exceed the appropriate value in CS 25.1393 , where I is the minimum intensity prescribed in CS 25.1391 for the corresponding angles in the horizonta l plane.

(3) Intensities in overlaps between adjacent signals. No intensity in any overlap between adjacent signals may exceed the values given in CS 25.1395 , except that higher intensities in overlaps may be used with main beam intensities substantially greater than the minima specified in CS 25.1391 and 25.1393 if the overlap intensities in relation to the main beam intensities do not adversely affect signal clarity. When the peak intensity of the forward position lights is more than 102 cd (100 candles), the maximum overlap intensities between them may exceed the values given in CS 25.1395 if the overlap intensity in Area Powered by EASA eRules Page 1020 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) LIGHTS A is not more than 10% of peak position light intensity and the overlap intensity in Area B is not greater than 2·5% of peak position light intensity.

CS 25.1391 Minimum intensities in the horizo ntal plane of forward

and rear position lights

ED Decision 2003/ 2/RM Each position light intensity must equal or exceed the applicable values in the following table: Dihedral angle Angle from right or left of longitudinal Intensity candela (candles) (li ght included ) axis, measured from dead ahead o o L and R 0 to 10 41 (40) o o (forward red and green) 10 to 20 31 (30) o o 20 to 110 5 o o A (rear white) 110 to 180 20

CS 25.1393 Minimum intensities in any vertical plane of forward

and rear position lights

ED Decision 2003/ 2/RM Each position light intensity must equal or exceed the applicable values in the following table: Angle above or below the horizontal plane: Inten sity 0 ° 1·00 I 0 ° to 5 ° 0·90 I 5 ° to 10 ° 0·80 I 10 ° to 15 ° 0·70 I 15 ° to 20 ° 0·50 I 20 ° to 30 ° 0·30 I 30 ° to 40 ° 0·10 I 40 ° to 90 ° 0·05 I

CS 25.1395 Maximum intensities in over - lapping beams of f orward

and rear position lights

ED Decision 2003/ 2/RM No position light intensity may exceed the applicable values in the following table, except as provided in CS 25.1389(b)(3) : Maximum intensity Overlaps Area A candela (candles) Area B candela (candles) Green in dihedral angle L 10 1 Red in dihedral angle R 10 1 Green in dihedral angle A 5 1 Red in dihedral angle A 5 1 Rear white in dihedral angle L 5 1 Rear white in dihedral angle R 5 1 Powered by EASA eRules Page 1021 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPA RT F – EQUIPMENT (CS - 25) LIGHTS Where – (a) Area A includes all directions in the adjacent dihedral angle that pass through the light source and intersect the common boundary plane at more than 10 ° but less than 20 ° ; and (b) Area B includes all directions in the adjacent dihedral angle that pass through the light source and intersect the common boundary plane at more than 20 ° .

CS 25.1397 Colour specifications

ED Decision 2003/ 2/RM Each position light colour must have the applicable International Commission on Illumination chromaticity co - ordinates as follows: (a) Aviation red – ‘y’ is not greater than 0·335; and ‘z’ is not greater than 0·002.

(b) Aviation green – ‘x’ is not greater than 0·440 – 0·320y; ‘x’ is not greater than y – 0 ·170; and ‘y’ is not less than 0·390 – 0·170x.

(c) Aviation white – ‘x’ is not less than 0·300 and not greater than 0·540; ‘y’ is not less than ‘x – 0·040’ or ‘y – 0·010’, whichever is the smaller; and o ‘y’ is not greater than ‘x+0·020’ nor ‘0·636 – 0·400x’; Where ‘y ’ is the ‘y’ co - ordinate of the o Planckian radiator for the value of ‘x’ considered.

CS 25.1401 Anti - collision light system

ED Decision 2003/ 2/RM (a) General . The aeroplane must have an anticollision light system that – (1) Consi sts of one or more approved anti - collision lights located so that their light will not impair the crew’s vision or detract from the conspicuity of the position lights; and (2) Meets the requirements of sub - paragraphs (b) to (f) of this paragraph.

(b) Field of coverage . The system must consist of enough light to illuminate the vital areas around the aeroplane considering the physical configuration and flight characteristics of the aeroplane.

The field of coverage must extend in ea ch direction within at least 75 ° above and 75 ° below the horizontal plane of the aeroplane, except that a solid angle or angles of obstructed visibility totalling not more than 0·03 steradians is allowable within a solid angle equal to 0·15 steradians centred about the longitudinal a xis in the rearward direction.

(c) Flashing characteristics . The arrangement of the system, that is, the number of light sources, beam width, speed of rotation, and other characteristics, must give an effective flash frequency of not less than 40, nor mor e than 100 cycles per minute. The effective flash frequency is the frequency at which the aeroplane’s complete anti - collision light system is observed from a distance, and applies to each section of light including any overlaps that exist when the system Powered by EASA eRules Page 1022 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) LIGHTS c onsists of more than one light source. In overlaps, flash frequencies may exceed 100, but not 180 cycles per minute.

(d) Colour . Each anti - collision light must be either aviation red or aviation white and must meet the applicable requirements of CS 25.1397 .

(e) Light intensity . The minimum light intensities in all vertical planes, measured with the red filter (if used) and expressed in terms of ‘effective’ intensities, must meet the requirements of sub - paragraph ( f) of this paragraph. The following relation must be assumed: 𝑡 ( ) ∫ 𝐼 𝑡 𝑑𝑡 𝑡 𝐼 = 𝑒 0 ∙ 2 + ( 𝑡 − 𝑡 ) 2 1 where: I = effective intensity (candela (candles) e I(t) = instantaneous intensity as a function of time t – t = flash time interval (seconds) 2 1 Normally, the maximum value of effective intensity is obtained when t and t are chosen so 2 1 that the effective intensity is equal to the instantaneous intensity at t and t .

2 1 (f) Minimum effective intensities for anticollisi on lights. Each anti - collision light effective intensity must equal or exceed the applicable values in the following table: Angle above or below the horizontal plane: Effective intensity (candela (candles)) 0 ° to 5 ° 407 (400) 5 ° to 10 ° 244 (240) 10 ° to 20 ° 81 (80) 20 ° to 30 ° 41 (40) 30 ° to 75 ° 20

CS 25.1403 Wing icing detection lights

ED Decision 2015/008/R (see AMC 25.1403 ) Unless operations at night in known or forecast icing conditions are prohibited by an operating limitation, a means must be provided for illuminating or otherwise determining the formation of ice on the parts of the wings that are critical from the standpo int of ice accumulation. Any illumination that is used must be of a type that will not cause glare or reflection that would handicap crewmembers in the performance of their duties.

[Amdt 25/16] Powered by EASA eRules Page 1023 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) LIGHTS

AMC 25.1403 Wing icing detection lights

ED Decision 2016/01 0 /R Unless operations at night in icing conditions are prohibited by an operating limitation, CS 25.1403 requires that a means be provided, during flight at night, to illuminate or otherwise determine ice formation on parts of the wings that are critical from the s tandpoint of ice accumulations resulting from Appendix C and Appendix O icing conditions. For showing compliance with the CS - 25 certification specifications relative to SLD icing conditions represented by Appendix O, the applicant may use a comparative analysis. AMC 25.1420(f) provides guidance for comparative analysis.

a. If the flight crew cannot see the wings, one acceptable means of compliance with this regulation would be to install an ice evidence pr obe in a position where the flight crew can observe ice accumulation. The applicant should substantiate that formation of ice on this device precedes formation of ice on the wings or occurs simultaneously with it. Consideration should be given to the need for illuminating the ice evidence probe.

b. Wing icing detection lights should be evaluated both in and out of clouds during night flight to determine that the component of interest is adequately illuminated without excessive glare, reflections, or other distractions to the flight crew. These tests may be accomplished during the aeroplane certification flight tests. Typically, aeroplane - mounted illumination has been used to comply with this regulation. Use of a hand - held flashlight ha s not been considered acceptable because of the associated workload. The appropriate manual should identify the ice characteristics which the flight crew is expected to observe as well as the action the flight crew must perform if such ice is observed.

[Am dt 25/16] [Amdt 25/18] Powered by EASA eRules Page 1024 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT

SAFETY EQUIPMENT

CS 25.1411 General

ED Decision 2008 / 006/R (a) Accessibility . Required safety equipment to be used by the crew in an emergency must be readily accessible.

(b) Stowage provisions . Stowage provisions for required emergency equipment must be furnished and must – (1) Be arranged so that the equipment is directly acce ssible and its location is obvious; and (2) Protect the safety equipment from inadvertent damage.

(c) Emergency exit descent device . The stowage provisions for the emergency exit descent device required by CS 25.81 0(a) must be at the exits for which they are intended.

(d) Liferafts (1) The stowage provisions for the liferafts described in CS 25.1415 must accommodate enough rafts for the maximum number of occupants for which certification for ditching is requested.

(2) Life rafts must be stowed near exits through which the rafts can be launched during an unplanned ditching.

(3) Rafts automatically or remotely released outside the aeroplane must be attached to the aeroplane by means of the static line prescribed in CS 25.1415 .

(4) The stowage provisions for each portable life raft must allow rapid detachment and removal of the raft for use at other than the intended exits.

(e) Long - range signalling device . The stowage provisions for the long - range signalling device required by CS 25.1415 must be near an exit available during an unplanned ditching.

(f) Life - preserver stowage provisions . The stowage provisions for life preservers described in CS 25.1415 mus t accommodate one life preserver for each occupant for which certification for ditching is requested. Each life preserver must be within easy reach of each seated occupant.

(g) Life line stowage provisions. If certification for ditching under CS 25.801 is requested, there must be provisions to store the lifelines. These provisions must – (1) Allow one life line to be attached to each side of the fuselage; and (2) Be arranged to allow the lifelines to be used to en able the occupants to stay on the wing after ditching. This requirement is not applicable to aeroplanes having no over - wing ditching exits.

[Amdt 25/5] Powered by EASA eRules Page 1025 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQU IPMENT (CS - 25) SAFETY EQUIPMENT

AMC 25.1411(f) Life preserver stowage provisions

ED Decision 2020/024/R The applicant should demonst rate that the life preserver is within easy reach of, and can be readily removed by, a seated and belted occupant (shoulder strap(s) may be removed prior to the demonstration), for all seat orientations and installations that are intended for use during ta xi, take - off and landing. In lieu of an actual life preserver, a representative object (e.g. of the same size and weight) may be utilised for testing. The evaluation to quickly retrieve the preserver is to begin with the occupant moving their hand(s) from the seated position to reach for the preserver and to end with the occupant having the preserver in their hand(s) and fully removed from the stowage container. It does not include the time for the occupant to return to the upright position, to remove a pul l strap from the preserver (if used) or to open the preserver package provided by the preserver manufacturer.

The applicant should test the critical configuration(s) to demonstrate retrieval of the life preserver in less than 10 seconds by a minimum of 5 test subjects with a success rate of no less than 75 %. The test should evaluate three anticipated occupant test subject size categories: the 5th, 50th and 95th percentile. At least one occupant from each size category should demonstrate successful retriev al within 10 seconds. No more than 40 % of the overall test subject population should be in the 5th or 95th percentile occupant categories.

1) For passenger seats, the test subjects should be naïve. For the purpose of this test, naïve test subjects should be defined as follows: they should have had no experience within the prior 24 months in retrieving a life preserver. The subjects should receive no retrieval information other than a typical preflight briefing. The occupant size categories to be evaluated should be defined as: a. A 5th percentile occupant is no taller than 1.5 m (60 in).

b. A 50th percentile occupant is at least 1.6 m (63 in) tall but no taller than 1.8 m (70 in).

c. A 95th percentile occupant weighs at least 110.7 kg (244 lb).

2) For flight attendant and observer seats, the test subjects do not need to be naïve. The occupant size categories to be evaluated should be defined as: a. A 5th percentile occupant is no taller than 1.5 m (60 in).

b. A 50th percentile occupant is at least 1.6 m (63 in) tall but no taller than 1.8 m (70 in).

c. A 95th percentile occupant weighs at least 110.7 kg (244 lb).

3) For pilot/co - pilot seats, the test subjects do not need to be naïve. The occupant size categories to be evaluated should be defined as: a. A 5th percentile occupant is no taller than 1.57 m (62 in).

b. A 50th percentile occupant is at least 1.6 m (63 in) tall but no taller than 1.8 m (70 in).

c. A 95th percentile occupant weighs at least 110.7 kg (244 lb).

[Amdt 25/26] Powered by EASA eRules Page 1026 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT

CS 25.1415 Ditchi ng equipment

ED Decision 2003/ 2/RM (a) Ditching equipment used in aeroplanes to be certified for ditching under CS 25.801 , and required by the Operating Rules, must meet the requirements of this paragraph.

(b) Eac h liferaft and each life preserver must be approved. In addition – (1) Unless excess rafts of enough capacity are provided, the buoyancy and seating capacity beyond the rated capacity of the rafts must accommodate all occupants of the aeroplane in the even t of a loss of one raft of the largest rated capacity; and (2) Each raft must have a trailing line, and must have a static line designed to hold the raft near the aeroplane but to release it if the aeroplane becomes totally submerged.

(c) Approved survival equipment must be attached to, or stored adjacent to, each liferaft.

(d) There must be an approved survival type emergency locator transmitter for use in one life raft.

(e) For aeroplanes, not certificated for ditching under CS 25.801 and not having approved life preservers, there must be an approved flotation means for each occupant. This means must be within easy reach of each seated occupant and must be readily removable f rom the aeroplane.

CS 25.1419 Ice Protection

ED Decision 200 9 / 013 /R (See AMC 25.1419 ) If the applicant seeks certification for flight in icing conditions, the aeroplane must be able to safely operate in the continuous maximum and intermittent maximum icing conditions of Appendix C . To establish this – (a) An analysis must be performed to establish that the ice protection for the various components of the aeroplane is adequate, taking into account the various aeroplane operational configurations; and (b) To verify the ice protection analysis, to check for icing anomalies, an d to demonstrate that the ice protection system and its components are effective, the aeroplane or its components must be flight tested in the various operational configurations, in measured natural atmospheric icing conditions, and as found necessary, by one or more of the following means: (1) Laboratory dry air or simulated icing tests, or a combination of both, of the components or models of the components.

(2) Flight dry air tests of the ice protection system as a whole, or of its individual components.

(3) Flight tests of the aeroplane or its components in measured simulated icing conditions.

(c) Caution information, such as an amber caution light or equivalent, must be provided to alert the flight crew when the anti - ice or de - ice system is not function ing normally.

(d) For turbine engine powered aeroplanes, the ice protection provisions of this paragraph are considered to be applicable primarily to the airframe. For the powerplant installation, certain additional provisions of Subpart E may be found app licable.

(e) One of the following methods of icing detection and activation of the airframe ice protection system must be provided: (1) A primary ice detection system that automatically activates or alerts the flight crew to activate the airframe ice pr otection system; or Powered by EASA eRules Page 1027 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT (2) A definition of visual cues for recognition of the first sign of ice accretion on a specified surface combined with an advisory ice detection system that alerts the flight crew to activate the airframe ice protection system; or ( 3) Identification of conditions conducive to airframe icing as defined by an appropriate static or total air temperature and visible moisture for use by the flight crew to activate the airframe ice protection system.

(f) Unless the applicant shows that the airframe ice protection system need not be operated during specific phases of flight, the requirements of paragraph (e) of this section are applicable to all phases of flight.

(g) After the initial activation of the airframe ice protection system: (1) The ice protection system must be designed to operate continuously; or (2) The aeroplane must be equipped with a system that automatically cycles the ice protection system; or (3) An ice detection system must be provided to alert the flight crew e ach time the ice protection system must be cycled.

(h) Procedures for operation of the ice protection system, including activation and deactivation, must be established and documented in the Aeroplane Flight Manual.

[Amdt 25/3] [Amdt 25/7]

AMC 25.1419 Ic e Protection

ED Decision 20 15 / 008 /R If certification for flight in icing conditions is desired, the aeroplane must be able to safely operate throughout the icing envelope defined in Appendix C .

In the context of this AMC, the wording “relevant icing environment” means the Appendix C icing conditions.

CS 25.1419 provides specific airframe requirements for certification for flight in the icing conditions defined in Appendix C . Additionally, for other parts of the aeroplane (i.e., engine, engine inlet, propeller, flight instrument external probes, windshield) there are more specific icing related CS - 25 specifications and associa ted acceptable means of compliance.

Other icing related specifications must be complied with, even if the aeroplane is not certificated for flight in icing: CS 25.629(d)(3) CS 25.975(a)(1) CS 25.1093(b) CS 25.1324 CS 25.1325(b) CS 25.1326 CS 25J1093(b ) Additional information for showing compliance with the aeroplane performance and handling qualities requirements for icing certification may be found in AMC 25.21(g) Powered by EASA eRules Page 1028 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT (a) CS 25.1419(a) Analysis The applicant should prepare analysis to substantiate the choice of ice protection equipment for the aeroplane. Such analysis should clearly state the basic protection required and the assumptions made, and delineate methods of anal ysis used. All analysis tools and methods should be validated by tests or should have been validated by the applicant on a previous certification program. The applicant who uses a previously validated method should substantiate why that method is applicabl e to the new program.

1. Analytical Simulation Methods Analytical simulation methods for icing include impingement and accretion models based on computational fluid dynamics. The applicant will typically use these methods to evaluate protected as well as unprotected areas for potential ice accretions. Analytical simulation provides a way to account for the variability in drop distributions. It also makes it possible to examine impingement in relation to visual icing cues and to analyse the location of det ection devices for detrimental local flow effects.

2. Analysis of areas and components to be protected In evaluating the aeroplane’s ability to operate safely in the relevant icing environment, and in determining which components will be protected, the applicant should examine relevant areas to determine the degree of protection required. An applicant may determine that protection is not required for one or more of these areas or components.

If so, the applicant’s analysis should include the supporting d ata and rationale for allowing those areas or components to remain unprotected.

The applicant should show that: — the lack of protection does not adversely affect handling characteristics or performance of the aeroplane, as required by CS 25.21(g) , — the lack of protection does not cause unacceptable affects upon the operation and functioning of affected systems and equipment, — the lack of protection does not affect the flight instrument external probes systems, and — s hedding of ice accreting on unprotected areas will not create unacceptable damages to the engines or the surrounding components which would prevent continued safe flight and landing.

3. Impingement Limit Analysis The applicant should prepare a drop trajec tory and impingement analysis of: — wings, — horizontal and vertical stabilizers, — engine air intakes, — propellers, — any means used to detect ice accretion (ice detector, visual cues) and — all other critical surfaces upon which ice may accrete.

This analysis should consider the various aeroplane operational configurations, phases of flight, and associated angles of attack.

Powered by EASA eRules Page 1029 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT The impingement limit analysis should establish upper and lower aft drop impingement limits that can then be used to establish the aft ice formation limit and its relationship to the Ice Protection Systems (IPS) coverage.

Water content versus drop size relationships defined in Ap pendix C , Figures 1 and 4 are defined in terms of mean effective drop diameter. CS - 25 does not require consideration of specific distributions for Appendix C icing conditions.

In determining the rates of catch, the full spectrum of the droplet sizes should be considered but in determining impingement areas, a maximum droplet size of 50 μm need only be considered for compliance to CS 25.1419 .

4. Ice Shedding Analysis For cri tical ice shedding surfaces an analysis must be performed to show that ice shed from these surfaces will not create unacceptable damages which would prevent continued safe flight and landing.

Airframe ice shedding may damage or erode engine or powerplant c omponents as well as lifting, stabilizing, and flight control surface leading edges. Fan and compressor blades, impeller vanes, inlet screens and ducts, and propellers are examples of powerplant components subject to damage from shedding ice. For fuselage - mounted turbojet engines (and pusher propellers that are very close to the fuselage and well aft of the aeroplane's nose), ice shedding from the forward fuselage and from the wings may cause significant damage. Ice shedding from components of the aeroplane , including antennas, should not cause damage to engines and propellers that would adversely affect engine operation or cause an unacceptable loss of power or thrust (compliance with CS 25.1093(b) ).

The applicant should also consider aeroplane damage that can be caused by ice shedding from the propellers.

Control surfaces such as elevators, ailerons, flaps, and spoilers, especially those constructed of thin metallic, non - metallic, or composite materials, are also subject to damage.

Currently available trajectory and impingement analysis may not adequately predict such damage. Unpredictable ice shedding paths from forward areas such as radomes and forward wings (canards) have been found to negate the results of the se analysis.

For this reason, a damage analysis should consider that the most critical ice shapes will shed and impact the areas of concern.

5. Thermal Analysis and Runback Ice An analysis shall be performed to predict the effectiveness of the thermal IP S (hot air or electrical). Design objectives (fully evaporative or running wet) shall be assessed against the relevant icing environment.

Water not evaporated by thermal ice protection systems and unfrozen water in near - freezing conditions (or in conditio ns when the freezing fraction is less than one) may run aft and form runback ice. This runback ice can then accumulate additional mass from direct impingement.

Runback ice should be determined and should be considered when determining critical ice shapes. Simulated runback ice shapes may be used when evaluating effects of critical ice shapes. Computer codes may be unable to estimate the characteristics of the runback Powered by EASA eRules Page 1030 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT water or resultant ice shapes (rivulets or thin layers), but some codes may be able to esti mate the mass of the runback ice. Thus runback ice should be determined experimentally, or the mass determined by computer codes with assumptions about runback extent and thickness similar to those used successfully with prior models.

The applicant should consider potential hazards resulting from the shedding of runback ice.

6. Power Sources The applicant should evaluate the power sources in the IPS design (e.g. electrical, bleed air, or pneumatic sources). An electrical load analysis or test should be co nducted on each power source to determine that it is adequate to operate the IPS as well as to supply all other essential electrical loads for the aeroplane throughout the aeroplane flight envelope. The effect of an IPS component failure on availability of power to other essential loads should be evaluated in accordance with CS 25.1309 . All power sources affecting engines or engine IPS for multiengine aeroplanes must comply with the engine isolation requirements of CS 25.903(b) .

7. Artificial ice shapes and roughness AMC 25.21(g) contains guidance on icing exposure during various phases of flight that should be considered when determining artificial ice shapes and surface roughness. The shape and surface roughness of the ice should be developed and substantiated with acceptable me thods. When developing critical ice shapes, the applicant should consider ice accretions that will form during all phases of flight and those that will occur before activation and proper functioning of the ice protection system.

If applicable, runback, re sidual, and inter - cycle ice accretions should also be considered.

The applicant should substantiate the drop diameter (mean effective, median volume), liquid water content, and temperature that will cause formation of an ice shape critical to the aeroplan e’s performance and handling qualities.

Ice roughness used should be based on icing tunnel, natural icing, or tanker testing, or the guidance in AMC 25.21(g) , Appendix 2.

8. Similarity Analysis (i) For certification based on similarity to other type - certificated aeroplanes previously approved for flight in icing conditions, the applicant should specify the aeroplane model and the component to which the reference of similarity applies.

The applicant should show specific similarities in the areas o f physical, functional, thermodynamic, ice protection system, and aerodynamic characteristics as well as in environmental exposure. The applicant should conduct analysis to show that component installation, operation, and effect on the aeroplane’s performa nce and handling are equivalent to that of the same or similar component in the previously approved configuration.

(ii) A demonstration of similarity requires an evaluation of both system and installation differences. Differences should be evaluated for t heir effect on IPS functionality and on safe flight in icing. If there is uncertainty about the effects of the differences, the applicant should conduct additional tests and/or analysis as necessary and appropriate to resolve the open issues.

(iii) CS 25.1419(b) requires flight testing in measured natural icing conditions. Flight test data from previous certification programs may be used to show compliance Powered by EASA eRules Page 1031 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT with CS 25.1419( b) if the applicant can show that the data is applicable to the aeroplane in question. If there is uncertainty about the similarity analysis, the applicant should conduct flight tests in measured natural icing conditions for compliance with CS 25.1419(b) .

Note: The applicant must possess all the data to substantiate compliance with applicable specifications, including data from past certifications upon which the similarity analysis is based.

(b) CS 25.1419(b) Testing The aeroplane should be shown to comply with certification specifications when all IPS are installed and functioning when operating normally and under certain failure conditions. This can normally be accomplish ed by performing tests in natural or simulated icing conditions to either validate analysis or to test those conditions found to be most critical to basic aeroplane aerodynamics, IPS design, and powerplant functions. All IPS equipment should perform their intended functions throughout the entire operating envelope.

The primary purposes of flight testing are to: — Determine that the IPS is acceptably effective and performs its intended functions during flight as predicted by analysis or ground testing, — Eval uate any degradation in performance and flying qualities, — Verify the adequacy of flightcrew procedures as well as limitations for the use of the IPS in normal, abnormal, and emergency conditions, — Confirm that the powerplant installation as a whole (engine, propeller, inlet, anti - ice system, etc.) performs satisfactorily in icing conditions, and — Validate the ice accretion size, location, texture and other general characteristics.

Performance and handling qualities specifications are identified in CS 25.21(g) . Flight tests to show compliance with these requirements are addressed in AMC 25.21(g) .

1. Dry air flight tests with ice protection equipment operating The first flight tests conducted to evaluate the aeroplane with the IPS operating are usually dry air flight tests. The initial dry air tests are conducted to: — Verify that the IPS does not affec t flying qualities of the aeroplane in clear air, and — Obtain a thermal profile of an operating thermal IPS to substantiate its thermal performance.

Several commonly used IPS and components are discussed below to illustrate typical dry air flight test prac tices. Other types of equipment should be evaluated as their specific design dictates.

1.1 Thermal ice protection leading edge systems Dry air flight tests are conducted to verify the system design parameters and thermal performance analysis.

Normally, instruments are installed on system components to measure the anti - icing mass flow rate or energy input (for electrical systems), supply air temperature, and surface temperatures. The dry air test plan generally includes operating conditions such as the c limb, holding, and descent phases of a normal Powered by EASA eRules Page 1032 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT flight profile. Since the presence of moisture can affect surface temperatures, tests should be conducted where no visible moisture is present.

Measurements of supply air mass flow rate, energy input, and air temperature allow determination of how much heat is available to the system. The adequacy of the IPS can then be demonstrated by comparing the measured data to the theoretical analysis.

Surface temperatures measured in the dry air, for example, can be usef ul in extrapolating the maximum possible leading edge surface temperature in - flight, the heat transfer characteristics of the system, and the thermal energy available for the IPS. Supply air temperatures or energy input may also be used to verify that the IPS materials were appropriately chosen for the thermal environment.

1.2 Bleed air systems Effects of bleed air extraction on engine and aeroplane performance, if any, should be examined and included in the Aeroplane Flight Manual (AFM) performance data. The surface heat distribution analysis should be verified for varying flight conditions incl uding climb, cruise, hold, and descent. Temperature measurements may be necessary to verify the thermal analysis. In accordance with provisions of CS 25.939(a) , the maximum bleed air for ice protection should have no detrimental effect on engine operation throughout the engine’s power range.

1.3 Pneumatic leading edge boots Tests should demonstrate a rise and decrease in operating pressures, which results in the effective removal of ice. This pressure rise time, a s well as the maximum operating pressure for each boot, should be evaluated throughout the altitude range defined in the relevant icing environment. The appropriate speed and temperature limitation (if any) on boot activation should be included in the AFM.

Boot inflation should have no significant effect on aeroplane performance and handling qualities.

1.4 Fluid anti - icing/de - icing systems Flight testing should include evaluation of fluid flow paths to confirm that adequate and uniform fluid distribution over the protected surfaces is achieved. A means of indicating fluid flow rates, fluid quantity remaining, etc., should be evaluated to determine that the indicators are plainly visible to the pilot and that the indications provided can be effectively read . The AFM should include information advising the flight crew how long it will take to deplete the amount of fluid remaining in the reservoir.

2. Dry air flight tests with predicted artificial ice shapes and roughness The primary function of dry air flig ht tests with artificial ice shapes is to demonstrate the ability of the aeroplane to operate safely with an accumulation of critical ice shapes based on exposure to icing conditions. The specific flight tests used to evaluate aeroplane performance and han dling qualities are addressed in AMC 25.21(g) .

For failure conditions of the IPS that are not extremely improbable, validation testing may be required to demonstrate that the effect on safety of flight (as measured by degradation in flight characteristics) is commensurate with the failure probability. The applicant may use dry air flight tests with predicted critical failed IPS ice shapes, which may include asymmetric ice shapes, to demonstrate acceptable operationa l safety.

Powered by EASA eRules Page 1033 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT 3. Icing flight tests Flight tests in measured natural icing and tests performed with artificial icing tools, such as icing tankers, are normally used to demonstrate that the IPS performs during flight as predicted by analysis or other testing. Such tests are also used to confirm analysis used in developing the various components, such as ice detectors, and ice shapes. CS 25.1419 requires measured natural icing flight tests within the icing conditions of CS - 25, Appendix C . The natural icing flight tests are accomplished to corroborate the general nature of the effects on aeroplane handling characteristics and performance determined with artificial ice shapes (see AMC 25.21(g) ), as well as to qualitatively assess the analytically predicted location and general physical characteristics of the ice accretions.

If necessary, there should be a means to record ice accumulations to allow the size, location, shape, extent and general nature of the ice to be approximated. Various means can be used to aid this, such as a rod or fence mounted on the aerofoil and black or brightly coloured paint on the aerofoil to increase the contrast b etween the ice accretion and the aerofoil and aid the determination of the ice shape size.

3.1 Instrumentation The applicant should plan sufficient instrumentation to allow documentation of important aeroplane, system, and component parameters, as well a s icing conditions encountered. The following parameters should be considered: 1. Altitude.

2. Airspeed.

3. Engine power level or speed.

4. Propeller speed and pitch, if applicable.

5. Temperatures that could be affected by ice protection equipme nt or ice accumulation or that are necessary for validation of analysis, such as the temperatures of Static air, Engine components, Electrical generation equipment, Surfaces, Structural components.

6. Liquid water content. This should be measured over th e complete water drop size distribution.

7. Median volume drop diameter and drop diameter spectra. When measurement of the icing environment drop diameter is necessary, instrumentation used for measuring drop sizes should be appropriate for the icing env ironment considered.

3.2 Artificial icing Flight testing in artificial icing environments, such as behind icing tankers, is one way to predict capabilities of individual elements of the ice protection equipment and to determine local ice shapes.

Since t he ice plume has a limited cross - section, testing is usually limited to components, such as heated pitot tubes, antennas, air inlets including engine induction air inlets, empennage, aerofoil sections, and windshields. Calibration and verification of the i cing cloud produced by the tanker should be accomplished as necessary for meeting test objectives.

Use of an icing tanker can provide high confidence in local icing effects. But obtaining small drop sizes may be difficult with some spray nozzles. As a res ult, Powered by EASA eRules Page 1034 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT these methods could produce larger ice build - ups and different ice shapes than those observed in natural Appendix C icing conditions.

Icing tanker techniques can be used in a manner similar to icing tunnel te sting with respect to ice shape development. The plume may be of sufficient size that it could be applied to sections of the airframe to examine any potential hinge moment or CLmax (maximum lift coefficient) effects from ice accretions behind protected are as.

This method also has the advantage of being able to combine the effects of thermal systems (such as runback) with direct accretion to simulate resulting ice accumulations.

Atmospheric effects such as humidity and drop residence time (time required to bring the drop to static temperature) should be considered in this type of testing.

3.3 Appendix C natural icing flight testing CS 25.1419(b) requires measured natural icing flight tests. Flight tests in measured natural icing conditions are intended to verify the ice protection analysis, to check for icing anomalies, and to demonstrate that the IPS and its components function as intended.

The aeroplane should be given sufficient exposure to icing conditions to allow extrapolation to the envelope critical conditions by analysis. Test data obtained during these exposures may be used to validate the analytical methods used and the results of any preceding artificial icing tests.

Flight testing in natural icing conditions should also be used to verify AFM procedures for activation of the IPS, including recognition and delay times associated with IPS activation. Such testing should verify the analy tically predicted location and general physical characteristics of the ice accretions. Critical ice accumulations should be observed, where possible, and sufficient data taken to allow correlation with dry air testing. Remotely located cameras either on th e test aeroplane or on a chase aeroplane have been used to document ice accumulations on areas that cannot be seen from the test aeroplane’s flight deck or cabin.

For an aeroplane with a thermal de - icing system, the applicant should demonstrate the effect iveness of the de - icing operation either in artificial icing conditions or during a natural icing flight test certification program. The tests usually encompass measurements of the surface temperature time history. This time history includes the time at wh ich the system is activated, the time at which the surface reaches an effective temperature, and the time at which the majority of ice is shed from the leading edge. Any residual or intercycle ice accretions should be documented. The data should be recorde d in the flight test report.

For anti - icing/de - icing fluid systems, fluid flow paths should be determined when the fluid is mixed with impinging water during system operation.

4. Icing wind tunnel tests Icing wind tunnels provide the ability to simulate natural icing conditions in a controlled environment. Scale models may be used with appropriate scaling corrections, if the scale testing on the component has been validated with full - scale testing or analysis. Hybrid models, with the full - scale leading ed ge extending beyond the impingement limits, may Powered by EASA eRules Page 1035 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT also be used. The applicant may use these models to estimate impingement limits, examine visual icing cues, and evaluate ice detection devices.

A variety of icing conditions can be simulated, depending on th e icing wind tunnel.

Icing wind tunnels have been used to evaluate ice shapes on unprotected areas and on or aft of protected areas, such as inter - cycle, residual, and runback ice. They have also been used to evaluate performance of IPS, such as pneumatic and thermal systems.

For the evaluation of the performance of the IPS, a critical points analysis can be used to identify critical test conditions under which an IPS should be tested in an icing tunnel. In lieu of a critical points analysis the following conditions have been successfully used in the past to simulate the Appendix C conditions: 4.1 Continuous Maximum Condition o 3 Atmospheric Temperature ( C) Liquid Water Content (g/m ) 0 0.8 - 10 0.6 - 20 0.3 - 30 0.2 The test should be run until steady state conditions are reached. The steady state can be identified by the protected surfaces being completely free of ice or the total ice accretion being contained by repetitive shedding either naturally or enforced by cyclic operation of the IPS. If the steady state cannot be reached, the duration of the run should be limited to 45 minutes.

4.2 Intermittent Maximum Conditions The encounters considered should include three clouds of 5 km horizontal extent with Inte rmittent Maximum concentrations as in the following table separated by spaces of clear air of 5 km.

o 3 Atmospheric Temperature ( C) Liquid Water Content (g/m ) 0 2.5 - 10 2.2 - 20 1.7 - 30 1.0 For both the Continuous maximum and Intermittent Conditions, an MVD of 20 μm should be used.

5. Dry air wind tunnel tests Dry air wind tunnel testing using scaled models and artificial ice shapes has been used to determine if ice protection on particular components (horizontal/vertical plane or wing se ctions) is required. The scaling, including the effect of the roughness of the ice, should be substantiated using methods found acceptable to the Agency.

(c) CS 25.1419(c) Caution information CS 25.1419(c) requires that Caution information be provided to alert the flight crew when the IPS is not functioning normally. In this context, Caution information is considered to be a general term referring to an a lert rather than referring specifically to a Caution level alert. Crew alerting should be provided for failure conditions of the IPS in accordance with CS 25.1309(c) and Powered by EASA eRules Page 1036 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT CS 25.1322 . It should be assumed that icing conditions exist during the failure event. In accordance with CS 25.1419(c) , the decision to provide an alert must not be based on the numerical probability of the failure event. However, the type of alert provided should be based on the failure effects and necessary crew action to be performed in response.

1) Sensor(s) used to identify a failure condition should be evaluated to ensure that they are properly located to obtai n accurate data on the failure of the IPS.

2) The indication system should not be designed so that it could give the flight crew a false indication that the system is functioning normally because of a lack of an alert. The applicant should submit data to substantiate that this could not happen. For example, if a pneumatic de - icing system (boots) requires a specific minimum pressure and pressure rise rate to adequately shed ice, an alert should be provided if that minimum pressure and pressure rise rate are not attained. Without an alert, the flight crew may erroneously believe that the boots are operating normally when, in fact, they might not be inflating with sufficient pressure or with a sufficient inflation rate to adequately shed ice. The applicant sho uld also consider the need for an alert about ice forming in the pneumatic system that can result in low pneumatic boot pressures or an inadequate pressure rise rate.

(d) CS 25.1419(e) Ice Detection 1. Compliance with CS 25.1419(e)(1) and (e)(2) .

These subparagraphs provide alternatives to CS 25.1419(e)(3) which specifies operation of the IPS based on icing conditions . These alternatives require either a primary ice detection system, or substantiated visual cues and an advisory ice detection system. CS 25.1419(e)(2 ) requires defined visual cues for recognition of the first sign of ice accretion on a specified surface combined with an advisory ice detection system that alerts the flight crew to activate the airframe ice protection system. The following conditions sho uld be considered when determining compliance with CS 25.1419(e)(2) : — The advisory ice detection system annunciates when icing conditions exist or when the substantiated visual cues are present.

— The defined visual cues rely on the flight crew’s observation of the first sign of ice accretion on the aeroplane and do not depend on the pilot determining the thickness of the accretion.

— The flight crew activates the ice protection system when they obse rve ice accretion or when the ice detector annunciates ice, whichever occurs first.

1.1 Ice detection system (IDS) 1.1.1 Primary Ice Detection System (PIDS) A PIDS must either alert the flight crew to operate the IPS using AFM procedures or automatical ly activate the IPS before an unsafe accumulation of ice on the airframe, engine components, or engine air inlets occurs. The primary ice detection system must perform its intended function for the aeroplane configurations, phases of flight, and within the relevant icing environment.

1.1.2 Advisory Ice Detection System (AIDS) The AIDS, in conjunction with visual cues, such as visible ice accretion on referenced or monitored surfaces, should advise the flight crew to initiate Powered by EASA eRules Page 1037 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT operation of the IPS using AFM procedures. An AIDS is not the prime means used to determine if the IPS should be activated. When there is an AIDS installed on an aeroplane, the flight crew has primary responsibility for determining when the IPS must be activated; an AIDS that would aut omatically activate the IPS(s) would not be accepted. Although the flight crew has primary responsibility for determining when the IPS must be activated, if the aeroplane is certificated in accordance with CS 25.14 19(e)(2) , the AIDS is required (i.e. not optional) and must perform its intended function for the aeroplane configurations, for its phases of flight, and within the relevant icing environment.

1.1.3 Performance and Installation of the ice detection syste m (IDS) (i) An IDS should be capable of detecting the presence of icing conditions or actual ice accretion under all atmospheric conditions defined in the relevant icing environment.

It should be demonstrated that the presence of ice crystals mixed with supercooled liquid water does not lead to unacceptable supercooled liquid water ice detection performance degradation, when assessed at aircraft level.

For IDS capable of detecting the presence of ice on a monitored surface, the IDS should always detect wh en ice is present on the monitored surface whether or not icing conditions are within the relevant icing environment and the IDS should not indicate the presence of ice when no ice is present.

(ii) The applicant should accomplish a drop impingement analys is and/or tests to ensure that the ice detector(s) are properly located. The ice detector should be located on the airframe surface where the sensor is adequately exposed to the icing environment. The applicant should conduct flow field and boundary - layer analysis of candidate installation positions to ensure that the ice detector sensor is not shielded from impinging water drops. The IDS should be shown to operate in the range of conditions defined by the icing environment.

Performance of the IDS is affect ed by the physical installation and can only be verified after installation. It should be shown by analysis and/or flight test that the location(s) of the detection systems sensor(s) is adequate to cover all aeroplane operational configurations, phases of flight, airspeeds, associated angles of attack and sideslip.

A combination of tests and analysis is required to demonstrate performance of the ice detector as installed on the aeroplane. This could include icing tunnel and icing tanker tests to evaluate ic e detector performance. The applicant may use drop impingement analysis to determine that the ice detector functions properly over the drop range of the icing environment when validated through natural or artificial icing tests (e.g. tanker, icing tunnel). The applicant should demonstrate that the aeroplane can be safely operated with the ice accretions formed up to the time the ice protection system becomes Powered by EASA eRules Page 1038 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT effective, following activation by the ice detector. The detector and its installation should minimi ze nuisance warnings.

(iii) Evidences should be provided that the system is qualified under the appropriate standards, and in addition, it should be demonstrated that when installed on the aeroplane the IDS can detect under: — Light icing conditions (minim um detectability), — Heavy glaze ice conditions (warm runback), and — Cold, high - LWC (Liquid Water Content) conditions (thermal load).

(iv) The maximum detection threshold should be established. The threshold level chosen to activate the ice detection and ann unciation system should be guided by the assurance that: — The aeroplane has adequate controllability and stall warning margins with the ice accretions that exist on the unprotected and protected surfaces prior to normal activation of the IPS(s); — The amount of ice accreted can be safely eliminated by the IPS(s). It should be demonstrated that when the amount of ice that is accreted on the protected surfaces is shed, no unacceptable damages occur to the airframe or the engines; — The system will not be overly se nsitive, but sensitive enough to readily detect sudden exposure; and — If the thickness of accreted ice is in excess of the maximum detection threshold on the monitored surface, the IDS should continue to indicate the presence of ice.

(v) If the IDS ice detection logic is inhibited during certain flight phases, handling qualities and performance should be demonstrated, assuming that the ice protection systems are inoperative and the aeroplane is operating in conditions conducive to icing.

(vi) If an accr etion - based technology is used for ice detection, and if the IDS cannot detect ice in some condition where ice accretes on critical aircraft surfaces: — For PIDS, the applicant should either show that the aeroplane can be operated safely with the ice accreti ons, or the IPS(s) should be forced to operate within the envelope of non - detection of the PIDS.

— For AIDS, if such icing conditions may go undetected by the flight crew (absence of visual cues for these conditions), then the IPS(s) should be forced manual ly to operate within the envelope of non - detection of the AIDS.

Alternatively, the installation of an icing conditions detector (i.e. one that detects both moisture and temperature), or additional substantiation with the resulting undetected ice accretions, may be required.

Powered by EASA eRules Page 1039 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUB PART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT (vii) Preferably, the IDS should be turned on automatically at aeroplane power - up, and an alert should be provided if the IDS is turned off.

(viii) If the PIDS has automatic control of the IPS(s), it should be possible to de - select the automatic feature and to revert to an advisory system.

(ix) D uring the certification exercise, the proper operation of the IDS should be monitored especially by comparison with other icing signs (visual cues, ice accretion probe, etc.). Cloud conditions of the icing encounter should be measured and recorded. When mu ltiple ice detectors are used in an IDS, signals from each ice detector should be recorded during icing tests to verify whether the ice detectors are fully redundant in the whole Appendix C and flight envelope or rather have their own detection threshold t o cover the whole Appendix C and flight envelope.

1.1.4 Aeroplane Flight Manual (AFM) AFM procedures have to be established to cover system malfunction and actions to be taken by the flight crew when alerted by the system. The AFM should at least address the following: — Pre - flight check, if required, to verify the correct functioning of the IDS, — Operational use of the IDS and limitations, and — Appropriate flight crew procedure(s) in case of failure indication(s).

1.1.5 Ice detection system safety considera tions The applicant should accomplish a functional hazard assessment to determine the hazard level associated with failure of the ice detection system (refer to AMC 25.1309 ).

The probability of encountering the ic ing conditions defined in Appendix C to CS - 25 should be considered to be 1.

The un - annunciated failure of a PIDS is assumed to be a catastrophic failure condition, unless characteristics of the aeroplane in icing conditions without activation of the aircr aft IPS(s) are demonstrated to result in a less severe hazard category. When showing compliance to CS 25.1309 and when considering PIDS integrating multiple ice detectors, it should be assumed that the loss of one ice detector leads to the loss of the primary ice detection function, unless it is demonstrated during flight tests that all ice detectors have comparable ice detection performance. After the loss of one ice detector, the applicant may choose to revert to an advisory ice detection system; in this case the applicant should substantiate visual cues and AFM procedures in compliance with CS 25.1419(e)(2).

If visual cues are the primary means of ice detection, the pilots retain responsibility to monitor and detect ice accretions when an AIDS is installed.

However, the natural tendency of flight crews to become accustomed to using the AIDS elevates the importance of the detector and increases the need to make flight crews aware of an AIDS failure. Therefore, an un - annunciated failure of the AIDS should be considered as at least a major Powered by EASA eRules Page 1040 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT failure condition unless substantiated as meriting a lower failure condition classification.

For the identification of conditions conducive to airframe icing in the frame of CS 25.1419(e)(3) , the temperature cue used in combination with visible moisture has to be considered as a primary parameter, and the display of erroneous too high temperature to t he flight crew, which potentially leads to non - activation of the IPS, should be considered as a catastrophic failure condition, unless substantiated as meriting a lower failure condition classification.

1.2 Visual cues Visual cues can be either direct ob servation of ice accretions on the aeroplane’s protected surfaces or observation of ice accretions on reference surfaces. The first indications of any of the following are examples of what could potentially be used as visual cues: — Accretions forming on th e windshield wiper posts (bolt or blade).

— Accretions forming on propeller spinner.

— Accretions forming on radome.

— Accretions on the protected surfaces.

If accretions on protected surfaces cannot be observed, a reference system would be necessary if compliance with CS 25.1419(e)(2) is sought. The applicant should consider providing a reference surface that can be p eriodically de - iced to allow the flight crew to determine if the airframe is continuing to accumulate ice.

Without a means to de - ice the reference surface, as long as ice is present on the reference surface : — The IPS should operate in presence of conditions conducive to icing (AFM procedure based on visible moisture and temperature); the IPS may be switched off after leaving conditions conducive to icing, even though ice may still be present on the reference surface; or — The IPS should operate conti nuously , even if additional ice is not accumulating.

When ice accretion is no longer present on the reference surface, the next activation of the IPS can again be triggered by the presence of ice accreting on this reference surface.

As the freezing fracti on drops below 1, although some reference surfaces may not build up ice, ice may begin to accumulate on protected surfaces of the aeroplane.

The applicant should substantiate, for all the icing conditions defined in the relevant icing environment, that the reference surface accumulates ice at the same time as or prior to ice accumulating on the protected surfaces.

1.2.1 Field of view Visual cues should be developed with the following considerations: a. Visual cues should be within the flight crew’s prim ary field of view, if possible. If cues are outside the primary field of view, they should be visible from the design eye point and easily incorporated into the Powered by EASA eRules Page 1041 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT flight crew’s vision scan with a minimum of head movement while seated and performing their nor mal duties.

b. Visual cues should be visible during all modes of operation (day, night, and in cloud).

1.2.2 Verification During the certification process, the applicant should verify the ability of the crew to observe the visual cues. Visibility of t he visual cues should be evaluated from the most adverse flight crew seat locations in combination with the range of flight crew heights, within the approved range of eye reference point locations, if available. A visual cue is required for both the left a nd right seats. If a single visual cue is used, it should be visible from each seat. The adequacy of the visual cue should be evaluated in all expected flight conditions, and in particular the capability of detecting clear ice should be verified. The appli cant may carry out night evaluations with artificial accretions to assess visibility in and out of cloud. Visual cues should be substantiated by tests and analysis, including tests in measured natural icing.

2. Compliance With CS 25.1419(e)(3) This subparagraph of CS 25.1419 provides an alternative to the PIDS and visual cues plus the AIDS as defined in CS 25.1419(e)(1) and (e)(2). This alternative requires operation of the IPS when the aeroplane is in conditions conducive to airframe icing during all phases of flight.

2.1 Temperature cue.

The temperature cue used in combination with visible moisture should consider static temper ature variations due to local pressure variations on the airframe. If the engine IPS and the airframe IPS are both activated based on visible moisture and temperature, a common conservative temperature for operation of both systems should be used. For exam ple, if the engine IPS is activated at + 5 ºC static air temperature or less, the airframe IPS should be activated at the same temperature, even if it is substantiated that the airframe will not accrete ice above + 2 ºC static air temperature. This would e ase the flight crew workload and increase the probability of procedural compliance.

2.2 Either total or static temperatures are acceptable as cues. If static is used, a display of static air temperature should be provided to allow the flight crew to easi ly determine when to activate the systems. As an alternative, a placard showing corrections for the available temperature, to the nearest degree Celsius, can be used, so the flight crew can determine the static air temperature in the region of interest (th at is, around 0 ºC).

2.3 Aeroplane Flight Manual (AFM).

The Limitations section of the AFM should identify the specific static or total air temperature and visible moisture conditions that must be considered as conditions conducive to airframe icing and should specify that the IPS must be operated when these conditions are encountered.

(e) CS 25.1419(f) This subparagraph of CS 25.1419 states that requirements of CS 25.1419(e)(1) , CS 25.1419(e)(2) or CS 25.1419(e)(3) are applicable to all phases of flight unless i t can be shown that the IPS need Powered by EASA eRules Page 1042 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT not be operated. To substantiate that the IPS need not be operated during certain phases of flight, the applicant should consider ice accretions that form during these phases, without the IPS operating, and establish that t he aeroplane can safely operate in the relevant icing environment (f) CS 25.1419(g) This subparagraph of CS 25.1419 requires that after the initial activation of the IPS: — The IPS must operate continuously, or — The aeroplane must be equipped with a system that automatically cycles the IPS, or — An ice detection system must be provided to a lert the flight crew each time the IPS must be cycled.

Some examples of systems that automatically cycle the IPS are: — A system that senses ice accretion on a detector and correlates it to ice accretion on a protected surface. This system then cycles the IPS at a predetermined rate.

— A system that uses a timer to cycle the IPS. The applicant should substantiate that the aeroplane can safely operate with the ice accretions that form between the time one de - icing cycle is completed and the time the next cycl e is initiated. If more than one cycling time is provided to the flight crew (for example choosing between a 1 - or 3 - minute intervals), it should be substantiated that the flight crew can determine which cycle time is appropriate.

— A system that directly s enses the ice thickness on a protected surface and cycles the IPS.

A common attribute of the above systems is that the pilot is not required to manually cycle the IPS after initial activation.

Some types of ice detection systems that alert the flight cre w each time the IPS must be cycled could operate in a manner similar to the automatic systems discussed above, except that the crew would need to manually cycle the system. Flight crew workload associated with such a system should be evaluated. Because of flight crew workload and human factors considerations, a timed system without an ice sensing capability should not be used to meet this requirement.

The ice shedding effectiveness of the selected means for cycling the ice protection system should be evalua ted during testing in natural icing conditions. All inter - cycle and runback ice should be considered when showing compliance with CS 25.21(g).

(g) CS 25.1419(h) CS 25.1419(h) requires that AFM procedures for operation of the IPS, including activation and deactivation, must be established. Procedures for IPS deactivation must be consistent with the CS 25.1419(e) requirements for activation of the IPS. The exact timing of deactivation should consider the type of ice protection system (e.g., de - icing, anti - icing, or running wet) and all delays in deactivation necessary to ensure that residual ice is minimized. Pneu matic boots should be operated for three complete cycles following the absence of the cues used for activation. However, if the aeroplane’s stall protection system reverts from an icing schedule to a non - icing schedule when the airframe IPS is deactivated, AFM procedures should state that the airframe IPS should not be deactivated until the flight crew are certain that the critical wing surfaces are free of ice.

[Amdt 25/16] Powered by EASA eRules Page 1043 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT

CS 25.1420 Supercooled large drop icing conditions

ED Decision 2016/010 /R (see AMC 25.1420 ) (a) If certification for flight in icing conditions is sought, in addition to the requirements of CS 25.1419 , the aeroplane must be capable of operating in accord ance with sub - paragraphs (a)(1), (a)(2), or (a)(3) of this paragraph.

(1) Operating safely after encountering the icing conditions defined in Appendix O: (i) The aeroplane must have a means to detect that it is operating in Appendix O icing conditions; a nd (ii) Following detection of Appendix O icing conditions, the aeroplane must be capable of operating safely while exiting all icing conditions.

(2) Operating safely in a portion of the icing conditions defined in Appendix O as selected by the applicant.

(i) The aeroplane must have a means to detect that it is operating in conditions that exceed the selected portion of Appendix O icing conditions; and (ii) Following detection, the aeroplane must be capable of operating safely while exiting all icing conditions.

(3) Operating safely in the icing conditions defined in Appendix O .

(b) To establish that the aeroplane can operate safely as required in sub - paragraph (a) of this paragraph, an applicant must show through analysis that the ice protection for the various components of the aeroplane is adequate, taking into account the various aeroplane operational configurations. To verify the analysis, one, or more as found necessary, of the following methods must be used: (1) Laboratory dry air or simulated icing tests, or a combination of both, of the components or models of the components.

(2) Laboratory dry air or simulated icing tests, or a combination of both, of models of the aeroplane.

(3) Flight tests of the aeroplane or its components in simulated icing condit ions, measured as necessary to support the analysis.

(4) Flight tests of the aeroplane with simulated ice shapes.

(5) Flight tests of the aeroplane in natural icing conditions, measured as necessary to support the analysis.

(c) For an aeroplane certifie d in accordance with sub - paragraph (a)(2) or (a)(3) of this paragraph, the requirements of CS 25.1419(e), (f), (g), and (h) must be met for the icing conditions defined in Appendix O in which the aeroplane is certi fied to operate.

(d) A comparative analysis may be used as an alternative to CS 25.1420(b) to establish that the aeroplane can operate safely as required in CS 25.1420(a), and as an alternative to CS 25.1420(c) regarding methods of icing detection and act ivation of the airframe ice protection system. In this case, tests may not be required (see AMC 25.1420(f)).

[Amdt 25/16] [Amdt 25/18] Powered by EASA eRules Page 1044 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT

AMC 25.1420 Supercooled large drop icing conditions

ED Decision 2016/010 /R If certification for flight in icing condition s is sought, in addition to the requirements of CS 25.1419 , the aeroplane must be capable of operating in accordance with subparagraphs (a)(1), (a)(2), or (a)(3) of CS 25.1420 .

Besides being able to operate safely in Appendix C icing conditions, the aeroplane must also be able to safely operate in or exit the icing conditions defined by CS - 25, Appendix O . The applicant, however, has several certification options available for Appendix O icing conditions. The aeroplane can be certified for: — The ability to detect Appendix O conditions and safely exit all icing conditions , or — The ability to operate safely throughout a portion of Appendix O icing conditions and safely exit all icing conditions when that portion of Appendix O is exceeded, or — The ability to operate safely throughout all Appendix O icing conditions.

In the context of this A MC: — ‘Relevant icing environment’ means the Appendix O or a portion of the Appendix O as applicable.

— ‘All icing conditions’ means Appendix C and Appendix O icing environment.

— ‘Simulated Icing Test’ means testing con ducted in simulated icing conditions, such as in an icing tunnel or behind an icing tanker.

— ‘Simulated Ice Shape’ means an ice shape fabricated from wood, epoxy, or other materials by any construction technique.

CS 25.1420 provides specific airframe requir ements for certification for flight in the icing conditions defined in Appendix O. Additionally, for other parts of the aeroplane (i.e. engine, engine inlet, propeller, flight instrument external probes, windshield) there are more specific icing related CS - 25 specifications and associated acceptable means of compliance.

Appendix O Spectra Appendix O defines freezing drizzle and freezing rain environments by using four spectra of drop sizes with associated liquid water content (LWC) limits. An FAA detailed report on the development of Appendix O is available from the FAA William J. Hughes Technical Ce nter (reference report DOT/FAA/AR - 09/10, dated March 2009). Following are the four drop size spectra: a ) Freezing drizzle environment with a median volume diameter (MVD) less than 40 microns (μm).

In addition to drizzle drops, which are defined as measuri ng 100 to 500 μm in diameter, this environment contains drops less than 100 μm, with a sufficient number of drops less than 40 μm so the MVD is less than 40 μm.

b) Freezing drizzle environment with an MVD greater than 40 μm. In addition to freezing drizz le drops, this environment contains smaller drops, with diameters less than 100 μm.

c) Freezing rain environment with an MVD less than 40 μm. In addition to freezing rain drops, which are defined as measuring more than 500 μm in diameter, this environmen t also contains smaller drops of less than 500 μm with a sufficient number of drops less than 40 μm so the MVD is less than 40 μm.

d) Freezing rain environment with an MVD greater than 40 μm. In addition to freezing rain drops, this environment also cont ains smaller drops of less than 100 μm.

Powered by EASA eRules Page 1045 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT Caution information: CS 25.1420 describes requirements that are in addition to the requirements in CS 25.1419 for certain aeroplanes and does not contain a requirement complementary to CS 25.1419(c). Instead, it rel ies on compliance with CS 25.1309(c) to ensure that adequate warning is provided to the flight crew of unsafe system operating conditions. Warning information required by CS 25.1309(c) , to alert the flight crew of unsafe system operating conditions, is applicable to design features installed to meet the additional requirements in CS 25.1420 and must be provided in accordance with CS 25.1322 .

(a) CS 25.1420(a)(1) Detect Appendix O icing conditions and safely exit all icing conditions When complying with CS 25.1420(a)(1), the applicant must provide a method for detecting that the aeroplane is operating in Appe ndix O icing conditions. Following detection, the aeroplane must be capable of operating safely while exiting all icing conditions until landing.

Substantiated methods of alerting flight crews when Appendix O icing conditions are encountered are required. It is acceptable to use an ice detection system that detects accretions behind the aeroplane’s protected areas. Considerations in paragraph (b) below, related to CS 25.1420(a)(2) acceptable means of alerting flight crews when Appendix O icing conditions are encountered, are also relevant for this paragraph.

(b) CS 25.1420(a)(2) Operate safely throughout a portion of Appendix O icing conditions If the applicant seeks certif ication for safe operation in portions of Appendix O icing conditions, such as freezing drizzle only, or during specific phases of flight, CS 25.1420(a)(2) applies. If this option is chosen, following detection of conditions that exceed the selected portio n of Appendix O, the aeroplane must be capable of operating safely while exiting all icing conditions until landing.

Substantiated methods of alerting flight crews when those portions of Appendix O are exceeded are required.

Certification for flight in a p ortion of Appendix O icing conditions depends upon the applicant substantiating an acceptable way for the flight crew to distinguish the portion of Appendix O conditions for which the aeroplane is certified from the portion of Appendix O conditions for whi ch the aeroplane is not approved. Certification for a portion of Appendix O allows latitude for certification with a range of techniques. Ice shapes will need to be developed to test for the portion of the envelope for which approval is sought, as well as for detecting and exiting icing conditions beyond the selected portion. The icing conditions the aeroplane may be certified to fly through may be defined in terms of any parameters that define Appendix O conditions and could include phase of flight limits, such as take - off or holding, in Appendix O or a portion of Appendix O. For example, an aeroplane may be certificated to take off in portions of Appendix O conditions, but not be certificated for holding in those same conditions. Substantiated means must b e provided to inform flight crews when the selected icing conditions boundary is exceeded. The applicant must show compliance with CS 25.21(g) for exiting the restricted Appendix O icing conditions. Ice shapes to be tested are those representing the critic al Appendix O icing conditions during recognition and subsequent exit from those icing conditions.

Ice shapes developed using the approved portion of the icing envelope should account for the range of drop distribution and water content and consider the p roposed method for identifying icing conditions that must be exited. The definition of the certificated portion of Appendix O for a particular aeroplane should be based on measured characteristics of the selected icing environment and be consistent with me thods used for developing Appendix O. Initial certification for flight in a portion of Appendix O conditions will likely include all of freezing Powered by EASA eRules Page 1046 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT drizzle or all of freezing rain. Such certification could be restricted to operation in Appendix O conditions b y phase of flight.

Methods of defining the selected Appendix O icing conditions boundary should be considered early in the certification process, with concurrence from the Agency.

Determining whether the selected Appendix O icing conditions boundary has been exceeded can potentially be accomplished using: — substantiated visual cues, — an ice detection system, or — an aerodynamic performance monitor.

The relevant AFM section(s) (possibly the limitation and the emergency procedure) should detail the method to warn the flight crew that the certified icing envelope has been exceeded.

1. Substantiated visual cues Substantiated visual cues can range from direct observation of ice accretions aft of the aeroplane’s protected surfaces to observation of ice accretio ns on reference surfaces.

Methods used to substantiate visual cues should be agreed upon with the Agency.

Responding to a visual cue should not require the flight crew to judge the ice to be a specific thickness or size.

Examples of potential visual cues are accretions forming on the side windshields, the sides of nacelles, the propeller spinners aft of a reference point, the radomes aft of a reference point, and/or aft of protected surfaces.

Visual cues should be developed with the following considerations: (i) Visual cues should be within the flight crew's primary field of view if possible. If outside the primary field of view, the visual cues should be visible from the design eye point and easily incorporated in to the flight crew's visual scan with a minimum of head movement while seated and performing their normal duties.

(ii) Visual cues should be visible during all modes of operation (day, night) without use of a handheld flashlight.

During the certificatio n process, the applicant should verify the ability of the crew to observe visual cues or reference surfaces. Visibility of the visual cues should be evaluated from the most adverse flight crew seat locations in combination with the range of flight crew hei ghts, within the approved range of eye reference point locations, if available. A visual cue is required for both the left and right seats. If a single visual cue is used, it should be visible from each seat. Consideration should be given to the difficulty of observing clear ice. The adequacy of the detection method should be evaluated in all expected flight conditions. The applicant may carry out night evaluations with simulated ice shapes to assess visibility in and out of cloud.

Visual cues should be su bstantiated by tests and analysis, including tests in measured natural icing, or icing tanker tests, or potentially through icing wind tunnel tests. The applicant should consider the drop distributions of Appendix O when developing the visual cue, and the applicant should substantiate that these cues would be present in all the restricted Appendix O icing conditions. If a reference surface is used, the applicant should substantiate that it accumulates ice at the sam e time as or prior to ice accumulation on the critical surfaces.

Powered by EASA eRules Page 1047 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT AMC 25.2 1(g) should be reviewed for guidance on the time flight crews need to visually detect Appendix O icing conditions.

2. Ice detection systems An ice detection system installed for co mpliance with CS 25.1420(a) is meant to determine when conditions have reached the boundary of the Appendix O icing conditions in which the aeroplane has been demonstrated to operate safely. The applicant should ac complish a drop impingement analysis and/or tests to ensure that the ice detector is properly located to function during the aeroplane operational conditions and in Appendix O icing conditions. The applicant may use analysis to determine that the ice detec tor is located properly for functioning throughout the drop range of Appendix O icing conditions when validated with methods described in document SAE ARP5903 “Drop Impingement and Ice Accretion Computer Codes”, dated October 2003. The applicant should ens ure that the system minimizes nuisance warnings when operating in icing conditions.

The low probability of finding conditions conducive to Appendix O ice accumulation may make natural icing flight tests a difficult way to demonstrate that the system funct ions in conditions exceeding Appendix C. The applicant may use flight tests of the aeroplane under simulated icing conditions (icing tanker). The applicant may also use icing wind tunnel tests of a representative aerofoil section and an ice detector to dem onstrate proper functioning of the system and to correlate signals provided by the detectors with the actual ice accretion on the surface.

3. Aerodynamic performance monitor (APM) A crew alerting system using pressure probes and signal processors could be developed for quantifying pressure fluctuations in the flow field from contamination over the wing surface. This technology does exist, but full development is necessary before incorporating it into the crew alerting system.

(c) CS 25.1420(a)(3) Operate safely throughout all Appendix O icing conditions CS 25.1420(a)(3) applies when the applicant seeks certification for all of the icing conditions described in Appendix O. An aeroplane certified to CS 25.1420(a)(3 ) must be capable of safely operating throughout the conditions described in Appendix O and does not need a means to distinguish Appendix O conditions from Appendix C conditions. The provisions in CS 25.1419 which require a method to detect icing condition s and activate the ice protection system are still applicable. If the aeroplane is certified for unrestricted flight in Appendix O conditions, the ice detection method must be substantiated to function throughout Appendix O. In effect, when CS 25.1420(a)(3 ) is chosen, the aeroplane is certificated for flight in icing without any specific aeroplane flight manual procedures or limitations to exit icing conditions.

If the AFM performance data reflects the most critical ice accretion (Appendix C and Appendix O ) and no special normal or abnormal procedures are required in Appendix O conditions, then a means to indicate when the aeroplane has encountered Appendix O icing conditions is not required. However, a mean s to alert the flight crew that the airplane has encountered icing conditions is still required in accordance with CS 25.1419.

(d) CS 25.1420 (b) 1. Analysis AMC 25.1419( a) applies and in addition, the following should be considered specifically for compliance with CS 25.1420(b): Powered by EASA eRules Page 1048 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT 1.1 Analysis of areas and components to be protected.

In assessing the areas and components to be protected, unless comparative analysis is use d as the means of compliance, considerations should be given on the fact that areas that do not accrete ice in Appendix C conditions may accrete ice in the Appendix O conditions.

1.2 Failure analysis Applying the system safety principles of CS 25.1309 is helpful in determining the need for system requirements to address potential hazards from an Appendix O icing environment. The following addresses application of the CS 25. 1309 principles to Appendix O conditions and may be used for showing compliance with CS 25.1309. Alternatively, a comparative analysis, if applicable, may be used as defined in paragraph (e) of this AMC.

1.2.1 Hazard classification Assessing a hazard classification for compliance with CS 25.1309 is typically a process combining quantitative and qualitative factors based on the assessment of the failure conditions and the associated severity of the effects . If the design is new and novel and has little similarity to previous designs, a hazard classification based on past experience may not be appropriate. If the design is derivative in nature, the assessment can consider the icing event history of similarly designed aeroplanes and, if applicable, the icing event history of all conventional design aeroplanes. The applicant should consider specific effects of supercooled large drop icing when assessing similarity to previous designs.

1.2.2 Qualitative Analysis The following qualitative analysis may be used to determine the hazard classification for an unannunciated encounter with Appendix O icing conditions. The analysis can be applied to aeroplanes shown to be similar to previous designs wi th respect to Appendix O icing effects, and to which the icing event history of all conventional design aeroplanes is applicable.

1.2.2.1 Assumptions The aeroplane is certificated to either: a. Detect Appendix O icing conditions and safely exit all ici ng conditions after detection of Appendix O icing conditions, or b. Safely operate in a selected portion of Appendix O icing conditions and safely exit all icing conditions after detection of Appendix O icing conditions beyond those for which it is certi ficated.

The ‘unannunciated encounter with Appendix O ’ refers to Appendix O icing conditions in which the aeroplane has not been shown to operate safely.

The airframe and propulsion ice protection systems have be en activated prior to the unannunciated encounter.

Powered by EASA eRules Page 1049 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQU IPMENT 1.2.2.2 Service history The applicant may use service history, design, and installation appraisals to support hazard classifications for CS 25.1309. Service history may be appropriate to support a haza rd classification if a new or derivative aeroplane has similar design features to a previously certificated aeroplane. Service history data are limited to the fleet of aeroplane type(s) for which the applicant is the holder of the Type Certificate(s), the owner of the data, or, if accepted by the Agency, has an agreement in place with the owner of the data that permits its use by the applicant for this purpose (see also paragraph (f)3.2 of this AMC).

1.2.2.3 Historical perspective While definitive statistics are not available, a historical perspective can provide some guidance. Many aeroplanes flying through icing have been exposed to supercooled large drop conditions without the pilot being aware of it. The interval of exposure to the s upercooled large drop conditions may have varied from a brief amount of time (such as could occur during a vertical transition through a cloud) to a more sustained exposure (such as during a hold). Severity of the exposure conditions in terms of water cont ent may have varied significantly. Therefore, the hazard from encountering supercooled large drop conditions may be highly variable and dependent on various factors.

1.2.2.4 Icing event his tory of aeroplanes of conventional design certified before the in troduction of CS 25.1420 .

Given the volume of aeroplane operations and the number of reported incidents that did not result in a catastrophe, a factor of around 1 in 100 is a reasonable assumption of probability for a catastrophic event if an aeroplane enc ounters the icing conditions represented by Appendix O Appendix O in which it has not been sh own capable of safely operating, while the aeroplane’s ice protection systems are operating normally (in accordance with approved procedures for the icing conditio ns represented by Appendix C). An applicant may assume that the hazard classification for an unannunciated encounter with the icing conditions represented by Appendix O while the se ice protection systems are operating normally is h azardous in accordance wi th AMC 25.1309, provided that the following are true: — The aeroplane is similar to previous designs with respect to icing effects in the icing conditions represented by Appendix O, and — The applicant can show that the icing event history of all aeroplanes of conventional design is relevant to the aeroplane being considered for certification.

Powered by EASA eRules Page 1050 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT 1.2.2.5 Hazard assessment If an aeroplane is not similar to a previous design, an assessment of the hazard classification may require more analysis or testing. One method of hazard assessment would be to consider effects of ice accumulations similar to those expected for aeroplanes being certified under CS 25.1420. Such ice shapes may be defined from a combination of analysis and icing tanker or icing wind tunnel testing.

Aerodynamic effects of such shapes could be evaluated with wind tunnel testing or, potentially, computational fl uid dynamics. Hazard classification typically takes place early in a certification program.

Therefore, a conservative assessment may be required until sufficient supporting data is available to reduce the hazard classification.

1.2.3 Probability of encou ntering the icing conditions represented by Appendix O Appendix C was designed to include 99 percent of icing conditions.

Therefore, the probability of encountering icing outside of Appendix C drop - 2 conditions is on the order of 10 . The applicant may ass ume that the average probability for encountering the icing conditions represented by Appendix O - 2 is 1 x 10 per flight hour. This probability should not be reduced based on phase of flight.

1.2.4 Numerical safety analysis .

For the purposes of a numerica l safety analysis, the applicant may combine the probability of equipment failure with the probability, defined above, of encountering Appendix O icing conditions. If the applicant can support a - 2 hazard level of ‘Hazardous’ using the above probability (10 ) of encountering the specified supercooled large drop conditions, the probability of an unannunciated failure of the equipment that alerts the - 5 flight crew to exit icing conditions should be less than 1 x 10 .

1.2.5 Assessment of visual cues.

Typical system safety analysis do not address the probability of crew actions, such as observing a visual cue before performing a specified action. As advised in AMC 25.1309 , quantitative assessments of crew errors are not considered feasible. When visual cues are to be the method for detecting Appendix O conditions and determining when to exit them, the applicant should assess the appropriateness and reasonableness of the specific cues.

Reasonable tasks are those f or which the applicant can take full credit because the tasks can realistically be anticipated to be performed correctly when required. The applicant should assess the task of visually detecting Appendix O conditions to determine if it could be performed w hen required.

The workload for visually detecting icing conditions should be considered in combination with the operational workload during applicable phases of flight. The applicant may assume that the flight crew is already aware that the aeroplane has e ncountered icing. The assessment of whether the task is appropriate and reasonable is limited to assessing the task of identifying Appendix O accumulations that require exiting from the icing conditions.

Powered by EASA eRules Page 1051 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT 1.3 Similarity On derivative or new aeroplane designs, the applicant may use similarity to previous type designs which have been certified for operation in SLD icing conditions, meanwhile the effects of differences will be substantiated. Natural ice flight testing may not be necessary for a design shown to be similar.

The guidance provided in AMC 25.1419(a)(8) applies.

The applicant must possess all the data required to substantiate compliance with applicable specifications, including data from past certifications upon which the similarity analysis is based.

2. Tests CS 25.1420 requires two or more means of compliance for approval of flight in icing, except when a comparative analysis is used to show compliance. It is common to use a combination of m ethods in order to adequately represent the conditions and determine resulting degradation effects with sufficient confidence to show compliance.

Some of the guidance contained in paragraph (b) of AMC 25.1419 may be relevant to this paragraph. In addition, with respect to natural icing flight testing in the Appendix O icing environment, CS 25.1420 does not specifically require measured natural icing flight tests.

However, flight testing in measured natural Appendix O icing conditions may be necessary to: (i ) verify the general physical characteristics and location of the simulated ice shapes used for dry air testing, and in particular, their effects on aeroplane handling characteristics.

(ii) determine if ice accretes on areas where ice accretion was not p redicted.

(iii) verify adequate performance of ice detectors or visual cues.

(iv) conduct performance and handling quality tests as outlined in AMC 25.21(g).

(v) evaluate effects of ice accretion not normally evaluated with simulated ice shapes (on pro peller, antennas, spinners, etc.) and evaluate operation of each critical aeroplane system or component after exposure to Appendix O icing conditions.

Flight testing in natural Appendix O conditions would unlikely be necessary unless the aeroplane will be certified for continued operation within a portion or all of appendix O conditions. For aeroplanes to be certified to a portion or all of Appendix O, where natural Appendix O icing conditions flight testing is perf ormed, measurement and recording of drop diameter spectra should be accomplished.

Flight testing in natural Appendix O icing conditions should be accomplished for aeroplane derivatives whose ancestor aeroplanes hav e a service record that includes a pattern of accidents or incidents due to in flight encounters with Appendix O conditions.

(e) CS 25.1420(c) CS 25.1420(c) requires that aeroplanes certified in accordance with subparagraph CS 25.1420(a)(2) or (a)(3) comply with the requirements of CS 25.1419 (e), (f), (g), and (h) for the icing conditions defined in Appendix O in which the aeroplane is certified to operate.

Paragraphs (d), (e), (f), and (g) of AMC 25.1419 apply.

If applicable, a comparative analysis, as defined in AMC 25.1420(f), may be used to show compliance.

Powered by EASA eRules Page 1052 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT (f) CS 25.1420(d) Comparative analysis For showing compliance with the CS - 25 certification specifications relative to SLD icing conditions as represented by Appendix O, the applicant may use a comparative analysis to show similarity of a new or derivative aeroplane model to existing model(s) with features and/or margins which are deemed to have contributed to a safe fleet history in all icing conditions.

When using comparative analysis as a means of compliance, flight testing in measured natural SLD icing conditions and/or flight testing with simulated ice shapes defined in accordance with Appendix O — part II is not required. Nevertheless, other types of tests may be required.

1. Definitions — Accident: The definition of the term ‘accident’ is provided in ICAO Annex 13, Chapter 1.

— Certification ice shapes/ice shape data: Ice shapes or ice shape data used to show compliance with certification specificatio ns for flight in icing conditions. As used in this document, these are the ice shapes or data used to represent the critical ice shapes with the intent that they convey the ice that represents the most adverse effect on performance and flight characteristi cs. The data which is used to represent these shapes may be comprised of flight test data (artificial or natural ice), wind tunnel data, analytical data, or combinations of the above as allowed during previous certification projects.

— Comparative analysis: — The use of analyses to show that an aeroplane is comparable to models that have previously been certified for operation in icing conditions via the environment represented by Appendix C and have a proven safe operating history in any supercooled liquid w ater icing conditions, but that may not have already been explicitly certified for operation in the icing environment represented by Appendix O.

— Key elements: — The new or derivative model is certifiable for Appendix C icing conditions, — Aeroplane models p reviously certified for Appendix C icing conditions are used to establish a reference fleet, — The new or derivative model has similar design features and/or margins for key parameters relative to the reference fleet, — The reference fleet has a safe fleet h istory in supercooled liquid water icing conditions.

— Events: Within this document the word ‘event’ means ‘accident and/or serious incident’ as defined in ICAO Annex 13, Chapter 1. For the purpose of identifying serious incidents with respect to the in - ser vice history used for the comparative analysis, this should include reports where the flight crew encountered difficulties controlling the aeroplane, or temporarily lost its control, when flying in icing conditions.

— Key parameters: Parameters deemed to ha ve contributed to the safe operation in icing conditions of the reference fleet. These parameters should be defined and Powered by EASA eRules Page 1053 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT provided by the applicant for each of the topics addressed using the comparative analysis. They should be agreed with the Agency.

— Refer ence fleet: The fleet of previously certified aeroplanes used to establish safe fleet history in order to enable the use of comparative analysis as a means of compliance.

— Serious incident: The definition of the term ‘serious incident’ is provided in ICAO Annex 13, Chapter 1.

— Similarity analysis: — The direct comparison of a new or derivative aeroplane model to models already certified for operation in the icing environment of Appendix C and/or Appendix O. The similarity can be established for the aeroplane , the systems and/or the components.

— Key elements: — Similar design features, — Similar performance and functionality.

2. Introduction This paragraph introduces comparative analysis as a means of compliance with the CS - 25 certification specifications addressing SLD icing conditions represented by Appendix O.

The Agency acknowledges that there are a significant number of large aeroplane mo dels which have an exemplary record of safe operation in all icing conditions, which inherently include SLD icing conditions. A comparative analysis provides an analytical certification path for new aeroplane models and derivatives by allowing the applican t to substantiate that a new or derivative model will have at least the same level of safety in all supercooled liquid water icing conditions that previous models have achieved.

For derivative models, the applicable certification specifications are determ ined through the application of the ‘Changed Product Rule (CPR)’. Rather than demonstrating compliance with the certification specifications in effect at the date of application, an applicant may demonstrate compliance with an earlier amendment of the cert ification specifications when meeting one of the conditions provided in Part - 21, point 21.A.101(b).

After application of the CPR, if the derivative model must comply with an amendment that includes the SLD - related certification specifications, compliance b y comparative analysis may be used.

To use a comparative analysis as means of compliance for a new or derivative aeroplane model, four main elements should be established: a. A reference fleet with an adequately safe history in icing conditions; b. An analysis of aeroplane design features and/or margins that are deemed to contribute to the safe history of the reference fleet.

c. A comparison showing that the new or derivative aeroplane model shares the comparable design features and/or margins, wit h the reference fleet.

d. The compliance of the new or derivative aeroplane model with the applicable CS - 25 certification specifications relative to flight in the icing conditions defined by Appendix C.

Powered by EASA eRules Page 1054 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT 3. Determining Adequately Safe Fleet History In order to use a comparative analysis, a safe fleet history has to be established for the reference fleet of aeroplane model(s) to be used for comparison.

3.1 Fleet History Composition The reference fleet should include the previous aeroplane model(s) sha ring the design features and/or margins that will be used to substantiate the comparative analysis. The applicant should present to the Agency any known supercooled - liquid - water - icing - related accidents or serious incidents of the reference fleet. The appli cant should present an analysis of any such events and explain how the identified root causes were addressed. Unless it can be justified, credit should not be taken for those flights of any aeroplane model that has experienced accidents or serious incident s due to flight in supercooled liquid water icing conditions. If design changes were made to correct deficiencies that contributed to or caused the accidents or serious incidents, including those which may have occurred in SLD, credit for flights may be ta ken only for the fleet of aeroplanes that have the changes incorporated (i.e. post - modification number of flights).

3.2 Use of Fleet History Data Not Owned by the Applicant The use of fleet history data from the fleets of other certificate holders for S upplemental Type Certificate, new Type Certificate, or Major change to Type Certificate applications may be accepted by the Agency when formal agreements between the applicant and the certificate holder permitting the use of the relevant fleet history are in place. The Agency will determine the acceptability and the applicability of the data.

3.3 Applicability of Fleet History for the Certification Options of CS 25.1420(a) When compiling data for aeroplane model(s) which will comprise the applicant’s ref erence fleet, operational limitations or restrictions imposed by either the AFM(s) or the operating manuals furnished by the TC holder for the model(s), should be considered. Relevant operational limitations existing for the reference fleet (e.g. AFM or op erating manual prohibition against take - off into freezing drizzle or light freezing rain, direction to avoid such conditions in flight, directions to exit severe icing, etc.) will limit the certification options available for the use of a comparative analy sis.

If the aeroplane model(s) proposed to be included in the applicant’s reference fleet has (have) limitations or restrictions applicable to SLD, the certification options for which comparative analysis could be used are limited to CS 25.1420(a)(1) or ( a)(2).

The applicant should demonstrate within the comparative analysis that the means of ice and/or icing condition detection for the reference fleet remain valid and are applicable to the new or derivative aeroplane.

3.4 Safe Fleet History Requirements The reference fleet should have accumulated two million or more flights in total with no accidents or serious incidents in supercooled liquid water icing conditions aloft.

Powered by EASA eRules Page 1055 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT 4. Compliance with the Applicable CS - 25 Certification Specifications Relative to Appendix C Icing Conditions A comparative analysis is an acceptable means of compliance only with the CS - 25 certification specifications relative to Appendix O icing conditions. The use of a comparative analysis is not an option for showing compliance with CS - 25 certification specifications relative to Appendix C icing conditions.

5. Conducting Comparative Analysis If a safe fleet history in icing conditions can be substantiat ed, and compliance with the CS - 25 certification specifications for safe flight in Appendix C icing conditions can be shown, then the reference fleet can be used for comparative analysis. The substantiation of the reference fleet’s design features and/or ma rgins which have contributed to the safe fleet history can be used for a new or derivative model having comparable design features and/or margins, to show compliance with the CS - 25 certification specifications relative to flight in SLD icing conditions. Wh en conducting a comparative analysis, the effects of key parameters for individual components or systems should be considered at the aeroplane level. A different design feature or margin may be shown to be acceptable when considered at the aeroplane level, taking into account the other aircraft design features and margins that are deemed to contribute to safe flight in icing conditions. The following aspects should be addressed: a. Ice protection systems, b. Unprotected components, c. Ice or icing con ditions detection, d. Ice accretion and ice shedding sources, e. Performance and handling characteristics, f. Aeroplane Flight Manual information, g. Additional considerations — Augmenting comparative analysis 5.1 Applicable CS - 25 certification specifications The applicable certification specifications relative to SLD ici ng are listed in Table 1 below. This guidance is applicable to these certificati on specifications.

Table 1: List of applicable CS 25 certification specifications Reference Title CS 25.21(g) Performance and Handling Characteristics in Icing Conditions CS 25.629 Aeroelastic stability requirements CS 25.773(b)(1)(ii) Pilot compartment view — icing conditions CS 25.773(b)(4) Pilot compartment view — non - openable windows CS 25.929(a) Propeller de - icing CS 25 1093(b) Powerplant icing — turbine engines CS 25.1324 Flight instrument external probes CS 25.1329 Flight Guidance System CS 25.1403 Wing icing detection lights CS 25.1420 Supercooled large drop icing conditions Powered by EASA eRules Page 1056 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFE TY EQUIPMENT CS 25J1093 Air intake system icing protection 5.2 Ice Protection Systems The applicant should demonstrate similar levels of protection against the effects of ice accretion at the aeroplane level in the icing conditions of Appendix C. In doing so, the applicant s hould consider the ice protection system performance, modes of operation and the other factors identified by the applicant that contribute to the overall safety of the aeroplane for flight in the icing conditions of Appendix C. The assessment could include , but is not necessarily limited to, an analysis of the protection limits relative to supercooled liquid water impingement limits, runback and residual ice, as applicable.

5.3 Failure Analysis The reference fleet will have been certified considering onl y the supercooled liquid water icing conditions of Appendix C and will have demonstrated an adequate level of safety when flying in both Appendix C and SLD icing conditions. Therefore, if a comparative analysis is used as a means of compliance with the CS - 25 certification specifications relative to Appendix O icing conditions, the ice protection system for a new or derivative aeroplane, and the related equipment or components comprising the system, should demonstrate a reliability level consistent with a Fu nctional Hazard Assessment (FHA) as per CS 25.1309(b). The classification and assessment of failure conditions need only consider the effects of Appendix C icing conditions.

5.4 Ice or Icing Conditions Detection If the new or derivative model being cert ified has similar ice and/or icing conditions detection means as the reference fleet, including installation and operational considerations (e.g. flight crew procedures), then a comparative analysis may be used to show compliance with Appendix O - related ce rtification specifications.

If the applicant chooses to introduce a new ice and/or icing conditions detection technology and show compliance at the aeroplane level based on a reference fleet with unrestricted operations, and the applicant is seeking certif ication by comparative analysis for unrestricted operations in SLD icing conditions for the new or derivative model per CS 25.1420(a)(3), the new ice and/or icing conditions detection technology should be installed and operate in a manner that results in e quivalent ice and/or icing conditions detection performance. This may include additional qualification to the icing conditions represented by Appendix C.

If the certification option chosen requires a differentiation between icing conditions (CS 25.1420(a) (1) or (a)(2)), then either the reference fleet should have demonstrated the ability to detect that the aeroplane is operating in conditions that exceed the conditions selected for certification (i.e. for CS 25.1420(a)(1), any Appendix O icing conditions; and for CS 25.1420(a)(2), the icing conditions that are beyond the selected portion of Appendix O), or the ice and/or icing conditions detection means should be substantiated for detection of the applicable Appendix O icing conditions at the aeroplane leve l.

If the reference fleet has achieved the required number of flights to enable the use of a comparative analysis to show compliance with the CS - 25 certification specifications relative to Appendix O, then Appendix C may be used to show Powered by EASA eRules Page 1057 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT compliance with the ce rtification specifications related to ice accretions before the ice protection system has been activated and is performing its intended function (e.g. CS 25.1419(e), CS 25.143(j) and CS 25.207(h)).

5.5 Unprotected Components For systems that are require d to operate in Appendix O icing conditions but do not require ice protection provisions, for example the Autopilot (CS 25.1329), wing illumination lights (CS 25.1403), unprotected environmental control system (ECS) intakes (CS 25.1420), etc., a comparativ e analysis may be used if design features are shown to be similar to those of the reference fleet.

5.6 Ice Accretion and Ice Shedding Sources If a comparative analysis is used as the means of compliance with the CS - 25 certification specifications relati ve to Appendix O icing conditions, certification ice shapes/ice data determined for Appendix C icing conditions are acceptable without additional Appendix O considerations. The locations where ice accretions may occur on the new or derivative model should be reviewed and compared to those of the reference fleet. The following aspects should be considered: i. An analysis showing that, in Appendix C icing conditions, the propulsion system and APU installation are such that the geometry and water catch of potential sources of ice shedding are similar to those used to establish the reference fleet history database .

ii. A comparison of the location of, or the methodology for locating, flight instrument external probes to assure that the effect of airframe ice accretion forward of the probes will be comparable for the new or derivative model with that of the refere nce fleet relative to safe flight in the icing conditions of Appendix C.

iii. For aeroelastic analyses, performance of an analysis showing ice accretion consistency (location and volume), defined using the icing conditions of Appendix C.

5.7 Aeroplane P erformance and Handling Characteristics The comparative analysis should substantiate that the effects of ice accretion and the agreed key parameters of the new or derivative model are comparable to those of the reference fleet. The applicant should substa ntiate by analysis, test, or a combination of both, that the new or derivative aeroplane will have similar margins to those of the reference fleet for flight in the icing conditions of Appendix C.

The following paragraphs provide guidance on how to achiev e the above: — Aeroplane performance, — Aeroplane controllability and manoeuvrability, — Aeroplane trim, — Aeroplane stability, — Aeroplane stalls.

5.7.1 Performance The effects on aeroplane performance of the certification ice shapes/ice shape data determi ned for flight in the icing conditions of Appendix C for the Powered by EASA eRules Page 1058 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT new or derivative model should be comparable to those of the reference fleet. A comparison of ice accretion effects on lift and drag may be used in this analysis.

If comparable effects to those of the reference fleet cannot be shown, then the applicant should show how margins similar to those of the reference fleet are restored for the new or derivative model by other means that compensate for the effect (e.g. airspeed increase, sizing criteria, or other aeroplane limitations).

5.7.2 Controllability and Manoeuvrability The effectiveness of the control surfaces and the control forces for the new or derivative model, with the certification ice shapes/ice shape data for flight in the icing conditi ons of Appendix C, should be comparable to those of the reference fleet. If critical Appendix C ice shapes affect the control surface effectiveness or control forces in a manner which may be different to that of the reference fleet, then the applicant shou ld show how the control effectiveness and forces are retained.

The manoeuvrability associated with the certification ice shapes/ice shape data determined for the icing conditions of Appendix C should be comparable to those of the aeroplanes which comprise the reference fleet.

If critical Appendix C ice shapes affect manoeuvrability in a manner which may be different to that of the reference fleet, then the applicant should show how the margins are retained (speed increase, etc.).

5.7.3 Trim In addition to showing that trim capability for the new or derivative model, with the certification ice shapes/ice shape data for flight in the icing conditions of Appendix C, is comparable to that of the reference fleet, the margins between the required trim in the m ost critical conditions and the trim capability in Appendix C icing conditions should be comparable to those of the reference fleet.

5.7.4 Stability The aeroplane stability associated with the certification ice shapes/ice shape data determined for the i cing conditions of Appendix C should be comparable to those of the reference fleet. If this cannot be shown, then the applicant should show how similar stability margins are retained (speed increase, sizing criteria, other aircraft limitations, etc).

5.7. 5 Stalls a. Stall warning and protection features Stall warning, stall protection, and/or airspeed awareness methods, devices, and/or systems as applicable should be shown by comparative analysis to be similar in function or improved relative to those of the reference fleet.

b. Stall warning margins Powered by EASA eRules Page 1059 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT Stall warning margins established with the certification ice shapes/ice shape data associated with flight in the icing conditions of Appendix C should be comparable to those of the reference fleet.

c. Stall characteristics The stall characteristics demo nstrated by the new or derivative model with the certification ice shapes/ice shape data for flight in the icing conditions of Appendix C should be comparable to those of the reference fleet.

d. Aeroplane with Flight Envelope Protection It should be sh own that the new or derivative aeroplane and the reference fleet aeroplane(s) high angle - of - attack protection systems have a comparable ability to accommodate any reduction in stalling angle of attack with the certification ice shapes/ice shape data for fl ight in the icing conditions of Appendix C relative to the clean aeroplane.

The high angle - of - attack characteristics demonstrated with the certification ice shapes/ice shape data for flight in the icing conditions of Appendix C should be comparable to th ose of the reference fleet.

5.8 Aeroplane Fight Manual Information If the certification option chosen for the new or derivative model being certified (CS 25.1420(a)(1), (a)(2), or (a)(3)) is consistent with the operation of the reference fleet, then the information to be provided in the AFM may be based on that provided in the reference fleet AFM(s) or other operating manual(s) furnished by the TC holder.

5.9 Additional Considerations — Augmenting Comparative Analysis In addition to the use of design features and/or margins, to substantiate a new or derivative design by comparative analysis, the applicant may augment the comparative analysis with other methodologies (e.g. test, analysis or a combination thereof). The new methodologies should be agreed with the Agency.

[Amdt 25/16] [Amdt 25/18]

CS 25.1421 Megaphones

ED Decision 2003/2/RM If a megaphone is installed, a restraining means must be provided that is capable of restraining the megaphone when it is subjected to the ultimate inertia forces speci fied in CS 25.561(b)(3) .

Powered by EASA eRules Page 1060 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) SAFETY EQUIPMENT

CS 25.1423 Public address system

ED Decision 2006 / 005/R A public ad dress system required by operational rules must – (a) Be powerable when the aircraft is in flight or stopped on the ground, after the shutdown or failure of all engines and auxiliary power units, or the disconnection or failure of all power sources dependent on their continued operation, for – (1) A time duration of at least 10 minutes, including an aggregate time durat ion of at least 5 minutes of announcements made by flight and cabin crew members, considering all other loads which may remain powered by the same source when all other power sources are inoperative; and (2) An additional time duration in its standby state appropriate or required for any other loads that are powered by the same source and that are essential to safety of flight or required during emergency conditions.

(b) The system must be capable of operation within 3 seconds from the time a microphone is removed from its stowage by a cabin crew member at those stations in the passenger compartment from which its use is accessible.

(c) Be intelligible at all passenger seats, lavatories, and cabin crew member seats and work stations.

(d) Be designed so that no unused, un - stowed microphone will render the system inoperative.

(e) Be capable of functioning independently of any required crewmember interphone system.

(f) Be accessible for immediate use from each of two flight - crew member stations in the pilot compartment.

(g) For each required floor - level passenger emergency exit which has an adjacent cabin crew member seat, have a microphone which is readily accessible to the seated cabin crew member, except that one microphone may serve more than one exit, p rovided the proximity of the exits allows unassisted verbal communications between seated cabin crew members.

[Amdt 25/2] Powered by EASA eRules Page 1061 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

MISCELLANEOUS EQUIPMENT

CS 25.1431 Electronic equipment

ED Decision 2003/2/RM (a) In showing compliance with CS 25.1309(a) and (b) with respect to radio and electronic equipment and their installations, critical environmental conditions must be considered (b) Radio and electronic equipment must be supplied with power under the req uirements of CS 25.1355(c) .

(c) Radio and electronic equipment, controls and wiring must be installed so that operation of any one unit or system of units will not adversely affect the simultaneous operation of an y other radio or electronic unit, or syste m of units, required by this CS - 25.

(d) Electronic equipment must be designed and installed such that it does not cause essential loads to become inoperative, as a result of electrical power supply transients or tr ansients from other causes.

CS 25.1433 Vacuum systems

ED Decision 2003/2/RM There must be means, in addition to the normal pressure relief, to automatically relieve the pressure in the discharge lines from the vacuum air pump when the delivery temperature of the air becomes unsafe.

CS 25.1435 Hydraulic Systems

ED Decision 2006 / 00 5/R (See AMC 25.1435 ) (a) Element design. Each element of the hydraulic system must be designed to: (1) Withstand the proof pressure without permanent deformation that would prevent it from performing its intende d function, and the ultimate pressure without rupture. The proof and ultimate pressures are defined in terms of the design operating pressure (DOP) as follows: Element Proof (x DOP) Ultimate (xDOP) 1. Tubes and fittings 1.5 3.0 2. Pressure vessels containing gas High pressure (e.g. accumulators) 3.0 4.0 Low pressure (e.g. reservoirs) 1.5 3.0 3. Hoses 2.0 4.0 4. All other elements 1.5 2.0 (2) Withstand, without deformation that would prevent it from performing its intended function, the design operating pressure in combination with limit structural loads that may be imposed; (3) Withstand, without rupture, the design operating pressure multiplied by a factor of 1.5 in combination with ultimate structural loads that can reasonably occur simultaneously; Powered by EASA eRules Page 1062 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT (4) Withstand the fatigue effects of all cyclic pressures, including transients, and associated externally induced loads, taking into account the consequences of element failure; and (5) Perform as intended under all environmental conditions for which the aeroplane is certificated.

(b) System design. Each hydraulic system must: (1) Have means located at a flight crew member station to indicate appropriate system parameters, if (i) It performs a function necessary for continued safe flight and landing; or (ii) In the event of hydraulic system malfunction, corrective action by the crew to ensure continued safe flight and landing is necessary; (2) Have means to ensure that system pressures, including transient pressures a nd pressures from fluid volumetric changes in elements that are likely to remain closed long enough for such changes to occur, are within the design capabilities of each element, such that they meet the requirements defined in CS 25.1435(a)(1) through CS 25.1435(a)(5) inclusive; (3) Have means to minimise the release of harmful or hazardous concentrations of hydraulic fluid or vapours into the crew and passenger compartment s during flight; (4) Meet the applicable requirements of CS 25.863 , 25.1183 , 25.1185 and 25.1189 if a flammable hydraulic fluid is used; and (5) Be designed to use any suitable hydraulic fluid specified by the aeroplane manufacturer, which must be identified by appropriate markings as required by CS 2 5.1541 .

(c) Tests. Tests must be conducted on the hydraulic system(s), and/or subsystem(s) and element(s), except that analysis may be used in place of or to supplement testing where the analysis is shown to be reliable and appropriate. All internal and ex ternal influences must be taken into account to an extent necessary to evaluate their effects, and to assure reliable system and element functioning and integration. Failure or unacceptable deficiency of an element or system must be corrected and be suffic iently retested, where necessary.

(1) The system(s), subsystem(s), or element(s) must be subjected to performance, fatigue, and endurance tests representative of aeroplane ground and flight operations.

(2) The complete system must be tested to determine p roper functional performance and relation to other systems, including simulation of relevant failure conditions, and to support or validate element design.

(3) The complete hydraulic system(s) must be functionally tested on the aeroplane in normal operatio n over the range of motion of all associated user systems. The test must be conducted at the relief pressure or 1.25 times the DOP if a system pressure relief device is not part of the system design. Clearances between hydraulic system elements and other s ystems or structural elements must remain adequate and there must be no detrimental effects.

[Amdt 25/2] Powered by EASA eRules Page 1063 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

AMC 25.1435 Hydraulic Systems - Design, Test, Analysis and

Certification

ED Decision 20 16 / 010 /R 1. PURPOSE This AMC (Acceptable Means of Compliance), which is similar to the FAA Advisory Circular AC 25.1435 - 1, provides advice and guidance on the interpretation of the requirements and on the acceptable means, but not the only means, of demonstrating compliance w ith the requirements of CS 25.1435 . It also identifies other paragraphs of the Certification Specifications (CS) that contain related requirements and other related and complementary documents.

The advice and guid ance provided does not in any way constitute additional requirements but reflects what is normally expected by the EASA.

2. RELATED REGULATORY MATERIAL AND COMPLEMENTARY DOCUMENTS (a) Related Certification Specifications CS - 25 Paragraphs (and their assoc iated AMC material where applicable) that prescribe requirements related to the design substantiation and certification of hydraulic systems and elements include: CS 25.301 Loads CS 25.303 Factor of safety CS 25.863 Flammable fluid fire protection CS 25.1183 Flammable fluid - carrying components CS 25.1185 Flammable fluids CS 25.1189 Shutoff means CS 25.1301 Function and installation CS 25.1309 Equipment, systems and installations CS 25.1322 Warning, caution and advisory lights CS 25.1541 General: Markings and Placards Additional CS - 25 paragraphs (and their associated AMC material where applicable) that prescribe requirements which can have a significant impact on the overall design and configuration of hydraulic systems are, but are not limited to: CS 25.671 General: Control systems CS 25.729 Extending r etracting mechanism s CS 25.903 Engines CS 25.1315 25 Negative acceleration (b) Complementary Documents Documents, which are considered to provide appropriate standards for the design substantiation and certification of hydraulic systems and system elem ents may include, but are not limited to: (i) CS - European Standard Orders (CS - E TSO's) E TSO - C47 Pressure Instruments - Fuel, Oil and Hydraulic E TSO - 2C75 Hydraulic Hose Assemblies (ii) Society of Automotive Engineers (SAE) Documents Powered by EASA eRules Page 1064 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT ARP 4752 Aerospace - Design and Installation of Commercial Transport Aircraft Hydraulic Systems Note: This document provides a wide range of Civil, Military and Industry document references and standards, which may be appropriate.

(iii) International Org anisation for Standardisation (ISO) Documents ISO 7137 Environmental Conditions and Test Procedures for Airborne Equipment (iv) US Military Documents MIL - STD - 810 Environmental Test Methods and Engineering Guidelines (v) European Aviation Safety Agencies Publication Certification Specification No. 20 AMC 20.6 Temporary Guidance Material for Extended Range Operation with Two - Engine Aeroplanes ETOPS Certification and Operation (vi) The European Organisation for Civil Aviation Equipment Documents E D - 14 G/RTCA DO - 160G Environmental Conditions and Test Procedures for Airborne Equipment 3. ADVICE AND GUIDANCE (a) Element Design (1) Ref. CS 25.1435(a)(1) The design operating pressure (DOP) is the normal maximu m steady pressure. Excluded are reasonable tolerances, and transient pressure effects such as may arise from acceptable pump ripple or reactions to system functioning, or demands that may affect fatigue. Fatigue is addressed in sub - paragraph (a)(4) of this paragraph.

The DOP for low - pressure elements (e.g., return, case - drain, suction, reservoirs, etc.) is the maximum pressure expected to occur during normal user system operating modes. Included are transient pressures that may occur during separate or simu ltaneous operation of user systems such as slats, flaps, landing gears, thrust reverses, flight controls, power transfer units, etc. Short term transient pressures, commonly referred to as pressure spikes, that may occur during the selection and operation of user systems (e.g., those pressure transients due to the opening and closing of selector/control valves, etc.) may be excluded, provided the fatigue effect of such transients is addressed in accordance with sub - paragraph (a)(4) of this paragraph.

In lo cal areas of systems and elements the DOP may be different from the above due to the range of normally anticipated aeroplane operational, dynamic and environmental conditions. Such differences should be taken into account.

At proof pressure, seal leakage not exceeding the allowed maximum in - service leak rate is permitted. Each element should be able to perform its intended functions when the DOP is restored.

For sub - paragraphs (a)(1), (a)(2) and (a)(3) of this paragraph, the pressure and structural loads, as applicable, should be sustained for sufficient time to enable adequate determination that compliance is demonstrated. Typically a time of 2 Powered by EASA eRules Page 1065 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT minutes for proof conditions and 1 minute for ultimate conditions will be considered acceptable.

The term "pres sure vessels" is not intended to include small volume elements such as lines, fittings, gauges, etc. It may be necessary to use special factors for elements fabricated from non - metallic/composite materials.

(2) Ref. CS 25.1435(a)(2) Limit structural loads are defined in CS 25.301(a) . The loading conditions of CS - 25, subpart C to be considered include, but are not limited to, flight and ground manoeuvres, and gust and turbulence conditions. The loads arising in thes e conditions should be combined with the maximum hydraulic pressures, including transients that could occur simultaneously. Where appropriate, thermal effects should also be accounted for in the strength justification. For hydraulic actuators equipped with hydraulic or mechanical locking features, such as flight control actuators and power steering actuators, the actuators and other loaded elements should be designed for the most severe combination of internal and external loads that may occur in use. For h ydraulic actuators that are free to move with external loads, i.e. do not have locking features, the structural loads are the same as the loads produced by the hydraulic actuators. At limit load, seal leakage not exceeding the allowed maximum in - service le ak rate is permitted.

(3) Ref. CS 25.1435(a)(3) For compliance, the combined effects of the ultimate structural load(s) as defined in CS 25.301 and 25.303 and the DOP, which can reasonably occur simultaneously, should be taken into account with a factor of 1.5 applied to the DOP. In this case the overall structural integrity of the element should be maintained. However, it may be permissible for this elemen t to suffer leakage, permanent deformation, operational/functional failure or any combination of these conditions. Where appropriate, thermal effects should also be accounted for in the strength justification.

(4) Ref. CS 25.1435(a)(4) Fatigue, the repeated load cycles of an element, is a significant contributor to element failure. Hydraulic elements are mainly subjected to pressure loads, but may also see externally induced load cycles (e.g. structural, thermal, et c.). The applicant should define the load cycles for each element. The number of load cycles should be evaluated to produce equivalent fatigue damage encountered during the life of the aeroplane or to support the assumptions used in demonstrating complianc e with CS 25.1309 . For example, if the failure analysis of the system allows that an element failure may occur at 25% of aeroplane life, the element fatigue life should at least support this assumption.

(5) Ref. CS 25.1435(a)(5) Aeroplane environmental conditions that an element should be designed for are those under which proper function is required. They may include, but are not limited to temperature, humidity, vibration, acceleration forces, icing, ambient pressure, electromagnetic effects, salt spray, cleaning agents, galvanic, sand, dust and fungus. They may be location specific (e.g., in pressurised cabin vs. in unpressurised area) or general (e.g. attitude). For furth er guidance on environmental testing, suitable references include, but are not limited to, Military Standard, MIL - STD - 810 "Environmental Test Methods and Engineering Guidelines", The European Organisation for Civil Aviation Equipment Document ED - 14 G "Envir onmental Conditions and Test Procedures for Airborne Equipment" or International Organisation for Standardisation Document No. ISO 7137 "Environmental Conditions and Test Procedures for Airborne Equipment".

Powered by EASA eRules Page 1066 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT (b) System Design Ref. CS 25.1435(b) Design features that should be considered for the elimination of undesirable conditions and effects are: (a) Design and install hydraulic pumps such that loss of fluid to or from the pump cannot lead t o events that create a hazard that might prevent continued safe operation. For example, engine driven pump shaft seal failure or leakage in combination with a blocked fluid drain, resulting in engine gearbox contamination with hydraulic fluid and subsequen t engine failure.

(b) Design the system to avoid hazards arising from the effects of abnormally high temperatures, which may occur in the system under fault conditions.

(1) Ref. CS 25.1435(b)(1) Appropriate system parameters may include, but are not limited to, pump or system temperatures and pressures, system fluid quantities, and any other parameters which give the pilot indication of the functional level of the hydraulic systems.

(2) Ref. CS 25.1435(b)(2) Compliance may be shown by designing the systems and elements to sustain the transients without damage or failure, or by providing dampers, pressure relief devices, etc.

(3) Ref. CS 25.1435(b)(3) Harmful or hazardous fluid or vapour concentrations are those that can cause short term incapacitation of the flight crew or long term health effects to the passengers or crew.

Compliance may be shown by taking design precautions, to minim ise the likelihood of releases and, in the event of a release, to minimise the concentrations. Suitable precautions, based on good engineering judgement, include separation of air conditioning and hydraulic systems, shut - off capability to hydraulic lines, reducing the number of joints and elements, shrouding, etc. In case of leakage, sufficient drainage should be provided.

(4) Ref. CS 25.1435(b)(4) Unless it has been demonstrated that there are no circumstances which can exist (on the aeroplane) under which the hydraulic fluid can be ignited in any of its physical forms (liquid, atomised, etc.), the hydraulic fluid should be considered to be flammab le.

(5) Ref. CS 25.1435(b)(5) If more than one approved fluid is specified, the term “suitable hydraulic fluid” is intended to include acceptable mixtures. Typical nameplate marking locations for hydraulic fluid us e, are all hydraulic components having elastomer seals such as cylinders, valves, reservoirs, etc.

(c) Tests Ref. CS 25.1435(c) Test conditions should be representative of the environment that the element, subsyste m or system may be exposed to in the design flight envelope. This may include loads, temperature, altitude effects, humidity, and other influences (electrical, pneumatic, etc.). Testing may be conducted in simulators, or stand - alone rigs, integrated labora tory rigs, or on the aeroplane. The test plan should describe the objectives and test methods. All interfaces between the aeroplane elements and the test facilities should be adequately represented.

(1) Ref. CS 25 .1435(c)(1) Testing for performance should demonstrate rates and responses required for proper system operation. Testing for fatigue (the repeated Powered by EASA eRules Page 1067 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT load cycling of an element) and endurance (the ability of parts moving relative to each other to continue to perform their intended function) should be sufficient to show that the assumptions used in demonstrating compliance with CS 25.1309 are correct, but are not necessary to demonstrate aeroplane design life. As part o f demonstrating that the element(s), sub - system(s), or system(s) perform their intended functions, the manufacturer (applicant) may select procedures and factors of safety identified in accepted manufacturing, national, military, or industry standards, pro vided that it can be established that they are suitable for the intended application. Minimum design factors specified in those standards or the requirements may be used unless more conservative factors have been agreed with the Agency.

An acceptable test approach for fatigue or endurance testing is to: (a) Define the intended element life; (b) Determine the anticipated element duty cycle; (c) Conduct testing using the anticipated or an equivalent duty cycle.

(2) Ref. CS 25.1435(c)(2) The tests should include simulation of hydraulic system failure conditions in order to investigate the effect(s) of those failures, and to correlate with the failure conditions considered for demonstrating compliance with CS 25.1309 . Relevant failure conditions to be tested are those, which cannot be shown to be extremely improbable, and have effects assessed to be major, hazardous, or have significant system interaction or operational implicati ons.

(3) Ref. CS 25.1435(c)(3) Compliance with CS 25.1435(c)(3) can be accomplished by applying a test pressure to the system using aeroplane pumps or an alternate pressure source (e.g. ground cart). The test press ure to be used should be just below the pressure required to initiate system pressure relief (cracking pressure).

Return and suction pressures are allowed to be those, which result from application of the test pressure to the pressure side of the system.

Some parts of the system(s) may need to be separately pressurised to ensure the system is completely tested. Similarly, it may be permissible that certain parts of the system need not be tested if it can be shown that they do not constitute a significant p art of the system with respect to the evaluation of adequate clearances or detrimental effects.

[Amdt 25/2] [Amdt 25/12] [Amst 25/18]

CS 25.1436 Pneumatic systems – high pressure

ED Decision 2016 / 010/R (See AMC 25.1436) (a) General . Pneumatic systems which are powered by, and/or used for distributing or storing, air or nitrogen, must comply with the requirements of this paragraph.

(1) Compliance with CS 25.1309 for pneumatic systems must be shown by functional tests, endurance tests and analysis. Any part of a pneumatic system which is an engine accessory must comply with the relevant requirements of CS 25.1163 .

Powered by EASA eRules Page 1068 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT (2) No element of the pneumatic system which would be liable to cause hazardous effects by exploding, if subject to a fire, may be mounted within an engine bay or other designated fire zone, or in the same compartment as a combustion heater.

(3) When the system is operating no hazardous blocka ge due to freezing must occur. If such blockage is liable to occur when the aeroplane is stationary on the ground, a pressure relieving device must be installed adjacent to each pressure source.

(b) Design . Each pneumatic system must be designed as follows : (1) Each element of the pneumatic system must be designed to withstand the loads due to the working pressure, P , in the case of elements other than pressure vessels or to the w limit pressure, P , in the case of pressure vessels, in combination with limit structural L loads which may be imposed without deformation that would prevent it from performing its intended function, and to withstand without rupture, the working or limit pressure loads multip lied by a factor of 1·5 in combination with ultimate structural loads that can reasonably occur simultaneously.

(i) P . The working pressure is the maximum steady pressure in service acting on the w element including the tolerances and possible pressure var iations in normal operating modes but excluding transient pressures.

(ii) P . The limit pressure is the anticipated maximum pressure in service acting on a L pressure vessel, including the tolerances and possible pressure variations in normal operating mode s but excluding transient pressures.

(2) A means to indicate system pressure located at a flight - crew member station, must be provided for each pneumatic system that – (i) Performs a function that is essential for continued safe flight and landing; or (ii ) In the event of pneumatic system malfunction, requires corrective action by the crew to ensure continued safe flight and landing.

(3) There must be means to ensure that system pressures, including transient pressures and pressures from gas volumetric cha nges in components which are likely to remain closed long enough for such changes to occur – (i) Will be within 90 to 110% of pump average discharge pressure at each pump outlet or at the outlet of the pump transient pressure dampening device, if provided; and (ii) Except as provided in sub - paragraph (b)(6) of this paragraph, will not exceed 125% of the design operating pressure, excluding pressure at the outlets specified in sub - paragraph (b)(3)(i) of this paragraph. Design operating pressure is the maximu m steady operating pressure.

The means used must be effective in preventing excessive pressures being generated during ground charging of the system. (See AMC 25.1436(b)(3) .)

(4) Each pneumatic element must be ins talled and supported to prevent excessive vibration, abrasion, corrosion, and mechanical damage, and to withstand inertia loads.

(5) Means for providing flexibility must be used to connect points in a pneumatic line between which relative motion or differe ntial vibration exists.

Powered by EASA eRules Page 1069 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT (6) Transient pressure in a part of the system may exceed the limit specified in sub - paragraph (b)(3)(ii) of this paragraph if – (i) A survey of those transient pressures is conducted to determine their magnitude and frequency; an d (ii) Based on the survey, the fatigue strength of that part of the system is substantiated by analysis or tests, or both.

(7) The elements of the system must be able to withstand the loads due to the pressure given in Appendix L , for the proof condition without leakage or permanent distortion and for the ultimate condition without rupture. Temperature must be those corresponding to normal operating conditions. Where elements are constructed from materials other than aluminium alloy, tungum, or m edium - strength steel, the Authority may prescribe or agree other factors. The materials used should in all cases be resistant to deterioration arising from the environmental conditions of the installation, particularly the effects of vibration.

(8) Where a ny part of the system is subject to fluctuating or repeated external or internal loads, adequate allowance must be made for fatigue.

(c) Tests (1) A complete pneumatic system must be static tested to show that it can withstand a pressure of 1·5 times the working pressure without a deformation of any part of the system that would prevent it from performing its intended function. Clearance between structural members and pneumatic system elements must be adequate and there must be no permanent detrimental deformation. For the purpose of this test, the pressure relief valve may be made inoperable to permit application of the required pressure.

(2) The entire system or appropriate sub - systems must be tested in an aeroplane or in a mock - up installation to det ermine proper performance and proper relation to other aeroplane systems. The functional tests must include simulation of pneumatic system failure conditions. The tests must account for flight loads, ground loads, and pneumatic system working, limit and tr ansient pressures expected during normal operation, but need not account for vibration loads or for loads due to temperature effects. Endurance tests must simulate the repeated complete flights that could be expected to occur in service. Elements which fai l during the tests must be modified in order to have the design deficiency corrected and, where necessary, must be sufficiently retested. Simulation of operating and environmental conditions must be completed on elements and appropriate portions of the pne umatic system to the extent necessary to evaluate the environmental effects. (See AMC 25.1436(c)(2) .)

(3) Parts, the failure of which will significantly lower the airworthiness or safe handling of the aeroplane mus t be proved by suitable testing, taking into account the most critical combination of pressures and temperatures which are applicable.

[Amdt 25/1] [Amdt 25/18] Powered by EASA eRules Page 1070 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

AMC 25.1436(b)(3) Pneumatic Systems

ED Decision 2003/ 2/RM 1 In systems in which the air press ure of the supply sources is significantly greater than the system operating pressure (e.g. an engine bleed - air tapping) due account should be taken of the consequences of failure of the pressure - regulating device when assessing the strength of the system, downstream of the device relative to the values of P , P and P .

W L R 2 Such devices should be protected as necessary against deleterious effects resulting from the presence of oil, water or other impurities, which may exist in the system.

AMC 25.1436(c)(2) Pneumatic Systems

ED Decision 2003/2/RM The loads due to vibration and the loads due to temperature effects are those loads, which act upon the elements of the system due to environmental conditions.

CS 25.1438 Pressurisation and low pressure pneumatic systems

ED Decision 2016/010/R (See AMC 25.1438 ) Pneumatic systems (ducting and components) served by bleed air, such as engine bleed air, air conditioning, pressurisation, engine starting and hotair ice - protection systems, which are essential for the safe operation of the aeroplane or whose failure may adversely affect any essential or critical part of the aeroplane or the safety of the occupants, must be so designed and installed as to comply the CS 25.1309 In particular account must be taken of bursting or excessive leakage. (See AMC 25.1438 paragraph 1 for strength and AMC 25.14 38 paragraph 2 for testing.)

[Amdt 25/18]

AMC 25.1438 Pressurisation and low pressure pneumatic s ystems

ED Decision 2003/ 2/RM 1 Strength 1.1 Compliance with CS 25.1309(b) in relation to leakage in ducts and components will be achieved if it is shown that no hazardous effect will result from any single burst or excessive leakage.

1.2 Each element (ducting and components) of a system, the failure of which is likely to endanger the aeroplane or its occupants, should satisfy the most critical conditions of Table 1.

TABLE 1 Conditions 1 Conditions 2 1·5 P at T 3·0 P at T 1 1 1 1 1·33 P 2 at T 2 2·66 P 2 at T 2 1·0 P at T 2·0 P at T 3 3 3 3 – 1·0 P 4 at T 4 Powered by EASA eRules Page 1071 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT P = the most critical value of pressure encountered during normal functioning.

T = the combination of internal and external temperatures which can be encountered in association with pressure P .

P = the most critical value of pressure corresponding to a probability of occurrence ‘reasonably probable’.

T = the combination of internal and external temperatures which can be encountered in association with pressur e P 2 .

P = the most critical value of pressure corresponding to a probability of occurrence ‘remote’.

T = the combination of internal and external temperatures which can be encountered in association with pressure P .

P = the most critical value of pressure corresponding to a probability of occurrence ‘extremely remote’.

T 4 = the combination of internal and external temperatures which can be encountered in association with pressure P .

1.3 After being subjected to the conditions given in col umn 1 of Table 1, and on normal operating conditions being restored, the element should operate normally and there should be no detrimental permanent distortion.

1.4 The element should be capable of withstanding the conditions given in column 2 of Table 1 without bursting or excessive leakage. On normal operating conditions being restored, correct functioning of the element is not required.

1.5 The element should be capable of withstanding, simultaneously with the loads resulting from the temperatures a nd pressures given in the Table, the loads resulting from – a. Any distortion between each element of the system and its supporting structures.

b. Environmental conditions such as vibration, acceleration and deformation.

1.6 The system should be designed to have sufficient strength to withstand the handling likely to occur in operation (including maintenance operations).

2 Tests 2.1 Static tests . Each element examined under 1.2 should be static - tested to show that it can wit hstand the most severe conditions derived from consideration of the temperatures and pressures given in the Table. In addition, when necessary, sub - systems should be tested to the most severe conditions of 1.2 and 1.5. The test facility should be as repres entative as possible of the aircraft installation in respect of these conditions.

2.2 Endurance tests . When failures can result in hazardous conditions, elements and/or sub - systems should be fatigue - tested under representative operating conditions that si mulate complete flights to establish their lives.

Powered by EASA eRules Page 1072 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

CS 25.1439 Protective breathing equipment

ED Decision 2007 / 0 2 0/R (a) Fixed (stationary, or built in) protective breathing equipment must be installed for the use of the flight crew, and at least one port able protective breathing equipment shall be located at or near the flight deck for use by a flight crew member. In addition, portable protective breathing equipment must be installed for the use of appropriate crew members for fighting fires in compartmen ts accessible in flight other than the flight deck. This includes isolated compartments and upper and lower lobe galleys, in which crew member occupancy is permitted during flight. Equipment must be installed for the maximum number of crew members expected to be in the area during any operation .

(b) For protective breathing equipment required by subparagraph (a) of this paragraph or by the applicable Operating Regulations, the following apply: (1) The equipment must be designed to protect the appropriate crewmember from smoke, carbon dioxide, and other harmful gases while on flight deck duty or while combating fires.

(2) The equipment must include – (i) Masks covering the eyes, nose and mouth, or (ii) Masks covering the nose and mouth, plus acc essory equipment to cover the eyes.

(3) Equipment, including portable equipment, while in use must allow communication with other crew members while in use . Equipment available at flight crew assigned duty stations must enable the flight crew to use radio equipment.

(4) The part of the eq uipment protecting the eyes must not cause any appreciable adverse effect on vision and must allow corrective glasses to be worn.

(5) The equipment must supply protective oxygen of 15 minutes duration per crew member at a pressure altitude of 2438 m (8000 ft) with a respiratory minute volume of 30 litres per minute BTPD. The equipment and system must be designed to prevent any inward l eakage to the inside of the device and prevent any outward leakage causing any significant increase in the oxygen content of the local ambient atmosphere. If a demand oxygen system is used, a supply of 300 litres of free oxygen at 21°C (70°F) and 760 mm Hg pressure is considered to be of 15 - minute duration at the prescribed altitude and minute volume. If a continuous flow open circuit protective breathing system is used a flow rate of 60 litres per minute at 2438 m (8 000 ft) (45 litres per minute at sea level) and a supply of 600 litres of free oxygen at 21°C (70°F) and 204 kPa (760 mm Hg) pressure is considered to be of 15 - minute duration at the prescribed altitude and minute volume.

Continuous flow systems must not increase the ambient oxygen con tent of the local atmosphere above that of demand systems. BTPD refers to body temperature conditions, that is 37°C (99°F), at ambient pressure, dry.

(6) The equipment must meet the requirements of CS 25.1441 .

[Amd t 25/4] Powered by EASA eRules Page 1073 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

CS 25.1441 Oxygen equipment and supply

ED Decision 2019/013/R (a) If certification with supplemental oxygen equipment is requested, the equipment must meet the requirements of this paragraph and CS 25. 1443 through 25.1453 .

(b) The oxygen system must be free from hazards in itself, in its method of operation, and in its effect upon other components. (See AMC 25.1441(b) ) (c) Except for oxygen chemical generators and for small sealed, one - time use, gaseous oxygen bottles, t here must be a means to allow the crew to readily determine, during flight, the quantity of oxyge n available in each source of supply.

(d) The oxygen flow rate and the oxygen equipment for aeroplanes for which certification for operation above 12192 m (40 000 ft) is requested must be approved. (See AMC 25.1441 (d) .)

[Amdt No: 25/18] [Amdt No: 25/21] [ Amdt No: 25/23]

AMC 25.1441(b) Risk assessment related to oxygen fire hazards in

gaseous oxygen systems

ED Decision 2018/005/R 1. Purpose This AMC provides guidance material and acceptable means of compliance for demonstrating compliance with CS 25.1441(b) , which requires an oxygen system to be free from hazards in itself, in its method of operation, and in its effect upon other components.

This AMC applies to centralised, decentralised or portable oxygen systems. Those systems may be installed in an occupied compartment or in a remote inaccessible area.

2. Related certification specificati ons CS 25.869(c) Fire protection: systems — Oxygen equipment and lines CS 25.1301 Function and installation CS 25.1309 Equipment, systems and installations CS 25.1441(b) Oxygen equipment and supply CS 25.1453 Protection of oxygen equipment from rupture 3. Installation CS 25.869(c) specifies that oxygen system equipment and lines must: (1) not be located in any designated fire zone; (2) be protected from heat that may be generated in, or may escape from, any designated fire zone; and (3) be installed so that escaping oxygen cannot cause the ignition of grease, fluid, or vapour accumulations that are present in normal operation or as a result of a failure or malfunction of any system.

In addition, the following analysis and precautions should be considered.

Powered by EASA eRules Page 1074 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIP MENT 3.1. External ignition sources An analysis should be performed to identify all possible external ignition sources and their mechanisms. If an ignition source exists in the vicinity of the oxygen system installation, it should be demonstrated that in norma l operation or in conditions that result from a failure or malfunction of any system, the risk of ignition is minimised and that all design precautions have been taken to minimise this risk.

3.2. Contamination The compartments in which oxygen system comp onents are installed should provide adequate protection against potential contamination by liquids, lubricants (grease, etc.), dust, etc.

3.3. Ventilation The compartments in which oxygen system components are installed should be ventilated in such a way that, if a leak occurred or oxygen was discharged directly into the compartment (not overboard) from any protective device or pressure - limiting device, the likelihood of ignition of the oxygen - enriched environment would be minimised. The applicant should substantiate that the ventilation rate of the compartment is adequate.

Analytically determined ventilation rates should be validated by flight test results o r their equivalent.

CS 25.1453(f) provides additional specifications related to ventilation.

This paragraph does not apply to portable oxygen systems, such as systems used to provide first - aid oxygen to passengers or supplemental oxygen for cabin crew mob ility, usually stowed in overhead bins, provided that it is confirmed that the shut - off means mounted on the oxygen container is always closed when the system is stowed and not used.

3.4. Routing The installation of the system should be such that components and pipelines are: — adequately separated from electrical and fluid systems; — routed so as to minimise joints and sharp bends; — clear of moving controls and other mechanisms.

CS 25.1453(b) provides additiona l specifications related to oxygen pressure sources and the installation of tubing.

4. Oxygen hazards analysis (OHA) The applicant should demonstrate that the oxygen systems and their components are designed so that the occurrence of an uncontrolled oxyge n fire at the aircraft level is extremely improbable and does not result from a single failure.

To assess the consequences of system/component failures, the applicant should conduct an oxygen hazards analysis (OHA) in either a qualitative or a quantitative manner, and include the conclusions of the OHA in the oxygen systems system safety analysis (SSA).

The applicant should provide an OHA with a detailed assessment of the potential ignition and combustion mechanisms. In the OHA, the applicant should do the following: Powered by EASA eRules Page 1075 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT 4.1. Equipment failures The applicant should use a detailed failure modes and effects analysis (FMEA) at the component level as the input for the OHA. The OHA should not include quality/production issues or human errors during assembly in.

Th e applicant should take into account all single failures, and any failure combinations that are not shown to be extremely improbable.

4.2. Operating conditions The applicant should consider the worst - case operating conditions, including any failures deter mined from paragraph 4.1 that are not shown to be extremely improbable.

4.3. Components and materials The analysis should cover all component designations and the materials of construction, including compounds and non - metallic material.

Most materials ign ite at lower temperatures in an oxygen - enriched environment than in air. The applicant should therefore establish the auto ignition temperature assuming a 100 % oxygen - enriched environment, and evaluate the materials used to determine whether they are flam mable under the conditions specified in paragraph 4.2.

4.4. Ignition mechanisms The assessment should address the identification of the possible internal ignition mechanisms. As a minimum, the following mechanisms should be assessed: — adiabatic compressio n (pneumatic impact) (see Note 1 below) — frictional heating — mechanical impact — particle impact — fresh metal exposure — static discharge — electric arc — chemical reaction — resonance.

The applicant should evaluate each ignition mechanism under the conditions specified in paragraph 4.2 to determine whether it exists in the component and in the system considered.

Note 1: in calculating the temperature elevation due to oxygen compression, the applicant should use the transient peak pressures measured under paragraph 5.2, unless other values are duly demonstrated.

4.5. Kindling chain The applicant should evaluate the ability of a fire to propagate and burn through a component, i.e. the kin dling chain. The ignition and burning of a single component may produce sufficient heat to ignite the surrounding materials, leading to a burn - through of the component.

Powered by EASA eRules Page 1076 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT Therefore, if any of the ignition mechanisms assessed under paragraph 4.4 exists, the a pplicant should conduct an analysis to assess the kindling chain, based on the ability of the materials of construction to contain a fire.

5. Design considerations 5.1. High - pressure shut - off As required by CS 25.1453(c), the applicant must keep to a min imum the parts of the system that are subjected to high - pressure oxygen, and must locate those parts so they are remote from occupied compartments to the extent that is practicable.

High - pressure shut - off valves should be designed to open and close slowly enough so as to avoid the possible risk of fire or explosion.

5.2. Pressure - limiting devices (e.g. relief valves) As required by CS 25.1453(e), the applicant must design the pressure - limiting devices (e.g. relief valves), which protect parts of the system from excessive pressure, so that in the event of a malfunction of the normal pressure - controlling means (e.g. a pressure reducing valve), they prevent the pressure from exceeding the applicable maximum working pressure multiplied by 1.33.

In addition, th e performance of pressure - limiting devices should be tested on a complete system under the conditions specified in paragraph 4.2, but limited to failures that are not shown to be extremely improbable.

For testing purposes, oxygen can be replaced by an ine rt gas (e.g. nitrogen). However, the relationship between the pressure and the temperature would not be simulated by the inert gas and should be analysed separately. The transient pressure level (TPL) should be measured at various locations, and each compo nent of the oxygen system exposed to the TPL should be demonstrated to sustain the pressure level.

The analysis detailed in paragraph 4.1 may identify single failures that affect the pressure regulation device. These failures could include poppet/shaft/dia phragm blockages or ruptures, seal leakages, etc. of a pressure reducer. If the applicant excludes any of these single failures from the TPL assessment due to — design considerations, such as a safety factor on the yield strength, the size of damage, etc. or — a low estimated probability of the failure occurring, they should provide a detailed rationale for this in the certification documents and agree it with EASA.

CS 25.1453(d) provides additional specifications related to the protection of oxygen pressure so urces (e.g. tanks or cylinders) against overpressure.

5.3. Isolation When the system includes multiple bottles as oxygen sources, each source should be protected from reverse flow or reverse pressure if a failure occurs on one source. Such isolation can b e achieved by installing check valves or an equivalent means in an appropriate manner.

Powered by EASA eRules Page 1077 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEO US EQUIPMENT 5.4. Non - metallic hoses Except for flexible lines from oxygen outlets to the dispensing units, or where shown to be otherwise suitable for the installation, non - metallic hoses should not be used for any oxygen line that is normally pressurised during flight.

If non - metallic hoses with anti - collapse springs are used due to installation constraints, it should be ensured that inadvertent electrical current cannot reach the spring, as this could cause the hose to melt or burn, leading to an oxygen - fed fire. As an example, correctly grounded metallic braid may be considered to prevent inadvertent electrical current from reaching the spring.

In addition , non - metallic oxygen distribution lines should not be routed where they may be subjected to elevated temperatures, electric arcing, or released flammable fluids that might result from normal operation, or from a failure or malfunction of any system.

5.5. Grounding All the oxygen lines and hoses should be grounded as appropriate.

5.6. Joints Joints should, as far as possible, be assembled dry. However, where compounds are used for sealing, they should be approved for that purpose.

5.7. Recharging systems Recharging systems, if installed, should be provided with means to prevent excessive rates of charging, which could result in dangerously high temperatures within the system.

The recharging system should also provide protection from cont amination.

Where in situ recharging facilities are provided, the compartments in which they are located should be accessible from outside the aircraft and be as remote as possible from other service points and equipment. Placards should be provided, locate d adjacent to the servicing point, with adequate instructions covering the precautions to be observed when the system is being charged.

[Amdt 25/21] AMC 25.1441(c) Oxygen chemical generators and small sealed,

one - time use gaseous oxygen bottles

ED Decisio n 2019/013/R 9 /01 3 /R For chemical generators and for small, sealed, one - time use, gaseous oxygen bottles distributed throughout the cabin for passenger use, the following precautions should be considered in order to ensure tha t oxygen is actually availabl e: 1. The oxygen supply source should be designed and tested to ensure that it will retain the required quantity of oxygen or chemicals throughout its expected life under the foreseeable operating conditions; 2. A means should be provided for maintenance p ersonnel to readily determine when oxygen is no longer available in the supply source due to inadvertent activation; 3. The life limit of the oxygen supply source should be established by test and analysis; 4. Each oxygen supply source should be labelled s uch that the expiration date can be easily checked by maintenance; and Powered by EASA eRules Page 1078 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT 5. Instructions for continued airworthiness should be provided to ensure that the oxygen supply sources: a. are removed from the aeroplane and replaced whenever they have been used, and before they re ach their expiration dates; and b. are not installed on the aeroplane beyond their expiration dates.

[Amdt No: 25/23]

AMC 25.1441(d) Oxygen equipment and s upply

ED Decision 2003/2/RM In assessing the required oxygen flow rates and equipment performance standards, consideration should be given to the most critical cabin altitude/time - history following any failure, not shown to be Extremely Improbable, which will result in the loss of ca bin pressure taking into account the associated emergency procedures.

CS 25.1443 Minimum mass flow of supplemental oxygen

ED Decision 2003/ 2/RM (a) If continuous flow equipment is installed for use by flight - crew members, the minimum mass flow of supplem ental oxygen required for each crew member may not be less than the flow required to maintain, during inspiration, a mean tracheal oxygen partial pressure of 149 mmHg when breathing 15 litres per minute, BTPS, and with a maximum tidal volume of 700 cm wit h a constant time interval between respirations.

(b) If demand equipment is installed for use by flight - crew members, the minimum mass flow of supplemental oxygen required for each crew member may not be less than the flow required to maintain, during insp iration, a mean tracheal oxygen partial pressure of 122 mmHg, up to and including a cabin p ressure altitude of 10668 m (35 000 ft), and 95% oxygen between cabin pr essure altitudes of 10668 m (35 000) and 12192 m (40 000 ft), when breathing 20 litres per mi nute BTPS. In addition, there must be means to allow the crew to use undiluted oxygen at their discretion.

(c) For passengers and cabin crew members, the minimum mass flow of supplemental oxygen required for each person at various cabin pressure altitudes may not be less than the flow required to maintain, during inspiration and while using the oxygen equipment (including masks) provided, the following mean tracheal oxygen partial pressures: (1) At cabin pres sure altitudes above 3048 m (10 000 ft) up to and including 5639 m (18,500 ft), a mean tracheal oxygen partial pressure of 100 mmHg when breathing 15 litres per minute, BTPS, and with a tidal volume of 700 cm with a constant time interval between respirations.

(2) At cabin pres sure altitudes above 5639 m (18 500 ft) up t o and including 12192 m (40,000 ft), a mean tracheal oxygen partial pressure of 83·8 mmHg when breathing 30 litres per minute, BTPS, and with a tidal volume of 1100 cm with a constant time interval between respirations.

(d) If first - aid oxygen equipment is installed, the minimum mass flow of oxygen to each user may not be less than 4 litres per minute, STPD. However, there may be a means to decrease this flow to not less than 2 litres per minute, STPD, at any cabin altitude. The quantity of oxygen required is based upon an average flow rate of 3 litres per minute per person for whom first - aid oxygen is required.

Powered by EASA eRules Page 1079 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT (e) If portable oxygen equipment is installed for use by crew members, the minimum mass flow of supplemental oxygen is the same a s specified in sub - paragraph (a) or (b) of this paragraph, whichever is applicable.

CS 25.1445 Equipment standards for the oxygen distributing system

ED Decision 2012 / 008/R (a) When oxygen is supplied to both crew and passengers, the distribution system m ust be designed for either – (1) A source of supply for the flight crew on duty and a separate source for the passengers and other crew members; or (2) A common source of supply with means to separately reserve the minimum supply required by the flight cre w on duty.

(b) Portable walk - around oxygen units of the continuous flow, diluter demand, and straight demand kinds may be used to meet the crew or passenger breathing requirements.

[Amdt 25/12]

CS 25.1447 Equipment standards for oxygen dispensing units

ED Decision 2017 / 015 /R (See AMC 25.1447) If oxygen - dispensing units are installed, the following apply: (a) There must be an individual dispensing unit for each occupant for whom supplemental oxygen is to be supplied. Units must be designed to cover the nose and mouth and must be equipped with a suitable means to retain the unit in position on the face. Flight crew masks for supplemental oxygen must have provisions for the use of communication equipment.

(b) If certification for operation up to and includ ing 7620 m (25 000 ft) is requested, an oxygen supply terminal and unit of oxygen dispensing equipment for the immediate use of oxygen by each crew member must be within easy reach of that crew member. For any other occupants the supply terminals and dispe nsing equipment must be located to allow use of oxygen as required by the operating rules.

(c) If certification for operation above 7620 m (25 000 ft) is requested, there must be oxygen dispensing equipment meeting the following requirements (See AMC 25.1447(c) ): (1) There must be an oxygen - dispensing unit connected to oxygen supply terminals immediately available to each occupant, wherever seated. If certification for operation above 9144 m (30 000 ft) is requested, the dispensing units providing the required oxygen flow must be automatically presented to the occupants before the cabin press ure altitude e xceeds 4572 m (15 000 ft) and the crew must be provided with a manual means to make the dispensing units immediately available in the event of failure of the automatic system.

The total number of dispensing units and outlets must exceed the number of seats by at least 10%. The extra units must be as uniformly distributed throughout the cabin as practicable. (See AMC 25.1447(c)(1) .)

(2) Each flight - crew member on flight deck duty must be provided with demand equipmen t.

In addition, each flight - crew member must be provided with a quick - donning type of oxygen dispensing unit, connected to an oxygen supply terminal, that is immediately Powered by EASA eRules Page 1080 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MIS CELLANEOUS EQUIPMENT available to him when seated at his station, and this is designed and installed so tha t it (see AMC 25.1447(c)(2) ) – (i) Can be placed on the face from its ready position, properly secured, sealed, and supplying oxygen upon demand, with one hand within 5 seconds and without disturbing eyeglasses or causing delay in proceeding with emergency duties; and (ii) Allows, while in place, the performance of normal communication functions.

(3) There must be sufficient outlets and units of dispensing equipment of a type similar to that required by sub - paragrap h (c)(1) of this paragraph i n all other areas that may be occupied by passenger s or crew members during flight. (See AMC 25.1447 (c)(3) ) (4) Portable oxygen equipment must be immediately available for each cabin cr ew member.

The portable oxygen equipment must have the oxygen dispensing unit connected to the portable oxygen supply. (See AMC 25.1447(c)(4) .)

[Amdt 25/12] [Amdt 25/13] [Amdt 25/18] [Amdt 25/19]

AMC 25.1447(c) Equipment standards for oxygen dispensing u nits

ED Decision 2003/2/RM Where Operational Regulations do not require all passengers to be provided with oxygen, (c)(3) and (c)(4) may not apply.

AMC 25.1447(c)(1) Equipment standards for oxygen - dis pensing

u nits

ED Decision 2017 / 015/R 1 When oxygen masks are presented, oxygen should be supplied to the mask but without flow.

2 Oxygen flow from the mask should be initiated automatically on pulling the mask to the face.

3 Facilities for manual presen tation by a crewmember should be provided on each dispensing unit.

4 Indication of the operation of the automatic presentation system should be provided at the appropriate flight - crew station.

5 The design of the automatic presentation system should take into account that when the landing field altitude is less than 610 m (2000 feet) below the normal preset automatic presentation altitude, the automatic presentation altitude may be reset to landing field altitude plus 610 m (2000 feet).

6 A supplemental oxygen supply should be provided for each passenger lying on a bed or a seat that can be converted into a bed. Except for cases where the occupant’s head location during sleeping is obvious, a placard indicating the correct sleeping position should be ins talled, unless the passenger oxygen system is designed to account for any sleeping position.

Powered by EASA eRules Page 1081 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT 7 Sufficient illumination should be provided at all times or automatically when necessary (i.e.

without the need of a crew action and without delay) at each loc ation where supplemental oxygen is provided so that in the event of oxygen mask presentation, the user has sufficient visibility to enable quick donning.

[Amdt 25/19]

AMC 25.1447(c)(2) Equipment standards for oxygen dispensing

u nits

ED Decision 2003/2/RM Unless it is required that the pilot at the control is wearing his mask and breathing oxygen while the altitude exceeds 7620 m (25 000 feet), the design of the flight - crew masks and their stowages should be such that each mask can be placed in position and put into operation in not more than five seconds, one hand only being used, and will thereafter remain in position, both hands bei ng free.

AMC 25.1447(c)(3) Equipment standards for oxygen - dispensing

units

ED Decision 2017/015 /R It is acceptable that oxygen outlets/units of dispensing equipment are not provided within an area where people are likely to congregate (for instance a wait ing area for lavatory facilities, a bar/lounge area etc.), provided the applicant demonstrates that sufficient oxygen - dispensing outlets are within five feet or five seconds reach of the area and that no visual obstruction exists between the potential oxyg en users and the outlets, such as curtains or partitions, unless another method of indication (e.g.

an ‘oxygen in use’ light) is provided in the area.

There should be at least two outlets and units of dispensing equipment in toilets, washrooms, galley work areas etc. In such areas where occupancy of more than two persons can be expected, the number of outlets (within the area or within five feet or five seconds reach) should be consistent with the expected maximum occupancy.

In the case of a shower, there s hould be an oxygen outlet and unit of dispensing equipment immediately available to each shower occupant without stepping outside the shower. Reaching through an opened shower cubicle door is acceptable, in which case the door should be sufficiently transp arent so that the location of the mask and the required actions to access it are immediately obvious.

[Amdt 25/13] [Amdt 25/15] [Amdt 25/19]

AMC 25.1447(c)(4) Equipment standards for oxygen dispensing

u nits

ED Decision 2003/ 2/RM 1 The equipment should be so located as to be within reach of the cabin crewmembers while seated and restrained at their seat stations.

2 The mask/hose assembly should be already connected to the supply source, and oxygen should be delivered with no action being required except tu rning it on and donning the mask.

Powered by EASA eRules Page 1082 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT 3 Where a cabin crewmember’s work area is not within easy reach of the equipment provided at his seat station, an additional unit should be provided at the work area.

CS 25.1449 Means for determining use of oxygen

ED Dec ision 2003/2/RM There must be a means to allow the crew to determine whether oxygen is being delivered to the dispensing equipment.

CS 25.1450 Chemical oxygen generators

ED Decision 2015 / 019/R (a) For the purpose of this paragraph, a chemical oxygen gen erator is defined as a device, which produces oxygen, by chemical reaction.

(b) Each chemical oxygen generator must be designed and installed in accordance with the following requirements: (1) Surface temperature developed by the generator during operation may not create a hazard to the aeroplane or to its occupants.

(2) Means must be provided to relieve any internal pressure that may be hazardous.

(3) Comply with CS 25.795(d).

(c) In addition to meeting the requirements in sub - paragraph (b) of this paragraph, each portable chemical oxygen generator that is capable of sustained operation by successive replacement of a generator element must be placarded to show – (1) The rate of oxygen flow, in lit res per minute; (2) The duration of oxygen flow, in minutes, for the replaceable generator element; and (3) A warning that the replaceable generator element may be hot, unless the element construction is such that the surface temper ature cannot exceed 37.8 ° C (100 ° F).

[Amdt 25/17]

CS 25.1453 Protection of oxygen equipment from rupture

ED Decision 2007 / 0 2 0/R (a) Each element of the system , excluding chemical oxygen generators , must have sufficient strength to withstand the maximum working pressures and tempe ratures in combination with any externally applied load, arising from consideration of limit structural loads that may be acting on that part of the system in service.

(1) The maximum working pressure must include the maximum normal operating pressure, the transient and surge pressures, tolerances of any pressure limiting means and possible pressure variations in the normal operating modes. Transient or surge pressures need not be considered except where these exceed the maximum normal operating pressure mu ltiplied by 1·10.

(2) Account must be taken of the effects of temperature up to the maximum anticipated temperature to which the system may be subjected.

Powered by EASA eRules Page 1083 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUI PMENT (CS - 25) MISCELLANEOUS EQUIPMENT (3) Strength demonstration using proof pressure and burst pressure coefficients specified in Table 1 i s acceptable, unless higher stresses result when elements are subjected to combined pressure, temperature and structural loads.

(i) The proof and burst factors in Table 1 must be applied to maximum working pressure obtained from sub - paragraph (a)(1) with c onsideration given to the temperature of sub - paragraph (a)(2).

(ii) Proof pressure must be held for a minimum of 2 minutes and must not cause any leakage or permanent distortion.

(iii) Burst pressure must be held for a minimum of 1 minute and must not caus e rupture but some distortion is allowed.

TABLE 1 Systems Element Proof Factor Burst Factor Cylinders (i.e. pressure vessels) 1·5 2·0 Flexible hoses 2·0 4·0 Pipes and couplings 1·5 3·0 Other components 1·5 2·0 (b) Oxygen pressure sources and tubing lines between the sources and shut - off means must be – (1) Protected from unsafe temperatures; and (2) Located where the probability and hazard of rupture in a crash landing are minimised.

(c) Parts of the system subjected to high oxygen pressure must be kept to a minimum and must be remote from occupied compartments to the extent practicable. Where such parts are installed within occupied compartments they must be protected from accidental damage.

(d) Each pressure source (e.g. tanks or c ylinders) must be provided with a protective device (e.g.

rupture disc). Such devices must prevent the pressure from exceeding the maximum working pressure multiplied by 1·5.

(e) Pressure limiting devices (e.g. relief valves), provided to protect parts of the system from excessive pressure, must prevent the pressures from exceeding the applicable maximum working pressure multiplied by 1·33 in the event of malfunction of the normal pressure controlling means (e.g. pressure reducing valve).

(f) The discharge from each protective device and pressure limiting device must be vented overboard in such a manner as to preclude blockage by ice or contamination, unless it can be shown that no hazard exists by its discharge within the compartment in which it is installe d. In assessing whether such hazard exists consideration must be given to the quantity and discharge rate of the oxygen released, the volume of the compartment into which it is discharging, the rate of ventilation within the compartment and the fire risk d ue to the installation of any potentially flammable fluid systems within the compartment.

[Amdt 25/ 4 ]

CS 25.1455 Draining of fluids subject to freezing

ED Decision 2003/ 2/RM If fluids subject to freezing may be drained overboard in flight or during ground operation, the drains must be designed and located to prevent the formation of hazardous quantities of ice on the aeroplane as a result of the drainage.

Powered by EASA eRules Page 1084 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

CS 25.1457 Cockpit voice recorders

ED Decision 2020/024/R (See AMC 25.1457 ) (a) Each cockpit voice recorder required by the operating rules must be approved and must be installed so that it will record the following: (1) Voice communications transmitted from or received in the a eroplane by radio.

(2) Voice communications of flight - crew members on the flight deck.

(3) Voice communications of flight - crew members on the flight deck, using the aeroplane’s interphone system.

(4) Voice or audio signals identifying navigation or approac h aids introduced into a headset or speaker.

(5) Voice communications of flight - crew members using the passenger loudspeaker system, if there is such a system and if the fourth channel is available in accordance with the requirements of sub - paragraph (c)(4 )(ii) of this paragraph.

(b) The recording requirements of sub - paragraph (a)(2) of this paragraph must be met by installing a cockpit - mounted area microphone, located in the best position for recording voice communications originating at the first and seco nd pilot stations and voice communications of other crew members on the flight deck when directed to those stations. The microphone must be so located and, if necessary, the pre - amplifiers and filters of the recorder must be so adjusted or supplemented, th at the intelligibility of the recorded communications is as high as practicable when recorded under flight cockpit noise conditions and played back. Repeated aural or visual playback of the record may be used in evaluating intelligibility.

(c) Each cockpit voice recorder must be installed so that the part of the communication or audio signals specified in subparagraph (a) of this paragraph obtained from the following sources is recorded on at least four separate channels: (1) From each boom, mask, or hand - h eld microphone, headset, or speaker used at the first pilot station.

(2) From each boom, mask, or hand - held microphone, headset, or speaker used at the second pilot station.

(3) From the cockpit - mounted area microphone.

(4) From: (i) each boom, mask, or handheld microphone, headset or speaker used at the stations for the third and fourth crew members; or (ii) if the stations specified in subparagraph (c)(4)(i) of this paragraph are not required or if the signal at such a station is picked up by another ch annel, each microphone on the flight deck that is used with the passenger loudspeaker system if its signals are not picked up by another channel.

No channel shall record communication or audio signals from more than one of the following sources: the first pilot station, second pilot station, cockpit - mounted area microphone, or additional crew member stations.

As far as is practicable, all the sounds received by the microphones listed in subparagraphs (c)(1), (2) and (4) of this paragraph must be recorded wi thout interruption irrespective of the Powered by EASA eRules Page 1085 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT position of the interphone - transmitter key switch. The design must ensure that sidetone for the flight crew is produced only when the interphone, public address system or radio transmitters are in use.

(d) Each cockpi t voice recorder must be installed so that – (1) (i) It receives its electric al power from the bus that provides the maximum reliability for operation of the cockpit voice recorder without jeopardising service to essential or emergency loads; and (ii) It remains powered for as long as possible without jeopardising emergency operation of the aeroplane; (2) If the recorder has a recording duration of less than 25 hours, t here is an automatic means to stop the recording within 10 minutes after crash impact; (3) There is an aural or visual means for pre - flight checking of th e recorder for proper operation; (4) Any single electrical failure that is external to the recorder does not disable both the cockpit voice recorder function and the flight data recorder function; (5) There is a means for the flight crew to stop the cockpit voice record er function upon completion of the flight in a way such that re - enabling the cockpit voice recorder function is only possible by dedicated manual action; (6) It has an alternate power source: — that provides at least 10 minutes of electrical power to operate both the recorder and the cockpit - mounted area microphone; and — to which the recorder and the cockpit - mounted area microphone are switched automatically in the event that all other power to the recorder is interrupted either by a normal shutdown or by any other loss of power; and (7) If the recorder is deployable: (i) It has an automatic deployment capability that is engaged no later than when the aeroplane is airborne and that remains engaged as long as the aeroplane is airborne; (ii) The automatic deploym ent capability and the emergency locator transmitter integrated in the deployable recorder cannot be manually disengaged from the cockpit when the aeroplane is capable of moving under its own power; (iii) The deployment occurs upon the detection of severe structural damage that causes the immediate break - up of the aeroplane; (iv) The deployment occurs upon the immersion of the aeroplane in water; (v) An assessment of the effects of unintended deployment is made in accordance with the specifications of CS 25.1309 ; (vi) Effects on persons other than aeroplane occupants and on search - and - rescue services are taken into account when assessing the unintended deployment failure condition; (vii) There is no means to manually deploy the recorder while the aeroplane is capable of moving under its own power; and Powered by EASA eRules Page 1086 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT (viii) An alert is provided to the flight crew when the flight recorder is no longer attached to the aeroplane.

( e) If the recorder is not deployable, the container of the recording medium must be located and mounted so as to minimise the probability of the container rupturing, the recording medium being destroyed, or the underwater locating device failing as a result of any possible combinations of: (1) imp act with the Earth’s surface; (2) the heat damage caused by a post - impact fire; and (3) immersion in water.

If the recorder is deployable, the deployed part must be designed and installed so as to minimise the probability of the recording medium being dest royed or the emergency locator transmitter failing to transmit (after damage or immersion in water) as a result of any possible combinations of: (1) the deployment of the recorder; (2) impact with the Earth’s surface; (3) the heat damage caused by a post - i mpact fire; and (4) immersion in water.

(f) If the cockpit voice re corder has an erasure device or function , the installation must be designed to minimise the probability of inadvertent operation and actuation of the erasure device or function during crash impact.

(g) The container of the cockpit voice recorder must – (1) Be bright orange; however, if the recorder is deployable, the surface that is visible from outside the aeroplane, when the recorder is installed, may be of another colour; (2) Have re flective tape affixed to its external surface to facilitate locating it; (3) Have , if the recorder is not deployable, an underwater locating device on or adjacent to the container which is secured in such a manner that they are not likely to b e separated d uring crash impact; (4) Have, if the recorder is deployable, an integrated emergency locator transmitter that automatically starts emitting upon deployment; and (5) Be, if the recorder is deployable, able to float on water and self - oriented so that the tra nsmission of the emergency signal is not impeded.

[Amdt 25/23] [Amdt 25/26] Powered by EASA eRules Page 1087 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

AMC 25.1457 Cockpit voice recorders

ED Decision 2020/024/R 1. General The installation of a recorder with an ETSO authorisation against ETSO - C123c (or equivalent standard accepted by EASA) satisfies the approval requirement in CS 25.1457(a) .

In showing compliance with CS 25.1457 , the applicant should take account of EUROCAE Document No ED - 112A ‘MOPS for Crash Protected Airborne Recorder Systems’ or a later revision.

‘Deployable recorder’ designates a f light recorder installed on the aeroplane which is capable of automatically deploying from the aeroplane.

‘CVR system’ designates the cockpit voice recorder (CVR) and its dedicated equipment (e.g.

dedicated sensors or transducers, amplifiers, dedicated dat a busses, dedicated power source).

2. Combination recorders a. If the recorder performs several recording functions (i.e. it is a combination recorder), the means for pre - flight checking the recorder for proper operation should indicate which recording fun ctions (e.g. FDR, CVR, data - link recording, etc.) have failed.

b. When two flight data and cockpit voice combination recorders are installed, either because they are required or because they are an acceptable alternative to a flight data recorder and a coc kpit voice recorder, then these two fight data and cockpit voice combination recorders should be connected to separate power buses.

3. Automatic means to stop the recording after a crash impact The automatic means to stop the recording (which is required i f the recorder has a recording duration of less than 25 hours) should operate even if a power supply is still available.

The automatic means to stop the recording within 10 minutes after a crash impact may rely on: a. dedicated crash impact detection senso rs. In that case, negative acceleration sensors (also called ‘g - switches’) should not be used as the sole means of detecting a crash impact; or b. the recording start - and - stop logic, provided that this start - and - stop logic stops the recording 10 minutes af ter power is lost on all engines (and, when applicable, the APU) when the aeroplane is on the ground.

4. Means for pre - flight checking of the recorder The means for pre - flight checking of the recorder should be able to detect and indicate the following: a. A loss of electrical power to the flight recorder system; b. A failure of the data acquisition and processing stages; c. A failure of the recording medium and/or drive mechanism; and d. A failure of the recorder to store the data in the recording medium a s shown by checks of the recorded data including, as far as is reasonably practicable for the storage medium concerned, its correct correspondence with the input data.

Powered by EASA eRules Page 1088 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT 5. Means for the flight crew to stop the cockpit voice recorder function The means required for the flight crew to stop the cockpit voice recorder function after the completion of the flight is needed in order to preserve the recording for the purpose of investigating accidents and serious incidents. In fulfilling this requirem ent, it is acceptable to use circuit breakers to remove the power to the equipment. Such a means to stop the cockpit voice recorder function is not in contradiction with CS 25.1357(f) , because it would not be used under normal operating conditions, but after an accident or a serious incident has occurred.

6. Power sources a. An alternate power source is a power source that is different from the source(s) that normally provides (provide) power to the cockpit voice re corder function.

In CS 25.1457(d)(6) , a ‘normal shutdown’ of power to the cockpit voice recorder means a commanded interruption of the power supply from the normal cockpit voice recorder power bus; for example, after the termination of a normal flight. ‘All other power’ means the electrical power source(s) used for normal operation of the cockpit voice recorder function. The following applies to the installation of an alternate power source: i. A toleran ce of 1 minute on the 10 minutes minimum power requirement of CS 25.1457(d)(6) is acceptable; ii. The use of aeroplane batteries or other power sources is acceptable, provided that electrical power to the essential and critical loads is not compromised; iii. If the alternate power source relies on dedicated stand - alone batteries (such as a recorder independent power supply), then these batteries should be located as close as practicable to the recorder; iv. The mean s for performing a pre - flight check of the recorder for proper operation should include a check of the availability of the alternate power source; v. If the cockpit voice recorder function is combined with other recording functions within the same unit, th e alternate power source may also power the other recording functions; and vi. If two flight data and cockpit voice combination recorders are installed, either because they are required, or because they are an acceptable alternative to single - function reco rders, then only one recorder needs to have an alternate power source for the cockpit voice recorder function. This should be the combination recorder that is located closer to the cockpit area.

b. If the cockpit voice recorder function has a recording dur ation of less than 25 hours, the electrical power to this function should not be supplied for more than 10 minutes after power is lost on all engines (and, when applicable, the APU) when the aeroplane is on the ground.

7. Recorder container The attachment of the recorder container should comply with the specifications given in EUROCAE Document No ED - 112A.

The container of a non - deployable recorder should be installed in the rear section of the aeroplane and in an area that increases the chances of the equip ment surviving crash impact forces and the heat damage caused by a fire. However, it should not be installed where aft - mounted engines may crush the container during impact.

Powered by EASA eRules Page 1089 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT If two combination flight data and cockpit voice recorders (non - deployable) are in stalled, then the container of the recorder that is dedicated to the cockpit voice recorder function may be located near the flight crew compartment if at least one recorder is installed in the rear section.

8. Deployable recorder If the recorder is deploy able: a. The automatic deployment capability should be available as long as the aeroplane is airborne; this should include cases in which electrical power is lost from the engines and APU.

In the event of a landing on water, the deployment should occur upo n the immersion of the aeroplane in water; this means that the automatic deployment capability should remain available after contact with the water for a certain period in order to allow automatic deployment upon immersion; b. The assessment of the effects of unintended deployment of the recorder in flight should include: i. The effects on the continued safe flight and landing of the aeroplane. This assessment should cover the normal flight envelope of the aeroplane and include the following aspects: — Potent ial impact on aeroplane structure, including flight control surfaces, and on systems; and — Aerodynamic effects caused by the cavity created in the structure after deployment.

In order to address the effects of the impact on the aeroplane after deployment, t he applicant should: — either demonstrate that impact with the aeroplane is extremely improbable; — or demonstrate continued safe flight and landing after impact damage, considering all flight phases. The demonstration should include the effect of the damage t o the structure and systems on residual strength, stability, control and aeroelasticity: — Residual strength should be demonstrated in accordance with AMC 25.571, Section 10.(c) ; and — Freedom from aeroelastic instability should be demonstrated within the aeroelastic stability envelope as defined by CS 25.629(b)(2) ; and ii. The effects on persons other than aeroplane occupants due to unintended deployment while the aeroplane is airborne, in particular the risk of serious or fatal injuries for persons being hit by the deployed part.

Several methods can be adopted in order to quantify the probability of causing serious or fatal injuries to the persons on the ground associated with unintended deployment of a recorder. However, the following variables should be used: — The density of population, with reasonable correction factors related to time exposure and shielding such as being indoors an d shielded by, for example, buildings, or being in a means of transportation; and — The size and weight of the deployed part.

Powered by EASA eRules Page 1090 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT The probability of causing a serious or fatal injury is expressed as the combination of: — the probability of an unintended deployment ; — the probability of a person being hit by the deployed part; and — the probability that, if hit by the deployed part, a person will suffer serious or fatal injuries. This probability may be set to 1, as a conservative assumption; otherwise, the applicant ma y propose another value to EASA for approval.

c. The assessment of the effects of unintended deployment of the recorder on ground should include: i. The risk of injuries caused to persons. This should include those who are involved in aeroplane maintenance , ground handling, taxiing, rescue operations, or emergency evacuation; and ii. The effects on other aircraft and facilities.

In particular: — A conspicuous placard or label that is visible from the outside of the aeroplane should be placed adjacent to the r ecorder deployment point; — ICA and/or operational procedures should be provided to prevent injuries during maintenance and ground handling; — Operational procedures should define the first actions to be taken by the flight crew when the recorder is no longer attached to the aeroplane, in order to address any risk to continued safe flight and landing and the possible effects on other aircraft and facilities; — Procedures should address the precautions that should be taken to avoid injuries which could be caused b y an unintended deployment during emergency evacuation; — Information that addresses the precautions to be taken by search - and - rescue services after an accident should be publicly available; and — The deployment mechanism should only release the recorder in on e piece.

d. There may be a means to manually disengage the deployment capability when the aeroplane is not capable of moving under its own power; however, in this case, an alert should be provided to the flight crew during the pre - flight checks if the depl oyment capability is disengaged; e. The deployable recorder installation should be such as to guarantee the highest probability of the deployment of the recorder in the event of an explosion or a collision.

In particular, the installation and the performan ce of the deployment capability should be such that, in most cases of collision, the deployment of the recorder can take place before the deployment mechanism is damaged. However, the installation should be such that, to the extent possible, the recorder d oes not deploy in a non - catastrophic occurrence such as a hard landing or a tail strike.

f. The demonstration of compliance with CS 25.1457(e) should cover the whole flight envelope of the aeroplane, and additional trajectories that might be expected during the initial stages of an accident sequence.

Powered by EASA eRules Page 1091 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT The applicant may use the following Table 1 parameter ranges that have been observed during occurrences of loss of control of large aeroplanes: Table 1: Parameter rang es Parameter Range Unit Pitch angle +/ - 60 ° Roll angle +/ - 60 ° Pitch rate +/ - 20 °/s Roll rate +/ - 30 °/s Yaw rate +/ - 20 °/s Altitude 0 to 26 000 ft ft Speed 60 kt to V D /M D (design diving speed) Vertical speed from maximum negative vertical speed at V /M to 0 D D g. The alert that the recorder is no longer attached to the aeroplane should be provided as early as permitted by the principles of AMC 25.1322 .

h. The deployment capability should function under all the environmental conditions for which the aeroplane is certificated.

i. The effect of exposure to environmental conditions (such as temperature, rain, lightning strikes, etc.) on the serviceability of the flight recorder and of its deployment capability shoul d be addressed by design features and/or by ICA. ICA or operational procedures or both should also be provided such as to prevent maintenance and operational actions on the external surfaces of the aeroplane (such as painting, cleaning, application of de - / anti - icing fluids, etc.) from adversely affecting the serviceability of the flight recorder and its deployment capability.

j. In order to limit the effects on search - and - rescue services of an unintended activation of the emergency locator transmitter (ELT) that is integrated in the recorder: — unintended deployment of the recorder should be classified at least as a major failure condition; and — operational procedures should define the flight crew actions to be taken after they realise that an unintended record er deployment has taken place, including actions to prevent an unnecessary search - and - rescue response.

Furthermore, in order to identify the conditions which triggered an unintended deployment of the recorder (including the ensuing activation of the ELT) o r an activation of the ELT without deployment of the recorder, appropriate data should be recorded on board or transmitted to the ground to support the post - flight analysis.

9. Evaluation of the CVR recording The following acceptable means of compliance wi th CS 25.1457(b) is provided to demonstrate that the performance of a new or modified CVR system is acceptable and that the quality of the CVR recording is acceptable. Inspections of the CVR recording that are part of the Instructions for Continued Airworthiness are not in the scope of this paragraph.

a. The CVR system should be installed in accordance with the recommendations made in EUROCAE Document ED - 112A, in particular: — Chapter 2 - 5, Equipment installation and i nstalled performance, and Powered by EASA eRules Page 1092 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT — Part I, Cockpit Voice Recorder System, Chapter I - 6.1.1 Interface design, I - 6.1.2 Recorder Operation and I - 6.1.3 Bulk Erasure Interlocks.

Particular attention should be given to the location of the cockpit area microphone (CAM).

ED - 112A, Chapter I - 6.2., Equipment location, provides guidance on this topic.

It should be noted that the CVR may record on more than four channels, and that this may help to avoid superimposition between signal sources recorded on the same CVR channel.

b. T o ensure that the CVR system is properly installed, and to verify that the quality of the audio signals recorded on all the channels is acceptable, the applicant should conduct a flight test. The recording obtained should be evaluated to confirm that the q uality is acceptable during all the normal phases of flight (including taxi - out, take - off, climb, cruise, descent, approach, landing, and taxi - in). ED - 112A provides guidance for testing a new CVR installation. (Refer to Chapter I - 6.3).

c. The evaluation of the CVR recording should include: i. the tasks described in ED - 112A, Annex I - A, Chapter I - A.3; ii. checking that the vocal signal sources are intelligible and that non - vocal alerts on headsets or speakers can be identified; iii. checking that the levels o f sidetone signals (e.g. radio) and public address are adjusted so that these signals are audible and do not mask the signals from the flight crew microphones (refer to ED - 112A, Part I, Chapter I - 6.1.1); iv. checking the start - and - stop function of the CVR system. The CVR should begin to operate no later than when power from sources other than from the alternate power source is available and the pre - flight checklist is started. The CVR should continue to operate until either the completion of the final post - flight checklist or until 10 minutes after power is lost on all engines (and, when applicable the APU) and the aeroplane is on the ground.; and v. checking for the presence of any fault in the memory of the built - in - test feature of the CVR, if applicable.

d. The evaluation of the CVR recording should fulfil all of the conditions below: i. The equipment used for the CVR recording replay should meet the specifications of Chapter I - A.2 of Annex I - A of ED - 112A or a higher standard; ii. The replay and evaluation of CVR recordings should be performed by personnel who have adequate knowledge of CVR systems and aircraft operations, and who have appropriate experience of the techniques used to evaluate recordings; iii. The observations from the evaluation s hould be documented in an evaluation report. An example of an evaluation report is provided in ED - 112A, Annex I - A; and iv. The evaluation report should indicate the quality of each audio signal required to be recorded by CS 25.1457(c) according to defined criteria. For example, the following audio quality rating scale may be used: GOOD: 1. When considering a vocal signal source (crew voice, radio reception, radio sidetone, interphone, public address, synthetic voice in callouts, warnings and alerts) recorded on a channel other than the CAM channel, the signal is intelligible without using any signal post - processing techniques, and no Powered by EASA eRules Page 1093 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT significant issue (e.g. saturation, noise, interference, or inadequate signal level of a source) affects the quality of this signal; 2. When considering non - vocal alerts recorded on a channel other than the CAM channel, the sounds are accurately identifiable in the recording without using any signal post - processing techniques, and no sign ificant issue affects the quality of the sound recording; 3. When considering the CAM, the recording is representative of the actual ambient sound, conversations and alerts as if an observer was listening in the cockpit, and no significant issue affects th e quality of the signal; and 4. No ‘medium’ or ‘major’ issue is identified on any channel (see Table 1 below for examples).

FAIR: a significant issue affects the signal source being considered. However, the related signal can still be analysed without sign al post - processing, or by using signal post - processing techniques provided by standard audio analysis tools (e.g. audio level adjustment, notch filters, etc.). The severity of the identified issues is not rated higher than ‘medium’ (see Table 1 below for e xamples).

POOR: the signal source being considered is not intelligible or not identifiable, and this cannot be corrected even with the use of signal post - processing techniques. The severity of the identified issues is not necessarily rated as ‘major’, it m ay also be rated as ‘medium’, depending on the consequences for the required signal sources (see Table 1 below for examples); and v. the audio quality rating of a CVR channel required by CS 25.1457(c) should be the same as the worst audio quality rating among the signal sources to be recorded on this channel.

e. The performance of the CVR system should be considered acceptable by the applicant only if, for none of the signal sources required by CS 25.1457(c) or by the applicable operating rules, the quality of the audio recording was rated as ‘poor’. In addition, if the CVR system is part of a new aeroplane type, the performance of the CVR system should be considered acceptab le by the applicant only if, for all of the signal sources required by CS 25.1457(c) and by the applicable operating rules, the quality of the audio recording was rated as ‘good’.

Table 1: Examples of issues affect ing a signal source and of the associated severity.

Issue severity rating Examples of issues MAJOR: — One or more warning or callout is not recorded — Uncommanded interruption of the CAM signal leading to a ‘POOR’ rating for — Unexplained variation of the CAM dynamic range the affected signal — Hot - microphone function not operative — CVR time code not available — CAM saturation (due to low frequency vibration) — Radio side tone is missing — One required signal source is missing from the recording (e.g.

one m icrophone signal not recorded) — Poor intelligibility of one microphone source (e.g. speech through oxygen mask microphone) — Quasi - permanent physical saturation of the CAM due to its excessive sensitivity — Quasi - permanent electrical saturation of a CVR channel Powered by EASA eRules Page 1094 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT — Mechanical and/or electrical interference making the transcription of signals difficult or impossible — Insufficient CAM sensitivity — Fault in the start/stop sequence MEDIUM: — Inappropriate level balance between signal sources on a CVR channel that results in a signal source masking other signal leading to a ‘POOR’ or ‘FAIR’ sources rating for the affected signals, — Electrical interference caused by either the aircraft or the depending on the duration and recorder power sup ply the occurrence rate of the — Low dynamic range of the recording on a CVR channel issues.

— Low recording level of alert and or callout — Oversensitivity of the CAM line* to electromagnetic interference in the HF, UHF, or EHF domain (Wi - Fi, GSM, 5G, etc.)

— Oversensitivity of the CAM line* to el ectrostatic discharge (ESD) phenomena — Oversensitivity of the CAM to air flow or conditioning noise (bleed air) — Phasing anomaly between CVR channels — Side tone recorded with a low level — Transitory saturation *CAM line: microphone+control or preamplifier uni t+wiring to the CVR 10. Instructions for Continued Airworthiness (ICA) When developing the ICA for the CVR system, required by CS 25.1529 and Appendix H , the applicant should address all the failures that may affect the correct functioning of the CVR system or the quality of the recorded audio signals.

Examples of failures (indicative and non - exhaustive li st): — Loss of the recording function or of the acquisition function of the CVR; — Any communication or audio signal (required by CS 25.1457(c) or by the applicable air operations regulations) is missing, or is recorded with an audio quality that is rated ‘poor’ (refer to the example of audio quality rating provided in Section 9 of this AMC); — Failure of a sensor, transducer or amplifier dedicated to the CVR system (e.g. failure of the cockpit area microphone); — Failure of a means to facilitate the finding of the CVR recording medium after an accident (e.g. an underwater locating device or an emergency locator transmitter attached to the recorder); — Failure of any power source dedicated to the CVR (e.g. dedicated battery); — Failure of the start - and - stop function; — Failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpose of deploying the recorder if it is deployable).

[Amdt 25/2] [Amdt 25/23] [Amdt 25/26] Powered by EASA eRules Page 1095 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

CS 25.1459 Flight data recorders

ED Decision 2020/024/R (See AMC 25.1459 ) (a) Each flight data recorder required by the operating rules must be approved and must be installed so that – (1) It is supplied with airspeed, altitude, and directional data obtained from sources that meet the accuracy requirements of CS 25.1323 , 25.1325 and 25.1327 , as appropriate; (2) The vertical acceleration sensor is rigidly attached, and located longitudinally either within the approved centre of gravity limits of the a eroplane, or at a distance forward or aft of these limits that does not exceed 25% of the aeroplanes mean aerodynamic chord; (3) (i) It receives its electrical power from the bus that provides the maximum reliabil ity for operation of the recorder without j eopardising service to essential or emergency loads; and (ii) It remains powered for as long as possible without jeopardising the emergency operation of the aeroplane; (4) There is an aural or visual means for pre - flight checking of the recorder for proper recording of data in the storage medium; (5) If the recorder has a recording duration of less than 25 hours , there is an automatic means to stop the recording within 10 minutes after crash impact . This requirement does not apply to recorders that are powe red solely by the engine - driven electrical generator system; (6) There is a means to record data from which the time of each radio transmission either to or from ATC can be determined; (7) If another recorder is installed to perform the cockpit voice recorder function, any single electrical failure that is external to the recorder dedicated to the flight data recorder function does not disable both the recorders; and (8) If the recorder is deployable, it complies with CS 25.1457(d)(7) .

(b) If the recorder is not deployable, the container of the recording medium must be located and mounted so as to minimise the probability of the co ntainer rupturing, the recording medium being destroyed, or the underwater locating device failing as a result of any possible combinations of: (1) impact with the Earth’s surface; (2) the heat damage caused by a post - impact fire; and (3) immersion in wate r.

If the recorder is deployable, the deployed part must be designed and installed so as to minimise the probability of the recording medium being destroyed or the emergency locator transmitter failing to transmit (after damage or immersion in water) as a result of any possible combinations of: (1) the deployment of the recorder; (2) impact with the Earth’s surface; (3) the heat damage caused by a post - impact fire; and Powered by EASA eRules Page 1096 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT (4) immersion in water.

(c) A correlation must be established between the flight data rec order readings of airspeed, altitude, and heading and the corresponding readings (taking into account correction factors) of the first pilot’s instruments. The correlation must cover the airspeed range over which the aeroplane is to be operated, the range of altitude to which th e aeroplane is limited, and 360 ° of heading. Correlation may be established on the ground as appropriate.

(d) The container of the flight data recorder must comply with the specifications in CS 25.1457(g) that are applicable to the c ontainer of the cockpit voice recorder.

(e) Any novel or unique design or operational characteristics of the aeroplane must be evaluated to determine if any dedicated parameters must be recorded on the flight data recorder in addition to , or in place of , t he parameters that are required by the existing requirements.

[Amdt 25/11] [Amdt 25/18] [Amdt 25/23] [Amdt 25/26]

AMC 25.1459 Flight data recorders

ED Decision 2020/024/R 1. General The installation of a recorder with an ETSO authorisation against ETSO - C124c (or equivalent standard accepted by EASA) satisfies the approval requirement in CS 25.1459 (a) .

In showing compliance with CS 25.1459 , the applicant should take into account EUROCAE Document No ED - 112A ‘MOPS for Crash Protected Airborne Recorder Systems’ or a later revision .

‘FDR system’ designates the flight data recorder (FDR) and its dedicated equ ipment. It may include the following items as appropriate to the aircraft: a. The equipment necessary to: i. acquire and process analogue and digital sensor signals; ii. store the recorded data in a crash - survivable recording medium; and iii. when necessary, support dedicated sensors.

b. Digital data busses and/or networks providing communications between elements of the system.

‘Deployable recorder’ designates a flight recorder that is installed on the aeroplane, and which is capable of automatical ly deploying from the aeroplane.

2. Automatic means to stop the recording after a crash impact Refer to the Section of AMC 25.1457 titled ‘Automatic means to stop the recording after a crash impact’.

3. Means for pre - flight checking of the recorder The means for pre - flight checking of the recorder should be able to detect and indicate the following: a. a loss of electrical power to t he flight recorder system; Powered by EASA eRules Page 1097 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT b. a failure of the data acquisition and processing stages; c. a failure of the recording medium and/or drive mechanism; and d. a failure of the recorder to store the data in the recording medium as shown by checks of the recorde d data including, as far as is reasonably practicable for the storage medium concerned, its correct correspondence with the input data.

4. Recorder container Refer to the Section of AMC 25.1457 titled ‘Recorder con tainer’.

5. Combination recorder Refer to the Section of AMC 25.1457 titled ‘Combination recorder’.

6. Deployable recorder Refer to the Section of AMC 25.1457 titled ‘Deplo yable recorder’ 7. Instructions for Continued Airworthiness (ICA ) When developing the ICA for the FDR system, required by CS 25.1529 and Appendix H , the applicant should ad dress all the failures that may affect the correct functioning of the FDR system or the quality of the recorded data.

Examples of failures (indicative and non - exhaustive list): — Loss of the recording function or of the acquisition function of the FDR; — Any p arameter (required by CS 25.1459(a)(1) or by the applicable air operations regulations) is missing, or is not correctly recorded; — Failure of a sensor dedicated to the FDR system; — Failure of a means to facilitate the finding of the FDR recording medium after an accident (e.g. an underwater locating device or an emergency locator transmitter attached to the recorder); — Failure of the start - and - stop function; — Failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpos e of deploying the recorder if it is deployable).

In addition, the ICA should include the following items, unless the applicant shows that this is not applicable: — Calibration checks of parameters from sensors dedicated to the flight data recorder to verify the accuracy of these parameters; and — FDR decoding documentation.

i. Definitions FDR decoding documentation : a document that presents the information necessary to retrieve the raw binary data of an FDR data file and convert it into engineering units and t extual interpretations.

Fixed - frame recording format : a recording format organised in frames and subframes of a fixed length and that are recorded chronologically. ARINC Specifications 573 and 717 provide an example of a fixed - frame recording format.

Powered by EASA eRules Page 1098 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT Varia ble - frame recording format : a recording format based on recording frames which are individually identified and time stamped, so that their order in the recording file is not important. ARINC Specification 767 provides an example of a variable - frame recordi ng format.

ii. Content of the FDR decoding documentation The FDR decoding documentation should at least contain information on: — the aircraft make and model; — the date and time when the document was modified; and — in the case of a fixed - frame recording format : — the sync pattern sequence; — the number of bits per word, of words per subframe, and of subframes per frame; and — the time duration of a subframe; — In the case of a variable - frame recording format, the list of frames, and for each frame: — its identification; — information on whether the frame is scheduled or event - triggered; — the recording rate (for a scheduled frame); — the frame event condition (for an event - triggered frame); and — the list of parameters, by order of recording; — For every parameter: — its identification: name (and mnemonic code or other identification if applicable); — the sign convention and the units of converted values (if applicable); — the location of each component of a parameter in the data frame; — instructions and equations to assemble t he components of each parameter and convert the raw binary values into engineering units (if applicable); and — the conversion to text or the discrete decipher logic (if applicable).

iii. Format of the FDR decoding documentation The FDR decoding documentatio n should: — be provided in an electronic format; — contain all the information described in paragraph f.ii. above; and — comply with the standard of ARINC Specification 647A or a later equivalent industry standard.

[Amdt 25/23] [Amdt 25/26] Powered by EASA eRules Page 1099 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

CS 25.1460 Data link recorders

ED Decision 2020/024/R (See AMC 25.1460) (a) Each recorder performing the data link recording function required by the operating rules must be approved and must be installed so that it will record data link communication messages related t o air traffic services (ATS) communications to and from the aeroplane.

(b) Each data link recorder must be installed so that: (1) (i) it receives its electrical power from the bus that provides the maximum reliability for the operation of the recorder with out jeopardising service to essential or emergency loads; and (ii) it remains powered for as long as possible without jeopardising the emergency operation of the aeroplane; (2) there is an aural or visual means for pre - flight checking of the recorder for the proper recording of data in the storage medium; and (3) if the recorder is deployable, it complies with CS 25.1457(d)(7).

(c) If the recorder is not deployable, the container of the recording medium must be located and mounted so as to min imise the probability of the container rupturing, the recording medium being destroyed, or the underwater locating device failing as a result of any possible combinations of: (1) impact with the Earth’s surface; (2) the heat damage caused by a post - impact fire; and (3) immersion in water.

If the recorder is deployable, the deployed part must be designed and installed so as to minimise the probability of the recording medium being destroyed or the emergency locator transmitter failing to transmit (after dama ge or immersion in water) as a result of any possible combinations of: (1) the deployment of the recorder; (2) impact with the Earth’s surface; (3) the heat damage caused by a post - impact fire; and (4) immersion in water.

(d) The container of the data link recorder must comply with the specifications applicable to the container of the cockpit voice recorder in CS 25.1457(g).

[Amdt 25/26] Powered by EASA eRules Page 1100 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT

AMC 25.1460 Data link recorders

ED Decision 2020/024/R 1. General The installation of a recorder wit h an ETSO authorisation against ETSO - C177a (or an equivalent standard accepted by EASA) satisfies the approval requirement in CS 25.1460(a) .

In showing compliance with CS 2 5.1460 , the applicant should take into account EUROCAE Document ED - 112A, ‘Minimum operational performance specification for crash protected airborne recorder systems’, dated September 2013, or a later revision.

‘DLR system’ designates the data link recorde r (DLR) and its dedicated equipment. It may include the following items as appropriate to the aircraft: a. A crash - protected recorder.

b. Digital interface equipment suitable for converting a data link communication message into a format which is to be recorded.

c. Digital data busses and/or networks providing communications between elements of the system.

The data link recording function may be performed by: a. a cockpit voice recorder; b. a flight data recorder; c. a flight data and cockpit voice combination recorder; or d. a dedicated data link recorder.

2. Combination recorders Refer to the Section of AMC 25.1457 titled ‘Combination recorder’.

3. Recorded data The recorded data should be sufficient to all ow investigators, in the framework of an accident or incident investigation, to accurately reconstruct the sequence of data link communications between the aircraft and air traffic service units, other aircraft and other entities. For this purpose, the dat a link recording should comply with: a. EUROCAE Document ED - 93 (dated November 1998), ‘Minimum aviation system performance specification for CNS/ATM message recording systems’, Section 2.3.1, Choice of recording points, and Section 2.3.2, Choice of data to be recorded on board the aircraft; and b. EUROCAE Document ED - 112A (dated September 2013), ‘Minimum operational specification for crash protected airborne recorder systems’, Part IV, Chapter IV - 2, Section IV - 2.1.6, Data to be recorded.

4. Instructions for Continued Airworthiness (ICA) When developing the ICA for the DLR system, as required by CS 25.1529 and Appendix H , the applicant should address all the failures that may affect the correct functioning of the DLR system or the integrity of the recorded information.

Examples of failures (indicative and non - exhaustive list): — Loss of the recording function or of the acquisition function of the DLR; Powered by EASA eRules Page 1101 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART F – EQUIPMENT (CS - 25) MISCELLANEOUS EQUIPMENT — Part of the data link commun ication (required by CS 25.1460(a) or by the applicable air operations regulations) is missing or corrupted; — Failure of a means to facilitate the finding of the DLR recording medium after an accident (e.g. an under water locating device or an emergency locator transmitter attached to the recorder); — Failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpose of deploying the recorder if it is deployab le).

In addition, the ICA should include the following item, unless the applicant shows that this is not applicable: Documentation to perform the following: i. Convert the recorded data back to the original format of the data link communication messages, ii. Retrieve the time and the priority of each recorded message, and iii. Correlate the recorded messages with the FDR and CVR recordings.

[Amdt 25/26]

CS 25.1461 Equipment containing high - energy rotors

ED Decision 2003/ 2/RM (a) Equipment containing high energy rotors must meet sub - paragraph (b), (c) or (d) of this paragraph.

(b) High energy rotors contained in equipment must be able to withstand damage caused by malfunctions, vibration, abnormal speeds, and abnormal temperatures. In addition – (1) Auxiliary rotor cases must be able to contain damage caused by the failure of high energy rotor blades; and (2) Equipment control devices, systems, and instrumentation must reasonably ensure that no operating limitations affecting the in tegrity of high - energy rotors will be exceeded in service.

(c) It must be shown by test that equipment containing high - energy rotors can contain any failure of a high - energy rotor that occurs at the highest speed obtainable with the normal speed control de vices inoperative.

(d) Equipment containing high energy rotors must be located where rotor failure will neither endanger the occupants nor adversely affect continued safe flight.

Powered by EASA eRules Page 1102 of 1495 | Jan 2023

Next: SUBPART G – OPERATING LIMITATIONS AND INFORMATION →

SUBPART G – OPERATING LIMITATIONS AND INFORMATION

Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION MISCELLANEOUS EQUIPMENT

SUBPART G – OPERATING LIMITATIONS AND

INFORMATION

CS 25.1501 Ge neral

ED Decision 201 3/ 0 10/R (See AMC 25.1501 ) (a) Each operating limitation specified in CS 25.1503 to 25.1533 and other limitations and information necessary for safe operation must be established.

(b) The operating limitations and other information necessary for safe operation must be made available to the crew memb ers as prescribed in CS 25.1541 to CS 25.1593 .

[Amdt 25/13]

AMC 25.1501 Operati ng Limitations and Information - General

ED Decision 2003/2/RM The limitation s and information established in accordance with Subpart G should be only those which are within the competence of the flight crew to observe, and should relate only to those situations (including pre - and post - flight) with which a flight crew member might reasonably be concerned.

Powered by EASA eRules Page 1103 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION OPERATING LIMITATIONS

OPERATING LIMITATIONS

CS 25.1503 Airspeed limitations: general

ED Decision 2003/2/RM When airspeed limitations are a function of weight, weight distribution, altitude, or Mach number, limitations corresponding to each critical co mbination of these factors must be established.

CS 25.1505 Maximum operating limit speed

ED Decision 2003/ 2/RM The maximum operating limit speed (V /M , airspeed or Mach number, whichever is critical at a MO MO particular altitude) is a speed that may not be deliberately exceeded in any regime of flight (climb, cruise, or descent), unless a higher speed is authorised for flight test or pilot training operations.

V /M must be established so that it is not greater than the design cruising speed V and so t hat it MO MO C is sufficiently below V /M or V /M , to make it highly improbable that the latter speeds will be D D DF DF inadvertently exceeded in operations. The speed margin between V MO /M MO and V D /M D or V DF /M DF may not be less than that determined under CS 25.335(b) or found necessary during the flight tests conducted under CS 25.253 .

CS 25.1507 Manoeuvring speed

ED Decision 200 3/ 2/RM The manoeuvring speed must be established so that it does not exceed the design manoeuvring speed V determined under CS 25.335(c) .

A

CS 25.1511 Flap extended speed

ED Decision 2003/2/RM The established flap extended speed V must be established so that it does not exceed the design flap FE speed V chosen under CS 25.335(e) and 25.345 , for the corresponding wing - fl ap positions and engine F powers.

CS 25.1513 Minimum control speed

ED Decision 2003/ 2/RM The minimum control speed V determined under CS 25.149 must be establis hed as an operating MC limitation.

CS 25.1515 Landing gear speeds

ED Decision 2003/ 2/RM (a) The established landing gear operating speed or speeds, V , may not exceed the speed at which LO it is safe both to extend and to retract the landing gear, as determined under CS 25. 729 or by the flight characteristics. If the extension speed is not the same as the retraction speed, the two speeds must be designated as V and V respectively.

LO (EXT) LO (RET) , (b) The established landing gear extended speed V may not exceed the speed at which it is safe LE to fly with the landing gear secured in the fully extended position, and that determined under CS 25.729 .

Powered by EASA eRules Page 1104 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION OPERATING LIMITATIONS

CS 25.1516 Other speed limitations

ED Decision 2003/2/RM Any other limitation associated with speed must be established.

CS 25.15 17 Rough air speed, V

RA ED Decision 2005 / 006/R (a) A rough air speed, V for use as the recommended turbulence penetration air speed, and a RA rough air Mach number M , for use as the recommended turbulence penetration Mach RA number, must be established to ensure that likely speed variation during rough air encounters will not cause the overspeed warning to operate too frequently.

(b) At altitudes where V is not limited by Mach number, in the absence of a rational investigation MO substantiatin g the use of other values, V must be less than V - 35 KTAS.

RA MO (c) At altitudes where V is limited by Mach number, M may be chosen to provide an optimum MO RA margin between low and high speed buffet boundaries.

[ Amdt 25/1]

CS 25.1519 Weight, centre of grav ity and weight distribution

ED Decision 2016/010/R (See AMC 25.1519) The aeroplane weight, centre of gravity, and weight distribution limitations determined under CS 25.23 to CS 25.27 must be established as operating limitations.

[Amdt 25/1 8]

AMC 25.1519 Weight, centre of gravity and weight d istribution

ED Decision 2003/2/RM A statement of the maximum certificated take - off and landing weights, and the minimum certificated take - off and landing weights, should be established, together with th e maximum ramp or taxying weight, the maximum zero - fuel weight and any other fixed limit on weight, including weight limitations resulting from such factors as brake energy limits, tyre limits, etc., established in accordance with the airworthiness standar ds of CS - 25. Any limitations on aeroplane loading associated with the stated weight limitations (e.g. fuel load and usage, maximum fuel for landing) should be considered.

CS 25.1521 Powerplant limitations

ED Decision 2015 / 008/R (See AMC 25.1521 ) (a) General. The powerplant limitations prescribed in this paragraph must be established so that they do not exceed the corresponding limits for which the engines or propellers are type certificated and do not exceed the values on which compliance with any other requirement of this Code is based.

(b) Reserved.

Powered by EASA eRules Page 1105 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION OPERATING LIMITATIONS (c) Turbine engine installations . Operating limitations relating to the following must be established for turbine engine installations: (1) Horse power, torque or thrust, rpm, gas temperature, and time for – (i) Maximum continuous power or thrust (relating to augmented or unaugmented operation as applicable).

(ii) Take - off power or thrust (relating to augmented or unaugmented operation as applicable ).

(2) Fuel designation or specification.

(3) Maximum time interval between engine run - ups from idle, run - up power setting, duration at power, and the associated minimum ambient temperature, if any, demonstrated for the maximum time interval, for ground o peration in icing conditions, as defined in CS 25.1093(b)(2) .

(4 ) Any other parameter for which a limitation has been established as part of the engine type certificate except that a limitation need not be establis hed for a parameter that cannot be exceeded during normal operation due to the design of the installation or to another established limitation.

(d) Ambient temperature. An ambient temperature limitation (including limitations for winterisation installation s, if applicable) must be established as the maximum ambient atmospheric temperature established in accordance with CS 25.1043(b) .

[Amdt 25/16]

AMC 25.1521 Power - plant l imitations

ED Decision 2003/ 2/RM 1 In furn ishing limitations, consideration should be given to the following. The list does not necessarily include all the items to be considered for a given aeroplane.

a. Rotational speeds.

b. Exhaust and/or turbine gas temperature.

c. Oil temperatures and pressures.

d. Fuel temperatures and pressures.

e. Water and/or water methanol usage.

f. Anti - icing.

g. Specifications of approved fuels, oils and additives.

2 Other parameters, e.g. time , altitude, ambient temperatures, airspeed, may be necessary in defining power - plant limitations.

3 All operating phases should be considered in establishing the power - plant limitations.

Powered by EASA eRules Page 1106 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION OPERATING LIMITATIONS

CS 25.1523 Minimum flight crew

ED Decision 2016/010/R (See AMC 25 .1523) The minimum flight crew must be established (see AMC 25.1523 ) so that it is sufficient for safe operation, considering – (a) The workload on individual crew members; (b) The accessibility and ease of operat ion of necessary controls by the appropriate crew member; and (c) The kind of operation authorised under CS 25.1525 .

The criteria used in making the determinations required by this paragraph are set forth in Appendix D .

[Amdt 25/18]

AMC 25.1523 Minimum flight c rew

ED Decision 2003/ 2/RM 1 Both the number and identity of the flight crew members should be established.

2 If the minimum flight crew varies with the kinds of operation to which the aeroplane is limited, the approved number and identity of the flight crew members should be stated for each kind of operation.

3 If a particular flight crew member's station has to be occupied at all material times, this should be stated when specifying the minimum flight crew.

CS 25.1525 Kinds of operation

ED Decision 2003/2/RM The kinds of operation to which the aeroplane is limited are established by the category in which it is eligible for certification and by the installed equipment.

CS 25.1527 Ambient air temperature and operating altitude

ED Decision 2003/2/RM The extreme s of the ambient air temperature and operating altitude for which operation is allowed, as limited by flight, structural, powerplant, functional, or equipment characteristics, must be established.

CS 25.1529 Instructions for Continued Airworthiness

ED Dec ision 2003/2/RM Instructions for Continued Airworthiness in accordance w ith Appendix H must be prepared .

CS 25.1531 Manoeuvring flight load factors

ED Decision 2003/2/RM Load factor limitations, not exceeding th e positive limit load factors determined from the manoeuvring diagram in CS 25.333(b) , must be established.

Powered by EASA eRules Page 1107 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION OPERATING LIMITATIONS

CS 25.1533 Additional operating limitations

ED Decision 2016 / 010 /R (See AMC 25.1533) (a) Additional oper ating limitations must be established as follows: (1) The maximum take - off weights must be established as the weights at which compliance is shown with the a pplicable provisions of this CS - 25 (including the take - off climb provisions of CS 25.121(a) to (c) , for altitudes and ambient temperatures).

(2) The maximum landing weights must be established as the weights at which compliance is shown with the a pplicable provisions of this CS - 25 (including the landing and approach climb provisions of CS 25.119 and 25.121(d) for altitudes and ambient temperatures).

(3) The minimum take - off distances must be estab lished as the distances at which compliance is shown with the a pplicable provisions of this CS - 25 (including the provisions of CS 25.109 and 25.113 , for weights, altitudes, temperatures, wind components, runway surface conditions (dry and wet) and runway gradients) for smooth, hard - surfaced runways. Additionally, at the option of the applicant, wet runway take - off distances may be established for runway surfaces that have be en grooved or treated with a porous friction course and may be approved for use on runways where such surfaces have been designed, constructed and maintained in a manner acceptable to the Agency. (See AMC 25.1533(a )(3) .)

(b) The extremes for variable factors (such as altitude, temperature, wind, runway gradients) are those at which compliance with the appl icable provisions of this CS - 25 is shown.

(c) For aeroplanes certified in accordance with CS 25.1420(a)(1) or (a)(2) , an operating limitation must be established to: (1) Prohibit intentional flight, including take - off and landing, into icing conditions defined in Appendix O for which the aeroplane has not been certified to safely operate; and (2) Require exiting all icing conditions if icing conditions defined in Appendix O are encountered for which the aeroplane has not been certified to safely operate.

[Amdt 25/16] [Amdt 25/18 ]

AMC 25.1533(a)(3) Take - off distances on runways with a grooved

or porous friction course surface

ED Decision 2003/2/RM Runways that have a grooved or porous friction course (PFC) surface can maintain a significantly higher wheel - braking coefficient of friction when wet than can runways that lack such surface treatments.

Where take - off distance information specifically appl icable to such runways has been established, this higher level of friction has been taken into account in accordance with CS 25.109(d) . It is therefore essential that such information is only approved for use on ru nways having a grooved or PFC surface that has been constructed and maintained to acceptable standards. FAA AC 150/532012B ‘Measurement, Construction and Maintenance of Skid - Resistant Airport Paving Surfaces’ provides guidance on such standards. Where such operational approval has not been obtained, the performance information applicable to a smooth, hard - surfaced runway must be used.

Powered by EASA eRules Page 1108 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION OPERATING LIMITATIONS

CS 25.1535 ETOPS Design approval

ED Decision 2018/005 /R For an aeroplane configuration to be capable of ETOPS, the followin g are required : (a) Compliance with the requirements of CS - 25 considering the maximum flight duration and the longest diversion time for which approval is being sought.

(b) For Early ETOPS, approval of the engine for ETOPS capability in compliance with CS - E 1040.

(c ) Consideration must have been given to the crew workload and operational implications and the flight crew’s and passengers’ physiological needs of continued operations with failure effects for the longest diversion time for which approval i s being sought.

(d ) The appropri ate capability and limitations must have been established. (See AMC 20 - 6.)

(See AMC 20 - 6) [Amdt 25/10] [Amdt 25/21] Powered by EASA eRules Page 1109 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION MARKINGS AND PLACARDS

MARKINGS AND PLACARDS

CS 25.1541 General

ED Decision 2003/ 2/RM (See AMC 25.1541 ) (a) The aeroplane must contain – (1) The specified markings and placards; and (2) Any additional information, instrument markings, and placards required for the safe operation if there are unusual design , operating, or handling characteristics.

(b) Each marking and placard prescribed in sub - paragraph (a) of this paragraph – (1) Must be displayed in a conspicuous place; and (2) May not be easily erased, disfigured, or obscured.

AMC 25.1541 Markings and pla cards — General

ED Decision 2021/015/R Markings or placards should be placed close to or on (as appropriate) the instrument or control with which they are associated. The terminology and units used should be consistent with those used in the Flight Manua l. The units used for markings and placards should be those that are read on the relevant associated instrument.

Publications which are considered to provide appropriate standards for the design substantiation and certification of symbolic placards may include, but are not limited to, ‘General Aviation Manufacturers Association (GAMA) Publication No. 15 — Symbolic Messages’, Initial Issue, 1 March 2014.

EASA accepts the relevant parts of Federal Aviation Administration (FAA) AC 25 - 17A ‘Transport Airplane Cabin Interiors Crashworthiness Handbook’, of 24 May 2016, as an acceptable means of compliance with CS 25.1541 .

Note: ‘relevant parts’ means the AC 25 - 17A parts that address the applicable Federal Aviation Regula tion (FAR)/CS - 25 paragraph(s).

[Amdt 25/19] [Amdt 25/27]

CS 25.1543 Instrument markings; general

ED Decision 2003/ 2/RM (See AMC 25.1543 ) For each instrument – (a) When markings are on the cover glass of the instrument, there must be means to maintain the correct alignment of the glass cover with the face of the dial; and (b) Each instrument marking must be clearly visible to the appropriate crew member.

Powered by EASA eRules Page 1110 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION MARKINGS AND PLACARDS

A MC 25.1543 Instrument Markings - General

ED Decision 20 03/2/RM The markings should be such that the instrument remains easily readable with the minimum of confusion.

CS 25.1545 Airspeed limitation information

ED Decision 2016/010/R (See AMC 25.1545 ) The airspeed limi tations required by CS 25.1583(a) must be easily read and understood by the flight crew.

[Amdt 25/18]

AMC 25.1545 Airspeed limitation i nformation

ED Decision 2003/2/RM A placard could be used when the speed limita tion can be a simple presentation (e.g. an IAS speed up to a given altitude and an indicated Mach number thereafter). A complex speed limitation should be presented automatically on the instrument, (e.g. by means of an additional moving pointer).

CS 25.154 7 Magnetic direction indicator

ED Decision 2003/2/RM (a) A placard meeting the requirements of this paragraph must be installed on, or near, the magnetic direction indicator.

(b) The placard must show the calibration of the instrument in level flight with the engines operating.

(c) The placard must state whether the calibration was made with radio receivers on or off.

(d) Each calibration reading must be in terms of magnetic heading in not more than 45 ° increments.

CS 25.1549 Powerplant instruments

ED Decision 2003/ 2/RM (See AMC 25.1549 ) For each required powerplant instrument, as appropriate to the type of instrument: (a) Each maximum and, if applicable, minimum safe operating limit must be marked with a red radial or a red line; (b) Each normal operating range must be marked with a gree n arc or green line, not extending beyond the maximum and minimum safe limits; (c) Each take - off and precautionary range must be marked with a yellow arc or a yellow line; and (d) Each engine or propeller speed range that is restricted because of excessive vibration stresses must be marked with red arcs or red lines.

Powered by EASA eRules Page 1111 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION MARKINGS AND PLACARDS

AMC 25.1549 Powerplant i nstruments

ED Decision 2003/ 2/RM 1 Powerplant instrument range markings are intended to indicate to flight crew members, at a glance, that the powerplant operation is b eing accomplished in a safe or desirable, undesirable but allowable, or unsafe region. The colour red indicates an unsafe condition which requires immediate and precise action by the flight crew. The use of multiple red lines should be avoided to minimise confusion.

2 A precautionary range is a range where limited operation is permissible, as indicated in the aeroplane Flight Manual. Experience has shown that to satisfy the requirement for clearly visible markings, the following minimum dimensions should b e observed.

a. Red, yellow and green lines . 1.3 mm (0·05 inch) wide and 7.6 mm (0·3 inch) long.

b. Red, yellow and green arcs and areas . 2.5 mm (0·1 inch) wide, length as required.

CS 25.1551 Oil quantity indicator

ED Decision 2003/2/RM Each oil quanti ty indicating means must be marked to indicate the quantity of oil readily and accurately.

CS 25.1553 Fuel quantity indicator

ED Decision 2003/2/RM If the unusable fuel supply for any tank exceeds 3.8 l (one gallon), or 5% of the tank capacity, whichever is greater, a red arc must be marked on its indicator extending from the calibrated zero reading to the lowest reading obtainable in level flight.

CS 25.1555 Control markings

ED Decision 2003/ 2/RM (a) Each cockpit control, other than primary flight cont rols and controls whose function is obvious, must be plainly marked as to its function and method of operation.

(b) Each aerodynamic control must be marked under the requirements of CS 25.677 and 25.699 .

(c) For powerplant fuel controls – (1) Each fuel tank selector control must be marked to indicate the position corresponding to each tank and to each existing cross feed position; (2) If safe operation requires the use of any tanks in a specific sequence, that sequence must be marked on, or adjacent to, the selector for those tanks; and (3) Each valve control for each engine must be marked to indicate the position corresponding to each engine controlled.

(d) For accessory, auxiliary, and emergency controls – (1) Each emergency control (including each fuel jettisoning and fluid shutoff control) must be coloured red; and (2) Each visual indicator required by CS 25.729(e) must be marked so that the pilot can determine at any time when the wheels are locked in either extreme position, if retractable landing gear is used.

Powered by EASA eRules Page 1112 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION MARKINGS AND PLACARDS

CS 25.1557 Miscellaneous markings and placards

ED Decision 2016 / 010/R (See AMC 25.1557) (a) Baggage and cargo compartm ents and ballast location . Each baggage and cargo compartment, and each ballast location must have a placard stating any limitations on contents, including weight, that are necessary under the loading requirements. However, underseat compartments designed for the storage of carry - on articles weighing not more than 9 kg (20 lb) need not have a loading limitation placard. (See AMC 25.1557(a) .)

(b) Powerplant fluid filler openings. The following apply: (1) Fuel fille r openings must be marked at or near the filler cover with – (i) The word ‘fuel’; (ii) Reserved.

(iii) The permissible fuel designations; and (iv) For pressure fuelling systems, the maximum permissible fuelling supply pressure and the maximum permissib le defuelling pressure.

(2) Oil filler openings must be marked at or near the filler cover with the word ‘oil’.

(3) Augmentation fluid filler openings must be marked at or near the filler cover to identify the required fluid.

(c) Emergency exit placards. E ach emergency exit placard must meet the requirements of CS 25.811 .

(d) Doors . Each door that must be used in order to reach any required emergency exit must have a suitable placard stating that the door is to be latched in the open position during take - off and landing.

[Amdt 25/18]

AMC 25.1557(a) Baggage and Cargo Compartment and Ballast

Location

ED Decision 2003/2/RM If baggage, cargo compartment and ballast location limitations are complex and involve, for example, additional limitations on loading intensity and distribution, it is acceptable to provide a placard making reference to the appropriate document.

Powered by EASA eRules Page 1113 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION MARKINGS AND PLACARDS

CS 25.1561 Safety equipment

ED Decision 2003/2/RM (a) Each safety equipment control to be operated by the crew in emergency, such as controls for automatic liferaft releases, must be plainly marked as to its method of operation.

(b) Each location, such as a locker or compartment, that carries any fire extinguishing, signalling, or other lifesav ing equipment must be marked accordingly.

(c) Stowage provisions for required emergency equipment must be conspicuously marked to identify the contents and facilitate the easy removal of the equipment.

(d) Each liferaft must have obviously marked operating instructions.

(e) Approved survival equipment must be marked for identification and method of operation.

CS 25.1563 Airspeed placard

ED Decision 2003/2/RM A placard showing the maximum airspeeds for wingflap extension for the take - off, appr oach, and landing positions must be installed in clear view of each pilot.

Powered by EASA eRules Page 1114 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL

AEROPLANE FLIGHT MANUAL

CS 25.1581 General

ED Decision 2003/ 2/RM (See AMC 25.1581 ) (a) Furnishing information. An aeroplane Flight Manual must be furnished with each aeroplane, an d it must contain the following : (1) Information required by CS 25.1583 to 25.1587 .

(2) Other information that is necessary for safe operation because of design, operating, or handling characteristics.

(3) Any limitation, procedure, or other information established as a condition of compliance with the applicable noise standards.

(b) Approved information. Each part of the manual listed in CS 25.1583 to 25.1587 that is appropriate to the aeroplane, must be furnished, verified, and approved, and must be segregated, identified, and clearly distinguished from each unapproved part of that manual.

(c) Reserved.

(d) Each aer oplane Flight Manual must include a table of contents if the complexity of the manual indicates a need for it.

AMC 25.1581 Aeroplane f light m anual

ED Decision 2021/015/R 1 PURPOSE The primary purpose of the European Aviation Safety Agency (EASA) approved Aeroplane Flight Manual (AFM) is to provide an authoritative source of information considered to be necessary for safely operating the aeroplane. This Acceptable Means of Compliance (AMC) identifies the information that must be provided in the AFM under the airworthiness regulations and provides guidance as to the form and content of the approved portion of an AFM. Although mandatory terms such as ‘shall’ or ‘must’ are used in this AMC, because the AMC method of compliance is not mandatory, these t erms apply only to applicants who seek to demonstrate compliance by following the specific procedures described in this AMC.

2 RELATED CERTIFICATION SPECIFICATIONS (CS) Paragraphs 25.1581, 25.1583, 25.1585, 25.1587 and 25 . 1591 of the CS and noise regulations identify the information that must be provided in the AFM. Paragraph 25.1581 also requires ‘other information that is necessary for safe operation because of the design, operating, or handling characteristics’. Additional related requirements a re the applicable operational rules.

3 DEFINITIONS a. Aeroplane Flight Manual (AFM) . A EASA approved document that contains information (limitations, operating procedures, performance information, etc.) necessary to operate the aeroplane at the level of sa fety established by the aeroplane’s certification basis.

b. Flight Crew Operating Manual (FCOM) . A document developed by a manufacturer that describes, in detail, the characteristics and operation of the aeroplane or its systems.

Powered by EASA eRules Page 1115 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL c. Safe Operation . For the purposes of this AMC, safe operation means operation of the aeroplane in a manner that is mandatory, or is recommended, for compliance with the airworthiness requirements.

d. Limitation . For the purposes of this AMC, an AFM limitation establishes the appr oved bounds of operation of the aeroplane or its systems.

e. Aeroplane Flight Manual Warnings, Cautions and Notes . The AFM contains operating procedures, techniques, etc. that may be categorised as warnings, cautions and notes as defined in the following p aragraphs. The following definitions should not be confused with the colour requirements prescribed in CS 25.1322 for warning, caution and advisory lights installed in the cockpit.

(1) Warning. An operating procedu re, technique, etc. that may result in personal injury or loss of life if not followed.

(2) Caution. An operating procedure, technique, etc. that may result in damage to equipment if not followed.

(3) Note. An operating procedure, technique, etc. considere d essential to emphasise.

Information contained in notes may also be safety related.

f. Procedure . A procedure is a step - by - step method used to accomplish a specific task.

(1) Emergency. A procedure requiring immediate flight crew action to protect the ae roplane and occupants from serious harm.

(2) Abnormal or Non - normal. A procedure requiring flight crew action, due to failure of a system or component, to maintain an acceptable level of airworthiness for continued safe flight and landing.

(3) Normal. A pr ocedure associated with systems that are functioning in their usual manner.

g. Revision . A change to the content of the AFM through the addition, deletion, or modification of material.

h. Appendices and Supplements . Additions to the AFM that may or may no t supersede existing AFM material.

(1) Appendix. An addition to the AFM to cover the installation of optional equipment or specific operations (engine inoperative ferry, reduced thrust or power takeoff, configuration deviation list (CDL), etc.).

(2) Suppl ement. Information that supersedes or is in addition to the basic AFM resulting from the issuance of a supplemental type certificate (STC), or from approved changes to AFM limitations, procedures, or performance information without an STC.

4 DISCUSSION The AFM provides information to safely operate the aeroplane under normal, abnormal and emergency conditions. The AFM contains the operating limitations, operating procedures, and performance information for the aeroplane.

a. Historically , the AFM was often the only source of information available to the flight crew for safely operating a transport category aeroplane. Consequently, the form and content of these earlier AFMs were designed to meet the needs of the flight crew. For example, Powered by EASA eRules Page 1116 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL v ery detailed operating procedures were presented in a form easily used in the cockpit (e.g., checklist format).

b. As more complex equipment was incorporated into transport category aeroplanes, many aeroplane and equipment manufacturers developed separate operating manuals intended for on - board use by the flight crew. These operating manuals are generically referred to within this AMC as Flight Crew Operating Manuals (FCOM). By locating information such as cockpit checklists, systems descriptions and detai led procedures in the FCOM, the bulk and complexity of the AFM can be kept manageable. As a result, the AFM for many transport aeroplanes has evolved into more of a reference document than a document used frequently by the flight crew. In recognition of th e usefulness and convenience provided by these FCOMs, the normal operating procedures information in the AFMs for these transport category aeroplanes should be limited to those procedures considered ‘peculiar’ to the operation of that aeroplane type.

c. T he AFM should be limited to the smallest practicable amount of material that is appropriate for the intended operation of the aeroplane. In general, the systems descriptions and procedures provided in the AFM for most large transport aeroplanes should be l imited to that which is uniquely related to aeroplane safety or airworthiness.

Since the AFM still serves as the sole operating manual for many small transport category aeroplanes, these AFMs should continue to contain detailed operating information.

d. Widespread use of computers has led to the capability of replacing or supplementing parts of the conventional paper AFM with a computerized version. Guidance for EASA approval of computerized AFM information is presented in Appendix 1 of this AMC.

5 GENERAL GUIDELINES Previously approved AFMs are unaffected by this AMC. When such manuals are amended, the concepts of this AMC should be applied, if practicable.

a. Segregation of Approved and Unapproved Material . Par agraph 25.1581 of the CS requires that EASA approved information be segregated, identified, and clearly distinguished from each unapproved part of the AFM. Unapproved material should be labelled that it is for guidance information only, and must be located in a different section than the approved material.

b. Provisions for approval of and revisions to the AFM are as follows: (1) Each page of the approved port ion should bear the notation, ‘ EASA Approved’, a unique date of approval or revision number for t hat page, the aeroplane type or model designation, and an appropriate document identification number. For AFM pages produced by an STC applicant, both the STC applicant’s name and the aeroplane type or model designation should appear.

(2) All AFMs, revisio ns, appendices, and supplements requiring EASA approval must be submitted to the EASA. A log of currently approved pages in the AFM should be furnished in each copy of the manual. A location should be provided on the log for the approval signature and the approval date. Alternatively, a specific approval page can be furnished for the approval signature and the current revision status.

(3) When revisions are incorporated, a means of indicating those parts of the information that have been changed should be p rovided. For example, vertical bars placed in the margin of the revised page may be used for this purpose. Each revised Powered by EASA eRules Page 1117 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND IN FORMATION AEROPLANE FLIGHT MANUAL page should be identified in the same manner as the original, with the exception of the new date and revision notation, as applicable.

( 4) Appendices and supplements should be incorporated in the AFM in a separate section appropriately identified at the end of the basic manual. Supplements should normally follow appendices. Format, page identification, organisation, and other details shoul d be the same as that of the basic manual.

(5) Appendices and supplements may be developed by the TC holder, STC applicant, or the operator, and should be submitted for evaluation and approval according to EASA certification procedures. Usually, the TC hol der writes appendices to the AFM, and an STC applicant or operator supplements the AFM. However, an STC applicant may elect to produce a completely new AFM.

(6) It may be necessary to provide a greater amount of descriptive and procedural information in ap pendices and supplements than that appearing in the basic AFM, if the appendix or supplement is the only source for this information.

c. The AFM may address either a single aeroplane model (i.e., hardware build) or several models of the same aeroplane type . If information is provided for more than one model, the AFM should clearly identify which operating limitations, operating procedures, and performance information apply to each model (e.g., by model designation, serial number, etc.). If the AFM format is such that different pages apply to different aeroplanes, the log of pages should clearly identify the specific pages of the AFM that apply to each aeroplane.

d. Any required weight and balance information that is not a physical part of the AFM, must be i ncorporated by reference in the Limitations Section of the AFM per CS 25.1583(c) .

e. Aeroplane Flight Manual Units. The AFM units should be consistent with the flight deck instrumentation, placards, and other measuring devices for a particular aeroplane. The AFM should be given in SI units (International System of Units). This does not apply to the units of measurement related to: — airspeed : knots.

— altitude : feet.

— vertical speed : feet per minute.

— navigational distance : nautical miles.

Systems of units must be properly identified and presented. Multiple scales may be used on AFM charts to show different units, e.g., pounds and kilograms. However, the charts should be constructed to minimise any misunderstanding or interpolation problems by, for example, using a transfer scale so that principal values of each of the units are on major grid lines or index marks.

6 AERO PLANE FLIGHT MANUAL CONTENTS The AFM should be divided into the following sections, as appropriate for the specific aeroplane type or model. For purposes of standardisation, it is recommended that the sequence of sections and of items within sections follo w this outline.

Powered by EASA eRules Page 1118 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL a. Introductory Section . The intent of the introductory material is to identify the revision status and control the applicability and content of the AFM. The normal content of this section is as follows: (1) Title page. The title page sh ould include the manufacturer’s name, the aeroplane model designation, the commercial designation or name, if any, assigned to the aeroplane, and an appropriate document identification number. Provision should be made for the inclusion of the approval date of the basic document and the signature, name, and title of the EASA approving official.

(2) Log of revisions.

(3) Revision highlights, if appropriate.

(4) Log of pages (including all information necessary to determine which pages apply to a given aeroplane model (i.e., hardware build)).

(5) Compatibility listing of appendices and supplements produced by the aeroplane manufacturer.

(6) Table of contents. (Alternatively, a table of contents for each section may be placed at the beginning of that sect ion.)

(7) List of abbreviations.

b. Limitations Section . The purpose of the Limitations Section is to present those operating limitations appropriate to the aeroplane model as established in the course of the type certification process in determining compl iance with the applicable certi fication requirements (e.g., CS - 25 and noise regulations). The operating limitations must be expressed in mandatory, not permissive, language. The terminology used in the AFM must be consistent with the relevant regulatory la nguage. Limitations prescribed by operating rules may be incorporated as appropriate.

(1) Weight Limitations. A statement of the maximum certificated take - off and landing weights must be provided. The maximum taxi/ramp weight, maximum zero - fuel weight, an d any other fixed limit on weight, should also be included. Any limitations on aeroplane loading associated with the stated weight limitations must be included in the AFM or addressed in a separate weight and balance document.

Separate take - off and landing weight limits may be listed corresponding to each applicable constraint (e.g., structural or noise requirements, customer option, etc.), if the instructions in the Limitations Section clearly state that the most restrictive of these take - off and landing w eight limitations represent the maximum certified weights.

(i) For those performance weight limits that vary with runway length, altitude, temperature and other variables, the variation in weight limitations may be presented as graphs in the Performance Section of the AFM and included as limitations by specific reference in the Limitations Section.

(ii) Only one set of noise limited take - off and landing weights may be established for a specific aeroplane model (i.e., hardware build).

(2) Noise limitations. An aeroplane model (i.e., hardware build) may not be identified as complying with the requirements of more than one noise stage level at a time.

The operating limitations contained in the Limitations Section of the AFM should comply with the noise certification criteria for that stage. If the noise certification status of an aeroplane model is upgraded to a more stringent stage level the AFM Powered by EASA eRules Page 1119 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL must either be revised or supplemented, whichever is appropriate, to include only information appropria te to the new stage level.

(i) Landing Flap Restriction. An operating limitation preventing the use of an approved landing flap setting to comply with noise requirements can only be established under the airworthiness requirements or as a voluntary design change. A statement must be added to the Limitations Section to preclude using that landing flap setting for normal operations. Emergency procedures may, however, continue to use the restricted flap setting. A placard must be placed in the aeroplane and ap propriate other means must be installed (e.g., crushable guard on the restricted portion of the flap selection quadrant), to prevent using the restricted flap setting for normal operations.

(ii) Reduced and Derated Take - off Thrust or Power. Noise certifica tion levels are determined at the maximum all - engines operating take - off thrust or power.

Reduced and derated thrust or power are not changes that would invalidate the noise certification status of the aeroplane, provided the full rated take - off thrust or power remains approved for that aeroplane.

(3) Operating Limitations. The extremes of the operational variables, including any appropriate descriptions for which compliance with the certification requirements has been shown and for which the AFM data have been approved, should be listed with respect to the following: (i) Operations.

(A) Maximum take - off, landing and zero - fuel weight limits.

(B) Minimum in - flight weight.

(C) Minimum and maximum pressure altitude for which operation is limited for each flight phase (take - off, en route and landing). Further altitude limitations caused by changes to structure, powerplant, equipment characteristics or flight characteristics (e.g. due to failures) should be provided.

(D) Ambient atmospheric temperature (maximum an d minimum).

(E) Minimum control speed. (This information may be located in the Performance Section of the AFM, with cross - reference in the Limitations Section.)

(F) Maximum tailwind. The maximum allowable tailwind component for take - off and landing should normally be limited to 10 knots. If airworthiness approval has been granted for take - off and landing in tailwinds greater than 10 knots, the AFM should provide the limiting tailwind value, accompanied by a statement such as the following: The capability of this aeroplane has been satisfactorily demonstrated for take - off and manual landing with tailwinds up to knots. This finding does not constitute operational approval to conduct take - offs or landings with tailwind components greater than 10 knots.

Powered by EASA eRules Page 1120 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (G) M aximum demonstrated crosswind.

(1) If the maximum demonstrated crosswind is considered to be limiting for either take - off or landing, the crosswind limitation must be stated in the Limitations Section. If the crosswind value is considered to be limiting fo r one type of operation (e.g.

autoland) but not for another, the crosswind limitation may also state the specific operations to which it applies.

(2) If the maximum crosswind value demonstrated under CS 25.237 is considered to be not limiting for both take - off and landing operations, the demonstrated crosswind value may be presented in a section other than the Limitations Section.

(H) Runway slope. Limitations an d performance information should normally be restricted to runway gradients up to ±2 percent.

Limitations for runway slopes greater than ±2 percent may be approved if the effects of the larger slopes are validated in a manner acceptable to the EASA.

(I) Ru nway surface type (smooth and hard - surfaced, or any other type approved).

(ii) En route Flight Paths.

(A) Maximum altitude.

(B) Ambient atmospheric temperature (maximum and minimum).

(C) In accordance with CS 25.12 3(a) , en route flight path data must be presented in the AFM for all altitudes and temperatures within the operating envelope limits of the aeroplane.

(4) Centre - of - Gravity Limits. Indicate by using tables or graphs the centre of gravity (c.g.) limits for taxi, take - off and landing, zero fuel weight, and for any other practicably separable flight condition. As appropriate, data should be provided for a range of weights between the maximum taxi weight and the minimum in - flight weight. The data sho uld be shown with the appropriate gear position for the phase of flight, and gear effects on the centre - of - gravity should be built into the charts.

Data may be presented for gear - extended position only if there is proper accounting for the moment change du e to gear retraction. The c.g. limits should be presented in terms of either the distance - from - a specified datum or as a percentage of the mean aerodynamic chord (MAC). Either the location of the datum or the length and location of the MAC should be stated , as applicable. If alternate forward c.g. limits have been approved, these limits should be presented and appropriately identified.

(5) Fuel Limitations. A statement in accordance with CS 25.1585(d) must be includ ed.

Operating limitations due to fuel related considerations (e.g. lateral fuel imbalance, fuel management, fuel temperature) and their effects on altitude limitations (e.g.

boost pump(s) inoperative, fuel type) should also be provided.

(6) Powerplant Limi tations.

(i) State all limitations necessary to ensure safe operation of engines, propellers, fuel systems and powerplant accessories, including auxiliary powerplants (see CS 25.1521 and 25J1521 ). If the use of reduced or derated Powered by EASA eRules Page 1121 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL take - off thrust or power is requested, then any associated operating or performance limitations should be included in accordance with acceptable reduced and derated takeoff thrust or power procedure s. Limitations related to the use of reverse thrust in flight or on the ground should be clearly identified. Any engine limitations associated with operations in adverse weather (heavy rain, hail, turbulence, lightning, etc.) should be specified. Any icing conditions that may impact the normal operation of the engine should also be defined.

(ii) Because engine ice protection is critical to safety in icing conditions, a statement should be included in the Limitations Section that the engine ice protection mu st be on during all ground and flight operations when icing conditions exist or are anticipated. The following definition of icing conditions should also be included in the Limitations Section: Icing conditions – Icing conditions exist when outside air tem perature (OAT) on the ground and for take - off, or total air temperature (TAT) in flight, is 10 degrees C or below and visible moisture in any form is present (such as clouds, fog with visibility of one mile or less, rain, snow, sleet or ice crystals).

Ici ng conditions also exist when the OAT on the ground and for take - off is 10 degrees C or below when operating on ramps, taxiways, or runways where surface snow, ice, standing water or slush may be ingested by the engines or freeze on engines, nacelles or en gine sensor probes.

(7) Airspeed and Mach Number Limitations. All airspeed limitations should be in terms of indicated airspeed and in units of knots or Mach number, where applicable and should be consistent with cockpit indication. If airspeed or Mach nu mber limitations vary with altitude or loading conditions, such variation must be shown.

Limitations data must be included for at least the following: (i) Maximum operating limit speed, V /M , together with a statement that MO MO this speed limit may not be de liberately exceeded in any regime of flight (climb, cruise or descent), unless a higher speed is authorised for flight test or pilot training. The last phrase (unless a higher speed is authorised for flight test or pilot training) may be omitted at the opt ion of the applicant.

(ii) Manoeuvr ing speed (established under CS 25.1507 ) together with statements, as applicable to the particular design, explaining that: (a) full application of pitch, roll, or yaw controls should be confined to speeds below the manoeuvring speed; and (b) rapid and large alternating control inputs, especially in combination with large changes in pitch, roll, or yaw, and full control inputs in more than one axis at the same time, sho uld be avoided as they may result in structural failures at any speed, including below the manoeuvring speed.

(iii) Flap - extended speed, V , for each approved flap and high lift device FE position.

(iv) Landing gear operating speed, V , together with a stat ement that this is the LO maximum speed at which it is safe to extend or retract the landing gear. If Powered by EASA eRules Page 1122 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL different speeds are established for extension and retraction, each speed should be listed and defined.

(v) Landing gear extended speed, V , together with a statement that this is the LE maximum speed at which the aeroplane can be safely flown with the landing gear extended and locked.

(vi) Any other limiting speeds for extendable devices other than the landing gear, should be included as applicable (e.g. spoile rs, thrust reversers, landing lights, ram air turbine (RAT), windows that may be opened in flight, etc.).

(8) Manoeuvring Load Factor Limitations. The positive and negative flight manoeuvring limit load factors (expressed in terms of ‘g’s’) for which the s tructure is approved should be provided, including any variation with the position of the high lift devices.

(9) Kinds of Operations. This subsection should contain a statement similar to the following: This aeroplane is certificated as a Large Turbine - powered Aeroplane and is eligible for the following kinds of operations when the appropriate instruments and equipment required by the airworthiness and operating requirements are installed and approved and are in operable condition.

The approval status of the following should be stated: (i) Operation in atmospheric icing conditions.

(ii) Extended over - water operation.

(iii) Extended range operations with two - engine aeroplanes (ETOPS).

(iv) Day and night o perations under visual flight rules (VFR).

(v) Operations under instrument flight rules (IFR).

(vi) Backing the aeroplane with reverse thrust.

(vii) Category I, II or III operations.

(10) Minimum Flight Crew. The minimum number of flight crew approved to o perate the aeroplane should be stated.

(11) Systems and Equipment Limitations. All limitations applicable to systems and equipment installations that are considered necessary for safe operation must be included. Examples of systems and equipment installati ons for which limitations may be appropriate include, but are not limited to, electrical, hydraulic, pneumatic, cabin pressurisation, air conditioning, airframe fire protection, airframe ice protection, auto braking systems, autopilot, autothrottle, flight director, yaw damper, anti - skid devices, performance or flight management system (including software identifier if displayable), etc.

(12) Miscellaneous Limitations. This item should include any information not specified under the preceding headings but necessary, as a limitation, to ensure safe operation of the aeroplane.

Powered by EASA eRules Page 1123 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL c. Operating Procedures Section . The Operating Procedures Section of the AFM should contain, as a minimum, the essential information, peculiar to the particular aeroplane type design, that is needed for safe operation under normal and other - than - normal conditions. Procedures not directly related to airworthiness, or not under control of the flight crew, should not be included in the AFM. A notation similar to the following should be placed at the beginning of the Operating Procedures Section.

The operating procedures contained in this manual have been developed and recommended by the manufacturer and approved by the EASA for use in operating this aeroplane. These procedure s are provided as guidance and should not be construed as prohibiting the operator from developing equivalent procedures in accordance with the applicable operating rules.

(1) Procedures Categories. Information should be presented for normal, non - normal, and emergency procedures and be distinctly separated. Procedural tasks considered to be recall or immediate action items, which must be accomplished from memory, should be clearly identified.

(2) Format. Procedures should be presented either in a narrative or a checklist format, depending upon the intended use of the AFM.

(i) Narrative. This format is acceptable if sources of procedures information other than the AFM are intended for flight crew use (e.g. Flight Crew Operating Manual (FCOM)). Procedures pre sented in this format should be drafted in a manner from which the needed sequence can be easily established.

(ii) Checklist. This format should be used if the AFM is intended to be used directly by the flight crew for operating procedures.

(3) Procedures Development. Prior to initial type certification, it is essential to verify that proposed procedures are technically valid and operationally practicable. It is recognised that such procedures may have had only limited operational exposure at the time of ce rtification and may need to be revised based on service experience.

(4) Procedures Content. The content and level of detail for the normal, non - normal, and emergency procedures provided in the AFM should be based on the intended use of the AFM. More inform ation and detail should be provided in AFMs that are intended to be the flight crew’s primary sources of operating procedures information than for AFMs that are not intended to be used directly by the flight crew.

(i) General. Classifying an operating proc edure as normal or as non - normal should reflect whether the aeroplane’s systems are operating normally.

Procedures associated with failed or inoperative systems should be considered non - normal. Procedures associated with glideslope deviation, ground proxim ity warning, all engines operating go - around, turbulent air penetration, etc, which do not occur routinely, should be placed in the normal procedures subsection, provided the aeroplane’s systems are operating normally.

(ii) Other Sources of Procedures Info rmation. The flight crew of large transport category aeroplanes typically use other sources of operating procedures information other than the AFM. Examples of other sources of operating Powered by EASA eRules Page 1124 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLA NE FLIGHT MANUAL procedures information include manufacturer - or operatorproduced oper ating manuals, Quick Reference Handbooks (QRH), System Pilot’s Guides and Emergency or Abnormal Checklists. For these aeroplanes, items such as cockpit checklists, systems descriptions, and the associated normal procedures should not be presented in the AF M if they are provided in other documents acceptable to the Agency. Normal procedures that are necessary for safe operation should be presented in the AFM, but the remaining normal procedures should be placed in the manufacturer produced FCOM (or other acc eptable sources of operating procedures information). The non - normal procedures section of the AFM for these types of aeroplanes should include, as a minimum, procedures dictated by the aeroplane’s system and failure modes, and may also include those emerg ency procedures listed in paragraph 6.c(5) of this AMC. Whenever procedures are provided in another source rather than the AFM, a statement should be placed in the appropriate procedures section of the AFM referencing where the detailed procedures informat ion can be found.

(iii) AFM Used Directly. For those manufacturers and operators that do not produce other sources of procedures information (generally manufacturers and operators of small transports), the AFM is the only source of this information. In thi s circumstance, the AFM operating procedures information must be comprehensive and include information such as cockpit checklists, systems descriptions and associated procedures.

(5) Emergency Procedures. The emergency procedures can be included either in a dedicated section of the AFM or in the non - normal procedures section. In either case, this section should include the procedures for handling any situation that is in a category similar to the following: (i) Engine failure with severe damage or separation.

(ii) Multiple engine failure.

(iii) Fire in flight.

(iv) Smoke control. The following should be clearly stated in the AFM: After conducting the fire or smoke procedures, land at the nearest suitable airport, unless it is visually verified that the fire has been extinguished.

(v) Rapid decompression.

(vi) Emergency descent.

(vii) Uncommanded reverser deployment in flight.

(viii) Crash landing or ditching.

(ix) Emergency evacuation.

d. Performance Section. This section of the AFM contains the performance limitations, other data required by the applicable airworthiness and noise regulations, and any special conditions that may apply. Additional information may be provided to assist the operator in complying with the operating rules or for implementing unique operational needs. The performance information should cover the operating range of weights, altitudes, temperatures, aeroplane configurations, thrust ratings, and any other operational variables stated as operational performance limitations for the aeroplane. If additional Powered by EASA eRules Page 1125 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL performance information is presented for operation at a specific altitude, these performance data should cover a pressure altitude span of at least the specific altitude ±1,000 feet to a llow an operator to adequately account for pressure altitude variations.

It is recommended that such data be included as a separate section or appendix to the AFM.

(1) General. Include all descriptive information necessary to identify the configuration an d conditions for which the performance data are applicable. Such information should include the type or model designations of the aeroplane and its engines, the approved flap settings, a brief description of aeroplane systems and equipment that affect perf ormance (e.g. anti - skid, automatic spoilers, etc.), and a statement indicating whether such systems and equipment are operative or inoperative. This section should also include definitions of terms used in the Performance Section (e.g. IAS, CAS, ISA, confi guration, net flight path, icing conditions, etc.), plus calibration data for airspeed (flight and ground), Mach number, altimeter, air temperature and other pertinent information. The airspeed, altitude and air temperature calibration data should be prese nted for the following ranges: (i) Take - off configurations: (A) Ground run, 0·8 V to V .

1MIN 2MAX (B) In - flight, V to V .

2MIN FE (ii) Approach and landing configurations: (A) Approach, 1·13 V to V .

SR FE (B) Landing, 1·23 V to V .

SR FE (iii) En route configuration : (A) Airspeed and Altimeter: For the take - off/take - off path altitude range, 1.18 V to V /M .

SR MO MO (B) Airspeed and Altimeter: For higher altitudes, from 1.18 V or the SR speed for 1·2 g buffet onset margin, whichever is lower, to V /M .

MO MO (C) Mach Number: From the lowest useful Mach number (generally in the range of 0·4 to 0·5) to M .

MO (D) Total or Static Air Temperature: For Mach numbers corresponding to the speed ranges noted in paragraphs 6.d(1)(iii)(A) and (B) of this AMC.

(2) Performance Procedures. T he procedures, techniques and other conditions associated with the AFM performance data should be included. Performance procedures may be presented as a performance subsection or in connection with a particular performance graph. In the latter case, a comp rehensive listing of the conditions associated with the particular performance data may serve as procedures if sufficiently complete. The AFM should also include adequate information to enable the operator to show compliance with CS 25.1001 for each take - off.

(3) Thrust or Power Setting. Thrust or power settings should be provided for at least take - off, maximum continuous, and go - around thrust or power, along with the thrust or power setting procedures necessary to obtain the performance shown in the AFM. These dat a should be shown for each applicable thrust or power setting Powered by EASA eRules Page 1126 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LI MITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL parameter. If backing the aeroplane by reverse thrust is proposed, thrust setting limits should be established considering contaminated runway, foreign object damage potential, environmental con trol system impact, aeroplane weight and c.g., cockpit visibility, effect of braking, etc.

(4) Minimum Control Speeds. Minimum control speed data may be located in the Performance Section with a reference in the Limitations Section as to its location.

(5) Stall Speeds. The stall speeds established in showing compliance with certification requirements should be presented, together with associated conditions. Data should be presented in terms of calibrated airspeed. If applicable, stall speed increments w ith accreted ice must be provided.

(6) Take - off Speeds. The take - off speeds, V , V and V must be presented in the AFM, 1 R 2 together with the associated conditions. These speeds should be presented in units consistent with cockpit instrument indication. V an d V speeds should be based 1 R upon ground effect calibration data while V speeds should be based upon free air calibration data. The take - off speeds associated with minimum control speeds and the maximum energy absorption capability of the brakes should be included. At the option of the applicant, the AFM may also include the V speeds associated with unbalanced field lengths. At all conditions and aeroplane configurations represented in the AFM (i.e., at all altitudes, temperatures, weights, winds, runway s lopes, flap settings, etc.), the accuracy of the V speed should either 1) be within 1·5 knots of the V speed used to calculate the take - off and accelerate - stop distances, or 2) not cause an increase to these distances of more than the greater of 100 feet or the incremental increase resulting from a 1·5 knots variation in V speed.

(7) Take - off and Accelerate - Stop Distances. Take - off and accelerate - stop distances, complying with CS 25.105 , 25.109 , 25.113 , and 25.1591 must be provided. At the option of the applicant, and with concurrence by the Agency, additional data may be provided for opera tions on other than smooth hard - surfaced runways.

(8) Climb Limited Take - off Weight. The climb limited take - off weight, which is the most limiting weight showing compliance with CS 25.121(a), (b) and (c) , must be p rovided.

(9) Miscellaneous Take - off Weight Limits. Take - off weight limits should be shown for any equipment or characteristic of the aeroplane that imposes an additional take - off weight restriction (e.g. maximum tyre speed, maximum brake energy, fuel jetti son consideration, inoperative system(s), etc.).

(10) Take - off Climb Performance. For the prescribed take - off climb aeroplane configurations, the climb gradients must be presented, together with associated conditions. The scheduled climb speed(s) should be included.

(11) Take - off Flight Path Data. Take - off flight paths, or performance information necessary to construct such paths, together with the associated conditions (e.g.

procedures and speeds), should be presented for each approved take - off co nfiguration. The presentation should include all flight path segments existing between the end of the take - off distance and the end of the take - off path, as defined in CS 25.111(a) . Such data must be based upon net performance, as prescribed in CS 25.115(b) and (c).

Powered by EASA eRules Page 1127 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (12) En route Flight Path Data. The net flight path gradient data prescribed in CS 25.123 must be presented, together with the associated conditions (e.g. proced ures and speeds). Data must be presented for one - and two - engine - inoperative cases, as applicable, throughout the approved operating altitude and temperature envelope.

(13) Climb Limited Landing Weight. The climb limiting landing weight, which is the most limiting weight showing compliance with CS 25.119 and 25.121(d) , should be provided.

(14) Miscellaneous Landing Weight Limits. Landing weight limits for any equipment or ch aracteristic of the aeroplane configuration that imposes an additional landing weight restriction should be shown.

(15) Approach Climb Performance. For the approach climb configuration, the climb gradients ( CS 25.1 21(d) ) and weights up to maximum take - off weight ( CS 25.1587(b)(3) ) should be presented, together with associated conditions (e.g.

procedures and speeds). The effects of ice accretion on unprotected portions of the airframe and the effects of engine and wing ice protection systems should be provided.

(16) Landing Climb Performance. Data for the landing climb configuration should be presented in a manner similar to that described for the approach configuration above.

(17) Landing Approach Speeds. The scheduled speeds associated with the approved landing distances and operational landing runway lengths (see paragraph 6.d(18) of this AMC) should be presented, together with associated conditions.

(18) Landing Distance. T he landing distance from a height of 50 ft must be presented either directly or with the factors required by the operating regulations, together with associated conditions and weights up to the maximum take - off weight. For all landplanes, landing distance data must be presented for smooth, dry, hard - surfaced runways for standard day temperatures. With concurrence by the Agency, additional data may be presented for other temperatures and runway slopes within the operational limits of the aeroplane, or for op erations on other than smooth, hard - surfaced runways. For all weather operations, additional landing performance data may be required.

The unfactored landing distances for dry and wet runways are minimum normalised values based on certification test procedures. For those distances, a runway surface with no slope at standard day temperature as well as standard landing speeds are assumed.

The AFM should state the following conditions for which the landing distances are valid: — runway s lope, — temperature, — landing configuration, and — thrust or power setting.

The landing distances at the time of arrival (LDTA) reflect the performance that is expected in operational conditions. The AFM should present LDTA as follows: Powered by EASA eRules Page 1128 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL — for all runway condition codes from 1 to 6, — for certified landing configurations, — for final - approach speeds (V ) including recommended speed increments, APP — with and without reverse thrust credit, and — within the certified flight envelope for: — runway slope, and — outside air temperature.

The AFM should state that a safety margin should be applied to the landing distances to account for operating practices and expected operational variability.

The performance information that is provided in the AFM to comply with CS 25.1592 and the LDTA concept in the applicable air operations regulations produce a large variety of landing distance data being provided in the AFM.

Therefore, the intended use of each piece of the landing - distance informati on should be properly explained in the AFM.

The AFM should emphasise the need to apply a safety margin, particularly to such landing distances whose method of derivation is the least conservative. Such landing distances are, for example, those determined b y a maximum - performance manoeuvre based on data (e.g. flight path angle and touchdown sink rate) that are normalised to specified conditions so that the landing distances achieved in operational conditions may be greater.

(19) Performance Limits and Inform ation Variation with Centre of Gravity. If performance information, (e.g. buffet boundary) is not presented for the most critical c.g. condition, the AFM should present the effect of variation with c.g.

(20) Noise Data. The noise levels achieved during typ e certification in accordance with the applicable noise requirements should be presented, together with associated conditions and with the following note: No determination has been made by the EASA that the noise levels of this aircraft are or should be ac ceptable or unacceptable for operation at, into or out of any airport.

The noise levels achieved during type certification should be included in the AFM and consist of only one take - off, one sideline, and one approach noise level for each aeroplane model ( i.e. hardware build). The noise certification standard complied with should accompany the noise level information to indicate the compliance status. Supplementary information (labeled as such) may be added to the AFM concerning noise levels for other confi gurations or conditions.

(21) Miscellaneous Performance Data. Any performance information or data not covered in the previous items that are required for safe operation because of unusual design features or operating or handling characteristics should be furnished. For example, the maximum quick turn around weight should be provided.

Powered by EASA eRules Page 1129 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL e. Loading Instructions. CS 25.1583 requires instructions necessary to ensure loading of the aeroplane within the established limits of weight and centre - of - gravity, and to maintain the loading within such limits in flight to be presented either in the AFM or included in a separate weight a nd balance document referenced in the AFM Limitations Section. If applicable, the loading instructions must refer to flight procedures that consider the change to the aeroplane’s centre of gravity as fuel is consumed.

(1) Loading Instructions Presented in a Separate Document. If the loading instructions are presented in a separate document, the AFM Limitations Section should contain at least the following: (i) Maximum taxi weight limits.

(ii) Maximum take - off weight limits.

(iii) Maximum landing weight lim its.

(iv) Maximum zero fuel weight limits.

(v) Minimum in - flight weight.

(vi) Centre - of - gravity limits.

(vii) Information required to maintain the aeroplane within the above limits.

(2) Weight - and - Balance Data. Documentation of the weight - and - balance mater ial outlined below is normally adequate for aeroplanes with conventional loading and fuel - management techniques. For aeroplanes that require fuel to be redistributed (other than through normal consumption) to maintain loading within prescribed limits, the loading instructions should be expanded as necessary.

(i) Weight Limits. A list and identification of all weight limitations should be included.

(ii) Centre - of - Gravity Limits. The approved centre - of - gravity range, or ranges, should be presented with due ac counting for aeroplane configuration (i.e.

landing gear position, passenger loading, cargo distribution etc.) such that loading limits can be maintained.

(iii) Dimensions, Datum and MAC. The dimensions and relative location of aeroplane features associated with weighing and loading of the aeroplane and with weight - and - balance computations should be described or illustrated.

(iv) Configuration Checklist or Equipment List. The aeroplane should be defined or described sufficiently to identify the pre sence or absence of optional systems, features or installations that are not readily apparent. In addition, all other items of fixed or removable equipment included in the empty weight should be listed.

(v) Fuel and Other Liquids. All fuel and other liquid s, including passenger service liquids, that are included in the empty weight should be identified and listed, together with the information necessary to enable ready duplication of the particular condition.

(vi) Weighing Computations. Computation of the e mpty weight and the empty - weight c.g. location should be included.

(vii) Loading Schedule. The loading schedule should be included, if appropriate.

Powered by EASA eRules Page 1130 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (viii) Loading Instructions. Complete instructions relative to the loading procedure or to the use of the lo ading schedule should be included.

(ix) Compartment and floor load limits.

7 CONFIGURATION DEVIATION LIST (CDL) Operation of the aeroplane without certain secondary airframe and engines parts is allowed through the use of an approved CDL. The CDL should be included in the AFM as a separate appendix. The following guidance should be followed when preparing the CDL.

a. The parts or combinations of parts permitted to be missing, together with the associated performance penalties and other limitations should be determined and presented in the same format as the Master Minimum Equipment List (MMEL).

b. Unless it can be established that a zero or negligible performance degradation occurs as a result of a part missing from the aeroplane (see paragraph 8.b of this AMC), a performance penalty should be presented for each part or for each combination of parts.

c. Performance penalties are normally presented as weight or percent weight decrements.

Equivalent penalties expressed as other parameters are also acceptable. A single performance penalty applicable to all AFM performance limitations may be presented for a missing part or, subject to certain restrictions, performance penalties may be presented for each phase of flight as follows: (1) Only a single performance penalty for take - off and a single performance penalty for landing will be permitted. For take - off, the penalty shall be the most restrictive of the take - off field length, first, second and final segment climbs, and take - off flight path considerations. For landing, the penalty shall be the most restrictive of approach climb, landing climb, and landing distance consi derations.

(2) Only a single weight penalty for en route climb performance, applying to both the one - engine - inoperative and two - engine - inoperative cases, as applicable, will be permitted.

(3) The CDL should contain the explanations of take - off performance penalty, landing performance penalty and en route performance penalty, as appropriate for the aeroplane, when individual penalties are used.

d. General Limitations . The following information should be presented in the CDL appendix: (1) When the aeroplane is operated using the CDL, it must be operated in accordance with the limitations specified in the AFM, as amended in the CDL.

(2) The associated limitations must be listed on a placard affixed in the cockpit in clear view of the pilot in command and other appropriate crew member(s).

(3) The pilot in command should be notified of each operation with a missing part(s) by listing the missing part(s) in the flight or dispatch release.

(4) The operator should list in the aeroplane logbook an appropriate notatio n covering the missing part(s) on each flight.

(5) If an additional part is lost in flight, the aeroplane may not depart the airport at which it landed following this event, until it again complies with the limitations of the CDL. This, of course, does not preclude the issuance of a ferry permit to allow the aeroplane to be flown to a point where the necessary repairs or replacements can be made.

Powered by EASA eRules Page 1131 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (6) No more than one part for any one system may be missing, unless specific combinations are indicated in the C DL. Unless otherwise specified, parts from different systems may be missing. The performance penalties are cumulative, unless specifically designated penalties are indicated for the combination of missing parts.

(7) No more than three parts that have each been determined to cause a negligible performance degradation may be missing for take - off without applying a performance penalty. When more than three such parts are missing, a performance penalty of either 0·05 percent of the maximum ta ke - off weight or 50 kg, whichever is less, must be applied for take - off, en route, and landing for each missing part.

(8) Take - off performance penalties should be applied to the take - off weights that are limited by performance considerations (i.e. take - off field length, firs t, second, or, final segment climb, or take - off flight path). If the performance limited take - off weight is greater than the maximum certified take - off weight, the take - off performance penalties should be applied to the maximum certified take - off weight to ensure compliance with the noise requirements.

(9) Landing performance penalties should be applied to the landing weights that are limited by performance considerations (i.e. landing field length, landing climb or approach climb). If the performance limit ed landing weight is greater than the maximum certified landing weight, the landing performance penalties should be applied to the maximum certified landing weight to ensure compliance with the noise requirements.

(10) En route performance penalties apply only to operations that are limited by the one - or two - engine(s) inoperative en route climb performance.

(11) The numbering and designation of systems in the CDL appendix is based on Air Transport Association (ATA) Specification 100. The parts within each system are identified by functional description and, when necessary, by part numbers.

8 ACCOUNTABILITY OF PERFORMANCE DEGRADATION RELATIVE TO BOTH MINOR DESIGN CHANGES AND CDL ITEMS a. General . Whenever a minor change to the type design aerodynamic co nfiguration or a CDL proposal (e.g. installation of wing tip mounted emblem lights, missing flap hinge covers, etc.), has been submitted for EASA approval, the applicable performance degradation needs to be determined. In lieu of a complete flight test ana lysis to determine the performance degradation, simple criteria are prescribed below for establishing an acceptable level of airworthiness for the affected items.

b. Criteria .

(1) Estimated Drag. The aerodynamic drag of the type design change or CDL item should be evaluated. Design changes or CDL items that have no impact on, or actually improve, the aerodynamic drag of the aeroplane are considered to have no performance penalty. In cases where there are quantifiable effects on aerodynamic drag (no ma tter how small), the drag value should be estimated and then increased by a factor of 2, unless the estimate drag was determined with equivalent conservatism.

Powered by EASA eRules Page 1132 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (2) Performance Penalty. Performance penalties (usually expressed in kg or percent weight) should be determined for all appropriate performance limitations (take - off, en route and landing) based on the effects of the estimated drag. If the resulting weight penalty is less than the smaller of 0·05 percent of the maximum certified take - off weight or 50 kg, the performance degradation may be considered negligible. The AFM supplement or CDL appendix should identify those type design changes or CDL items that result in a negligible performance degradation. If the performance degradation is not considered ne gligible, the appropriate performance penalty should be provided as a limitation in the AFM supplement or in the CDL appendix.

[Amdt 25/2] [Amdt 25/21] [Amdt 25/22] [Amdt 25/2 6 ] [Amdt 25/27]

AMC 25.1581, Appendix 1 Computerised Aeroplane Flight Manual

ED D ecision 2020/024/R 1 PURPOSE This appendix presents guidelines for obtaining approval of a computerised version of an AFM that would replace or supplement parts of the conventional paper AFM. These guidelines also apply to computerised AFM appendices and supplements. The criteria provided in the main body of this AMC remain applicable except where modified by this appendix. These guidelines do not cover: a. Systems used on board the aeroplane during flight.

b. Systems that provide direct input to other a eroplane systems or equipment.

c. Supplementary software or software functions used to prepare documentation suitable for use in the operation of the aeroplane under the applicable operating rules (e.g. airport analysis software).

2 APPLICABILITY This appendix applies to aeroplanes eligible to be certificated to CS 25. The guidelines contained herein pertain to generating and presenting AFM performance information required by CS 25 by means of computer software. This appendix may be a mended to include relevant aspects for other EASA approved information that is stored and presented through computer software.

3 DEFINITIONS a. Computerised AFM . The computerised AFM software application used in conjunction with the hardware and software environment in which it is installed to generate computerised AFM information.

b. Computerised AFM Software Application . The computer programs and data, installation information and operating guide that are used in generating computerised AFM information.

c. Computerised AFM Information . The information generated by the EASA approved computerised AFM in lieu of or supplementing parts of the conventional paper AFM.

Powered by EASA eRules Page 1133 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND IN FORMATION AEROPLANE FLIGHT MANUAL d. Software Environment . The additional computer programs (e.g. operating system) that provide services to the computerised AFM software application to input, process and output the information to the user.

e. Hardware Environment . The equipment (e.g. terminal, printer, keyboar d, math co - processor, central processing unit, etc.) that enables the operation of the software environment and the computerised AFM software application to input, process and output the information to the user.

f. Commercial - Off - the - Shelf (COTS) Computer . A multi - purpose computer (e.g. a standard personal computer) that is available, or can be made available, to all potential users of the respective computerised AFM.

g. Calculation . Data generation by means of combination of table - lookup or arithmetic op erations.

h. First Principles Calculation . A Calculation using basic parameters such as lift, drag, thrust, etc. with the equations of motion.

4 GENERAL GUIDELINES The criteria herein do not affect the status of computerised AFMs that have previously bee n EASA or JAA approved. When such manuals are amended in the future, the concepts of this appendix should be applied, where practicable.

a. Official Reference (1) The conventional paper portion of the AFM should contain appropriate references about applic ability of the EASA approved computerised AFM software application.

This reference should be revised each time the EASA approved computerised AFM software application is changed (see paragraph 6.d of this appendix).

(2) The AFM should contain a statement s imilar to the following: The computerised AFM replaces or supplements portions of the paper AFM, and is an EASA approved source for that AFM information. Any modification to the EASA approved computerised AFM software application, or subsequent alteration to the generated output, will cancel the airworthiness approval of the information, unless this change was approved by the EASA. This statement applies regardless of any approval notation printed on a generated output.

b. Approved and Unapproved Informati on . Paragraph 25.1581 of the CS requires that the EASA approved information be segregated, identified and clearly distinguished from any unapproved information in the AFM. Therefore, the approval status of generated output should be clearly indicated on th e screen and printed on each printout page of any calculated results by indication of: (1) Approved program version.

(2) Approved data version, if applicable.

(3) Approval status of results with respect to requirement basis of the computation (e.g. FAR/Ce rtification Specifications (CS)).

(4) Applicable certification basis, if the program is capable of generating results for more than one certification basis (e.g. FAR/Certification Specifications (CS)).

(5) Date of output data generation.

Powered by EASA eRules Page 1134 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL c. Software Usage Aspects . The applicant should substantiate that the computerised AFM is designed to: (1) Provide a generated output containing all the information required to be in the conventional paper AFM by CS 25 for the part that is replaced or supplemented by the computerised AFM. This includes all relevant information (e.g. variables used for a specific condition) to determine operating condition and applicability of the generated output.

(2) Provide equivalent or conservative results to that obtained by direct us e of a first principles calculation using certified baseline parameters (e.g. lift, drag, thrust).

(3) Preclude calculations that would generate results identified as EASA approved by: (i) Extrapolating data beyond computational bounds agreed to by the Agency and the applicant; or (ii) Using unapproved flight test analysis or AFM expansion methods.

(4) Provide at least the standard of transparency (e.g. understanding of performance relations and limitations) that is available from a conventional paper AF M presentation.

(5) Minimise mistakes or misunderstanding by a trained user during data input and interpretation of output.

5 COMPUTERISED AEROPLANE FLIGHT MANUAL CONTENTS a. General (Reserved.)

b. Limitations Section (Reserved.)

c. Procedures Sections (Reserved.)

d. Performance Section (1) The computerised AFM may be used to generate all of the EASA approved performance information required to be in the AFM.

(2) The operating rules require operators to carry, in each transport category aeropl ane, either the AFM or an operator - prepared manual that contains all of the information required to be in the AFM. The computerised AFM is not intended for use on board the aeroplane. Thus, any portions of the AFM that are provided only in computerised (i. e. electronic) form may not be used to satisfy these operating requirements. This does not preclude printing out information calculated by the EASA approved computerised AFM and subsequently using the paper printout on board the aeroplane.

(3) Configuratio n Deviation List (CDL) and Master Minimum Equipment List (MMEL) effects on performance may be included if they are EASA approved and applications are clearly identified on the generated output.

Powered by EASA eRules Page 1135 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (4) Although the output from the computerised AFM should be us able without adjustment, applying corrective factors that are provided in the paper AFM may be acceptable in the following cases: (i) CDL or MMEL information.

(ii) Urgent temporary EASA approved revisions made mandatory for safety reasons.

(iii) Any case i n which the appropriate data are unavailable from the computerised AFM and it is clear to the user that corrective factors must be applied.

(iv) Supplements produced by STC applicants.

(5) Supplementary performance information may be included in accordance with paragraph 4.b of this appendix (e.g. for operation on runways contaminated with standing water, slush, snow or ice).

(6) The applicant may request EASA approval of supplementary computerised AFM applications (e.g. optimised runway performance). This supplementary software application will not be required by the EASA for type certification.

6 SOFTWARE INTEGRITY, DEVELOPMENT AND DOCUMENTATION REQUIREMENTS The computerised AFM consists of the AFM software application used in conjunction with the hardware and software environment in which it is installed. This paragraph provides guidelines that address the integrity, development process, and documentation requirements of the software.

a. Software Integrity (1) The potential safety effect at the aeroplane level of the computation of hazardously misleading primary information such as take - off speeds, landing approach speeds, engine thrust or power, engine limit data or other related aeroplane performance data, should be assessed. This assessment should be th e basis for determining the software architecture and the level of integrity of the AFM software application. The AFM software application should, as far as practicable, be protected from inadvertent, deliberate, or unauthorised alterations. For example, s elf - check features could be used to provide software verification and protection against deliberate or inadvertent alteration.

(2) The level of integrity established for the computerised AFM is the basis for the software development process and should be a ddressed in the plan for software aspects of certification (see paragraph 6.b of this appendix).

(3) Each part of the EASA approved AFM software application (e.g. program, data) should bear a unique notation, a unique date, or a revision number.

(4) A means to check the programs and data to avoid undetected failures should be provided (e.g. a checksum routine, tabular data to verify a check case, or provisions for a line - by - line file comparison).

Powered by EASA eRules Page 1136 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (5) Commercially available software, such as operating systems (e.g. MS - DOS), word - processors and spreadsheets, will not be approved by the EASA. However, this software can be used to run the computerised AFM software application or process (i.e. edit, format, manipulate, etc.) AFM data to produce ap proved AFM information if: (i) the applicant demonstrates that the unapproved software does not interfere with the correct functioning of the EASA approved computerised AFM software application; (ii) the applicant demonstrates that the unapproved software produces reliable results when used with the specified hardware environment and the computerised AFM software application; and (iii) the applicant specifies, in the paper AFM or a user’s guide, the title, manufacturer, and version number of such software. The version number may refer to future versions of the software (e.g. ‘Version XX and later’) if the verification check performed under paragraph 6.c(1) of this appendix is designed such that improper operation of these later software versions would be det ected.

b. Software Development . The integrity of the software components of the computerised AFM is achieved through the software development processes used.

(1) The applicant should propose the software development process in the plan for software aspect s of certification. The application should document the methods, parameters and allowable range of conditions contained in the computerised AFM.

The results obtained from the computerised AFM should be shown to meet all applicable CS - 25 requirements. This compliance may be shown using substantiation documentation, demonstrations, or other means mutually agreed to by the Agency and the applicant. The software development process described in AMC 20 - 115 ( Software Considerations for Airborne Systems and Equipm ent Certification ) is valid, in general, for developing either airborne or ground based software. It represents one acceptable approach, but not the only acceptable approach, for developing software for the computerised AFM. Some of the specific guidance p rovided in A MC 20 - 115 , however, may not apply to the computerised AFM.

(2) The applicant should submit a description of the computerised AFM and the plan for software aspects of certification to the Agency for review early in the certification process. Thi s plan proposes the schedule and means by which compliance with the requirements will be achieved and the means by which certification data and supporting records will be made available to the Agency for review.

c. Hardware and Software Environment . The co mputerised AFM software application may be EASA approved independent of the hardware and software environment in which it is installed. A common example of this would be the development of a computerised AFM software application to be run in a commercial - o ff - the - shelf (COTS) hardware and software environment. The applicant should provide for item (1) as follows, plus either item (2) or (3), as appropriate.

Powered by EASA eRules Page 1137 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (1) A mechanism, such as an installation utility function or test set, that verifies the proper func tioning of the computerised AFM software application in the target software and hardware environment. The verification check should include, but not be limited to, proper functioning with hardware specified in the AFM, including input and output devices, a nd with resident software, including terminate - to - stay - resident or other control programs such as Microsoft Windows, and with any operating system calls made by the AFM software.

(2) If the computerised AFM is intended for a COTS hardware and software envi ronment, installation information that describes the minimum requirements, including limitations and constraints, for the software and hardware environment.

(3) If the computerised AFM is intended for a specific hardware/software system, installation infor mation that describes the specific hardware and software environment in which the computerised AFM software application must be installed. Additionally, the applicant should provide a configuration management scheme that ensures the hardware and software e nvironment that will be used in service is identical to the environment specified in the EASA approved installation data.

d. Revisions to a Computerised AFM Software Application (1) Revisions to a EASA approved computerised AFM should be submitted for eva luation and EASA approval in accordance with software development methodology established in paragraph 6.b of this appendix. A log of EASA approved AFM software application parts should be furnished by the applicant. For historical purposes, the applicant should maintain records from which the information from any approved revision level of the computerised AFM can be reproduced, unless none of the affected aeroplanes remain in operational service.

(2) The applicant should submit a description of the propos ed changes and an updated plan for software aspects of certification. In addition, the applicant should: (i) re - assess the software integrity level (paragraph 6.a of this appendix) of the revised computerised AFM; (ii) demonstrate that revisions do not aff ect any of the unrevised portions of the computerised AFM; and (iii) demonstrate that the revisions are compatible with the hardware and software environment intended for the computerised AFM software application.

(3) Revisions to a computerised AFM can be made only by the TC or STC holder of that computerised AFM. The STC applicant may supplement but not revise a TC holder’s computerised AFM.

(4) When revisions are incorporated, a means (e.g. document) of indicating those parts of the software that have be en changed should be provided.

(5) Each revised software element should be identified in the same manner as the original, with the exception of the new date or revision notation (see paragraph 6.a(3) of this appendix).

Powered by EASA eRules Page 1138 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL e. Submittal and EASA Approval of Software (1) The applicant will be considered the responsible party for all matters pertaining to the computerised AFM software application, including submittal to the Agency and obtaining EASA approval.

(2) The applicant and the Agency shall discuss and agree on the data structures and calculation models.

(3) The applicant should provide any part of the hardware environment necessary for operating the computerised AFM that is not readily available to the Agency.

f. Documentation Requirements . Documentation containing the following information should be provided by the applicant to the Agency.

(1) Approval plan that describes the software aspects of certification, including time schedules, an outline of the desired applications, and design objec tives for software and data integrity.

(2) Software development plan, including the methods used to accomplish the design objectives.

(3) Software descriptions, including justifications that program structures and calculation models are appropriate to thei r intended function.

(4) Data verification document, including a description of the scope and depth of the review, analysis, and tests used to determine that the developed software and generated output accurately reflect the aeroplane performance character istics.

This description should include the purpose of each test case and the set of inputs, expected results, test environment and calculated results.

(5) Operating instructions, including all information for proper use of the computerised AFM, installati on instructions, and identification of the suitable hardware and software environment.

(6) Software configuration reference, including a log of the approved software elements and a statement that design objectives of the approval plan and compliance with t he guidelines of this appendix have been demonstrated.

7 PROVISIONS FOR EASA POST CERTIFICATION ACCESS TO COMPUTERISED AFM In the plan for software aspects of certification, the applicant should propose which components of the computerised AFM will be subm itted to the EASA. In cases where the AFM software application can be installed on EASA equipment, the applicant need only provide the computerised AFM software application, which includes the installation data and operating guide. However, if the computer ised AFM software application requires a hardware and software environment that is not available to the EASA, the applicant should also provide the EASA with the necessary components to acces s the AFM software application.

[Amdt 25/2] [Amdt 25/12] [Amdt 25 /26] Powered by EASA eRules Page 1139 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL

AMC 25.1581, Appendix 2 Aeroplane Flight Manual Specification

ED Decision 2003/ 2/RM 1 PURPOSE This appendix to the AMC 25.1581 is a guideline for preparation of the AFM specification required early in the certification process to allow judgement about acceptability of various peculiarities of the proposed flight manual.

2 APPLICABILITY This acceptable means of compliance applies to aircraft eligible to be certificated to CS 25.

3 DEFINITIONS Reserved.

4 GENERAL GUIDELINES Following information should be presented in form of a document: a. Constructors Name.

b. Contact person: Name, Address, Telephone, Telefax.

c. Aircraft Description, including kinds of operation for which certification is intended.

d. Basic Approval Authority.

e. Certification Basis (e.g. FAR 25 amendment or CS 25 change no.).

f. Flight man ual compliance proposal (e.g. FAA AC or EASA AMC etc.).

g. Type of AFM (i.e. multi - regulation).

h. Intended document number.

i. Means of identification for draft pages and revisions thereto.

k. Size of final AFM pages.

l. Example pages: Title sheet a nd approval provision Preface List of Effective Pages Page layout, including identification and approval status m. Units of measure proposed.

n. Amendment system (e.g. temporary revision identification and normal revision identification).

o. Breakdown of the manual (e.g. topics, sequence, dividers).

p. Performance charts layout.

q. Digital performance data proposal, if applicable.

r. References to other information required by the certification basis but not contained in the basic AFM.

The document presented may include more than the proposed amount of in formation, if deemed necessary.

Powered by EASA eRules Page 1140 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLA NE FLIGHT MANUAL

CS 25.1583 Operating limitations

ED Decision 2018/010/R (See AMC 25.1583) (a) Airspeed limitations. The following airspeed limitations and any other airspeed limitations necessary for safe operation must be furnished.

(1) The maximum operating limit speed V /M and a statement that this speed limit may MO MO not b e deliberately exceeded in any regime of flight (climb, cruise, or descent) unless a higher speed is authorised for flight test or pilot training.

(2) If an airspeed limitation is based upon compressibility effects, a statement to this effect and informati on as to any symptoms, the probable behaviour of the aeroplane, and the recommended recovery procedures.

(3) The manoeuvring speed established under CS 25.1507 and statements, as applicable to the particular design , explaining that: (i) full application of pitch, roll, or yaw controls should be confined to speed s below the manoeuvring speed; and (ii) rapid and large alternating control inputs, especially in combination with large changes in pitch, roll, or yaw, and full control inputs in more than one axis at the same time, should be avoided as they may result in structural failures at any speed, including below the manoeuvring speed.

(4) The flap extended speeds V and the pertinent wing - flap positions and engi ne powers.

FE (5) The landing gear operating speed or speeds, and a statement explaining the speeds as defined in CS 25.1515(a) .

(6) The landing gear extended speed V , if greater than V , and a statement that this is the LE LO maximum speed at which the aeroplane can be safely flown with the landing gear extended.

(b) Powerplant limitations . The following information must be furnished: (1) Limitations required by CS 25.1521 .

(2) Explanation of the limitations, when appropriate.

(3) Information necessary for marking the instruments required by CS 25.1549 to 25.1553 .

(c) Weight and loading distribution. The weight and centre of gravity limitations established under CS 25.1519 must be furnished in the aeroplane Flight Manual. All of the following information, including the weight distribution limitati ons established under CS 25.1519 , must be presented either in the aeroplane Flight Manual or in a separate weight and balance control and loading document that is incorporated by reference in the aeroplane Flight M anual; (1) The condition of the aeroplane and the items included in the empty weight as defined in accordance with CS 25.29 .

(2) Loading instructions necessary to ensure loading of the aeroplane within the weight and centre of gravity limits, and to maintain the loading within these limits in flight.

(3) If certification for more than one centre of gravity range is requested, the appropriate limitations, with regard to weight and loading procedures, for each separa te centre of gravity range.

Powered by EASA eRules Page 1141 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (d) Flight crew. The number and functions of the minimum flight crew determined under CS 25.1523 must be furnished.

(e) Kinds of operation. The kinds of operation approved under CS 25.1525 must be furnished.

(f) Ambient air temperatures and operating altitudes. The extremes of the ambient air temperatures and operating altitudes established under CS 25.1 527 must be furnished.

(g) Reserved.

(h) Additional operating limitations. The operating limitations established under CS 25.1533 must be furnished.

(i) Manoeuvring flight load factors. The positive manoeuvring l imit load factors for which the structure is proven, described in terms of accelerations, must be furnished. (See AMC 25.1583(i) ) (j) reserved (k) A limitation on the maximum depth of runway contaminants for take - off operation must be furnished. (See AMC 25.1583(k) .)

[Amdt No: 25/1] [Amdt No: 25/18] [Amdt No: 25/22]

AMC 25.1583(i) Manoeuvring Flight Load Factors

ED Decision 2003/2/RM The flight manoeuvring limit load factors for which the structure is approved, expressed in terms of normal acceleration, or g, should be included. If more restrictive flight load factors are established for particular operat ions outside the normal operating envelope (e.g. landing flap position with maximum take - off weight) such factors should be presented and defined.

AMC 25.1583(k) Maximum Depth of Runway Contaminants for

Take - off Operations

ED Decision 2006 / 005/R Complian ce with CS 25.1583(k) may be shown using either Method 1 or Method 2 – a. Method 1 . If information on the effect of runway contaminants on the expected take - off performance of the aeroplane is furnished in accor da nce with the provisions of CS 25.1591 , take - off operation should be limited to the contamination depths for which take - off information is provided.

b. Method 2 . If information on the effect of runway contaminants on the expected take - off performance of the aeroplane in accordance with the provisions of CS 25.1591 is not provided, take - off operation should be limited to runways where the degree of contamination does not exceed the equivalent of 3 mm (0·125 inch) of water, except in isolated areas not exceeding a total of 25% of the area within the required length and width being used.

Powered by EASA eRules Page 1142 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LI MITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL NOTE 1 In establishing the maximum depth of runway contaminants it may be necessary to take account of the maximum depth for which the engine air intakes have been shown to be free of ingesting hazardous quantities of water or other contaminants in accordance with CS 25.1091(d)(2) .

NOTE 2: Unless p erformance effects are based on tests in water depths exceeding 15 mm, or on other evidence equivalent in accuracy to the results of direct testing, it will not normally be acceptable to approve take - off operation in depths of contaminants exceeding the eq uivalent of 15 mm of water.

[Amdt 25/2]

CS 25.1585 Operating procedures

ED Decision 2003/ 2/RM (a) Operating procedures must be furnished for – (1) Normal procedures peculiar to the particular type or model encountered in connection with routine operation s; (2) Non - normal procedures for malfunction cases and failure conditions involving the use of special systems or the alternative use of regular systems; and (3) Emergency procedures for foreseeable but unusual situations in which immediate and precise ac tion by the crew may be expected to substantially reduce the risk of catastrophe.

(b) Information or procedures not directly related to airworthiness or not under the control of the crew, must not be included, nor must any procedure that is accepted as bas ic airmanship.

(c) Information identifying each operating condition in which the fuel system independence prescribed in CS 25.953 is necessary for safety must be furnished, together with instructions for placing th e fuel system in a configuration used to show compliance with that section.

(d) The buffet onset envelopes determined under CS 25.251 must be furnished. The buffet onset envelopes presented may reflect the centre of gravity at which the aeroplane is normally loaded during cruise if corrections for the effect of different centre of gravity locations are furnished.

(e) Information must be furnished that indicates that when the fuel quantity indicator reads ‘zero’ in level flight, any fuel remaining in the fuel tank cannot be used safely in flight.

(f) Information on the total quantity of usable fuel for each fuel tank must be furnished.

CS 25.1587 Performance information

ED Decision 2018 / 005/R (a) Each aeroplane Flight Manual must contain information to permit conversion of the indicated temperature to free air temperature if other than a free air temperature indicator is used to comply wi th the requirements of CS 25.1303(a)(1) .

(b) Each aeroplane Flight Manual must contain the performance information computed under the a pplicable provisions of this CS - 25 (including CS 25.115 , 25.123 and 25.125 for the weights, altitudes, temperatures, wind components, and runway gradients, as applicable) within the operational limits of the a eroplane, and must contain the following: (1) In each case, the conditions of power, configuration, and speeds, and the procedures for handling the aeroplane and any system having a significant effect on the performance information.

(2) V determined in a ccordance with CS 25.103 .

SR Powered by EASA eRules Page 1143 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (3) The following performance information (determined by extrapolation and computed for the range of weights between the maximum landing weight and the maximum takeoff weight): (i) Climb i n the landing configuration.

(ii) Climb in the approach configuration.

(iii) Landing distance.

(4) Procedures established under CS 25.101(f) and (g) that are related to the limitations and information required by CS 25.1533 and by this paragraph in the form of guidance material including any relevant limitation or information.

(5) An explanation of significant or unusual flight or ground handling characteristics of the aeroplane.

(6) Corrections to indicated values of airspeed, altitude and outside air temperature.

(7) An explanation of operational landing runway length factors included in the presentation of t he landing distance, if appropriate.

c) Each aeroplane flight manual (AFM) must contain the performance information associated with abnormal landing configurations (see AMC 25.1587(c) ).

[Amdt 25/21]

AMC 25.1587(c) Landing distances in abnormal configurations

ED Decision 2018/005/R 1. Purpose This AMC provides guidance and recommendations on how to determine and present in the aeroplane flight manual (AFM) landing distance information appropriate to abnormal config urations or following the loss of normal services, and guidelines on which failure cases should be considered.

2. Related certification specifications CS 25.125 Landing CS 25.1585 Operating procedures CS 25.1587 Performance information 3. Background When a failure occurs in flight, the flight crew has to analyse the consequences of this fai lure on the landing. Some failures cause an increase in the landing distance, which must be evaluated. A diversion may be necessary if the destination aerodrome runway is no longer appropriate due to the increased landing distance.

For the production of AF M data, the applicant considers all failures and assesses their probability of occurrence. In addition, the question of the best presentation of the relevant data should be addressed.

This AMC does not consider configuration deviation list (CDL) items or any unserviceabilities identified in the master minimum equipment list (MMEL) that are known prior to dispatch.

Powered by EASA eRules Page 1144 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL 4. Performance information The applicant should determine information on the landing distance that is likely to be needed for landings in abn ormal configurations, and following the loss of normal services. This information should consist of the horizontal distance from the point at which the main gear of the aeroplane is 50 ft above the landing surface to the point where the aeroplane comes to a complete stop for standard temperatures at each weight, altitude and wind within the operational limits established by the applicant for landing on a dry runway. This information should be established in accordance with CS 25.125(b)(4) and ( 5), CS 25.125 (c)(1) and (2), CS 25.125(f) and with the following conditions: (a) The aeroplane is in the landing configuration appropriate to the failure case being considered; (b) A steady approach is maintained down to the 50 - ft height, at not less than the recommend ed approach speed, and using the recommended approach procedure, appropriate to the failure case being considered. (See paragraph 5 below); (c) Changes to configuration, power or thrust, and speed are made in accordance with the recommended procedure appro priate to the failure case being considered; and (d) All deceleration devices with which the aeroplane is fitted, including reverse thrust, may be used during the on - ground part of the landing, to an extent dependent both on the characteristics of the aero plane and on the recommended use of deceleration devices, provided that: (1) a practical procedure for their use has been established; (2) the controllability of the aeroplane during their use has been shown to be satisfactory (see paragraph 8 below); and (3) they would be available, and their use is recommended, for the failure case being considered.

5. Operating procedures It is intended that in deriving the landing distance of paragraph 4 above, which is required by CS 25.1585(a) to be included in the AFM, the applicant should use procedures that are generally based on the application of conventional stall and controllability margins. However, it is acknowledged that for failure cases, this is not always practica l. Where the procedure uses less than the normal margin, this should be based on flight evaluation and stated in the AFM, along with advice on how this might affect the way the approach is conducted (e.g. reduced pitch manoeuvre capability and the ability to counteract wind shear). Nevertheless, for some configurations that cannot be easily flight - tested, a combination of simulation and analysis may be acceptable.

6. Effect of failures on landing distance The applicant should determine information on landi ng distances in abnormal configurations in accordance with the procedures appropriate to the abnormal configuration for single failures and combinations of failures provided in the AFM that: - 7 (a) have a probability of occurrence greater than approximately 1 0 ; and (b) result in more than a 10 % increase in landing distance.

If a procedure is included in the AFM for a failure case that: - 7 (a) has a probability of occurrence less than 10 ; and Powered by EASA eRules Page 1145 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION AEROPLANE FLIGHT MANUAL (b) results in an increase in the landing distance of more than 10 %, then information about the increase in landing distance should also be included in the AFM.

7. Effect of overspeed and wet runway The applicant should provide information on the separate effects of a 10 - kt overspeed and of a wet runway.

Note: overspeed in the above context refers to speed in excess of the approach speed recommended for the abnormal condition, which itself may be gre ater than the normal approach speed.

8. Deceleration devices The applicant may include the use of deceleration devices during the on - ground part of the landing to the extent that directional control can be readily maintained during their use on a wet runw ay, with a crosswind component of not less than 10 kt from the adverse side.

9. Data derivation and AFM presentation The applicant may derive the performance information described in paragraph 4 from calculations that are conservatively based on the best available information, on simulation or flight test, or any combination of these. The recommended operating procedures discussed in paragraph 5 should be presented in a simple manner (e.g. as increments in the landing distance, or approach speeds). The eff ects of overspeed and a wet runway may be presented as generalised information that covers a variety of abnormal configurations.

[Amdt 25/21] Powered by EASA eRules Page 1146 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION

SUPPLEMENTARY INFORMATION

CS 25.1591 Take - off performance information for operations on

slippery wet and contaminated runways

ED Decision 2021/015/R (See AMC 25.1591 ) (a) Supplementary take - off performance information applicable to aeroplanes operated on slippery wet runways and on runways contaminated with sta nding water, slush, snow , or ice may be furnished at the discretion of the applicant. If supplied, this information must include the expected performance of the aeroplane during take - off on hard - surfaced runways covered by these contaminants. If informatio n on any one or more of the above surface conditions is not supplied, the AFM must contain a statement prohibiting take - off on surfaces that do not meet the minimum friction criteria, or contaminated surface(s) for which information is not supplied. Additi onal information covering operation on contaminated surfaces other than the above may be provided at the discretion of the applicant.

(b) Performance information furnished by the applicant must be contained in the AFM. The information may be used to assist operators in producing operational data and instructions for use by their flight crews when operating with contaminated runway surface conditions. The information may be established by calculation or by testing.

(c) The AFM must clearly indicate the conditions and the extent of applicability for each contaminant used in establishing the contaminated runway performance information. It must also state that actual conditions that are different from those used for establishing the contaminated runway per formance information may lead to different performance.

[Amdt 25/2] [Amdt 25/2 7 ]

AMC 25.1591 The derivation and methodology of performance

information for use when taking - off from slippery wet and

contaminated runways

ED Decision 2021/015/R 1.0 Purpose This AMC provides information, guidelines, recommendations , and acceptable means of compliance for use by applicants in the production of performance information for aeroplanes when taking off from runways that are slippery wet or contaminated by standing water, slush, snow, and ice.

2.0 Technical Limitations of Data The methodology specified in this AMC provides one acceptable means of compliance wit h the provisions of CS 25.1591 . In general it does not require aeroplane testing on contaminated runway surfaces, although such testing if carried out at the discretion of the applicant may significantly improve the quality of the result or reduce the quantity of analytical work require d.

Due to the nature of naturally occurring runway contaminants and difficulties associated with measuring aeroplane performance on such surfaces, any data that is either calculated or Powered by EASA eRules Page 1147 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INF ORMATION measured is subject to limita tions with regard to validity. Consequentl y the extent of applicability should be clearly stated.

The properties specified in this AMC for various contaminants are derived from a review of the available test and research data and are considered to be ac ceptable for use by applicants. This is not a n implied prohibition of data for other conditions or that other conditions do not exist.

EASA acknowledges that the observing of and reporting on the type and depth of runway surface contaminants (water, slush, dry snow, wet snow) is limited. This informa tion may not be accurately and timely relayed to the flight crew. Furthermore, shallow depths of contaminants do not generally reduce wheel braking friction below that of a wet runway, except in unfavourable circumstances where lower than expected runway c ondition codes (RWYCCs) are reported (see AMC 25.1592 ). In line with International Civil Aviation Organization (ICAO) and Federal Aviation Administration (FAA) standards, EASA considers a depth of more than 3 mm fo r loose contaminant accountability in take - off performance assessments a reasonable lower threshold. If the depth of such loose contaminant is lower than 3 mm, or if there is a thin layer of frost, the runway is considered wet, for which this AMC 25.1591 does not apply.

It is intended that the use of aeroplane performance data for contaminated runway conditions produced in accordance with CS 25.1591 should include recommenda tions associated with t he operational use of the data. Where possible, this operational guidance should be provided by the applicant or its production co - ordinated with the applicant to ensure that its use remains valid.

Operators are expected to make care ful and conservative judgments in selecting the appropriate performance data to use for opera tions on contaminated runways. Particular attention should be paid to the presence of any contaminant in the critical high speed portion of the runway. For takeoff , it may be appropriate to use different contaminant types or depths for the takeoff an d the accelerate - stop portions. For example, it may be appropriate to use a greater contaminant depth or a contaminant type that has a more detrimental effect on acceler ation for the takeoff portion than for the accelerate - stop portion of the takeoff analysis.

In considering the maximum depth of runway contaminants it may be necessary to take account of the maximum depth for which the engine air intakes have been shown to be free of ingesting hazardous quantities of water in accordance with CS 25.1091(d)(2) .

3.0 Standard Assumptions Due to the wide variation in possible conditions when operating on contaminated runways and the limi tations inherent in representing the effects of these conditions analytically, it is not possible to produce performance data that will precisely correlate with each specific operation on a con taminated surface. Instead, the performance data should be dete rmined for a standardised set of conditions that will generally and conservatively represent the variety of contaminated runway conditions occurring in service.

It should be assumed that: — the contaminant is spread over the entire runway surface to an even depth (although rutting, for example, may have taken place).

— the contaminant is of a uniform specific gravity.

— where the contaminant has been sanded, graded (mechanically levelled) or otherwise treated before use, that it has been done in accordance with a greed national procedures.

Powered by EASA eRules Page 1148 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 4.0 Definitions The following definitions are a subset of the runway surface condition descriptors for which a representative take - off performance model may be derived using the methods contained in this AMC.

4.1 Frost Ice crystals formed from airborne moisture on a surface whose temperature is below freezing. Frost differs from ice in that frost crystals grow independently and, therefore, have a more granular texture.

Note 1: ‘below freezing’ refers to air temperature equal to or lower than the freezing point of water (0 C/32°F).

Note 2: under certain conditions, frost can render the runway surface very slippery, which should then be appropriately reported as ‘reduced braking action’.

4.1.a Standing w ater Wat er of a depth greater than 3mm.

Note: a surface condition where there is a layer of water of 3 mm or less is considered wet, for which this AMC 25.1591 is not applicable.

4.2 Slush Snow that is so water - saturated that wate r will drain from it when a handful is picked up or will splatter if stepped on forcefully.

4.3 Wet s now Snow that contains enough water to be able to make a well - compacted, solid snowball, without squeezing out water.

4.4 Dry s now Snow from which a snowba ll cannot readily be made.

4.5 Compacted s now Snow that has been compacted into a solid mass such that aeroplane tyres, at operating pressures and loadings, will run on the runway surface without significant further compaction or rutting of the runway surf ace.

4.6 Ice Water that has frozen or compacted snow that has transitioned into ice, in cold and dry conditions.

Note: this definition excludes wet ice that has a film of water on top of it or contains melting ice, which provides minimal braking friction and uncertain lateral control .

4.7 Slippery wet runway A wet runway where the surface friction characteristics on a significant portion of the runway have been determined to be degraded.

Powered by EASA eRules Page 1149 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMI TATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 4.8 Specially p repared w inter r unway A runway, with a dry frozen surface of compacted snow and/or ice which has been treated with sand or grit or has been mechanically or chemically treated to improve runway friction. The runway friction is monitored and reported on a regular basis in accordance with national pro cedures.

4. 9 Specific g ravity The density of the contaminant divided by the density of the water.

5.0 Contaminant Properties to be Considered 5.1 Range of Contaminants The following general range of condit ions or properties may by used. The list given in Table 1 is not necessarily comprehensive and other contaminants may be considered, provided account is taken of their specific properties.

Data should assume the contaminant to be uniform in properties and uniformly spread over the compl ete runway.

Contaminants can be classified as being: - (i) Drag producing, for example by contaminant displacement or impingement, (ii) Braking friction reducing, or (iii) A combination of (i) and (ii).

Data to be produced should use the classification and assumptions of Table 1 and then the appropriate sections of the AMC as indicated.

Range of Depths Specific Gravity Is Braking Friction Analysis Contaminant Is Drag to be Considered Assumed for Reduced b elow Dry Paragraphs Type Increased?

— mm Calculation Runway Value? Relevant More than 3 up Standing water, to 15 1.0 Yes Yes 7.1, 7.3, 7.4 Flooded runway (see Note 1) More than 3 up Slush to 15 0.85 Yes Yes 7.1, 7.3, 7.4 (see Note 1) More than 3 up Wet s now to 5 No Yes 7.3, 7.4 (see Note 2) (see Note 1) Wet s now More than 5 0.5 Yes Yes 7.1, 7.3, 7.4 (see Note 3) up to 30 More than 3 Dry s now up to 10 No Yes 7.3, 7.4 (see Note 2) (see Note 1) More than 10 Dry Snow 0.2 Yes Yes 7.2, 7.3, 7.4 up to 130 Compacted s now at or below outside air 0 No Yes 7.3, 7.4 temperature ( see Note 4) (OAT) of - 15 °C/5 °F Powered by EASA eRules Page 1150 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION Compacted snow 0 No Yes 7.3, 7.4 above OAT of (see Note 4) - 15 °C/5 °F Dry snow over More than 10 0.2 Yes Yes 7.2, 7.3, 7.4 compacted snow up to 130 Wet snow over More than 5 up compacted snow 0.5 Yes Yes 7.1, 7.3, 7.4 to 30 (see Note 3) Ice (cold & dry) No Yes 7.3, 7.4 (see Note 4) Slippery wet No Yes 7.3, 7.4 (see Note 4) Specially p repared w inter r unway No Yes 7.3 .4 , 7.4 (see Note 4) (see Note 5) Table 1 Note 1: Runways with water depths or slush depths or snow depths of 3 mm or less are considered wet, for which this AMC 25.1591 is not applicable.

Note 2: Contaminant drag may be ignored.

Note 3: For conservatism , the same landing gear displacement and impingement drag methodology is used for wet snow as for slush.

Note 4: Where depths are given as zero , it is assumed that the aeroplane is rolling on the surface of the contaminant.

Note 5: No de fault model is provided for specially prepared winter runways in this AMC.

Such runway surfaces are specific, and their treatment may be of variable effectiveness.

The competent authority of the State of operator should approve the related procedures and m ethods .

5.2 Other Contaminants Table 1 lists the contaminants commonly found. It can be seen that the complete range of conditions or specific gravities has not been covered. Applicants may wish to consider other, less likely, contaminants in which case such contaminants should be defined in a manner suitable for using the resulting performance data in aeroplane operations.

6.0 Derivation of Performance Information 6.1 General Conditions Take - off performance information for contaminated runways shoul d be determined in accordance with the assumptions given in paragraph 7.0.

Where performance information for different contaminants are similar, the most critical may be used to represent all conditions.

This AMC does not set out to provide a complete tech nical analytical process but rather to indicate the elem ents that should be addressed. Where doubt exists with regard to the accuracy of the methodology or the penalties derived, consideration should be given to validation by the use of actual aeroplane te sts or other direct experimental measurements.

Powered by EASA eRules Page 1151 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 6.2 Take - off on a Contaminated Runway 6.2.1 Except as modified by the effects of contaminant as derived below, performance assumptions remain unchanged from those used for a wet runway, in accordance with th e agreed certification standard. These include accelerate - stop distance definition, time delays, take - off distance definition, engine failure accountability and stopping means other than by wheel brakes (but see paragraph 7.4.3).

6.2.2 Where airworthiness or operational standards permit operations on contaminated runways without engine failure accountability, or using a V and a V instead of STOP GO a single V , these performance assumptions may be retained. In this case, a simple method to derive a single V and associated data consistent with the performance assumptions of paragraph 6.2.1 must also be provided in the AFM.

NOTE: V is the highest decision speed from which the aeroplane can stop within STOP the accelerate - stop distance available. V is the lowes t decision speed from which GO a continued take - off is possible within the take - off distance available.

7.0 Effects of Contaminant 7.1 Contaminant Drag — Standing Water, Slush, Wet Snow General advice and acceptable calculation methods are given for estimating the drag force due to fluid contaminants on runways: Total drag Drag due to Drag due to airframe due to fluid = fluid displacement + impingement of fluid contaminant by tyres spray from tyres The essence of these simple calculation methods is the provision of appropriate values of drag coefficients below, at, and above tyre aquaplaning speed, V (see paragraph 7.1.1): P — Paragraphs 7.1.2.a and 7.1.2.b give tyre displacement drag coefficient values for speeds below V .

P — Paragraph 7.1.3.b .2 gives tyre equivalent displacement drag coefficient values to represent the skin friction component of impingement drag for speeds below V .

P — Paragraph 7.1.4 gives the variation with speed, at and above V , of drag coefficients P representing both fluid di splacement and impingement.

The applicant may account for the contaminant drag for computing the deceleration segment of the accelerate - stop distance. However, if the actual contaminant depth is less than the reported value, then, using the reported value to determine the contaminant drag will result in a higher drag level than the actual one. This will lead to a conservative take - off distance and take - off run, but also to a potentially optimistic accelerate - stop distance. It is assumed that these effects will offset each other; however, the applicant may consider: — either using 100 % of the reported contaminant depth when determining the acceleration portion, and 50 % when considering the deceleration portion; or — using 50 % of the reported con taminant depth when determining both the acceleration portion and the stop portion of the accelerate - stop distance; this should result in a conservative computation without being unduly penalising; the applicant should ensure that using drag for 50 % of th e reported contaminant Powered by EASA eRules Page 1152 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION depth for computing the accelerate - stop distance is conservative for the applicant’s aeroplane configuration.

7.1.1 Aquaplaning Speed An aeroplane will aquaplane at high speed on a surface that is contaminated by standing water, slush or wet snow. For the purposes of estimating the effect of aquaplaning on contaminant drag, the aquaplaning speed, V , is given by - P V = 9 P P where V is the ground speed in knots and P is the tyre pressure in lb/in .

P To estimate the effect of aquaplaning on wheel - to - ground friction, the aquaplaning speed (V ) that is provided above should be factored by a coefficient of 0.85.

P Predictions (Reference 5) indicate that the effect of running a wheel over a low - density liquid contaminant containing air, e.g. slush, is to compress it such that it essentially acts as high - density contaminant. This means that there is essentially no increase in aqu aplaning speed to be expected with suc h a lower density contaminant. For this reason, the aquaplaning speed given here is not a function of the density of the contaminant.

(See References 1, 5 and 10) 7.1.2 Displacement Drag This is drag due to the wheel(s) running through the contaminant and doing work by displacing the contaminant sideways and forwards.

a. Single wheel.

The drag on the tyre is given by - D = C ½  V S D Where  is the density of the contamination, S is the frontal area of the tyre in t he contaminant and V is the groundspeed, in consistent units.

S = b x d where d is the depth of contamination and b is the effective tyre width at the contaminant surface and may be found from – 1 2 ⁄ 𝛿 + 𝑑 𝛿 + 𝑑 𝑏 = 2 𝑊 [ ( ) − ( ) ] 𝑊 𝑊 Where W is the maximum width of th e tyre and  is the tyre deflection, which may be obtained from tyre manufacturers’ load - deflection curves.

The value of C may be taken as 0.75 for an isolated tyre below the D aquaplaning speed, V .

P (See Reference 3) b. Multiple wheels A typical dual wheel undercarriage shows a drag 2.0 times the single wheel drag, including interference. For a typical four - wheel bogie layout the drag is 4 times the single wheel drag (again including interference). For a six - wheel bogie layout a reasonab le conservative estimate suggests a figure of 4.2 times the single wheel drag. The drag of spray striking the landing gear Powered by EASA eRules Page 1153 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION structure above wheel height may also be important and should be included in the analysis for paragraph 7.1.3.b.1 but for multiple wh eel bogies the factors above include centre spray impingement drag on gear structure below wheel height.

(See Reference 3) 7.1.3 Spray Impingement Drag a. Determination of spray geometry The sprays produced by aeroplane tyres running in a liquid contamina nt such as slush or water are complex and depend on aeroplane speed, the shape and dimensions of the loaded tyre and the contaminant depth. The spray envelope should be defined, that is the height, width, shape and location of the sideways spray plumes and , in the case of a dual wheel undercarriage, the centre spray plumes. Additionally, a forward bow - wave spray will be present which may be significant in drag terms should it impinge on the aeroplane.

In order to assess the drag it is necessary to know the angles of the spray plumes so that they can be compared with the geometry of the aeroplane.

The angle at which the plumes rise is generally between 10° and 20° but it varies considerably with speed and depth of precipitation and to a small extent with tyr e geometry. A method for estimating the plume angles in the horizontal and vertical directions is given in References 1 and 7 and may be used in the absence of experimental evidence. This information may be used to indicate those parts of the airframe wh ich will be struck by spray, in particular whether the nose - wheel plume will strike the main landing gear or open wheel - wells , the wing leading edges or the engine nacelles, and whether the main - wheel plumes will strike the rear fuselage or flaps.

b. Deter mination of the retarding forces Following definition of the spray envelopes, the areas of contact between the spray and the airframe can be defined and hence the spray impingement drag determined. This will be in two parts, direct interaction of the spra y with the aeroplane structure and skin friction.

For smaller jet aeroplanes, typically those where the wing - to - ground height is less than 2 metres (6 feet), the methods contained in this document may not be conservative. Drag estimates should be correlate d with performance measurements taken, for example, during water trough tests for engine ingestion .

b.1. Drag caused by direct impact of the spray For aeroplane designs where surface areas are exposed to direct spray impact, the resulting drag forces shoul d be taken into account. These forces exist where a significant part of the spray flow is directed at part of the aeroplane structure at a normal or non - oblique angle. The drag, or momentum loss of the mass of fluid, so caused should be accounted for.

(See Reference 6) Powered by EASA eRules Page 1154 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPL EMENTARY INFORMATION b.2. Drag caused by skin friction Reference 2 explains that the relative velocity between spray from the landing gear and wetted aeroplane components causes drag due to skin friction and provides a method for its calculation. Where more tha n one spray acts on the same wing or fuselage surface the skin friction forces are not cumulative and the single, higher calculated value should be used.

An alternative, simple, conservative empirical estimate of skin friction drag, which converts the skin friction drag into an equivalent displacement drag coefficient based on nose - wheel alone drag measurements, is given by C spray = 8 x L x 0.0025 D where C spray is to be applied to the total nose - wheel displacement D area (b x d x number of wheels) and L is the wetted fuselage length in feet behind the point at which the top of the spray plume reaches the height of the bottom of the fuselage. This relation can also be used in the case of a main - wheel spray striking the rear fuselage. In the case of any one main wheel unit only the inner plume from the innermost leading wheel is involved so the relevant displacement area is half that of one main wheel.

7.1.4 Effect of Speed on Displacement and Impingement Drag Coefficients at and above Aquaplaning Speed (V ) P The drag above V reduces to zero at lift off and one acceptable method is to P reduce C as shown in the curve in Figure 1. This relationship applies to bo th D displacement and spray impingement drag coefficients.

Figure 1 Powered by EASA eRules Page 1155 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 7.2 Contaminant Drag - Dry Snow A basic method for calculating the drag of aeroplane tyres rolli ng in dry snow is given herein. The method is based on the theoretical model presented in References 8 and 9, using a specific gravity of 0.2 as provided in Table 1. Only snow of specific gravity of 0.2 is selected because it represents naturally occurring snow and results in the highes t drag variation with ground speed for the range of snow specific gravities that are likely to be encountered. For other snow specific gravities, the more detailed methods of Reference 8 should be used.

7.2.1 Single Tyre Drag The total displacement drag of a tyre rolling in dry snow is presented by the following equation: D = D + D C D The term D represents the drag due to the compression of the snow by t he tyre.

C The term D represents the drag due to the displacement of the snow particles in D a vertical dire ction.

The drag due to snow compression for a single tyre for snow with a specific gravity of 0.2 is given by: Tyre pressure > 100 psi D = 74000 bd (Newtons) C Tyre pressure 50  p  100 psi D = 56000 bd (Newtons) C In which: d = snow depth in metres b = is the tyre width at the surface in metres (see paragraph 7.1.2) The drag due to the displacement of the snow particles in a vertical direction for a single tyre for snow with a specific gravity of 0.2 is given by: Tyre pressure > 100 psi 56 9 2 2 𝐷 = ( + ) 𝑏𝑑 𝑉 (Newtons) 𝐷 𝑔 𝑅 𝑑 Tyre pressure 50  p  100 psi 56 8 2 2 𝐷 = ( + ) 𝑏𝑑 𝑉 (Newtons) 𝐷 𝑔 𝑅 𝑑 In which: d = snow depth in metres b = is the tyre width at the surface in metres (see paragraph 7.1.2) V = the ground speed in m/s g R = tyre radius in metres For other snow densities D and D can be calculated using the method presented C D in Reference 8.

Powered by EASA eRules Page 1156 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OP ERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 7.2.2 Multiple Wheels The drag on dual tyre landing gears (found on both nose and main gears) is simply the drag of bot h single tyres added together. The interference e ffects between both tyres, found on dual tyre configurations running through slush or water, are not likely to be present when rollin g over a snow covered surface. The drag originates from the vertical compaction of the snow layer. Although there is some d eformation perpendicular to the tyre direction of motion, this deformation occurs mainly at or below the bottom of the rut and therefore does not affect the deformation in front of the adjacent tyre. Hence, interference effects can be ignored.

In the case of a bogie landing gear only the leading tyres have to be considered for the drag calculatio n, as explained in Reference 8. After the initial compression of the snow by the leading tyres, the snow in the rut becomes stronger and a higher pressure must be a pplie d to compress the snow further. Therefore, the drag on the trailing tyres can be neglected and the drag on a bogie landing gear is assumed to be equal to that of a dual tyre configuration. All other multiple - tyre configurations can be treated in the s ame manner.

7.2.3 Spray Impingement Drag Experiments have shown that the snow spray coming from the tyres is limited with only small amounts striking the airframe. The speed and the density of the snow spray are much lower than, for instance, that of water spray. Therefore, the drag due to snow impingement on the airframe can be neglected.

7.2.4 Total Landing Gear Drag To obtain the total drag on the tyres due to snow, D and D for each single tyre C D (excluding the trailing tyres of a bogie gear) should be c alculated and summed.

7.3 Braking Friction (All Contaminants) On most contaminant surfaces the braking action of t he aeroplane will be impaired.

Performance data showing these effects can be based on either the minimum conservative ‘default’ values, given in Table 2 or test evidence and assume d values (see paragraph 7.3.2). In addition the applicant may optionally provide performance data as a function of aeroplane braking coefficient or wheel braking coefficient.

7.3.1 Default Values To enable aeroplane pe rformance to be calculated conservatively in the absence of any direct test evidence, default wheel - braking coefficient values as d efined in Table 2 may be used. These values represent the maximum effective wheel - braking coefficient of a fully modulating anti - skid controlled braked wheel/tyre. For quasi modulating systems, the applicant should multiply the listed wheel - braking coefficient by 0.625, and for on - off systems, multiply the listed wheel - braking coefficie nt by 0.375. For the classification of anti - skid systems, the applicant should refer to AMC 25.109(c)(2) . Aeroplanes without anti - skid systems should be addressed separately on a case - by - case basis.

Powered by EASA eRules Page 1157 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION D efault Wheel - Braking Coefficient Contaminant  3 2 Standing w ater 𝑉 𝑉 𝑉 = − 0 . 0632 ( ) + 0 . 2683 ( ) − 0 . 4321 ( ) + 0 . 3485 and s lush 100 100 100 where V is ground speed in knots Note : For V greater than 85 % of the aquaplaning speed (V P ) , use the = 0.05 constant . At the discretion of the applicant, the wheel - braking coefficient as defined for runway condition codes (RWYCC) 2 in AMC 25.1592 may be applied.

Wet s now above 0.1 6 3 mm depth Dry s now above 0.1 6 3 m m depth Wet snow over 0.16 compacted snow Dry snow over 0.16 compacted snow Compacted s now 0.20 below outside air temperature (OAT) of - 15 °C Compacted s now 0.16 above OAT of - 15 °C Ice 0.0 7 Slippery wet 0.16 Note: Braking Force = load on braked wheel x Default Friction Value  Table 2 Note: For a specially prepared winter runway surface no default friction value can be given due to the diversity of conditions that will apply.

(See reference 10) 7.3.2 Other Than Default Values In developing aeroplane braking performance using either test evidence or assumed friction values other than the default values provided in Table 2, a number of other brake related aspects should be considered. Brake efficiency s hould be assumed to be appropriate to the brake and anti - skid system behaviour on the contaminant under consideration or a conservative assumption can be used. It can be assumed that wheel brake torque capability and brake energy ch aracteristics are unaff ected. Where the tyre wear state significantly affects the braking performance on the contaminated surface, it should be assumed that there is 20% of the permitted wear range remaining.

Where limited test evidence is available for a model predecessor or de rivative this may be used given appropriate conservative assumptions.

Powered by EASA eRules Page 1158 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 7.3.3 Use of Ground Friction Measurement Devices T here is not, at present, a correlation between aircraft stopping capability and ground friction measuring devices. Hence , it is not practicable at present to determine aeroplane performance on the basis of a friction index measured by ground friction devices. Notwithstanding this lack of correlation , the applicant may optionally choo se to present take - off performance data as a function of an aeroplane braking coefficient or wheel braking coefficient constant with ground speed for runways contaminated with compacted snow or ice. The responsibility for relating this data to a friction i ndex measured by a ground friction device will fall on the operator and the competent authority of the State of operator.

7.3.4 Specially prepared winter runway surfaces At the discretion of the applicant, take - off performance data may be provided for spec ially prepared winter runway surfaces. This may include icy surfaces that have been treated with sand or gravel in such a way that a significant improvement of friction may be demonstrated. The applicant should apply a reasonable margin to the observed bra king action in performance computations for such surfaces, and assume wheel - braking coefficients no greater than 0.20 for fully modulating anti - skid systems. For other anti - skid system types, this coefficient must be factored as described in Section 7.3.1. The competent authority of the State of aerodrome should approve appropriate procedures and methods in compliance with point ADR.OPS.B.036 of Annex IV (Part - ADR.OPS) of Regulation (EU) No 139/2014 (‘Aerodromes Regulation’).

7.4 Additional Considerat ions 7.4.1 Minimum V For the purpose of take - off distance determination, it has been accepted that the minimum V speed may be established using the V value established in 1 MCG accordance with CS 25.149(g) . As impli ed in paragraph 8.1.3, this may not ensure that the lateral deviation after engine failure will not exceed 30 ft on a contaminated runway.

7.4.2 Reverse Thrust Performance information may include credit for reverse thrust where available and controllable , as described in AMC 25.109 .

8.0 Presentation of Supplementary Performance Information 8.1 General Performance information for contaminated runways, derived in accordance with the provisions of paragraphs 5.0 to 7.0, should be accompanied by appropriate statements such as: 8.1.1 Operation on runways contaminated with water, slush, snow, ice or other contaminants implies uncertainties with regard to runway friction and contaminant drag and therefore to the achievab le performance and control of the aeroplane during take - off, since the actual conditions may not completely match the assumptions on which the performance information is based. Where possible, every effort should be made to ensure that the runway surface i s cleared of any significant contamination.

Powered by EASA eRules Page 1159 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 8.1.2 The performance information assumes any runway contaminant to be of uniform depth and density.

8.1.3 The provision of performance information for contaminated runways should not be taken as implying that gr ound handling characteristics on these surfaces will be as good as can be achieved on dry or wet runways, in particular following engine failure, in crosswinds or when using reverse thrust.

8.1.4 The contaminated runway performance information does not in any way replace or amend the Operating Limitations and Performance Information listed in the AFM, unless otherwise stated.

8.2 Procedures In addition to performance information appropriate to operating on a contaminated runway, the AFM should also include recommended procedures associated with this performance information. Differences in other procedures for operation of the aeroplane on a contaminated surface should also be presented, e.g., reference to crosswinds or the use of high engine powers or derate s.

8.3 Take - off Data This should be presented either as separate data appropriate to a defined runway contaminant or as incremental data based on the AFM normal dry or wet runway information.

The landing distance must be presented either directly or with t he factors required by the operating manuals, with clear explanation where appropriate.

Where data is provided for a range of contaminant depths, for example greater than 3, 6, 9, 12, 15 mm, then the AFM should clearly indicate how to define data for conta minant depths within the range of contaminant depths provided.

The AFM should provide: — the performance data for operations on contaminated runways; and — definitions of runway surface conditions.

The AFM should state that operations are prohibited on runways with contaminant depths greater than those for which data is provided. Instructions for the use of that data should be provided in the appropriate documentation.

Where the AFM presents data using V and V , it must be stated in the AFM that use STOP GO of this concept is acceptable only where operation under this standard is permitted.

9 References Reference sources containing worked methods for the processes outlined in 7.1 to 7.3.3 are identified below: 1. ESDU Data Item 83042, December 1983, with Amendment A, May 1998 , ‘ Estimation of Spray Patterns Generated from the Side of Aircraft Tyres Running in Water or Slush ’ .

2. ESDU Data Item 98001, May 1998 , ‘ Estimation of Airframe Skin - Friction Drag due to Impingement of Tyre Spray ’ .

3. ESDU Data Item 90 035 * , November 1990, with Amendment A, October 1992 , ‘ Frictional and Retarding Forces on Aircraft Tyres , Part V: Estimation of Fluid Drag Forces ’ .

Powered by EASA eRules Page 1160 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 4. ESDU Memorandum No.97 * , July 1998 , ‘ The Order of Magnitude of Drag due to Forward Spray from Aircraft Tyre s ’ .

5. ESDU Memorandum No. 96 , reissue May 2011 , ‘ Operations on Surfaces Covered with Slush ’ .

6. ESDU Memorandum No. 95, reissue October 201 3 , ‘ Impact Forces Resulting From Wheel Generated Spray: Re - Assessment Of Existing Data ’ .

7. NASA Report TP - 2718 ‘ Measurement of Flow Rate and Trajectory of Aircraft Tire - Generated Water Spray ’ .

8. Van Es, G.W.H., ‘ Method for Predicting the Rolling Resistance of Aircraft Tires in Dry Snow ’ . AIAA Journal of Aircraft, Volume 36, No.5, September - Octo ber 1999.

9. Van Es, G.W.H., ‘ Rolling Resistance of Aircraft Tires in Dry Snow ’ , National Aerospace Laboratory NLR, Technical Report TR - 98165, Amsterdam, 1998.

10. ESDU Data Item 72008 * , May 1972 , ‘ Frictional and retarding forces on aircraft tyres ’, Part III: planning.

11. FAA AC 25 - 31, ‘Takeoff Performance Data for Operations on Contaminated Runways’, dated 22 December 2015.

12. ICAO Document 10064, ‘Aeroplane Performance Manual’, First Edition 2020.

* This document has been withdrawn by ESDU and is no lo nger available.

[Amdt 25/2] [Amdt 25/ 27 ]

CS 25.1592 Performance information for assessing the landing

distance

ED Decision 2021/015/R (See AMC 25.1592 ) (a) At the discretion of the applicant, supplementary landing performance information may be furnished for aeroplanes landing on slippery wet runways and on runways contaminated with standing water, slush, snow, or ice to be used by operators to support the dispatch of a flight.

If information o n any one or more of the above surface conditions is not supplied, the AFM must contain a statement that prohibits landing on surfaces that do not meet the minimum friction criteria, or contaminated surface(s) for which information is not supplied. Additio nal information covering operation on surface conditions other than the above may be provided at the discretion of the applicant.

(b) Landing - distance information must be furnished for assessing the landing performance at the time of arrival on dry, wet, s lippery wet runways, and runways contaminated with standing water, slush, snow, or ice.

(c) Performance information that is furnished by the applicant must be contained in the AFM. The information may be established through calculation or testing.

Powered by EASA eRules Page 1161 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFO RMATION SUPPLEMENTARY INFORMATION (d) Th e data to be used for assessing the landing performance at the time of arrival consists of the horizontal distance from the point at which the main gear of the aeroplane is 15 m (50 ft) above the landing surface to the point where the aeroplane comes to a complete stop. This data must allow to compute the landing distance based on the following elements: — runway condition (see AMC 25.1592 ), — wind, — ambient air temperature, — average runway slope, — pressure altitude, — i cing conditions, — planned final - approach speed, — aeroplane mass and configuration, and — deceleration devices.

The applicant may optionally provide information on runway surface conditions and braking actions.

[Amdt No: 25/27]

AMC 25.1592 The deriva tion and methodology of performance

information for use when landing on slippery wet and

contaminated runways to support the dispatch of a flight, and

landing assessment performance at the time of arrival in all runway

surface conditions

ED Decision 2021/0 15/R 1.0 Purpose This AMC provides information, guidelines, recommendations, and acceptable means of compliance for use by applicants in the production of landing performance information.

Operators should use that landing performance information to: — supp ort the dispatch of a flight when planning to land on runways that are slippery wet or contaminated by standing water, slush, snow, ice, or other contaminants; and — assess the landing performance at the time of arrival in all runway surface conditions .

2.0 Applicability of data Appropriate landing performance data are required for dispatch and for the time - of - arrival landing performance assessments. As the variables to be considered as well as the ways in which that data is to be used vary, the landing performance data for assess ing the landing performance at the time of arrival may be different from the landing performance data that are developed in accordance with CS 25.125 and provided in the aeroplane flight manual (AFM) in accordance with CS 25.1587(b) .

DRY AND WET RUNWAYS: this AMC 25.1592 includes the methods for deriving the landing distance on dry and wet runways, which is intended to be used for as sessing the landing performance at the time of arrival only. For assessing the preflight landing performance when Powered by EASA eRules Page 1162 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION planning to land on a dry or wet runway, the landing distance established in compliance with CS 25.1 25 should be used.

SLIPPERY WET AND CONTAMINATED RUNWAYS: the data that is derived in accordance with the method(s) included in this AMC is appropriate for assessing the landing performance at the time of arrival and for dispatch, when planning to land on a slippery wet or contaminated runway surface, provided that CS 25.125(c)(3) and CS 25.125(g) are also complied with.

Aeroplane performance data for contaminated runway con ditions, which are produced in accordance with CS 25.1592 , should include recommendations for their operational use. Where possible, this operational guidance should be provided by the applicant or its production s hould be co - ordinated with the applicant to ensure that the information is valid for use.

Operators should carefully and conservatively select the appropriate performance data to use in operations on slippery wet and contaminated runways. They should pay s pecial attention to any contaminant being present in the critical high - speed portion of the runway.

When determining the maximum depth of runway contaminants, the applicant should also consider the maximum depth for which the engine air intakes are shown t o be free of hazardous ingestion of water in accordance with CS 25.1091(d)(2) .

3.0 Standard assumptions The data for assessing the landing performance at the time of arrival should assume the expected landing perfo rmance of a trained flight crew of average skill following normal flight procedures. It should take into account the following: — runway surface conditions/runway condition codes, — winds, — temperatures, — average runway slopes, — pressure altitudes, — icing conditions, — final - approach speeds, — aeroplane weight and configuration, and — deceleration devices used.

As the landing distances defined in CS 25.125 , the landing distances to be used for time of arrival landing perf ormance assessments are defined as the horizontal distance from the point at which the main gear of the aeroplane is 50 ft above the landing surface to the position where the aeroplane comes to a stop (see Figure 1 below).

4.0 Definitions In addition to th e terms that are defined in AMC 25.1591 , the applicant should consider the following: Runway condition code (RWYCC) RWYCC is a number that is used in the runway condition report and describes the effect of the runw ay surface condition(s) on the deceleration performance and lateral control of the aeroplane (see Section 6.2 of this AMC for the classification of runway conditions).

Powered by EASA eRules Page 1163 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SU BPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION Note: the objective of the RWYCC is to enable the flight crew to calculate the operation al performance of the aeroplane. ICAO Doc 9981 ‘PROCEDURES FOR AIR NAVIGATION SERVICES (PANS) — Aerodromes’, 3rd Edition, 2020, describes procedures for determining the RWYCC.

5.0 Assumptions for landing distances The applicant should provide landing performance data as RWYCCs for codes six through one within the approved operational envelope for landing. The applicant may decide to provide additional data for fluid contaminants (dry snow, wet snow, slush, and standing water) for the range of d epths that are given in Table 2 of Section 7.0 of this AMC.

The applicant does not provide landing performance data for code zero (0) as this code does not represent a performance category. Code 0 is a condition in which flight operations should cease on t he runway until the aerodrome improves the braking action.

The applicant should provide the impact of each of the parameters affecting landing distance, taking into account the following: — approved landing configurations, including Category - III landing guid ance, where approved; — approved deceleration devices (e.g. wheel brakes, speed brakes/spoilers, and thrust reversers); — pressure altitudes within the approved operational envelope for landing; — weights up to the maximum take - off weight (MTOW); — expected airspeeds at the runway threshold, including speeds up to the maximum recommended final - approach speed, considering possible speed additives for winds and icing conditions; — temperatures within the approved operational envelope for landing; — operati onal correction factors for winds within the established operational limits of the aeroplane for: — no more than 50 % of the nominal wind components along the take - off path opposite to the direction of landing; and — no less than 150 % of nominal wind componen ts along the take - off path in the direction of landing; — runway slopes within the approved operational envelope for landing; and — icing conditions if CS 25.125(a)(2) applies.

6.0 Derivation of landing distance The la nding distance consists of three segments: — an airborne segment, — a transition segment, and — a final stopping - configuration (full - braking) segment, as shown in Figure 1.

Powered by EASA eRules Page 1164 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION Figure 1 — Landing - distance segments The applicant should derive the landing distance for assessing the landing performance at dispatch, when planning to land on a dry or wet runway surface, in accordance with CS 25.125 .

The applicant should derive the landing distance for assessing the landing performance at dispatch, when planning to land on a contaminated or slippery wet runway surface, in accordance with the method(s) contained in Sections 6 and 7 of this AMC.

The applicant may analytically derive the landing distance for assessing th e landing performance at the time of arrival from the landing performance model that the applicant developed to show compliance with CS 25.125 , modified as described in the following sections.

The applicant should make changes in the aeroplane’s configuration, speed, power, and thrust that are used to determine the landing distance for assessing the landing performance at the time of arrival using procedures that are established for operation in service. These proce dures should: — be able to be consistently executed in service by flight crews of average skill; — include safe and reliable methods or devices; and — allow for any time delays that may reasonably be expected in service (see Section 6.2 below).

6.1 Air distance 6.1.1 Default distance allowance Based on this section, the applicant should establish a distance allowance for the airborne phase, which is appropriate to most aeroplanes and types of approaches.

As shown in Figure 1, ‘air distance’ is defined as the dist ance from an aeroplane height of 15 m (50 ft) above the landing surface to the point of the main - gear touchdown. This ‘air distance’ definition is the same as the one used for compliance with CS 25.125 . However, an air distance that is determined under CS 25.125 may not be appropriate for making operational assessments of the landing performance, as it may be shorter than the distance that an average pilot is likely to achie ve in normal operation.

The air distance that is used for any landing at any runway is a function of the following variables: — runway approach guidance; — runway slope; — use of any aeroplane features or equipment (e.g. heads - up guidance, auto - flight systems, e tc.); Powered by EASA eRules Page 1165 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION — pilot technique; and — the inherent flare characteristics of the aeroplane.

Unless the air distance that is used for compliance with CS 25.125 is representative of an average pilot flying in normal operation (s ee flight test demonstration below), the applicant should analytically determine the air distance that is used for operational assessments of the landing performance as ‘the distance that is traversed over a period of 7 sec at a speed of 98 % of the recomm ended speed above the landing threshold’. The recommended ‘speed above the landing threshold’ may also be referred to as the ‘final - approach speed (V )’. The above air distance represents a flare time of 7 sec and APP a touchdown speed (V ) of 96 % of the V . The V should be consistent with the TD APP APP procedures recommended by the applicant, including any speed additives, e.g. those that may be used due to winds or icing conditions. The applicant should also provide the effects of higher speeds, to accoun t for variations that occur in operations or are caused by the operating procedures of individual operators.

If the applicant derives the air distance directly from flight test data instead of using the analytical method described above, the flight test da ta should meet the following criteria: — procedures consistent with the applicant’s recommended procedures for operation in service should be used; these procedures should address the recommended V , flare initiation height, thrust/power reduction height a nd APP technique, and target pitch attitudes; — at a height of 15 m (50 ft) above the runway surface, the aeroplane should have an airspeed not lower than the recommended V ; and APP — the rate of descent at touchdown should be in the range of 0.3 - 1.2°m/sec (1 - 4 ft/ sec).

If the air distance is based on a time of 7 seconds at a speed of 98 % of the recommended speed above the runway threshold, this air distance is considered valid for downhill runway slopes of up to 2 % in magnitude (no credit should be taken for uphi ll runway slopes).

6.1.2 Steep - approach landing The distance allowance described in Section 6.1.1 may not be appropriate for steep approaches. Therefore, this paragraph provides information for determining the air distance at a steep approach using a glide path greater than or equal to 4.5 °.

The applicant determines air distances that are achieved at steep approaches directly from flight tests performed in accordance with CS - 25 Appendix Q . The applicant may us e those demonstrated air distances for assessing the landing distance at dispatch and at the time of arrival, in lieu of complying with the air distances provided for in Section 6.1.1.

6.2 Transition distance As shown in Figure 1, ‘transition distance’ is defined as ‘the distance from the point of the main - gear touchdown to the point where all deceleration devices that are used for determining the landing distance are operating. If the air distance is based on a time of 7 sec at a speed of 98 % of the recom mended speed above the runway threshold, the speed at the start of the transition segment should be 96 % of the recommended speed above the runway threshold.

Powered by EASA eRules Page 1166 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMA TION The applicant should determine the transition distance based on the recommended procedures for use of the approved means of deceleration, both in terms of sequencing and of cues for initiation. The applicant should also consider reasonably expected time delays.

For procedures that call for the initiation of deceleration devices at nose gear touchdown, the minimum time for each pilot action to deploy or activate a deceleration means should be the demonstrated time but no less than 1 second.

For procedures that call for the initiation of deceleration devices prior to nose gear touchdown, the minimum time for each pilot action to deploy or activate a deceleration means should be the demonstrated time plus 1 second.

For automatically deployed or activated deceleration means (e.g. auto - speedbrakes or auto - brakes), the demonstrated time may be used with no add ed delay.

When determining the distance of the transition segment, as well the speed at the start of the final stopping - configuration segment, the applicant should consider the expected evolution of the braking force that is achieved over the transition di stance. The evolution of the braking force should include any differences that may occur for different RWYCCs, e.g. regarding the aeroplane transition to the full - braking configuration (see Table 1 for the wheel - braking coefficient of the full - braking conf iguration for each runway surface condition and reported RWYCC).

RWYCC Runway surface condition description Wheel - braking coefficient 6 DRY 90 % of the certified value that is used to comply with CS 25.125 5 FROST As per the method that is defined in WET (the runway surface is covered by CS 25.109(c) any visible dampness or water up to, and including, 3 mm deep SLUSH (up to, and including, 3 mm deep) DRY SNOW (up to, and including, 3 mm deep) WET SNOW (up to, and including, 3 mm deep) 4 COMPACTED SNOW (outside air 0.20 temperature of less than or equal to - 15 °C/5 °F) 3 WET (‘Slippery wet’ runway) 0.16 DRY SNOW (more than 3 mm deep) WET SNOW (more than 3 mm deep) DRY SNOW ON TOP OF COMPACTED SNOW (of any depth) WET SNOW ON TOP OF COMPACTED SNOW (of any depth) COMPACTED SNOW (outside air temperature of more than - 15° C/5 °F) 2 STANDING WATER (more than 3 mm (a) For speeds below 85 % of the deep) aquaplaning speed , 50 % of the SLUSH (more than 3 mm deep) wheel - braking coefficient that is determined in accordance with Powered by EASA eRules Page 1167 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION CS 25.109(c) , but no greater than 0.16 (b) For speeds equal to or higher than 85 % of the aquaplaning speed , 0.05 1 ICE 0.07 0 WET ICE Not applicable (no operations in WATER ON TOP OF COMPACTED ‘RWYCC = 0’ conditions) SNOW DRY SNOW OR WET SNOW ON TOP OF ICE Table 1 — Correlation between wheel - braking coefficient and RWYCC The applicant may use 100 % of the wheel - braking coefficient that is used to comply with CS 25.125 if the testing from which that braking coefficient was derived was conducted on portions of runways with operationa lly representative amounts of rubber contamination and paint stripes.

For these wheel - braking coefficients, the applicant should assume a fully modulating anti - skid system. For quasi - modulating systems, the applicant should multiply the listed wheel - brak ing coefficient by 0.625. For on - off systems, the applicant should multiply the listed wheel - braking coefficient by 0.375. For the classification of anti - skid systems, refer to AMC 25.109(c)(2) . The applicant shoul d address aeroplanes without anti - skid systems separately, on a case - by - case basis.

The aquaplaning speed ‘V ’ may be estimated by solving the equation ‘V = 9√ 𝑃 ’, P P where ‘V ’ is the ground speed in kt and ‘P’ is the tyre pressure in lb/in . To estimate P the effect of aquaplaning on wheel - to - ground friction, the aquaplaning speed (V ) P given above should be factored by a coefficient of 0.85.

6.3 Final stopping - configuration distance (Full - braking distance) As shown in Figure 1, the final stopping - configurat ion (full - braking) segment begins at the end of the transition segment, where all deceleration devices that are used for determining the landing distance are operating. The full - braking segment ends at the nose gear position where the aeroplane comes to a stop.

The applicant should calculate the final stopping - configuration distance based on the wheel braking coefficient that is appropriate for the runway surface condition or RWYCC, including the effect of aquaplaning, if applicable. The applicant may use a means other than wheel brakes to determine the landing distances if that means complies with CS 25.109(e) and CS 25.109(f) , except for time - of - arrival dry runway landing d istances, where the applicant may consider the effects of the available reverse thrust. The applicant may take credit for using a thrust reverser if the design of that reverser fulfils the criteria of AMC 25.109(f) , except for the demonstration requirements of Section 6 of this AMC. Using a thrust reverser may reduce directional controllability in combinations of crosswinds and low friction conditions. The applicant should provide to operators recommendations or gui delines for crosswind landings, including the maximum recommended crosswinds, for the RWYCCs for which landing - distance data is provided.

The applicant may carry out a suitable simulation to develop these guidelines for operation on contaminated runways (s ee Section 7 on considering contaminant drag from loose contaminants).

Powered by EASA eRules Page 1168 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATI ONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 6.4 Landing - distance data for dispatch For dispatch computation, performance data for landing on a contaminated runway surface may include credit for reverse thrust in compliance with CS 25.125(c)(3) and CS 25.1 25(g) ; CS 25.125(g) requires to consider the one engine inoperative configuration.

The applicant should assume that the engine fails during the landing flare. If this adversely affects the availability of a deceler ation device, then the applicant, in compliance with CS 25.125(g) , must compare: (a) the normal landing distance without engine failure, using the available deceleration means factored by 1.15; and (b) the unfactored landing distance, assuming an engine failure in the landing flare and loss of availability of any related deceleration means.

The scheduled landing distance is the longer between (a) and (b) above. Such distance is the minimum landing distance t hat already includes an operational factor of 1.15.

6.5 Time - of - arrival landing distance For time - of - arrival landing distances, CS 25.125(g) does not need to be applied.

7.0 Contaminant drag — standing water, slush , wet snow Loose contaminants result in additional contaminant drag due to the combination of the following: — the aeroplane tyres displace the contaminant; and — the contaminant spray is impinged upon the airframe.

Such contaminant drag is an additional force that helps decelerate the aeroplane, thus reducing the distance needed to stop the aeroplane. As the contaminant drag increases with the contaminant depth, the deeper the contaminant is, the shorter the stopping distance will be.

However, the actual conta minant depth may be less than the reported depth for the following reasons: — contaminant depths are reported in runway surface condition reports using specific depth increments; — the procedure for reporting contaminant depths is to report the highest depth o f the contaminant along the reported portion of the runway surface; contaminant depths, however, may not be uniform over the whole runway surface (or reported portion of the runway surface), therefore, areas of lower contaminant depth are likely; — in a stab le weather environment (the contaminant is not replenished on the runway), the contaminant depth is likely to decrease as successive aeroplanes use the runway displacing the contaminant; and — contaminated conditions are reported starting from 25 % coverage in each runway third; the total coverage of the runway with significant depths of contaminant may thus be less than 10 % of the entire runway surface.

If the actual contaminant depth is lower than the reported value, using the reported value to determine the contaminant drag will result in a higher drag level than the actual one, leading to an optimistic prediction of the stopping distance. Therefore, it is recommended not to include the effect of contaminant drag when calculating the landing dis tances for assessing the landing performance at the time of arrival. However, if the effect of contaminant drag is included, the applicant should limit it to no more than the drag resulting from 50 % of the reported depth.

Powered by EASA eRules Page 1169 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION If the effect of contaminant dept h is included in the landing - distance data, the applicant should provide data for up to the maximum depth of each runway contaminant, for which landing operations are permitted. When determining the maximum depth of runway contaminants, the applicant may n eed to consider the maximum depth for which the engine air intakes are shown to be free of hazardous ingestion of water in accordance with CS 25.1091(d)(2) .

If the effect of contaminant depth is included in the lan ding distance data, then the applicant should provide data for the specific gravities as shown in Table 2: Loose contaminant Specific gravity Standing water 1.0 Slush 0.85 Dry snow 0.2 Wet snow 0.5 Table 2 — Specific gravity of loose contaminants For the method of determining the contaminant drag, refer to AMC 25.1591 .

8.0 Presentation of supplementary performance information 8.1 General The applicant should include in the performance information for dry, wet, slippery wet, and contaminated runways, derived in accordance with Sections 5.0 - 7.0 of this AMC, the following statements or equivalent ones: — operation on runways that are contaminated with water, slush, snow, ice, or other contaminants implies uncertainties regarding runway friction and contaminant drag; therefore, the achievable performance and control of the aeroplane during landing are also uncertain as the actual conditions may not completely match the assumptions on which the performance information was based; where possible, every effort should be made to ensure that the runway surface is cleared of significant contamination; — the performance information has been established with the assumption that any runway cont aminant is of uniform depth and density; and — ground handling characteristics on contaminated runways should not be considered equivalent to those that may be achieved on dry or wet runways, in particular following an engine failure, in presence of crosswin ds, or when using reverse thrust.

8.2 Procedures In addition to performance information for operating on contaminated runways, the applicant should include in the AFM recommended procedures associated with this performance information if such procedures ar e specific to the aeroplane. The applicant should also include in the AFM changes in other procedures, e.g. reference to crosswinds, to adapt them to the operation of the aeroplane on a contaminated runway.

Powered by EASA eRules Page 1170 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION 8.3 Landing data The applicant should present l anding data: — either as separate data appropriate to a defined runway contaminant; or — as incremental data based on the dry or wet runway information in the AFM.

The applicant should also include information on the use of speeds higher than the reference lan ding speed (V ) on landing, i.e. speeds up to the maximum recommended REF approach speed in addition to the V , as well as on the related distances. The applicant REF should present the landing distance either directly or along with the factors that are requir ed by the applicable air operations regulations, including a clear explanation, where appropriate.

Where the applicant provides data for a range of contaminant depths, e.g. greater than 3, 6, 9, 12, or 15 mm, then the AFM should clearly indicate how to def ine data for contaminant depths within the range of the contaminant depths provided.

When for at least one runway condition, the landing distances to be used at the time of dispatch are defined by the unfactored distance that is determined with one engine assumed to be failing in the flare, the applicant should present all landing distances at the time of dispatch as factored distances in the AFM. The AFM should clearly state this to avoid double application of operational factors.

The AFM should provide: ( a) definitions of runway surface conditions; (b) the performance data for operations on contaminated runways; (c) landing distances on contaminated runways; (d) data with no reverse thrust credit to: (1) cover operational restrictions on the use of reverse rs; and (2) make flight crew aware of the importance of reverser selection on contaminated runways; (e) the procedures and assumptions that are used to develop the performance data; and (f) the appropriate statements as per Section 8.1 of this AMC.

The applicant should provide instructions on the use of the data in the appropriate operational documentation.

9.0 References Federal Aviation Administration (FAA) Advisory Circular (AC) 25 - 32, ‘Landing Performance Data for Time - of - Arrival Landing Performance Assessments’, 22 December 2015.

[Amdt No: 25/27] Powered by EASA eRules Page 1171 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION

CS 25.1593 Exposure to volcanic cloud hazards

ED Decision 2013/010/R (See AMC 25.1593 ) The susceptibility of aeroplane features to the effects of volcanic cloud h azards must be established.

[Amdt 25/13]

AMC 25.1593 Exposure to volcanic cloud hazards

ED Decision 2016 /010/R The aim of CS 25.1593 is to support operators by identifying and assessing airworthiness hazards associ ated with operations in contaminated airspace. Providing such data to operators will enable those hazards to be properly managed as part of an established management system.

Acceptable means of establishing the susceptibility of aeroplane features to the effects of volcanic clouds should include a combination of experience, studies, analysis, and/or testing of parts or sub - assemblies.

Information necessary for safe operation should be contained in the unapproved part of the flight manual, or other appropriate manual, and should be readily usable by operators in preparing a safety risk assessment as part of their overall management syste m.

A volcanic cloud comprises volcanic ash together with gases and other chemicals. Although the primary hazard is volcanic ash, other elements of the volcanic cloud may also be undesirable to operate through, and their effect on airworthiness should be a ssessed.

In determining the susceptibility of aeroplane features to the effects of volcanic clouds and the necessary information to operators, the following points should be considered: (1) Identify the features of the aeroplane that are susceptible to a irworthiness effects from volcanic clouds. These may include, but are not limited to, the following: a. The malfunction or failure of one or more engines, leading not only to reduction or complete loss of thrust but also to failures of electrical, pneumatic, and hydraulic systems; b. Blockage of pitot and static sensors, resulting in unreliable airspeed ind ications and erroneous warnings; c. Windscreen abrasion, resulting in windscreens being rendered partially or completely opaque; d. Fuel contamination; e. Volcanic ash and/or toxic chemical contamination of cabin air - conditioning packs, possibly leading to loss of cabin pressurisation or noxious fumes in the cockpit and/or cabin; f. Erosion, blockage, or malfunction of external and internal aeroplane components; g. Volcanic cloud static discharge, leading to prolonged loss of communications; and h. Re duced cooling efficiency of electronic components, leading to a wide range of aeroplane system failures.

Powered by EASA eRules Page 1172 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART G – OPERATING LIMITATIONS (CS - 25) AND INFORMATION SUPPLEMENTARY INFORMATION (2) The nature and severity of effects.

(3) Details of any device or system installed on the aeroplane that can detect the presence of volcanic cl oud hazards (e.g. volcanic ash (particulate) sensors or volcanic gas sensors).

(4) The effect of volcanic ash on operations to/from contaminated aerodromes. In particular, deposits of volcanic ash on a runway can lead to degraded braking performance, most significantly if the ash is wet.

(5) The related pre - flight, in - flight and post - flight precautions to be observed by the operator including any necessary amendments to Aircraft Operating Manuals, Aircraft Maintenance Manuals, Master Minimum Equipment Lis t/Dispatch Deviation, or equivalents required to support the operator. Pre - flight precautions should include clearly defined procedures for the removal of any volcanic ash found on parked aeroplanes.

(6) The recommended continuing airworthiness inspection s associated with operations in volcanic cloud contaminated airspace and to/from volcanic ash - contaminated aerodromes; this may take the form of Instructions for Continued Airworthiness or other advice.

[Amdt 25/13] [Amdt 25/18] Powered by EASA eRules Page 1173 of 1495 | Jan 2023

Next: SUBPART H – ELECTRICAL WIRING INTERCONNECTION SYSTEMS →

SUBPART H – ELECTRICAL WIRING INTERCONNECTION SYSTEMS

Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS S UPPLEMENTARY INFORMATION

SUBPART H – ELECTRICAL WIRING INTERCONNECTION

SYSTEMS

AMC 25 Subpart H Correlation with previous amendment of CS - 25

ED Decision 2021/015/R The following table provides correlation between CS - 25 Subpart H and CS - 25 amendment 4: Subpart H paragraph Subparagraph Based on previous CS - 25 paragraph CS 25.1701 (a) none Definition (b) none (c) none CS 25.1703 (a)(1) CS 25.1301(a) Function and installation; EWIS (a)(2) CS 25.1301(c) (a)(3) CS 25.1309(a) (a)(4) none (b) none (c) CS 25.869(a)(3) (d) none (e) none CS 25.1705 (a) none Systems and functions; EWIS (b)(1) CS 25.773(b)(2) (b)(2) CS 25.854 (b)(3) CS 25.8 8 5 (b)(4) CS 25. 981 (b)(5) CS 25. 1165 (b)(6) CS 25. 1203 (b)(7) CS 25.1 303(b) (b)(8) CS 25.1 310 (b)(9) CS 25.13 16 (b)(10) CS 25. 1331(a)(2) (b)(11) CS 25.13 51 (b)(12) CS 25.13 55 (b)(13) CS 25.13 60 (b)(14) CS 25.13 62 (b)(15) CS 25.136 5 (b)(16) CS 25. 1431(c) & (d) CS 25.1707 (a) CS 25.1353(a) System separation; EWIS (b) CS 25.1353(a) (c) CS 25.1353(b) (d)(1) CS 25.1351(b)(1) CS 25.1351(b)(2) (d)(2) (e)(1) CS 25.869(a)(3)(i) CS 25.869(a) (3)(ii) (e)(2) CS 25.1353(d)(3) Powered by EASA eRules Page 1174 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION Subpart H paragraph Subparagraph Based on previous CS - 25 paragraph (f)(1) CS 25.869(a)(3)(i) CS 25.869(a) (3)(ii) (f)(2) CS 25.1353(d)(3) (g) CS 25.1353(d)(3) (h)(1) CS 25.1353(d)(3) (h)(2) (i)(1) CS 25.1353(d)(3) (i)(2) (i)(3) (j)(1) CS 25.1353(d)(3) (j)(2) (k) none (l) CS 25.1353(d)(3) CS 25.1709 (a)(1) CS 25.1309(b)(1) System safety; EWIS (a)( 2 ) CS 25.1309(b)(1) ( b ) CS 25.1309(b)(2) CS 25.1711 (a) CS 25.1301(b) Component identification; EWIS (b)(1) none (b)(2) none (c) CS 25.1353(d)(2) (d) none (e) none CS 25.1713 (a) CS 25.869(a)(1) Fire protection; EWIS (b) CS 25.869(a)(2) (c) CS 25.869(a)(4) CS 25.1715 (a) CS 25.899 Electrical bonding and protection against static (b) CS 25.1353(e) electricity; EWIS CS 25.1717 CS 25.1353(d)(1) Circuit protection devices; EWIS CS 25.1719 CS 25.611 Accessibility provisions; EWIS CS 25.1721 (a)(1) CS 25.855(e)(1) Protection of EWIS (a)(2) CS 25.855(e)(2) (b) none (c) none CS 25.1723 CS 25.863(b)(3) Flammable fluid protection; EWIS CS 25.1725 (a) CS 25.903(b) Powerplants; EWIS (b) CS 25.903(d)(1) CS 25.1727 CS 25.1189(d) Flammable fluid shutoff means; EWIS CS 25.1729 CS 25.1529 Instructions for Continued Airworthiness; EWIS CS 25.1731 (a) CS 25.1203(e) Powerplant and APU fire detector system; EWIS (b)(1) CS 25.1203(f)(1) Powered by EASA eRules Page 1175 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION Subpart H paragraph Subparagraph Based on previous CS - 25 paragraph (b)(2) CS 25.1203(f)(2) Note: The term “none” in the above table indicates that the paragraph did not exist in the CS - 25 amendment 4.

[Amdt No: 25/5] [Amdt No: 25/ 27 ]

CS 25.1701 Definition

ED Decision 2008/006/R (See AMC 25.1701 ) (a) Electrical wiring interconnection system (EWIS) means any wire, wiring device, or combination of these, including termination devices, installed in any area of the aeroplane for the purpose of transmitting electrical energy, including data and signals between two or more intended termination points. Except as provided for in subparagraph (c) of this paragraph, this includes: (1) Wires and cables.

(2) Bus bars.

(3) The termination point on electrical devices, including those on relays, interrupters, switches, contactors, terminal blocks, and circuit breakers and other circuit protection devices.

(4) Connectors, including feed - through connectors.

(5) Conne ctor accessories.

(6) Electrical grounding and bonding devices and their associated connections.

(7) Electrical splices.

(8) Materials used to provide additional protection for wires, including wire insulation, wire sleeving, and conduits that have electri cal termination for the purpose of bonding.

(9) Shields or braids.

(10) Clamps and other devices used to route and support the wire bundle.

(11) Cable tie devices.

(12) Labels or other means of identification.

(13) Pressure seals.

(b) The definition in sub paragraph (a) of this paragraph covers EWIS components inside shelves, panels, racks, junction boxes, distribution panels, and back - planes of equipment racks, including, but not limited to, circuit board back - planes, wire integration units and external wir ing of equipment.

(c) Except for the equipment indicated in subparagraph (b) of this paragraph, EWIS components inside the following equipment, and the external connectors that are part of that equipment, are excluded from the definition in subparagraph (a ) of this paragraph: (1) Electrical equipment or avionics that is qualified to environmental conditions and testing procedures when those conditions and procedures are - (i) Appropriate for the intended function and operating environment, and Powered by EASA eRules Page 1176 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION (ii) Accepta ble to the Agency.

(2) Portable electrical devices that are not part of the type design of the aeroplane. This includes personal entertainment devices and laptop computers.

(3) Fibre optics.

[Amdt 25/5]

AMC 25.1701 Definition

ED Decision 2008/006/R 1 Paragraph CS 25.1701 defines EWIS for the purposes of complying with the subpart H requirements and other EWIS - related requirements of CS 25. CS 25.1701 clearly identifies which wires and components th ese requirements apply to. Although this definition is located in subpart H to CS 25, it applies to all EWIS requirements regardless of location within CS 25.

2 Subparagraph CS 25.1701(a) defines EWIS as any wire, wiring device, or combination of these, including termination devices, installed in any area of the aeroplane for the purpose of transmitting electrical energy, including data and signals between two or more intended termination points. The term “wire” me ans bare or insulated wire used for the purpose of electrical energy transmission, grounding, or bonding. This includes electrical cables, coaxial cables, ribbon cables, power feeders, and data busses.

3 Subparagraph CS 25.1701(a) of the requirement provides a listing of the component types that are considered part of the EWIS. These component types are listed as items CS 25.1701(a)(1) through CS 25.1701(a)(13) . While these are the most widely used EWIS components it is not an all inclusive list. There may be components used by an applicant to support transmission of electrical energy that are not listed but meet the EWIS definition. They will be EWIS components subject to EWIS related regulatory requirements.

4 CS 25.1701(b) says that EWIS components located inside shelves, panels, racks, junction boxes, distribution panels, and back - planes o f equipment racks (e.g., circuit board back - planes, wire integration units, external wiring of equipment) are covered by the EWIS definition. These components are included in the EWIS definition because the equipment they are inside of or part of, is typic ally designed and made for a particular aeroplane model or series of models. So the requirements that apply to aeroplane EWIS components must be applied to the components inside that equipment. These contrast with avionics components that must be sent back to their manufacturer or a specialized repair shop for service. Components inside shelves, panels, racks, junction boxes, distribution panels, and back - planes of equipment racks are maintained, repaired, and modified by the same personnel who maintain, re pair, and modify the EWIS in the rest of the aeroplane. For example, in an electrical distribution panel system separation must be designed and maintained within the panel just like the EWIS leading up to that panel. Identification of components inside the panel is just as important as outside the panel since the wiring inside the panel is treated much the same. Also, while this type of equipment is designed for its intended function and is manufactured and installed to the same standards as other EWIS, it is typically not qualified to an environmental standard such as EUROCAE ED - 14 / RTCA DO - 160.

5 There are some exceptions to the EWIS definitions and those are given in CS 25.1701(c) .

Paragraph excepts EWIS componen ts inside the following equipment, and the external connectors that are part of that equipment: Powered by EASA eRules Page 1177 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION 5.1 Electrical equipment or avionics that is qualified to environmental conditions and testing procedures when those conditions and procedures are − — appropria te for the intended function and operating environment, and — acceptable to the Agency.

5.2 Portable electrical devices that are not part of the type design of the aeroplane including personal entertainment devices and laptop computers.

5.3 Fibre optics.

6 The first exception means EWIS components located inside avionic or electrical equipment such as flight management system computers, flight data recorders, VHF radios, primary flight displays, navigation displays, generator control units, integrated drive generators, and galley ovens, if this equipment has been tested to industry - accepted environmental testing standards.

Examples of acceptable standards are EUROCAE ED - 14 / RTCA DO - 160, and equipment qualified to a European Technical Standard Order (ETSO) 7 An applicant may use any environmental testing standard if the applicant can demonstrate that the testing methods and pass/fail criteria are at least equivalent to the widely accepted standards of EUROCAE ED - 14 / RTCA DO - 160, or a specific ETSO. Applicant s should submit details of the environmental testing standards and results of the testing that demonstrate the equipment is suited for use in the environment in which it will be operated.

[Amdt 25/5]

CS 25.1703 Function and Installation; EWIS

ED Decision 2 008/006/R (See AMC 25.1703 ) (a) Each EWIS component installed in any area of the aeroplane must: (1) Be of a kind and design appropriate to its intended function.

(2) Be installed according to limitations specified for the EWIS components.

(3) Function properly when installed.

(4) Be designed and installed in a way that will minimise mechanical strain.

(b) The selection of wires must take into account known characteristics of the wire in relation to each particular installation and application in order to minimise the risk of wire damage, including any arc tracking phenomena.

(c) The design and installation of the main power cables, including generator cables, in the fuselage must allow fo r a reasonable degree of deformation and stretching without failure.

(d) EWIS components located in areas of known moisture accumulation must be adequately protected to minimise any hazardous effect due to moisture.

(e) EWIS modifications to the original t ype design must be designed and installed to the same standards used by the original aeroplane manufacturer or other equivalent standards acceptable to the Agency.

[Amdt 25/5] Powered by EASA eRules Page 1178 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECT ION SYSTEMS SUPPLEMENTARY INFORMATION

AMC 25.1703 Function And Installation; EWIS

ED Decision 2008/006/R 1 CS 25.1703 requires that applicants select EWIS components that are of a kind and design appropriate to their intended function just as CS 25.1301 requires this for other pieces of eq uipment installed on the aeroplane. Factors such as component design limitations, functionality, and susceptibility to arc tracking and moisture or other known characteristics of the particular component must be considered.

2 Subparagraph 25.1703(a)(1) requires that each EWIS component be of a kind and design appropriate to its intended function. In this context, the requirement means that components must be qualified for airborne use, or otherwise specifically ass essed as acceptable for their intended use. To be “appropriate” means that the equipment is used in a manner for which it was designed. For example, a wire rated at 150 degrees Celsius would not be appropriate for installation if that installation would ca use the wire to operate at a temperature higher than 150 degrees Celsius. Wire and other components made for household or consumer products use may not be appropriate for airborne use because they are manufactured for the consumer market and not for use in an airborne environment. Other factors that must be considered for EWIS component selection are mechanical strength, voltage drop, required bend radius, and expected service life.

3. Subparagraph 25.1703(a)(2) re quires that EWIS components be installed according to their limitations. As used here, limitations means the design and installation requirements of the particular EWIS component. Examples of EWIS component limitations are maximum operating temperature, de gree of moisture resistance, voltage drop, maximum current - carrying capability, and tensile strength. EWIS component selection and installation design must take into account various environmental factors including, but not limited to, vibration, temperatur e, moisture, exposure to the elements or chemicals (de - icing fluid, for instance), insulation type, and type of clamp.

4 Subparagraph 25.1703(a)(3) requires that EWIS function properly when installed. The key word in understanding the intent of this paragraph is “properly,” as that relates to airworthiness of the aeroplane. For an EWIS component to function properly means that it must be capable of safely performing the function for which it was designed. For exampl e, the fact that an in - flight entertainment (IFE) system fails to deliver satisfactory picture or sound quality is not what the term “properly” refers to. This is not a safety issue and therefore not a concern for certification aspects. The failure of an E WIS component has the potential for being a safety hazard whether it is part of a safety - related system or an IFE system. Therefore, EWIS components must always function properly (safely) when installed, no matter what system they are part of and any malfu nction of the EWIS must not degrade the airworthiness of the aeroplane (refer to CS 25.1709 for terminology relating to failure classifications).

5 Subparagraph 25.1703(a)(4) requires that EWIS components be designed and installed so mechanical strain is minimised. This means the EWIS installation must be designed so that strain on wires would not be so great as to cause the wire or other components to fail. This paragraph req uires that adequate consideration be given to mechanical strain when selecting wire and cables, clamps, strain relieves, stand - offs, and other devices used to route and support the wire bundle when designing the installation of these components.

6 Subpara graph 25.1703(b) requires that selection of wires take into account known characteristics of different wire types in relation to each specific application, to minimise risk of damage. It is important to select the aircraft wire type whose construction matches the application environment. The wire type selected should be constructed for the most severe Powered by EASA eRules Page 1179 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION environment likely to be encountered in service. This means, for example, that insulation types susceptible to arc t racking should not be used in areas exposed to high vibration and constant flexing in a moisture - prone environment.

7 Subparagraph 25.1703(c) contains the requirement formerly located in CS 25.869(a)(2) that design and installation of the main power cables allow for a reasonable degree of deformation and stretching without failure. Although it is now located in 25.1703(c) , the mean ing of the requirement has not changed. The reason for this requirement is the same as for CS 25.993(f) , which requires that each fuel line within the fuselage be designed and installed to allow a reasonable degree of deformation and stretching without leakage. The idea is that the fuselage can be damaged with partial separation or other structural damage without the fuel lines or electrical power cables breaking apart. Allowing for a certain amount of stretching wi ll help to minimise the probability of a fuel - fed fire inside the fuselage. As it is used in this requirement, a “reasonable degree of deformation and stretching” should be about 10% of the length of the electrical cable.

8 Subparagraph 25.1703(d) requires that EWIS components located in areas of known moisture build - up be adequately protected to minimise moisture’s hazardous effects. This is to ensure that all practical means are used to ensure damage from fluid co ntact with components does not occur. Wires routed near a lavatory, galley, hydraulic lines, severe wind and moisture problem areas such as wheel wells and wing trailing edges, and any other area of the aeroplane where moisture collection could be a concer n must be adequately protected from possible adverse effects of exposure to moisture.

9 EWIS component selection 9.1 Expected service life.

Expected service life is a factor needing consideration in selecting EWIS components to use. Expected service life means the expected service lifetime of the EWIS. This is not normally less than the expected service life of the aircraft structure. If the expected service life requires that all or some of the EWIS components be replaced at certain intervals, then these intervals must be specified in the ICA as required by CS 25.1529 . If the aircraft service life is extended, then EWIS components should be taken into account.

9.2 Qualified components.

EWIS components should be qualified for airborne use or specifically assessed as acceptable for the intended use and be appropriate for the environment in which they are installed.

Aircraft manufacturers list approved components in their manuals, such as the standard wiring practi ces manual (ATA Chapter 20). Ideally, only the components listed in the applicable manual or approved substitutes should be used for the maintenance, repair or modification of the aircraft. EWIS modifications to the original type design should be designed and installed to the same standards used by the original aircraft manufacturer or other equivalent standards acceptable to the Agency. This is because the manufacturer’s technical choice of an EWIS component is not always driven by regulatory requirements alone. In some cases specific technical constraints would result in the choice of a component that exceeds the minimum level required by the regulations.

Powered by EASA eRules Page 1180 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION 9.3 Mechanical strength. EWIS components should have sufficient mechanical strength for their servic e conditions.

a. The EWIS should be installed with sufficient slack so that bundles and individual wires are not under undue tension.

b. Wires connected to movable or shock - mounted equipment should have sufficient length to allow full travel without tension on the bundle to the point where failure of the EWIS could occur.

c. Wiring at terminal lugs or connectors should have sufficient slac k to allow for two re - terminations without replacement of wires, unless other design considerations apply. This slack should be in addition to the drip loop and the allowance for movable equipment.

d. In order to prevent mechanical damage wires should be s upported by suitable clamps or other devices at suitable intervals. The design should be such that the failure of a single clamp will not in itself result in the wire or wire bundle coming into contact with other wires, equipment, structure, fluid lines, c ontrol cables, or other items that could cause damage to the wire. Because of in - service experience with abrasion and chafing of wires contained in troughs, ducts, or conduits justification should be given if additional support of the wires will not be use d. The supporting devices should be of a suitable size and type, with the wires and cables held securely in place without damage to the insulation as per Society of Automotive Engineers SAE AS50881 or equivalent standard 9.4 Minimum bend radius.

To avoid damage to wire insulation, the minimum radius of bends in single wires or bundles should be in accordance with the wire manufacturer’s specifications. Guidance on the minimum bend radius can be found in the manufacturer’s standard wiring practices manual. Other industry standards such as AECMA EN3197 or SAE AS50881 also contain guidance on minimum bend radius. For example, SAE AS50881b states: “For wiring groups, bundles, or harnesses, and single wires and electrical cables individually routed and supporte d, the minimum bend radius shall be ten times the outside diameter of the largest included wire or electrical cable. At the point where wiring breaks out from a group, harness or bundle, the minimum bend radius shall be ten times the diameter of the larges t included wire or electrical cable, provided the wiring is suitably supported at the breakout point. If wires used as shield terminators or jumpers are required to reverse direction in a harness, the minimum bend radius of the wire shall be three times th e diameter at the point of reversal providing the wire is adequately supported.” 9.5 Coaxial cable damage.

Damage to coaxial cable can occur when the cable is clamped too tightly or bent sharply (normally at or near connectors). Damage can also be incurr ed during unrelated maintenance actions around the coaxial cable. Coaxial cable can be severely damaged on the inside without any evidence of damage on the outside. Installation design should minimise the possibility of such damage. Coaxial cables have a m inimum bend radius. SAE AS50881b states: “The minimum radius of bend shall not adversely affect the characteristics of the cable. For flexible type coaxial cables, the radius of bend shall not be less than six times the outside diameter. For semi - rigid typ es, the radius shall not be less than ten times the outside diameter.” Powered by EASA eRules Page 1181 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION 9.6 Wire bundle adhesive clamp selection.

Certain designs use adhesive means to fasten bundle supports to the aircraft structure.

Service history shows that these can work loose dur ing aircraft operation, either as a result of improper design or inadequate surface preparation. You should pay particular attention to the selection and methods used for affixing this type of wire bundle support.

9.7 Wire bundle routing.

Following are some considerations that should go into the design of an EWIS installation.

a. Wire bundles should be routed in accessible areas that are protected from damage from personnel, cargo, and maintenance activity. As far as practicable they should not be routed in areas in where they are likely to be used as handholds or as support for personal equipment or where they could become damaged during removal of aircraft equipment (reference CS 25.1719 and 25.1721 ).

b. Wiring should be clamped so that contact with equipment and structure is avoided.

Where this cannot be accomplished, extra protection, in the form of grommets, chafe strips, etc., should be provided. Wherev er wires cannot be clamped, protective grommets should be used, wherever wires cannot be clamped, in a way that ensures clearance from structure at penetrations. Wire should not have a preload against the corners or edges of chafing strips or grommets.

c. As far as practicable wiring should be routed away from high - temperature equipment and lines to prevent deterioration of insulation (reference CS 25.1707(j) ).

d. Wiring routed across hinged panels, should be rout ed and clamped so that the bundle will twist, rather than bend, when the panel is moved. When not possible, the bending radius must be in accordance with the acceptable minimum bundle radius.

9.8 Conduits.

Conduits should be designed and manufactured so that potential for chafing between the wiring and the conduit internal walls is minimised.

a. Non - metallic conduit. Insulating tubing (or sleeving) is sometimes used to provide additional electrical, environmental, and limited additional mechanical prote ction or to increase the external wire dimension. Insulating tubing should not be considered as the sole mechanical protection against external abrasion of wire because it does not prevent external abrasion. At best, it provides only a delaying action agai nst the abrasion. The electrical and mechanical properties of the tubing need to be considered to ensure that it its use is appropriate for the type of protection that the designer intends it to be used for. Additional guidance on the use of insulating tub ing or sleeving is given in AMC 25.1707 paragraph (2)(c).

b. Metallic conduit. The ends of metallic conduits should be flared and the interior surface treated to reduce the possibility of abrasion.

9.9 Connector s election.

The connector used for each application should be selected only after a careful determination of the electrical and environmental requirements.

a. Particular attention should be given to any use of components with dissimilar metals, because th is may cause electrolytic corrosion.

Powered by EASA eRules Page 1182 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION b. Environment - resistant connectors should be used in applications that will be subject to fluids, vibration, temperature extremes, mechanical shock, corrosive elements, etc.

c. Sealing plugs and contacts should be use d in unused connector cavities where necessary. In addition, firewall class connectors incorporating sealing plugs should be able to prevent the penetration of the fire through the aircraft firewall connector opening and continue to function without failur e for a specified period of time when exposed to fire.

d. When electromagnetic interference and radio frequency interference (EMI and RFI) protection is required, Special attention should be paid to the termination of individual and overall shields. Back shell adapters designed for shield termination, connectors with conductive finishes, and EMI grounding fingers are available for this purpose.

9.10 Splice selection.

Environmentally sealed splices should be used in accordance with the requirements of the airframe manufacturer’s standard wiring practices or SAE AS81824/1, or equivalent specification, particularly in un - pressurized and severe wind and moisture problem (SWAMP) areas. However, the possibility of fluid contamination in any installation needs to be considered.

a. Splices in pressurised areas. In press urised areas, pre - insulated splices conforming to SAE AS7928, or equivalent specification, may be used if these types of splices are listed as acceptable for use by the manufacturer in their standard wiring practices manual. The possibility of fluid contam ination in any installation should also be considered.

b. Mechanically protected splices. Mechanical splices allow maintenance personnel an alternative method to using a heat gun for splices in fuel vapour areas on post - delivery aircraft. The generally av ailable environmental splices use heat shrink material that needs application of heat. Most of these heat sources cannot be used in flammable vapour areas of an aircraft without proper precautions. Mechanical splices are acceptable for use in high temperat ure and fuel vapour areas, provided the splice is covered with a suitable plastic sleeve, such as a dual wall shrink sleeve or high temperature tape, such as Teflon, wrapped around the splice and tied at both ends. If high temperature tape is used, it shou ld be permanently secured at both ends. Mechanical splices should be installed according to the airframe manufacturer’s standard practices, or equivalent specification. The manufacturer’s standard wiring practices manual should provide part number detail a nd best practices procedures for mechanical splices. It should also detail the applicability of each of the recommended splices for all required critical aeroplane installations.

c. Aluminium wire splice. Splices for aluminium wires should be in accordanc e with the requirements of the airframe manufacturers’ standard practices or SAE AS70991, MS25439, or equivalent specification. Conditions that result in excessive voltage drop and high resistance at junctions that may ultimately lead to failure of the jun ction should be avoided. The preferable location for aluminium splices is in pressurized areas. To avoid contamination from foreign particles the crimp tool should be dedicated to aluminium wire crimping.

Powered by EASA eRules Page 1183 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION 9.11 Wire selection.

a. Installation environment .

(1) Careful attention should be applied when deciding on the type of wire needed for a specific application. Due consideration should be given such that the wire’s construction properly matches the application environment.

For each installation, you sho uld select wire construction type suitable for the most severe environment likely to be encountered in service. For example use a wire type that is suitable for flexing for installations involving movement, use a wire type that has a high temperature ratin g for higher temperature installations.

(2) When considering the acceptability of wire, you should refer to the industry standards defining acceptable test methods for aircraft wire, including arc tracking test methods. (e.g. EN3475, SAE AS4373, or alterna tive manufacturer standards) (3) Wires such as fire detection, fire extinguishing, fuel shutoff, and fly - by - wire / engine control system wiring that must operate during and after a fire must be selected from wire types qualified to provide circuit integri ty after exposure to fire for a specified period.

b. Wire insulation selection.

Wire insulation type should be chosen according to the environmental characteristics of wire routing areas. One wire insulation characteristic of particular concern is arc tracking. Arc tracking is a phenomenon in which a conductive carbon path forms across an insulating surface. A breach in the insulation allows arcing and carbonizes the insulation. The resulting carbon residue is electrically conductive. The carbon the n provides a short circuit path through which current can flow. This can occur on either dry or wet wires. Certain types of wire insulation are more susceptible to arc tracking than others, and wire insulated with aromatic polyimide is one. Therefore, its use should be limited to applications where it will not be subjected to high moisture, high vibration levels, or abrasion, or where flexing of the wire will occur. There are new types of aromatic polyimide insulated wire, such as hybrid constructions (e.g. , the aromatic polyimide tape is the middle layer, and the top and bottom layer is another type of insulation such as Teflon tape) which are less susceptible to arc tracking.

c. Mechanical strength of wire.

Wires should be sufficiently robust to withstan d all movement, flexing, vibration, abrasion and other mechanical hazards to which they may be reasonably subjected on the aeroplane. Generally, conductor wire should be stranded to minimise fatigue breakage. Refer to AS50881 and AECMA EN3197 for additiona l guidance.

Additionally, wires should be robust enough to withstand the mechanical hazards they may be reasonably subjected to during installation into the aircraft.

d. Mixing of different wire insulation types.

Different wire types installed in the sam e bundle should withstand the wire - to - wire abrasion they will be subject to. Consideration should be given to the types of insulation mixed within wire bundles, especially if mixing a hard insulation type with a relatively softer type, and particularly whe n relative motion could occur Powered by EASA eRules Page 1184 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION between the wires. Such relative motion between varying wire insulation types could lead to accelerated abrasion and subsequent wire failure.

e. Tin plated conductors.

Tin plated conductors may be difficult to solder if not treated properly, so preparation of the conductor is necessary to ensure a good connection is made.

(f) Wire gauge selection.

To select the correct size of electrical wire, the following requirements should be considered: (1) The wire size should be mat ched with the circuit protective device with regard to the required current.

(2) The wire size should be sufficient to carry the required current without overheating.

(3) The wire size should be sufficient to carry the required current over the required di stance without excessive voltage drop (based on system requirements).

(4) Particular attention should be given to the mechanical strength and installation handling of wire sizes smaller than AWG 22 (e.g., consideration of vibration, flexing, and termination.) Use of high - strength alloy conductors should be considered in small gauge wires to increase mechanical strength.

Note: Additional guidance for selecting wires and other EWIS components can be found in SAE AS50881 and EN2853.

g. Wire temperat ure rating.

Selection of a temperature rating for wire should include consideration of the worst - case requirements of the application. Caution should be used when locating wires in areas where heat is generated, for example where oxygen generators or lig hting ballast units are located.

(1) Wires have a specified maximum continuous operating temperature. For many types, this may be reached by any combination of maximum ambient temperature and the temperature rise due to current flow.

(2) In general, it is undesirable to contribute more than 40oC rise to the operating temperature by electrical heating.

(3) Other factors to be considered are altitude de - rating, bundle size de - rating, and use of conduits and other enclosures.

(4) Particular note should be tak en of the specified voltage of any wire where higher than normal potentials may be used. Examples are discharge lamp circuits and windscreen heating systems.

h. EWIS components in moisture areas.

(1) Severe wind and moisture problem.

Areas designated as severe wind and moisture problem (SWAMP) areas are different from aircraft to aircraft but they generally are considered to be such areas as wheel wells, wing folds, pylons, areas near wing flaps, and other exterior areas that may have a harsh environment . Wires for these Powered by EASA eRules Page 1185 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION applications should incorporate design features that address these severe environments.

(2) Silver plated conductors.

Many high strength copper alloy conductors and coaxial cables use silver plating. Contamination of silver - plated cond uctors with glycol (de - icing fluid) can result in electrical fire. Accordingly, you should not use silver plated conductors in areas where de - icing fluid can be present unless suitable protection features are employed. Silver plated conductors and shields can exhibit a corrosive condition (also known as ‘Red Plague’) if the plating is damaged or of poor quality and is exposed to moisture. Designers should be aware of these conditions.

(3) Fluid contamination of EWIS components.

Fluid contamination of EWIS components should be avoided as far as practicable. But EWIS components should be designed and installed with the appropriate assumptions about fluid contamination, either from the normal environment or from accidental leaks or spills. Industry standards, such as RTCA DO - 160/EUROCAE ED - 14, contain information regarding typical aircraft fluids. It is particularly important to appreciate that certain contaminants, notably from toilet waste systems, galleys, and fluids containing sugar, such as sweetened drink s, can induce electrical tracking in already degraded electrical wires and unsealed electrical components. The only cleaning fluids that should be used are those recommended by the aeroplane manufacturer in its standard practices manual.

10 EWIS component selection for future modifications If a TC includes subpart H in its certification basis, future modifiers of those TCs should comply with the subpart H requirements by using the same or equivalent standards / design practices as those used by the TC hold er. If modifiers choose to deviate from those standards / design practices, they should have to substantiate compliance independently. The standards / design practices used by the TC holder in order to justify their own choice of components should also be considered.

[Amdt 25/5]

CS 25.1705 Systems and Functions; EWIS

ED Decision 2008/006/R (a) EWIS associated with systems required for type certification or by operating rules must be considered an integral part of that system and must be considered in showin g compliance with the applicable requirements for that system.

(b) For systems to which the following rules apply, the components of EWIS associated with those systems must be considered an integral part of that system or systems and must be considered in showing compliance with the applicable requirements for that system.

(1) CS 25.773(b)(2) Pilot compartment view.

(2) CS 25.854 Lavatory fire protection (3) CS 25.858 Cargo compartment fire detection systems (4) CS 25.981 Fuel tank ignition prevention.

Powered by EASA eRules Page 1186 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMA TION (5) CS 25.1165 Engine ignition systems.

(6) CS 25.1203 Fire - detector systems (7) CS 25.1303(b) Flight and Navigation Instruments (8) CS 25.1310 Power source Capacity and Distribution (9) CS 25.1316 System lightning protection (10) C S 25.1331(a)(2) Instruments using a power supply (11) CS 25.1351 General.

(12) CS 25.1355 Distribution system.

(13) CS 25.1360 Precautions against injury.

(14) CS 25.1362 Electrical supplies for emergency conditions.

(15) CS 25.1365 Electrical applianc es, motors, and transformers.

(16) CS 25.1431(c) and (d) Electronic equipment.

[Amdt 25/5]

CS 25.1707 System Separation; EWIS

ED Decision 2008/006/R (See AMC 25.1707 ) (a) Each EWIS must be designed and installed wi th adequate physical separation from other EWIS and aeroplane systems so that an EWIS component failure will not create a hazardous condition.

Unless otherwise stated, for the purposes of this paragraph, adequate physical separation must be achieved by sep aration distance or by a barrier that provides protection equivalent to that separation distance.

(b) Each EWIS must be designed and installed such that any electrical interference likely to be present in the aeroplane will not result in hazardous effects upon the aeroplane or its systems except under extremely remote conditions.

(c) Wires and cables carrying heavy current and their associated EWIS components must be designed and installed to ensure adequate physical separation and electrical isolation, so that damage to essential circuits will be minimised under fault conditions.

(d) Each EWIS associated with independent aeroplane power sources or power sources connected in combination must be designed and installed to ensure adequate physical separation an d electrical isolation so that a fault in any one aeroplane power source EWIS will not adversely affect any other independent power sources. In addition: (1) Aeroplane independent electrical power sources must not share a common ground terminating locat ion, and (2) Aeroplane system’s static grounds must not share a common ground terminating location with any of the aeroplane independent electrical power sources.

(e) Except to the extent necessary to provide electrical connection to the fuel systems components the EW IS must be designed and installed with adequate physical separation from fuel lines and other fuel system components, such that (1) An EWIS component failure will not create a hazardous condition, and Powered by EASA eRules Page 1187 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION (2) Fuel leakage onto EWIS components will not create a hazardous condition.

(f) Except to the extent necessary to provide electrical connection to the hydraulic systems components the EWIS must be designed and installed with adequate physical separation from hydraulic lines and other hydraulic system compon ents, such that (1) An EWIS component failure will not create a hazardous condition, and (2) Hydraulic fluid leakage onto EWIS components will not create a hazardous condition.

(g) Except to the extent necessary to provide electrical connection to the oxygen systems components the EWIS must be designed and installed with adequate physical separat ion from oxygen lines and other oxygen system components, such that an EWIS component failure will not create a hazardous condition.

(h) Except to the extent necessary to provide electrical connection to the water/waste systems components the EWIS must be designed and installed with adequate physical separation from water/waste lines and other water/waste system components, such that (1) An EWIS component failure will not create a hazardous condition, and (2) Water/waste leakage onto EWIS components will not create a hazardous condition.

(i) Electrical wiring interconnection systems must be designed and installed with adequate physical separation between the EWIS and flight or other mechanical control systems cables, and associated system components such that, (1) Chafing, jamming, or other interference are prevented, and (2) An EWIS component failure will not create a hazardous condition, and (3) Failure of any flight or other mechanical control systems cables or systems components will not damage EWIS a nd create a hazardous condition.

(j) Electrical wiring interconnection systems must be designed and installed with adequate physical separation between the EWIS components and heated equipment, hot air ducts, and lines such that; (1) An EWIS component fa ilure will not create a hazardous condition, and (2) Hot air leakage or generated heat onto EWIS components will not create a hazardous condition.

(k) For systems for which redundancy is required either by specific certification requirements, operating ru les or by CS 25.1709 , each applicable EWIS must be designed and installed with adequate physical separation.

(l) Each EWIS must be designed and installed so there is adequate physical separation between it and oth er aeroplane components and structure, and so that the EWIS is protected from sharp edges and corners, in order to minimise potential for abrasion/chafing, vibration damage, and other types of mechanical damage.

[Amdt 25/5] Powered by EASA eRules Page 1188 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTR ICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION

AMC 25.1707 System separation ; EWIS

ED Decision 2008/006/R 1 Summary The continuing safe operation of an aeroplane depends on the safe transfer of electrical energy by the EWIS. If an EWIS failure occurs, its separation from other EWIS and from other systems and structures plays an important role in ensuring that hazardous effects of the failure are mitigated to an acceptable level. CS 25.1707 requires applicants to design EWIS with appropriate separation to minimise the possibility of hazardous conditions that may be caused by an EW IS interfering with other EWIS, other a eroplane systems, or structure.

The purpose of separation is to prevent hazards of interference between wires in a single bundle, between two or more bundles, or between an electrical bundle and a non - electrical syste m or structure. Such interference could take the form of mechanical and or electrical interference (EMI for example). Mechanical interference examples include chafing between electrical cables or pipes or structure and may lead to fluid leakage such as gal ley water waste systems.

2 Separation by physical distances versus separation by barrier.

CS 25.1707 states that adequate physical separation must be achieved by separation distance or by a barrier that provides protection equivalent to that separation d istance. The following should be considered when designing and installing an EWIS: a. In most cases, physical distance is the preferred method of achieving the required separation. This is because barriers themselves can be the cause of EWIS component dama ge (e.g., chafing inside of conduits) and can lead to maintenance errors such as barriers removed during maintenance and inadvertently left off. They can also interfere with visual inspections of the EWIS.

b. If a barrier is used to achieve the required separation, CS 25.1707 requires that it provide at least the same level of protection that would be achieved with physical distance. That means that when deciding on the choice of the barrier, factors such as di electric strength, maximum and minimum operating temperatures, chemical resistivity, and mechanical strength should be taken into account.

c. In addition to the considerations given in paragraph (b) above, when wire bundle sleeving is used to provide sepa ration, applicants should consider that the sleeving itself is susceptible to the same types of damage as wire insulation. The appropriate type of sleeving must be selected for each specific application and design consideration must be given to ensuring th at the sleeving is not subjected to damage that would reduce the separation it provides.

3 Determination of separation.

Determining the necessary amount of physical separation distance is essential. But because each system design and aeroplane model can be unique, and because manufacturers have differing design standards and installation techniques, CS 25.1707 does not mandate specific separation distances. Instead it requires that the chosen separation be adequat e so that an EWIS component failure will not create a hazardous condition. The following factors should be considered when determining the separation distance: a. The electrical characteristics, amount of power, and severity of failure condition of the sy stem functions performed by the signals in the EWIS and adjacent EWIS.

Powered by EASA eRules Page 1189 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION b. Installation design features, including the number, type, and location of support devices along the wire path.

c. The maximum amount of slack wire resulting from wire bundle build to lerances and the variability of wire bundle manufacturing d. Probable variations in the installation of the wiring and adjacent wiring, including position of wire support devices and amount of wire slack possible.

e. The intended operating environment, in cluding amount of deflection or relative movement possible and the effect of failure of a wire support or other separation means.

f. Maintenance practices as defined by the aeroplane manufacturer’s standard wiring practices manual and the ICA required by CS 25.1529 and CS 25.1729 .

g. The maximum temperature generated by adjacent wire/wire bundles during normal and fault conditions.

h. Possible EMI, HIRF, or induced lightning effects.

4 Cases of inadequate separation.

Some areas of an aeroplane may have localized areas where maintaining the minimum physical separation distance is not feasible. This is especially true in smaller aeroplanes. In those cases, other means of ensu ring equivalent minimum physical separation may be acceptable, if testing or analysis demonstrates that safe operation of the aeroplane is not jeopardized. The applicant should substantiate to the Agency that the means to achieve the required separation pr ovides the necessary level of protection for wire related failures. Electro - magnetic interference (EMI) protection must also be verified.

5 Meaning of the term “hazardous condition” as used in CS 25.1707 .

The term “hazardous condition” in CS 25.1707 has the same meaning as the one used in CS 25.1309 or CS 25.1709. Unlike CS 25.1309 or CS 25.1709, no probability objectives are required for compliance. The intent of CS 25.1707 , is that the applicant must perform a qu alitative design assessment of the installed EWIS and the physical separation to guard against hazardous conditions This assessment involves the use of reasonable engineering and manufacturing judgment and assessment of relevant service history to decide w hether an EWIS, system, or structural component could fail in such a way as to create a condition that would affect the aeroplane’s ability to continue safe operation. However, the requirements of CS 25.1707 do not preclude the use of valid component failu re rates if the applicant chooses to use a probability argument in addition to the design assessment to demonstrate compliance. It also does not preclude the agency from requiring such an analysis if the applicant cannot adequately demonstrate that hazardo us conditions will be prevented solely by using the qualitative design assessment.

6 Subparagraph CS 25.1707(a) requires that EWIS associated with any system on the aeroplane be designed and installed so that unde r normal conditions and failure conditions, it will not adversely affect the simultaneous operation of any other systems necessary for continued safe flight, landing, and egress. CS 25.1707(a) also requires that adequate physical separation be achieved by separation distance or by a barrier that provides protection equivalent to that separation distance.

Powered by EASA eRules Page 1190 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION 7 Subparagraph 25.1707(b) requires that each EWIS be designed and installed to limit electrical interference on the aeroplane.

One type of electrical int erference is electromagnetic interferences (EMI). Electromagnetic interference can be introduced into aeroplane systems and wiring by coupling between electrical cables or between cables and coaxial lines or other aeroplane systems. Function of systems sho uld not be affected by EMI generated by adjacent wire. EMI between wiring which is a source of EMI and wire susceptible to EMI increases in proportion to the length of parallel runs and decreases with greater separation. Wiring of sensitive circuits that m ay be affected by EMI should be routed away from other wiring interference, or provided with sufficient shielding to avoid system malfunctions under operating conditions. EMI should be limited to negligible levels in wiring related to systems necessary for continued safe flight, landing and egress. The following sources of interference should be considered: a. Conducted and radiated interference caused by electrical noise generation from apparatus connected to the busbars.

b. Coupling between electrical cables or between cables and aerial feeders.

c. Malfunctioning of electrically - powered apparatus.

d. Parasitic currents and voltages in the electrical distribution and grounding systems, including the effects of lightning currents or static disc harge.

e. Different frequencies between electrical generating systems and other systems.

8 This paragraph 25.1707(c) contains the wire - related requirements formerly located in CS 25.1353(b) . Coverage is expanded beyond wires and cable carrying heavy current to include their associated EWIS components as well. This means that all EWIS components, as defined by CS 25.1701 , that are associated with wires and cables carrying heavy current must be installed in the aeroplane so damage to essential circuits will be minimised under fault conditio ns.

9 Subparagraph 25.1707(d) contains wire - related requirements from CS 25.1351(b)(1) and (b)(2) and introduces additional requirements.

a. Subparagraph (d) requires that EWIS components associated with the gener ating system receive the same degree of attention as other components of the system, such as the electrical generators.

b. Subparagraph (d)(1) prohibits aeroplane independent electrical power sources from sharing a common ground terminating location. Para graph (d)(2) prohibits aeroplane static grounds from sharing a common ground terminating location with any aeroplane independent electrical power sources. The reason for these paragraphs is twofold: (1) to help ensure the independence of separate electrica l power sources so that a single ground failure will not disable multiple power sources; and (2) to prevent introduction of unwanted interference into aeroplane electrical power systems from other aeroplane systems.

10 Subparagraphs 25.1707(e), (f), (g), (h) contain specific separation requirements for the fuel, hydraulic, flight and mechanical control system cables, oxygen, hot bleed air systems, and waste/water systems. They require adequate EWIS separation from those systems except to the extent necessa ry to provide any required electrical connection to them. EWIS must be designed and installed with adequate separation so a failure of an EWIS component will not create a hazardous condition and any leakage from those systems (i.e., fuel, hydraulic, oxygen , waste/water) onto EWIS components will not create a hazardous situation.

Powered by EASA eRules Page 1191 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMEN TARY INFORMATION a. Under fault conditions and without adequate EWIS separation a potential catastrophic hazard could occur should an arcing fault ignite a flammable fluid like fuel or hydraulic fl uid. Also an arcing fault has the potential to puncture a line associated with those systems if adequate separation is not maintained. If there is leakage from one of those systems and an arcing event occurs, fire or explosion could result. Similarly, leak age from the water/waste system can cause damage to EWIS components and adversely affect their integrity. An EWIS arcing event that punctures a water or waste line could also introduce fluids into other aeroplane systems and create a hazardous condition.

b . In addition to the required separation distance, the use of other protection means such as drip shields should be considered to prevent the potential for fluids to leak onto EWIS.

11 Subparagraph 25.1707(i). To prevent chafing, jamming, or other types o f interference, or other failures that may lead to loss of control of the aeroplane, EWIS in general and wiring in particular must be physically separated from flight control or other types of control cables. Mechanical cables have the potential to cause c hafing of electrical wire if the two come into contact. This can occur either through vibration of the EWIS and/or mechanical cable or because of cable movement in response to a system command. A mechanical cable could also damage other EWIS components, su ch as a wire bundle support, in a way that would cause failure of that component. Also, if not properly designed and installed, a wire bundle or other EWIS component could interfere with movement of a mechanical control cable by jamming or otherwise rest ri cting the cable’s movement.

Without adequate separation, an arcing fault could damage or sever a control cable. A control cable failure could damage EWIS. Therefore, paragraph (i) requires an adequate separation distance or barrier between EWIS and flight or other mechanical control systems cables and their associated system components. It also requires that failure of an EWIS component must not create a hazardous condition and that the failure of any flight or other mechanical control systems cables or sys tems components must not damage EWIS and creates a hazardous condition. Clamps for wires routed near moveable flight controls should be attached and spaced so that failure of a single attachment point cannot interfere with flight controls or their cables, components, or other moveable flight control surfaces or moveable equipment.

12 Subparagraph 25.1707(j) requires that EWIS design and installation provide adequate physical separation between the EWIS components and heated equipment, hot air ducts, and li nes.

Adequate separation distance is necessary to prevent EWIS damage from extreme temperatures and to prevent an EWIS failure from damaging equipment, ducts, or lines. High temperatures can deteriorate wire insulation and other parts of EWIS components, a nd if the wire or component type is not carefully selected, this deterioration could lead to wire or component failure. Similarly, should an arcing event occur, the arc could penetrate a hot air duct or line and allow the release of high pressure, high tem perature air. Such a release could damage surrounding components associated with various aeroplane systems and potentially lead to a hazardous situation.

13 Subparagraph AMC 25.1707(k). For systems for which redundancy is required either by specific certi fication requirements, operating rules or by CS 25.1709 , each applicable EWIS must be designed and installed with adequate physical separation. To maintain the independence of redundant systems and equipment so tha t safety functions are maintained, adequate separation and electrical isolation between these systems must be ensured as follows: a. EWIS of redundant aircraft systems should be routed in separate bundles and through separate connectors to prevent a single fault from disabling multiple redundant systems.

Powered by EASA eRules Page 1192 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION Segregation of functionally similar EWIS components is necessary to prevent degradation of their ability to perform their required functions.

b. Power feeders from separate power sources should be routed i n bundles separate from each other and from other aircraft wiring in order to prevent a single fault from disabling more than one power source.

c. Wiring that is part of electro - explosive subsystems, such as cartridge - actuated fire extinguishers and emerge ncy jettison devices, should be routed in shielded and jacketed twisted - pair cables, shielded without discontinuities, and kept separate from other wiring at connectors.

14 Subparagraph 25.1707(l) requires that EWIS be designed and installed so they are a dequately separated from aircraft structure and protected from sharp edges and corners. This is to minimise the potential for abrasion and chafing, vibration damage, and other types of mechanical damage. This protection is necessary because over time the i nsulation on a wire that is touching a rigid object, such as an equipment support bracket, will fail and expose bare wire. This can lead to arcing that could destroy that wire and other wires in its bundle. Structural damage could also occur depending on t he amount of electrical energy the failed wire carries.

[Amdt 25/5]

CS 25.1709 System Safety; EWIS

ED Decision 2008/006/R (See AMC 25.1709 ) EWIS must be designed and installed so that: (a) Each catastrophic failure condition (1) is extremely improbable; and (2) does not result from a single failure; and (b) Each hazardous failure condition is extremely remote.

[Amdt 25/5]

AMC 25.1709 System safety; EWIS

ED Decision 2008/006/R 25.1709 requires applicants to perform a system safety assessment of the EWIS. The analysis required for compliance with CS 25.1709 is based on a qualitative approach to assessin g EWIS safety as opposed to numerical, probability - based quantitative analysis. The safety assessment must consider the effects that both physical and functional failures of EWIS would have on aeroplane safety. That safety assessment must show that each EW IS failure considered hazardous is extremely remote. It must show that each EWIS failure considered to be catastrophic is extremely improbable and will not result from a single failure.

1 Objective.

The objective of CS 25.1709 is to use the concepts of CS 25.1309 to provide a thorough and structured analysis of aircraft wiring and its associated components. As in CS 25.1309 , the fail - safe design concept applies. Any single failure condition, such as an arc fault, should be assumed to occur regardless of probability.

Powered by EASA eRules Page 1193 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPAR T H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION 2 Inadequacies of CS 25.1309 in relation to EWIS safety assessments.

CS 25.1309 requires the applicant to per form system safety assessments. But current CS 25.1309 practice has not led to the type of analysis that fully ensures all EWIS failure conditions affecting aeroplane level safety are considered. This is because wiring for non - required systems is sometimes ignored. Even for systems covered by CS 25.1309 (b) , the safety analysis requirements have not always been applied to the associated wire. When they are, there is evidence of inadequate and inconsistent application. Traditional thinking about non - required systems, such as IFE, has been that, since they are not required, and the function they provide is not necessary for the safety of the aeroplane, their failure could not af fect the safety of the aeroplane. This is not a valid assumption. Failure of an electrical wire, regardless of the system it is associated with, can cause serious physical and functional damage to the aeroplane, resulting in hazardous or even catastrophic failure conditions. An example of this is arcing from a shorted wire cutting through and damaging flight control cables. There are more failure modes than have been addressed with traditional analyses. Some further examples are arcing events that occur wit hout tripping circuit breakers, resulting in complete wire bundle failures and fire; or wire bundle failures that lead to structural damage 3 Integrated nature of EWIS.

The integrated nature of wiring and the potential severity of failures demand a more s tructured safety analysis approach than that traditionally used under CS 25.1309 . CS 25.1309 system safety assessments typically evaluate effects of wire failures on system functions. But they have not considered physical wire failure as a cause of the failure of other wires within the EWIS.

Traditional assessments look at external factors like rotor burst, lightning, and hydraulic line rupture, but not at internal factors, like a single wire chafing or arcing event, as the cause of the failure of functions supported by the EWIS. Compliance with CS 25.1709 requires addressing those failure modes at the aeroplane level. This means that EWIS failures need to be analyzed to determine what effect they could have on the safe operation of the aeroplane.

4 Compliance summary.

As specified above, the analysis required for compliance with CS 25.1709 i s based on a qualitative approach to assessing EWIS safety as opposed to numerical, probability - based quantitative analysis. The intent is not to examine each individual wire and its relation to other wires. Rather, it is to ensure that there are no combin ations of failures that could lead to a hazardous condition. However, in case the “top down” analysis process described in this AMC determines that a failure in a given bundle may lead to a catastrophic failure condition, the mitigation process may lead to performing a complete analysis of each wire in the relevant bundle.

5 Qualitative probability terms.

When using qualitative analyses to determine compliance with CS 25.1709 , the following descriptions of the prob ability terms have become commonly accepted as aids to engineering judgment: a. Extremely remote failure conditions.

These are failure conditions that are not anticipated to occur to an individual aeroplane during its total life but which may occur a few times when considering the total operational life of all aeroplanes of the type.

Powered by EASA eRules Page 1194 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION b. Extremely improbable failure conditions.

These are failure conditions so unlikely that they are not anticipated to occur during the entire operational life of all ae roplanes of one type.

6 Relationship to CS 25 system safety assessments.

The analysis described may be accomplished in conjunction with the required aircraft system safety assessments of CS 25.1309 , 25.671, etc.

7 Classification of failure terms.

The classification of failure conditions is specified in AMC 25.1309 .

8 Flowcharts depicting the analysis process.

Flowcharts 1 and 2 outline one method of complying with the requirements of CS 25.1709 . The processes in both Flowcharts 1 and 2 identify two aspects of the analysis: p hysical failures and functional failures. The processes described in both flowcharts begins by using the aircraft level functional hazard analysis developed for demonstrating compliance with CS 25.1309 to identify catastrophic and hazardous failure events. A step - by - step explanation of the analysis depicted in the flowcharts is given in paragraphs 11 (for flowchart 1) and 12 (for Flowchart 2).

a. Flowchart 1.

This flowchar t applies to applicants for pre - TC work and for amended TCs, and STCs when the applicant has all data necessary to perform the analysis. If Flowchart 1 is used for post - TC modifications the available data must include identification of the systems in the E WIS under consideration for modification and the system functions associated with that EWIS.

b. Flowchart 2.

This flowchart applies to applicants for post - TC modifications when the applicant cannot identify the systems or systems functions contained in EW IS under consideration for modification.

9 Definitions applicable to CS 25.1709 .

For this discussion the following definitions apply: a. Validation. Determination that requirements for a product are sufficiently c orrect and complete.

b. Verification. Evaluation to determine that requirements have been met.

c. Mitigation. Elimination of the hazard entirely or suitable precautions taken to minimize the overall severity to an acceptable level.

10 Physical failure ana lysis.

a. Only single common cause events or failures need to be addressed during the physical failure analysis as described in this AMC and shown on the left hand sides of Flowcharts 1 and 2. Multiple common cause events or failures need not be addressed.

b. In relation to physical effects, it should be assumed that wires are carrying electrical energy and that, in the case of an EWIS failure, this energy may result in hazardous or catastrophic effects directly or when combined with other factors, for exam ple fuel, oxygen, hydraulic fluid, or damage by passengers, These failures may result in fire, smoke, emission of toxic gases, damage to co - located systems and structural elements or injury Powered by EASA eRules Page 1195 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION to personnel. This analysis considers all EWIS from all systems (a utopilot, auto throttle, PA system, IFE systems, etc.) regardless of the system criticality.

Flowchart 1: Pre - and Post - Type Certification Safety Analysis Concept Powered by EASA eRules Page 1196 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYST EMS SUPPLEMENTARY INFORMATION Note: Mitigation as used in this flowchart means to eliminate the hazard entirely or minimise its severity to an acceptable level.

11 Descriptive text for flowchart 1 a. Box A: Aircraft functional hazard assessment.

(1) The functional failure analysis assumes that electrical wires are carrying power, signal, or information data. Failure of EWIS under these circumstances may lead to aircraft system degradation effects.

(2) The functional hazard assessment (FHA) referred to in this box is not a stand - alone separate document specifically created to show compliance with CS 25.1709 . It is the aircraft level FHA that the applicant will have developed in compliance with CS 25.1309 to help demonstrate acceptability of a de sign concept, identify potential problem areas or desirable design changes, or determine the need for and scope of any additional analyses (refer to AMC 25.1309 ) b. Analysis of Possible Physical Failures (1) Box B: EWIS characteristics.

Use the results of the FHA (BOX A and BOX J) to identify EWIS installation criteria and definitions of component characteristics. Results from BOX B are fed into the preliminary system safety analysis (PSSA) and syst em safety analys is (SSA) of BOX J.

(2) Boxes C, D and E: Validation and verification of installation criteria.

(i) Ensure that the EWIS component qualification satisfies the design requirements and that components are selected, installed, and used according to their quali fication characteristics and the aircraft constraints linked to their location (refer to the requirements of CS 25.1703 and CS 25.1707 ).

(ii) Use available information (dig ital mock - up, physical mock - up, aeroplane data, historical data) to perform inspections and analyses to validate that design and installation criteria are adequate to the zone/function, including considerations of multi - systems impact. Such inspections and analyses may include a 1st article inspection, design review, particular risk assessment, zonal safety assessment, zonal inspection, and common mode analysis, as applicable. Use such assessments and inspections to ascertain whether design and installation criteria were correctly applied. Special consideration should be given to known problem areas identified by service history and historical data (areas of arcing, smoke, loose clamps, chafing, arc tracking, interference with other systems, etc.). Regardles s of probability, any single arcing failure should be assumed for any power - carrying wire. The intensity and consequence of the arc and its mitigation should be substantiated. Give special consideration to cases where new (previously unused) material or te chnologies are used. In any case CS 25.1703(b) requires that the selection of wires must take into account known characteristics in relation to each installation and application to minimise the risk of wire damage, including any arc tracking phenomena.

(iii) Deviations from installation and component selection criteria identified by these activities should be evaluated. A determination can then be made Powered by EASA eRules Page 1197 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION about their acceptability. Develop alternative mitigation strategies as necessary.

(3) Boxes F and G: Development and validation of mitigation strategy .

Identify and develop a mitigation strategy for the physical failures and their adverse effects identified in Boxes D and E. Validation and verification of the mitigation solution should ensure that: (i) Hazardous failure conditions are extremely remote.

(ii) Catastrophic failure conditions do not result from a single common cause event or failure.

(iii) This mitigation solution does not introduce any new potential failure conditions.

(4) Box H: Incorporation of applicable mitigation strategies.

Incorpo rate newly developed mitigation strategies (BOX F) into guidelines (BOX B) for further design and inspection and analysis processes.

(5) Box I: Physical failure analysis results.

From the EWIS physical failure analysis, the following should be documented : — Physical failures addressed.

— Effects of those physical failures.

— Mitigation strategies developed.

This information should be used to support the final analysis documentation (BO X P).

c. Analysis of Possible Functional Failures (1) Box J: System safety assessments.

The results of the aeroplane level FHA (BOX A) should be used to guide the system level FHA (BOX J). Incorporate EWIS failures identified by CS 25.1709 into the system level and aircraft level FHA, the PSSA, the Common Ca use Analyses (CCA), and the SSA. These analyses are performed to satisfy requirements of CS 25.1309 .

Use results of these analyses to update the EWIS definition (BOX B).

(2 ) Boxes K, L and M: Hazardous and catastrophic failure conditions.

Use the analyses in BOX J to determine if the EWIS associated with the system under analysis can contribute (in whole or in part) to the failure condition under study. Determine whether th e EWIS failure needs to be mitigated. If so, develop, validate, and verify a mitigation strategy. If no mitigation is needed, complete the appropriate safety assessment per CS 25.1309 , CS 25.671, etc..

(3) Boxes N and O: Development and validation of mitigation strategy.

Identify and develop a mitigation strategy for the functional failures and adverse effects identified in BOX J. Validation and verification of the mitigati on solution should determine if initial objective is fully reached; and confirm that this mitigation solution is compatible with existing installations and installation criteria.

If the EWIS was the failure cause, the subsequent mitigation strategy develop ed may introduce new adverse effects not previously identified by the analysis. Check Powered by EASA eRules Page 1198 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION for any new adverse effects and update the aircraft level FHA and other system safety assessments as necessary.

(4) Box P: Documentation of EWIS safety analysis results.

After mitigation strategies have been validated and verified, the results of the CS 25.1709 analysis should be documented. Update as necessary the aircraft level FHA that has been developed in support of certific ation of the proposed modification, in compliance with CS 25.1309 (BOX A).

Powered by EASA eRules Page 1199 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION Flowchart 2: Post - TC Safety Analysis Concept Note: Mitigation as used in this flowchart means to eliminate the hazard entirely or minimise its severity to an acceptable level.

Powered by EASA eRules Page 1200 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION 12 Descriptive text for flowchart 2.

a. Applicants for post - TC modifications should use the analysis depicted in Flowchart 2 when the applicant cannot identi fy the systems or systems functions contained in existing aircraft EWIS that maybe utilized as part of the modification. An applicant should not add EWIS to an existing EWIS if the systems or systems functions contained in the existing EWIS are unknown. To do so could introduce unacceptable hazards. For example, IFE power wires could inadvertently be routed with aeroplane autoland EWIS.

b. The main objectives are to ensure that the proposed modification will be correctly designed and installed and will not introduce unacceptable hazards either through its own failure or by adversely affecting existing aircraft systems. As far as EWIS is concerned, correct incorporation of the modification should be ensured by both good knowledge of original aircraft manufact urer installation practices and their correct implementation or by adequate separation of the added EWIS from existing EWIS. In either case, physical analyses should be performed (similar to the physical failures part of Flowchart 1).

c. Box A: Aircraft fu nctional hazard assessment.

Aircraft level effects must be considered for modified systems or systems added to the aircraft. If the Aircraft level FHA is available, the applicant should examine it to determine the Aircraft level effect of the proposed mod ification. If the Aircraft level FHA is not available, then the applicant must generate an Aircraft level FHA based on the proposed modification. This Aircraft level FHA would be limited to just those Aircraft systems affected by the proposed modification. If it is determined that no Aircraft level functional effects are introduced, a statement to this effect and the supporting data is sufficient to satisfy BOX A.

d. Analysis of Possible Physical Failures (1) Box B: EWIS characteristics.

Use results of the Aircraft level FHA (BOX A and BOX J) to identify EWIS installation criteria and definitions of component characteristics. Results of BOX B are fed into the PSSA and SSA of BOX J.

(2) Box C: Physical separation of new EWIS from existing EWIS.

(i) The EWIS to be added should be separated from existing aeroplane EWIS since the systems or system functions contained in the existing EWIS are unknown. Physical separation between the new and existing EWIS should be established either by separation distanc e or by an appropriate barrier or other means shown to be at least equivalent to the physical separation distance when allowed by CS 25.1707 . Alternative methods given in the advisory material for CS 25.1707 provide an acceptable way to determine adequate separation.

(ii) In cases where separation cannot be maintained because of physical constraints (e.g., terminal strips and connectors), the applicant should accomplish the appropriate analysis to show that no adverse failure conditions result from sharing the common device. This analysis requires knowledge of the systems or system functions sharing the common device (e.g., terminal strips and connectors).

Powered by EASA eRules Page 1201 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCON NECTION SYSTEMS SUPPLEMENTARY INFORMATION (3) Box D and E: Validation and verification of installation criteria.

(i) Ensure that the EWIS component qualification satisfies the design requirements and that components are selected, installed, and used according to their qualification characteristics and the aerop lane constraints linked to their location.

(ii) Use available information (digital mock - up, physical mock - up, aeroplane data, historical data) to perform inspections and analyses to validate that design and installation criteria are adequate to the zone/fu nction, including considerations of multi - systems impact. Such inspections and analyses may include a 1st article inspection, design review, particular risk assessment, zonal safety assessment, zonal inspection, and common mode analysis, as applicable. Use such assessments and inspections to ascertain whether design and installation criteria were correctly applied. Special consideration should be given to known problem areas identified by service history and historical data (areas of arcing, smoke, loose cl amps, chafing, arc tracking, interference with other systems, etc.). Regardless of probability, any single arcing failure should be assumed for any power - carrying wire. The intensity and consequence of the arc and its mitigation should be substantiated.

Sp ecial consideration should be given to cases where new (previously unused) material or technologies are used. Evaluate deviations from installation and component selection criteria identified by these activities and determine their acceptability.

(iii) Al ternative mitigation strategies should be developed as necessary.

(4) Boxes F and G: Development and validation of mitigation strategy.

Identify and develop a mitigation strategy for the physical failures identified in BOXES D and E and resulting adverse effects. Validation and verification of a mitigation solution should ensure that: (i) Hazardous failure conditions are extremely remote.

(ii) Catastrophic failure conditions do not result from a single common cause event or failure.

(iii) This mitigation solution does not introduce any new potential failure conditions.

(5) Box H: Incorporation of Applicable Mitigation Strategies.

Incorporate newly developed mitigation strategies (BOX F) into guidelines (BOX B) for further design and inspection and analys is process.

(6) Box I: Physical failure analysis documentation.

From the EWIS physical failure analysis, the following should be documented: — Physical failures addressed.

— Effects of those physical failures.

— Mitigation strategies developed.

This informati on supports the final analysis documentation (BOX P).

e. Analysis of Possible Functional Failures Powered by EASA eRules Page 1202 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION (1) Box J: System safety assessments.

Use the results of the aircraft level FHA (BOX A) to guide the system level FHA (BOX J). Incorporate EWIS failures iden tified by CS 25.1709 into the system level and aircraft level FHA, the PSSA, the CCA, and the SSA. These analyses are performed to satisfy requirements of CS 25.1309 . Use results of these analyses to update the EWIS definition (BOX B).

(2) Boxes K, L and M: Hazardous and catastrophic failure conditions.

Use the analyses in BOX J to determine if the EWIS associated with the system un der analysis can contribute (in whole or in part) to the failure condition under study. Determine whether the EWIS failure needs to be mitigated. If so, develop, validate, and verify a mitigation strategy. If no mitigation is needed, complete the appropria te safety assessment (e.g., per CS 25.1309 , CS 25.671, etc.).

(3) Boxes N and O: Development and validation of mitigation strategy.

Identify and develop a mitigation strategy for the functional failures and adverse effects identified in BOX J. Validation and verification of the mitigation solution should determine if initial objective is fully reached and confirm that this mitigation s olution is compatible with existing installations and installation criteria. If the EWIS was the failure cause, the subsequent mitigation strategy developed may introduce new adverse effects not previously identified by the analysis. Check for any new adve rse effects and update the aircraft level FHA and other system safety assessments as necessary.

(4) Box P: Documentation of EWIS safety analysis results.

After mitigation strategies have been validated and verified, document the results of the CS 25.1709 analysis. Update as necessary the aircraft level FHA that has been developed in support of certification of the proposed modification, in compliance with CS 25.1309 , (BOX A).

[Amdt 25/5]

CS 25.1711 Component identification; EWIS

ED Decision 2008/006/R (See AMC 25.1711 ) (a) EWIS compone nts must be labelled or otherwise identified using a consistent method that facilitates identification of the EWIS component, its function, and its design limitations, if any.

(b) For systems for which redundancy is required either by specific certificatio n requirements, operating rules or by CS 25.1709 , concerned EWIS components must be particularly identified with its component part number, function, and separation requirement for bundles; (1) The identification m ust be placed along the wire, cable or wire bundles at appropriate intervals and in areas of the aeroplane so they are readily visible to maintenance, repair, or alteration personnel.

(2) If an EWIS component cannot be marked physically, then others means of identification must be provided.

(c) The identifying markings required by sub - paragraphs (a) and (b) must remain legible throughout the expected service life of the EWIS component.

Powered by EASA eRules Page 1203 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION (d) The means used for identifying each EWIS component as required by t his paragraph must not have an adverse effect on the performance of that component throughout its expected service life .

(e) Identification for EWIS modifications to the type design must be consistent with the identification scheme of the original type des ign.

[Amdt 25/5]

AMC 25.1711 Component identification; EWIS

ED Decision 2010/005 /R 1 Paragraph 25.1711 requires applicants to identify EWIS components using consistent methods that facilitate easy identification of the component, its function, and its design limitations. For EWIS associated with flight - essential functions where specific certification requi rements are met by redundancy, identification of the EWIS must also include separation requirements. This paragraph requires that the identifying markings remain legible throughout the expected service life of the EWIS component, and that the method used t o identify components have no adverse affect on their performance.

2 Subparagraph 25.1711(a) requires a consistent method in EWIS identification to avoid confusion and mistakes during aeroplane manufacturing, modi fication, and maintenance.

Aeroplane manufacturers should develop an EWIS identification method that facilitates easy identification of the systems that any specific EWIS component supports and use that identification method in a consistent manner througho ut the aeroplane. This consistent identification method must be used for new type certifications and changes to those designs.

3 Subparagraph 25.1711(b) : Certain aeroplane systems are installed with redundancy in order to meet the reliability requirements of CS 25.1309 and 25.1709 . For EWIS components associated with these systems, paragraph (b) requires specific identification indicating component part number, function, an d separation requirement. This is necessary to prevent modifiers from unintentionally introducing unsafe design or installation features on previously certified aeroplanes when they install new or modified systems. Such identification will aid the designer s and installers of the new system by alerting them to the presence of these systems It will allow them to make appropriate design and installation decisions. Component identification will also make those performing maintenance and inspections more aware o f what systems are associated with specific EWIS in the areas undergoing maintenance or inspection.

4 Subparagraph 25.1711(c) requires that identifying markings required by CS 25.1711(a) and (b) remain legible thro ughout the design life of the component. As most wire installations are designed to remain on the aeroplane throughout the aeroplane’s service life, this means the identification marks must be able to be read for the life of the aeroplane. The method of ma rking must take into account the environment in which the EWIS component will be installed.

The Society of Automotive Engineers (SAE) documents ARP 5607, “Legibility of Print on Aerospace Wire and Cables,” and AS 5942, “Marking of Electrical Insulating Mat erials,” provides guidance on this subject.

5 Subparagraph 25.1711(d) requires that the means used to identify an EWIS component may not have an adverse effect on component performance throughout its design life.

a. Certain wire marking methods have potential to damage wire insulation. Hot - stamp mark ing is one such method. According to SAE (Society of Automotive Engineers) aerospace information report AIR5575, “Hot Stamp Wire Marking Concerns for Aerospace Vehicle Applications,” the hot - stamp marking method is not well suited for Powered by EASA eRules Page 1204 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION today’s generation of thin wall aircraft wiring. As noted in that document, wire insulation has become markedly thinner over the years since the procedure was first introduced in the 1940s. Because of this, problems have arisen over wire damage from excessive penetration by th e hot stamp process. The document further states: “The frequent need for adjustments in temperature, pressure, and swell time inherent to achieving legible hot stamp wire marking provides many opportunities for error. The controls, methods, and guidance ne cessary to achieve satisfactory performance with hot stamp marking are often not made available to operators in smaller wire maintenance facilities.” In addition it should be established from the wire manufacturer that hot stamp printing is or is not suita ble for the particular wire.

b. If damage to the insulation occurs during the marking process, it may fail later in service after exposure to the sometimes - harsh environmental conditions of aircraft use. While CS 2 5.1711 does not prohibit use of hot - stamp marking, its use is discouraged. To comply with this paragraph, if the hot - stamp marking process is used, the guidelines of SAE recommended practice ARP5369, “Guidelines for Wire Identification Marking Using the Ho t Stamp Process” or equivalent should be followed.

c. In some cases it may not be practicable to mark an EWIS component directly because of component size or identification requirements. In this case other methods of identification such as a label or sleev e should be used.

6 CS 25.1711(e) requires that EWIS modifications to the type design maintain consistency with the identification scheme of the original type design. It requires that EWIS modifications to the type design take into consideration the ident ification scheme of the original type design. This is to ensure that the consistency required by CS 25.1711(a) is maintained when a modification is installed. The intent of this requirement is to provide continuity for EWIS identification on a particular model. It is not the intent of the requirement to impose on the modifier the exact wire identification methods of the aeroplane manufacturer. However, since the purpose of C S 25.1711 is to make it easy to identify those aeroplane systems essential to the safe operation of the aeroplane, it is in the best interest of safety that designers of any modifications to the original design consider the approved type design identificat ion methods. For example it would not be appropriate for a modifier to use purple wire to identify a specific flight critical system when the approved type design used the colour green, especially if the type design already uses purple wire to identify non - essential systems. Such a scheme could cause confusion and lead future modifiers or maintainers to believe that the routing of purple wires with green wires (and thus critical systems with non - essential systems) is acceptable. The paragraph does not presc ribe a particular method for identification but is meant to ensure that consistent identification is maintained throughout the life of the aeroplane.

7 CS 25.981(d) states that "...Visible means of identify ing crit ical features of the design must be placed in areas of the aeroplane where foreseeable maintenance, actions, repairs, or a lterations may compromise the critical design configuration control limitations (e.g., colour - coding of wire to identify separation limitation). These visible means must also be identified as CDCCL " The design approval holder should define a method of ensuring that this essential information will: — be communicated by statements in appropriate manuals, such as wiring diagram manuals, and — be evident to those who may perform and approve such repairs and alterations.

An example of a critical design configuration control limitation that would result in a requirement for visible identification means would be a requirement to maint ain wire separation between FQIS (fuel quantity indication system) wiring and other electrical circuits Powered by EASA eRules Page 1205 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION that could introduce unsafe levels of energy into the FQIS wires. Acceptable means of providing visible identification means for this limitation would i nclude colo u r - coding of the wiring or, for retrofit, placement of identification tabs at specific intervals along the wiring.

8 Types of EWIS component identification.

There are at least four types of EWIS component identification, which are accomplished at different stages. They are listed and described below.

a. Component manufacturer part number.

EWIS components should be identified by their manufacturer in accordance with the International Organization for Standardization document ISO 2574, “Aircraf t – Electrical Cables – Identification Marking,” or similar specifications. This identification comprises product part number, manufacturer identification, and, when possible or specifically required, batch identification or year of manufacture.

This helps ensure: — Identification and traceability of the component.

— Verification of compliance with the aircraft certification basis.

— Accuracy in manufacture, maintenance, quality control, storage and delivery.

— Verification of the use of approved/qualified sourcing .

— Monitoring of the aircraft configuration during the aircraft life.

(1) EWIS component manufacturer identification.

It is common practice to use the five - digit/letter C.A.G.E. code (Government and Commercial Entity Code), for manufacturer identification, particularly for wires.

Alternatively, for small components whose size may make it difficult to use other forms of clear identification, a logo may be used.

(2) Identification intervals.

Wires and cables should be identified at inter vals of not more than 38 cm (15 inches). This interval is different than the interval used by airframe manufacturers to prevent the possibility of two identifications overlapping over the entire length of the run, which could render both identifications illegible.

(3) Types of wire manufacturer markings.

Wire manufacturer markings should generally be green to differentiate them from the black marking typically used by the aeroplane manufacturer, but other contrasting colours are also acceptable. The preferred marking process i s the “ink transfer” or “ink jet” type, with post curing to increase resistance to mechanical or chemical wear. As stated above, hot stamp marking method has the potential to damage wire insulation and its use is discouraged.

(4) The component technical specification should include methods used for identification and legibility during the design life of the component.

b. Airframe manufacturer component function identification number.

In addition to the type identification imprint ed by the original wire manufacturer, aircraft wire should also contain a unique circuit identification coding that is accomplished at time of harness assembly. This allows existing installed wire to be identified as to its Powered by EASA eRules Page 1206 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIR ING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION performance capabilities when co nsidering replacement. Inadvertent use of a lower performance and unsuitable replacement wire can thus be avoided. Identification of EWIS components by the airframe manufacturer helps ensure: — Identification and inspection of cable runs.

— Accuracy of manufac ture, maintenance, quality control, storage and delivery.

— Verification of the system to which the component belongs.

— Identification of components related to systems required for safe flight, landing, or egress or that have the potential to impact the fligh t crew’s ability to cope with adverse operating conditions.

Identification of EWIS components should clearly correspond to aircraft wiring manuals.

c. Airframe manufacturer routing identification and modification.

Electrical drawings should describe wire routings through the entire aeroplane (for example: incompatibility between routes, minimum distance between routes, absolute ban of combining bundles) and be available in the maintenance documentation as required by Appendix H to CS 25. This information ensures that modification designers and maintenance personnel are aware of the defined physical segregation of the different routes of the aircraft model they are working on. Coding for identification of routes or b undles used on aircraft should be displayed by adequate means such as labels, tags, placards, coloured ties, bar - codes. This type of component identification helps ensure: — Identification and inspection of bundles.

— Accuracy of manufacture, maintenance, qua lity control, storage and delivery.

— Determination of the type of route, or route function, (feeder power, radio etc.).

— Clear identification of systems that require physical segregation (i.e. to detect the possible mix of different routes/bundles, the misrouting of a system in an area, etc).

— Identification of routes taken by systems that are required for safe flight, landing, egress, or have the potential to impact the ability of the flight crew to cope with adverse operating conditi ons.

(1) Means used for this identification should be appropriate for the component type.

The identification process used should not cause degradation of the characteristics of any of the wire cables or other EWIS components in the harness.

(2) Modificati on and repairs identification, in a form that helps ensure the original aeroplane manufacturer’s identification scheme, should be maintained throughout the service life of the aeroplane.

( 3) Wires and cables should be identified at intervals of preferably not more than 46 cm (18 inches) and should not obscure the identification markings of the EWIS component manufacturer or airframe manufacturer component function identification number. This identification interval is different than the interval used by wir e manufacturers to prevent the possibility of two identifications overlapping over the entire length of the run, which could render both identifications illegible.

Also, exceptions can be made for short runs of wires or cables or when the majority Powered by EASA eRules Page 1207 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION of the w ire or cable is installed in a manner that facilitates easy reading of the identification markings d. Identification of user EWIS modification or repair – (operator’s identification coding).

Repairs or modifications to EWIS should follow the identification guidance given in the above paragraphs for aeroplane manufacturers. This helps ensure that the original aeroplane manufacturer’s identification scheme is not compromised by future modifications or repairs and is maintained throughout the service life of t he aeroplane.

[Amdt 25/5] [Amdt 25/9]

CS 25.1713 Fire Protection; EWIS

ED Decision 2008/006/R (See AMC 25.1713 ) (a) All EWIS components must meet the applicable fire and smoke protection requirements of CS 25.831(c) and CS 25.863 .

(b) EWIS components that are located in designated fire zones and are necessary during emergency procedures must be at least fire resistant.

(c) Insulation on electrical wire and electrical cable, including materials used to provide additional protection for the wire and cable installed in any area of the aerop lane, must be self - extinguishing when tested in accordance with the applicable portions of Part I of Appendix F.

[Amdt 25/5]

AMC 25.1713 Fire protection: EWIS

ED Decision 2008/006/R The intent of CS 25.1713 is to ensure that the EWIS does not fail in such a way as to propagate fire and produce hazardous quantities of smoke and toxic fumes.

1 Subparagraph 25.1713(a) requires that all EWIS components meet the a pplicable fire and smoke protection requirements of CS 25.831(c) . After reasonably probable failures or malfunctions, EWIS components should not cause harmful or hazardous concentrations of gases or vapors in exces s of the levels prescribed in CS 25.831(b)(1) and (2) .

2 Subparagraph 25.1713(b) requires that EWIS components located in designated fire zones and are used during emergency procedures must be at least fire resist ant. This requirement is intended to help ensure that emergency services on the aeroplane are available in the event of a fire. EWIS components in regions immediately behind firewalls and in engine pod attachment structures should be made of such materials and installed at such a distance from the firewall that they will not suffer damage that could hazard the aeroplane if the surface of the firewall adjacent to the fire is heated to 1100° C for 15 minutes.

3 Subparagraph 25.1713(c) requires that insulation on electrical wire and electrical cable installed anywhere in the aeroplane be self - extinguishing when tested in accordance with the applicable portions of part I of Appendix F of CS 25.

Powered by EASA eRules Page 1208 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION In addition, to protect against propagation of a fire, EWIS components other than wire and cable should be designed using non - flammable and self - extinguishing materials as tested to meet the intent of Part I of Appendix F.

[Amdt 25/5]

CS 25.1715 Electrical bonding and protection against static

electricity; EWIS

ED Decision 2008/006/R (See AMC 25.1715 ) (a) EWIS components used for electrical bonding and protection against static electricity must meet the requirements of CS 25.899.

(b) Electrical bonding provided by EWIS components must provide an adequate electrical return path under both normal and fault conditions, on aeroplanes having earthed electrical systems (see CS 25.1353(e) ).

[Amdt 25/5 ]

AMC 25.1715 Electrical bonding and protection against static

electricity: EWIS

ED Decision 2008/006/R 1 The build - up and subsequent discharge of static electricity has the potential to create hazardous conditions for both aeroplane systems and the aeroplane occupants. Static can cause physical injury, interfere with installed electrical/electronic equipment, and cause ignition of flammable vapours. All EWIS components used for bonding and protection against static electricity play a vital role in en suring the integrity of the bonds.

2 CS 25.1715(a) requires that EWIS used for electrical bonding and protection against static electricity meet the requirements of CS 25.8 99 . To minimise the hazardous effects of static discharge, EWIS components should be selected, designed, and installed so that the cross - sectional area of bonding paths used for primary and secondary bonding ensure that an appropriately low electrical impe dance is obtained and maintained throughout the expected service life of the components. The maximum resistance for electrical bonds varies depending on the type of bond, e.g., ground stud, between connector shell and structure.

3 CS 25.1715(b) requires that EWIS components used for any electrical bonding purposes (not just those used for protection against static electricity) provide an adequate electrical return path under both normal and fault conditions. EWIS c omponents should be selected, designed, and installed so that the cross - sectional area of bonding paths used for primary and secondary bonding paths ensure that appropriately low electrical impedance is obtained and maintained throughout the expected servi ce life of the components.

[Amdt 25/5] Powered by EASA eRules Page 1209 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INF ORMATION

CS 25.1717 Circuit protective devices; EWIS

ED Decision 2008/006/R (See AMC 25.1717 ) EWIS components must be designed and installed so they are compatible with the circuit p rotection devices required by CS 25.1357 , so that a fire or smoke hazard cannot be created under temporary or continuous fault conditions.

[Amdt 25/5]

AMC 25.1717 Circuit protective devices: EWIS

ED Decision 2008/006/R CS 25.1717 requires that all applicable EWIS components (for example wires, connector pins, terminal blocks, relays, splices) be compatible with the circuit protective devices required by CS 25.1357 . This means that when selecting the EWIS components to be used for a specific application, care must be taken to ensure that the proper type and rating of the circuit protective device (e.g., circuit breaker) is selected so that the wire and cables are adequately protected from over - current situations.

[Amdt 25/5]

CS 25.1719 Accessibility Provisions; EWIS

ED Decision 2008/006/R (See AMC 25.1719 ) Means must be provided to allow for inspection of EWIS and the replacement of its components as necessary for continued airworthiness.

[Amdt 25/5]

AMC 25.1719 Accessibility provisions: EWIS

ED Decision 2008/006/R CS 25.1719 requires that means be provided to allow for inspection of EWIS and replacement of their components as necessary for continued airworthiness.

1 The intent of CS 25 .1719 is to ensure that EWIS components are installed so that inspections, tests, repairs, and replacements can be undertaken with a minimum of aircraft disassembly.

When adjacent structures and aircraft systems components must be removed to allow access t o wire installations, new possibilities for contamination, chafing, and other types of damage are introduced.

2 As far as practicable, EWIS components should be installed so that inspections, tests, repair, and replacements can be done without undue disturbance to the EWIS installation or to surrounding aircraft systems. During the design phase, consider minimizing the amount of aircraft disassembly required to perform such tasks. For example, wiring inside conduit may incur damage from chafing agains t the sides of the conduit. If failure of wiring inside a conduit can lead to an unsafe condition, a means should be provided for inspection of those wires.

Inspection may be by testing or other means acceptable to the Agency and should be included in the maintenance requirements that are part of the Instructions for Continued Airworthiness.

[Amdt 25/5] Powered by EASA eRules Page 1210 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION

CS 25.1721 Protection of EWIS

ED Decision 2008/006/R (See AMC 25.1721 ) (a) No cargo or baggage compartment may con tain any EWIS whose damage or failure may affect safe operation, unless the EWIS is protected so that: (1) It cannot be damaged by the movement of cargo or baggage in the compartment.

(2) Its breakage or failure will not create a fire hazard.

(b) EWIS must be designed and installed to minimise damage and risk of damage to EWIS by movement of people in the aeroplane during all phases of flight, maintenance, and servicing.

(c) EWIS must be designed and installed to minimise damage and risk of damage to EWIS b y items carried onto the aeroplane by passengers or cabin crew.

[Amdt 25/5]

AMC 25.1721 Protection of EWIS

ED Decision 2008/006/R 1 The requirements of this paragraph are intended to prevent damage to EWIS by passengers, crew members, baggage or cargo hand lers, or maintenance and service personnel.

CS 25.1721(a) is applicable to EWIS located in cargo or baggage compartments, and CS 25.1721(b) and (c) apply to EWIS located el sewhere in the aeroplane.

2 CS 25.1721(a) , specifies that EWIS cannot be located in cargo or baggage compartments if its damage or failure may affect safe operation unless it cannot be damaged by movement of cargo or baggage in the compartment, or its breakage or failure will not create a fire hazard. This means that any EWIS located in a cargo or baggage compartment must be protected against damage. EWIS in general and wiring in particular should be installed so th e structure affords protection against its use as a handhold and damage from cargo. Wires and wire bundles should be routed or otherwise protected to minimise the potential for maintenance personnel stepping, walking, or climbing on them. Wire bundles shou ld be routed along heavier structural members whenever possible. If the structure does not afford adequate protection, other protection means such as a mechanical guard should be provided. When EWIS is close to sharp metal edges, the edges should be protec ted to prevent chafing. Additionally, wires should not be routed between aircraft skin and fuel lines in the same plane.

3 Subparagraph 25.1721(b) requires that EWIS be designed and installed to minimise the risk of damage by movement of people in the aeroplane during all phases of flight, or during maintenance, and servicing. Some examples of areas of concern are the flight d eck, passenger compartment, crew rest area, wheel wells, and wing leading and trailing edges.

a. Special consideration should be given to EWIS that are routed to, around, and on passenger seats. It should be protected so that passengers cannot damage it w ith their feet or access it with their hands.

b. EWIS located in the lavatories should not be readily accessible by passengers or aircraft cleaners. It should be designed and installed so that it cannot be damaged by the removal and replacement of items s uch as rubbish containers.

c. EWIS located in the galleys should not be readily accessible by cabin crew, aircraft cleaners, or passengers. EWIS should be designed and installed so that galley equipment, including galley carts, cannot come into contact wit h it and cause damage.

Powered by EASA eRules Page 1211 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – EL ECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION d. As with EWIS located in baggage and cargo compartments, EWIS in areas such as landing gear bays, the APU compartment, and electrical and electronic bays should be designed and installed to minimise potential for maintenance person nel stepping, walking, or climbing on them. Where the structure does not afford adequate protection, other protection such as a mechanical guard should be provided.

[Amdt 25/5]

CS 25.1723 Flammable fluid protection; EWIS

ED Decision 2008/006/R (See AMC 25.1723 ) EWIS components must be considered to be a potential ignition source in each area where flammable fluid or vapours might escape by leakage of a fluid system and must meet the requirements of CS 25.863 .

[Amdt 25/5]

AMC 25.1723 Flammable fluid protection: EWIS

ED Decision 2008/006/R CS 25.1723 requires that EWIS located in areas where flammable fluid or vapours might escape must be considered to be a potential ignition source. As a result, these EWIS components must meet the requirements of CS 25.863. CS 25.863 requires that efforts be made to minimise the probability of ignition of f luids and vapours, and the hazards if ignition does occur. See CS 25.1707 for the separation requirements between EWIS and flammable fluids.

EWIS components located in fuel vapour zones should be qualified as expl osion proof, where appropriate, in accordance with Section 9 of E UROCAE ED - 14 / RTCA Document DO - 160 or other equivalent approved industry standard. The possibility of contamination with flammable fluids due to spillage during maintenance action should als o be considered.

[Amdt 25/5]

CS 25.1725 Powerplants; EWIS

ED Decision 2008/006/R (a) EWIS associated with any powerplant must be designed and installed so that the failure of an EWIS component will not prevent the continued safe operation of the remaining powerplants or require immediate action by any crew member for continued safe operation, in accordance with the requirements of CS 25.903(b) .

(b) Design precautions must be taken to minimise hazards to the aeroplane due to EWIS damage in the event of a powerplant rotor failure or of a fire originating within the powerplant, which burns through the powerplant case, in accordance with the requirements of CS 25.903(d)(1) .

[Amdt 25/5] Powered by EASA eRules Page 1212 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART H – ELECTRICAL WIRING (CS - 25) INTERCONNECTION SYSTEMS SUPPLEMENTARY INFORMATION

CS 25.1727 Flammable Fluid Shutoff Means; EWIS

ED Decision 2008/006/R EWIS associated with each flammable fluid shutoff means and control must be fireproof or must be located and protected so that any fire in a fire zone will not affect operation of the flammable flu id shutoff means in accordance with the requirements of CS 25.1189 .

[Amdt 25/5]

CS 25.1729 Instructions for Continued Airworthiness; EWIS

ED Decision 2008/06/R The applicant must prepare Instructions for Continued Airworthiness applicable to EWIS in accordance with the requirements of CS 25.1529 and Appendix H paragraphs H25.4 and H25.5 .

[Amdt 25/5]

CS 25.1731 Powerplant and APU fire detector system; EWIS

ED Decision 2008/006/R (a) EWIS that are part of each fire or overheat detector system in a fire zone must be at least fire - resistant.

(b) No EWIS component of any fire or overheat detector system for any fire zone may pass through another fire zone, unless: (1) It is protected against the possibility of false warnings resulting from fires in zones through which it passes; or (2) Each zone involved is simultaneously protected by the same detector and extinguishing system.

[Amdt 25/5] Powered by EASA eRules Page 1213 of 1495 | Jan 2023

Next: SUBPART J – AUXILIARY POWER UNIT INSTALLATIONS →

SUBPART J – AUXILIARY POWER UNIT INSTALLATIONS

Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS GENERAL

SUBPART J – AUXILIARY POWER UNIT INSTALLATIONS

GENERAL

CS 25J 901 Installation

ED Decision 2016 / 010 / R (See AMC 25J901) (a) For the purpose of this subpart, the APU installation includes: (1) The APU; (2) Each component that affects the control of the APU; (3) Each component that affects the safety of the APU.

(b) For the purpose of this subpart, (1) An essential APU is defined as an APU whos e function is required for the dispatch of the aeroplane and/or continued safe flight.

(2) A non - essential APU is defined as an APU whose function is a matter of convenience, either on the ground or in flight, and may be shut down without jeopardising saf e aeroplane operation.

(c) For each APU: (1) The installation must comply with: (i) The installation instructions provided under CS - APU, and (ii) The applicable provisions of this subpart for non - essential APUs, or (iii) The applicable provisions of this subpart for essential APUs.

(2) The components of the installation must be constructed, arranged, and installed so as to ensure their continued safe operation between normal inspections or overhauls. (See AMC 25J9 01(c)(2) .)

(3) The installation must be accessible for necessary inspections and maintenance; and (4) The major components of the installation must be electrically bonded to the other parts of the aeroplane. (See AMC 25J901(c)(4) .)

(d) The APU installation must comply with CS 25.1309, except that the effects of the following need not comply with CS 25.1309(b) (see AMC 25.901(c) ): (1) APU case burn through or rupture; and (2) Uncontained APU rotor failure.

[Amdt 25/1] [Amdt 25/18] Powered by EASA eRules Page 1214 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS GENERAL

AMC 25J901(c )(2) Assembly of Components

ED Decision 200 5 / 006 /R The objectives of CS 25.671(b) should be satisfied with respect to APU systems, where the safety of the aeroplane could otherwise be jeopardised.

[Amd t 25/1]

AMC 25J901(c )(4) Electrical Bonding

ED Decision 200 5 / 006 /R Where the APU is not in direct electrical contact with its mounting the engine should be electrically connected to the main earth system by at least two removable primary conductors, one on each side of the APU.

[Amdt 25/1]

CS 25J 903 Auxiliary power unit

ED Decision 200 5 / 006 /R (a) Each APU must meet the appropriate requirements of CS - APU for its intended function: (1) Essential: Category 1 APU, (2) Non - essential: Category 1 or Category 2 APU.

(b) Reserved (c) Control of APU rotation and shut - down capability.

(1) It shall be possible to shut down the APU from the flight deck in normal and emergency conditions.

(2) Where continued rotation of an APU could jeopardise the safety of the aeroplane, there must be a means for stopping rotation. Each component of the stop ping system located in the APU compartment must be at least fire resistant.

(d) For APU installation: (1) Design precautions must be taken to minimise the hazards to the aeroplane in the event of an APU rotor failure or of a fire originating within the AP U which burns through the APU casing. (See AMC 20 - 128A.)

(2) The systems associated with APU control devices, systems and instrumentation, must be designed to give reasonable assurance that those APU operating limitations that adversely affect turbine rot or structural integrity will not be exceeded in service.

(e) In - flight start capability.

(1) For non - essential APUs that can be started in - flight and all essential APUs: (i) Means must be provided to start the APU in - flight, and (ii) An altitude and airspeed envelope must be established and demonstrated for APU in - flight starting.

(2) For essential APUs: Cold soak must be considered in establishing the en velope of CS 25J903(e)(1)(ii) .

[Amdt 25/1] Powered by EASA eRules Page 1215 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS GENERAL

CS 25J 9 39 APU operating characteristics

ED Decision 2005/006/R (a) APU operating characteristics must be investigated in all aeroplane operating conditions from APU start until shutdown to determine that no adverse characteristics (such as stall, surge, or flam e - out) are present, to a hazardous degree, during normal and emergency operation within the range of operation limitations of the aeroplane and of the APU.

(b) Reserved (c) The APU air inlet system may not, as a result of air - flow distortion during normal operation, cause vibration harmful to the APU.

(d) It must be established over the range of operating conditions for which certification is required, that the APU installation vibratory conditions do not exceed the critical frequencies and amplitud es established under CS - APU 120 .

[ Amdt 25/1]

CS 25J 943 Negative acceleration

ED Decision 200 5 / 006/ R No hazardous malfunction of an APU or any component or system associated with the APU may occur when the aeroplane is operated at the negative acceleratio ns within the flight envelopes prescribed in CS 25.333 . This must be shown for the greatest duration expected for the acceleration.

[Amdt 25/1]

AMC 25J 943 APU Operating Characteristics

ED Decision 200 5 / 006 /R 1 Compliance with CS 25J943 should be shown by design analysis and flight tests. The flight tests should include manoeuvre in which less than zero 'g' occurs for one continuous period of at least 5 seconds and a furt her manoeuvre with two periods of less than zero 'g' with a total time for these two periods of at least 5 seconds.

2 In the case of non - essential APUs, inadvertent shut - down due to negative accelerations is acc eptable.

[Amdt 25/1] Powered by EASA eRules Page 1216 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS FUEL SYSTEM

FUEL SYSTE M

CS 25J951 General

ED Decision 2010/005 /R (a) Each fuel system must be constructed and arranged to ensure a flow of fuel at a rate and pressure established for proper APU functioning under each likely operating condition, including any manoeuvre for which certification is requested and during which the APU is permitted to be in operation.

(b) For essential APUs: Each fuel system must be arranged so that any air which is introduced into the system will not result in flameout.

(c) For essential APUs: Each fuel system for an essential APU must be capable of sustained operation throughout its flow and pressure range with fuel initially saturated with water at 26.7 °C and having 0.2 0 cm of free water per liter added and cooled to the most critical condit ion for icing likely to be encountered in operation.

[Amdt 25/1] [Amdt 25/9]

CS 25J 952 Fuel system analysis and test

ED Decision 200 5 / 006 /R (a) Proper fuel system functioning under all probable operating conditions must be shown by analysis and those test s found necessary by the Agency. Tests, if required, must be made using the aeroplane fuel system or a test article that reproduces the operating characteristics of the portion of the fuel system to be tested.

(b) The likely failure of any heat exchanger u sing fuel as one of its fluids may not re sult in a hazardous condition.

[Amdt 25/1]

CS 25J 953 Fuel system independence

ED Decision 200 5 / 006 /R Each fuel system must allow the supply of fuel to the APU: (a) Through a system independent of each part of the system supplying fuel to the main engines; or (b) From the fuel supply to the main engine if provision is made for a shut - off means to isolate the APU fuel line.

[Amdt 25/1] Powered by EASA eRules Page 1217 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS FUEL SYSTEM

CS 25J955 Fuel Flow

ED Decision 2016/010 /R (See AMC 25J955) (a) Each fuel s ystem must provide at least 100 percent of the fuel flow required by the APU under each intended operating condition and manoeuvre. Compliance must be shown as follows: (1) Fuel must be delivered at a pressure within the limits specified for the APU.

(2) For essential APUs: (i) The quantity of fuel in the tank may not exceed the amount established as the unusable fuel supply for that tank under the requirements of CS 25.959 plus that necessary to show complianc e with this paragraph.

(ii) Each main pump must be used that is necessary for each operating condition and attitude for which compliance with this paragraph is shown, and the appropriate emergency pump must be substituted for each main pump so used.

(iii) If there is a fuel flowmeter, it must be blocked and the fuel must flow through the meter or its bypass. (See AMC 25J955(a)(2)(iii ).)

(b) For essential APUs: If an APU can be supplied with fuel from more than one t ank, the fuel system must, in addition to having appropriate manual switching capability, be designed to prevent interruption of fuel flow to that APU, without attention by the flight crew, when any tank supplying fuel to that APU is depleted of usable fue l during normal operation, and any other tank, that normally supplies fuel to that APU, contains usable fuel.

[Amdt 25/1] [Amdt 25/18]

AMC 25J955(a)(2)(iii) Fuel Flow

ED Decision 2005/006/R The word "blocked" should be interpreted to mean "with the moving parts fixed in the posit ion for maximum pressure drop".

[Amdt 25/1]

CS 25J961 Fuel system hot weather operation

ED Decision 2005/006/R For essential APUs: (a) The fuel supply of an APU must perform satisfactorily in hot weather operation. It must be shown that the fuel system from the tank outlet to the APU is pressurised under all intended operations so as to prevent vapour formation. Alternatively, it must be shown that there is no evidence of vapour lock or other malfunctioning during a climb from the altitude of the airport selected by the applicant to the maximum altitude established as an operating limitation under CS 25J1527 , with the APU operating at the most critical conditions for vapour formation but not exceeding the maximum essential load conditions. If the fuel supply is dependant on the same fuel pumps or fuel supply as the main engines, the main engines mus t be operated at maximum continuous power. The fuel temperature must be at least 43°C at the start of the climb.

Powered by EASA eRules Page 1218 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS FUEL SYSTEM (b) The test prescribed in sub - paragraph (a) of this paragraph may be performed in flight or on the ground under closely simulated flight cond itions. If a flight test is performed in weather cold enough to interfere with the proper conduct of the test, the fuel tank surfaces, fuel lines, and other fuel system parts subject to cold air must be insulated to simulate, insofar as pract icable, flight in hot weather.

[Amdt 25/1]

CS 25J977 Fuel Tank Outlet

ED Decision 2005/006/R For essential APUs: (a) There must be a fuel strainer for the fuel tank outlet or for the booster pump. This strainer must prevent the passage of any object that could restrict fuel flow or damage any fuel system component.

(b) The clear area of each fuel tank outlet strainer must be at least five times the area of the outlet line.

(c) The diameter of each strainer must be at least that of the fuel tank outlet.

(d) Each finger strainer must be accessible for inspection and cleaning.

[Amdt 25/1] Powered by EASA eRules Page 1219 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS FUEL SYSTEM COMPONENTS

FUEL SYSTEM COMPONENTS

CS 25J991 Fuel Pumps

ED Decision 2008 /006/R (See AMC 25J991 ) For essential APUs: (a) Main pumps. Each fuel pump required for proper essential APU operation, or required to meet the fuel system requirements of this subpart (other than those in sub - paragraph (b) of this paragraph), is a main pump. For each main pump, provision must be made to allow the bypa ss of each positive displacement fuel injection pump other than a fuel pump approved as part of the APU.

(b) Emergency pumps. There must be emergency pumps or another main pump to feed an essential APU immediately after failure of any main pump (other than a fuel pump approved as part of the APU).

[Amdt 25/1] [Amdt 25/5]

AMC 25J991 Fuel Pumps

ED Decision 2005/006/R If the fuel supply to the APU is taken from the fuel supply to the main engine, no separate pumps need be provided for the APU.

[Amdt 25/1]

CS 25J 993 Fuel system lines and fittings

ED Decision 200 5 / 006 /R (a) Each fuel line must be installed and supported to prevent excessive vibration and to withstand loads due to fuel pressure and accelerated flight conditions.

(b) Each fuel line connected to components of the aeroplane between which relative motion could exist must have provisions for flexibility.

(c) Each flexible connection in fuel lines that may be under pressure and subjected to axial loading must use flexible hose assemblies.

(d) Flexible hose must be approved or must be shown to be suitable for the particular application.

(e) No flexible hose that might be adversely affected by exposure to high temperatures may be used where excessive temperatures will exist during operation or after an APU shut - down.

(f) Each fuel line within the fuselage must be designed and installed to allow a reasonable degree of deformation and stretching without leakage.

[Amdt 25/1] Powered by EASA eRules Page 1220 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS FUEL SYSTEM COMPONENTS

CS 25J 994 Fuel system components

ED Decision 200 7 / 010 /R Fuel system components in an APU compartment or in the fuselage must be protected from damage which could result in spillage of enough fuel to constitute a fire hazard as a result of a wheels - up lan ding on a paved runway under each of the conditions prescr ibed in CS 25.721(b).

[Amdt 25/1] [Amdt 25/3]

CS 25J 995 Fuel valves

ED Decision 200 5 / 006/ R In addition to the requirements of CS 25J1189 for shut - off means, each fuel valve must be supported so that no loads resulting from their operation or from accelerated flight conditions are transmitted to the lines attached to the valve, unless adequate strength margins under all loading conditions a re provided in the lines and connections.

[Amdt 25/1]

CS 25J997 Fuel strainer or filter

ED Decision 2005/006/R For essential APUs: There must be a fuel strainer or filter between the fuel tank outlet and the inlet of either the fuel metering device or an APU driven positive displacement pump, whichever is nearer the fuel tank outlet. This fuel strainer or filter must: (a) Be accessible for draining and cleaning and must incorporate a screen or element which is easily removable; (b) Have a sediment trap and drain except that it need not have a drain if the strainer or filter is easily removable for drain purposes; (c) Be mounted so that its weight is not supported by the connecting lines or by the inlet or outlet connections of the strainer or filter itself, unless adequate strength margins under all loading conditions are provided in the lines and connections; and (d) Have the capacity (with respect to operating limitations established for the APU) to ensure that APU fuel system functioning is not impaired, with the fuel contaminated to a degree (with respect to particle size and density) that is greater than that estab lis hed for the APU in CS - APU 250 .

[Amdt 25/1] Powered by EASA eRules Page 1221 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS OIL SYSTEM

OIL SYSTEM

CS25J 1011 Oil System General

ED Decision 200 5/006 /R (a) Each APU must have an independent oil system that can supply it with an appropriate quantity of oil at a temperature not above that safe for continuous operation.

(b) The usable oil capacity may not be less than the product of the endurance of the aeroplane and the maximum allowable oil consumption of the APU plus a suitable margin to ensure system circulation.

[Amdt 25/1]

CS 25A1017 Oil lines and fittings

ED Decision 200 5 / 006 /R (a) Each oil line must meet the requirements of CS 25J993 and each oil line and fitting in any designated fire zone must meet the requirements of CS 25J1183 .

(b) Breather lines must be arranged so that: (1) Condensed water vapour that might freeze and obstruct the line cannot accumulate at any point; (2) The breather discharge does not constitute a fire haza rd; (3) The breather does not discharge into the APU air intake system.

[Amdt 25/1]

CS 25J1019 Oil Filter

ED Decision 2005/006/R Where there is a filter in the APU lubrication system through which all the oil flows, it must be constructed and installed so that oil may flow at an acceptable rate through the rest of the system with the filter element completely blocked. An impending filter by - pass indication is required.

[Amdt 25/1 ]

CS 25J 1021 Oil system drains

ED Decision 200 5 / 006 /R A drain (or drains) must be provided to allow safe drainage of the oil system. Each drain must: (a) Be accessible; and (b) Have manual or automatic means for positive locking in the closed position.

[Amdt 25/1] Powered by EASA eRules Page 1222 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS OIL SYSTEM

CS 25J 1023 Oil radiators

ED Decision 200 5 / 006 /R Each oil radiator must be able to withstand, without failure, any vibration, inertia, and oil pressure load to which it would be subjected in operation.

[Amdt 25/1]

CS 25J 1025 Oil valves

ED Decision 200 5 / 006 /R (a) Each oil shut - off must meet the re quirements of CS 25J1189.

(b) Each oil valve must have positive stops or suitable index provisions in the "on'' and "off'' positions and must be supported so that no loads resulting from its operation or from accel erated flight conditions are transmitted to the lines attached to the valve, unless adequate strength margins under all loading conditions are provided in the lines and connections.

[Amdt 25/1] Powered by EASA eRules Page 1223 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS COOLING

COOLING

CS 25J 1041 General

ED Decision 200 5 / 006 /R (See AMC 25J1041 .)

The APU cooling provisions must be able to maintain the temperatures of APU components and fluids within the temperature limits established for these components and fluids, under critical ground and flight operating conditions, and after normal APU shutdown.

[Amd t 25/1]

AMC 25J1041 General

ED Decision 2005/006/R The need for additional tests, if any, in hot climatic conditions should take account of any tests made by the APU constructor to establish APU performance and functioning characteristics and of satisfactory operating experience of similar power units installed in other types of aeroplane.

The maximum climatic conditions for which compliance will be established should be declared and this should not be less severe than the ICAO Intercontinental Maximum Standard Climate (37·8 ° C o (100 F) at sea - level). If the tests are conducted under conditions which deviate from the maximum declared ambient temperature, the maximum temperature deviation should n ot normally exceed 13·9 ° C (25 ° F) .

[Amdt 25/1]

CS 25J 1043 Cooling tests

ED Decision 200 5 / 006 /R (a) General. Compliance with CS 25J1041 must be shown by tests, under critical co nditions. For these tests, the following apply: (1) If the tests are conducted under conditions deviating from the maximum ambient atmospheric temperature, the recorded APU temperatures must be corrected under sub - paragraph (c) of this paragraph.

(2) No corrected temperatures determined under sub - paragraph (a)(1) of this paragraph may exceed established limits.

(b) Maximum ambient atmospheric temperature. A maximum ambient atmospheric temperature corresponding to sea level conditions must be established. The temperature lapse rate is 2.0°C per 300 metres of altitude above sea level until a temperature of - 56.5°C is reached, above which altitude, the temperature is considered constant at - 56.5°C.

(c) Correction factor. Unless a more rational correction appl ies, temperatures of APU fluids and components for which temperature limits are established, must be corrected by adding to them the difference between the maximum ambient atmospheric temperature and the temperature of the ambient air at the time of the fi rst occurrence of the maximum component or fluid temperature re corded during the cooling test.

[Amdt 25/1] Powered by EASA eRules Page 1224 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes S UBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS COOLING

CS 25J 1045 Cooling test procedures

ED Decision 200 5 / 006 /R (a) Compliance with CS 25J1041 must be shown for the critical conditions that correspond to the applicable performance requirements. The cooling tests must be conducted with the aeroplane in the configuration, and operating under the co nditions that are critical relative to cooling. For the cooling tests, a temperature is 'stabilised' when its rate of change is less than 1°C per minute.

(b) Temperatures must be stabilised prior to entry into each critical condition being investigated, un less the entry condition normally is not one during which component and APU fluid temperatures would stabilise (in which case, operation through the full entry condition must be conducted before entry into the critical condition being investigated in order to allow temperatures to reach their natural levels at the time of entry).

(c) Cooling tests for each critical condition must be continued until: (1) The component and APU fluid temperatures stabilise; (2) The stage of flight is completed; or (3) An operating limitation is reached.

[Amdt 25/1] Powered by EASA eRules Page 1225 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS AIR INTAKE AND BLEED AIR DUCT SYSTEMS

AIR INTAKE AND BLEED AIR DUCT SYSTEMS

CS 25J 1091 Air intake

ED Decision 200 5 / 006 /R The air intake system for the APU: (a) Must supply the air required by the APU under each operating condition for which certification is requested, (b) May not draw air from within the APU compartment or other compartments unless the inlet is isolated from the APU accessories and power section by a firewall, (c) Must have means to prevent hazardous quan tities of fuel leakage or overflow from drains, vents, or other components of flammable fluid systems from entering, (d) Must be designed to prevent water or slush on the runway, taxiway, or other airport operating surface from being directed into the air intake system in hazardous quantities, (e) Must be located or protected so as to minimise the ingestion of foreign matter during takeoff, landing, and taxiing.

[Amdt 25/1]

CS 25J 1093 Air intake system icing protection

ED Decision 2016 / 010 /R (See AMC 25J10 93) (a) Each non - essential APU air intake system, including any screen if used, which does not comply with CS 25J1093(b) will be restricted to use in non - icing conditions, unless it can be shown that the APU complete with air intake system, if subjected to the icing conditions, defined in Appendices C, O and P will not affect the safe operation of the aeroplane.

b) For essential APUs: Each essential APU, with all icing protection systems operating, and screen if used, must: (1) operate throughout its flight power range in the icing conditions defined in Appendices C, O and P, and in falling and blowing snow within the limitations esta blished for the aeroplane for such operation, without the accumulation of ice on the APU, air intake system components or airframe components that would do any of the following: (i) Adversely affect installed APU operation or cause a sustained loss of po wer; or an unacceptable increase in gas path operating temperature; or an airframe/APU incompatibility; or (ii) Result in unacceptable temporary power loss or APU damage; or (iii) Cause a stall, surge, or flameout or loss of APU controllability (for ex ample, rollback).

Powered by EASA eRules Page 1226 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS AIR INTAKE AND BLEED AIR DUCT SYSTEMS (2) operate for a minimum of 30 minutes on the ground in the icing conditions shown in Table 1 of CS 25.1093(b)(2) , unless replaced by similar test conditions that are more critical. These cond itions must be demonstrated with the available icing protection (if applicable) at its critical condition, without adverse effect. The applicant must document the APU minimum ambient temperature demonstrated, if any, and establish the aeroplane operating l imitations. (See AMC 25J1093(b)) [Amdt 25/1] [Amdt 25/16] [Amdt 25/18]

AMC 25J1093(b) Essential APU air intake system de - icing and anti -

icing provisions

ED Decision 20 1 5/00 8 /R 1. General In establishing compliance with the requirements of CS 25J1093(b) , reference should be made to AMC 25.1093(b) . All the reference made to “engine” may be transposed to “esse ntial APU”.

Engine test (especially CS - E 780) may refer to essential APU icing test done for the APU certification, if any.

When the air intake is assessed separately, it should be shown that the effects of air intake icing would not invalidate the icing t ests of CS - APU. Factors to be considered in such evaluation are: a. Distortion of the airflow and partial blockage of the air intake.

b. The shedding into the APU of air intake ice of a size greater than the APU has been shown to ingest.

c. The icing of an y APU sensing devices, other subsidiary air intakes or equipment contained within the air intake.

d. The time required to bring the protective system into full operation 2. Operating limitations The conditions defined in CS 25J1093(b)(2) , in terms of time and temperature, should be considered as limitations necessary for the safe operation in freezing fog, and made available to the crew in the Aeroplane Flight Manual (refer to CS 25.1581 ).

Nevertheless, the applicant may use an analysis to substantiate safe operation of the APU at temperatures below the demonstrated minimum temperature. No limitation would then be required in the Aeroplane Flight Manual.

Any additional subs tantiation provided by the applicant to demonstrate the capability of an extended exposure beyond the conditions defined in CS 25J1093(b)(2) , based on further testing and/or analysis, will be considered by the Agency.

[Amdt 25/1] [Amdt 25/16] Powered by EASA eRules Page 1227 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATION S AIR INTAKE AND BLEED AIR DUCT SYSTEMS

CS 25J 1103 Air intake system ducts

ED Decision 200 5 / 006 /R (a) Each air intake system duct must be: (1) Drained to prevent accumulation of hazardous quantities of flammable fluid and moisture in the ground attitude. The drain(s) must not discharge in locations that might cause a fire hazard; and (2) Constructed of materials that will not absorb or trap sufficient quantities of flammable fluids such as to create a fire hazard.

(b) Each duct must be: (1) Designed to prevent air intake syst em failures resulting from reverse flow, APU surging, or inlet door closure; and (2) Fireproof within the APU compartment and for a sufficient distance upstream of the APU compartment to prevent hot gases reverse flow from burning through the APU air inta ke system ducts and entering any other compartment or area of the aeroplane in which a hazard would be created resulting from the entry of hot gases.

The materials used to form the remainder of the air intake system duct and plenum chamber of the APU must be capable of resisting the maximum heat conditions likely to occur.

(c) Each duct connected to components between which relative motion could exist m ust have means for flexibility.

[Amdt 25/1]

CS 25J1106 Bleed air duct systems

ED Decision 2005/006/R (a) For APU bleed air duct systems, no hazard may result if a duct failure occurs at any point between the air duct source and the aeroplane unit served by the bleed air.

(b) Each duct connected to components between which relative motion could exist must have a means for flexibility.

(c) Where the airflow delivery from the APU and main engine is delivered to a common manifold system, precautions must be taken to minimise the possibility of a hazardous condition due to reverse airflow throu gh the APU resulting from malfunctions of any component in the system.

[Amdt 25/1] Powered by EASA eRules Page 1228 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS EXHAUST SYSTEM

EXHAUST SYSTEM

CS 25J 1121 General

ED Decision 200 5 / 006 /R (a) Each exhaust system must ensure safe disposal of exhaust gases without fire hazard or carbon mon oxide contamination in any personnel compartment. For test purposes, any acceptable carbon monoxide detection method may be used to show the absence of carbon monoxide.

(b) Each exhaust system part with a surface hot enough to ignite flammable fluids or va pours must be located or shielded so that leakage from any system carrying flammable fluids or vapours will not result in a fire caused by impingement of the fluids or vapours on any part of the exhaust system including shields for the exhaust system.

(c) Each component that hot exhaust gases could strike, or that could be subjected to high temperatures from exhaust system parts, must be fireproof. All exhaust system components must be separated by fireproof shields from adjacent parts of the aeroplane tha t are outside the APU compartment.

(d) No exhaust gases may discharge so as to cause a fire hazard with respect to any flammable fluid vent or drain.

(e) Reserved (f) Each exhaust system component must be ventilated to prevent points of excessively high te mperature.

(g) Each exhaust shroud must be ventilated or insulated to avoid, during normal operation, a temperature high enough to ignite any flammable fluids or vapours external to the shroud.

[Amdt 25/1]

CS 25J 1123 Exhaust piping

ED Decision 200 5 / 006/ R (a) Exhaust piping must be heat and corrosion resistant, and must have provisions to prevent failure due to expansion by operating temperatures.

(b) Piping must be supported to withstand any vibration and inertia loads to which it would be subjected in op eration; and (c) Piping connected to components between which relative motion could exist m ust have means for flexibility.

[Amdt 25/1] Powered by EASA eRules Page 1229 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY PO WER UNIT (CS - 25) INSTALLATIONS APU CONTROLS AND ACCESSORIES

APU CONTROLS AND ACCESSORIES

CS 25J 1141 APU controls

ED Decision 200 5 / 006 /R (a) Means must be provided on the flight deck for starting, stopping, and emergency shutdown of each installed APU. Each control must: (1) Be located, arranged, and designed under CS 25.777(a)(b)(c)(d) and marked unde r CS 25.1555(a) ; and (2) Be located so that it cannot be inadvertently operated by persons entering, leaving, or moving normally on the flight deck; and (3) Be able to maintain any set position without constant attention by flight crew members and without creep due to control loads or vibration; and (4) Have sufficient strength and rigidity to withstand operating loads without failure and without excessive deflection; and (5) For flexible controls, be approved or must be shown to be suitable for the particular application.

(b) APU valve controls located in the flight deck must have: (1) For manual valves, positive stops or, in the case of fuel valves, suitable index provisions in the open and closed po sitions, (2) In the case of valves controlled from the flight deck other than by mechanical means, where the correct functioning of the valve is essential for the safe operation of the aeroplane, a valve position indicator which senses directly that the v alve has attained the position selected must be provided, unless other indications in the flight deck give the flight crew a clear indication that the valve has moved to the selected position. A continuous indicator need not be provided.

(c) For unattende d operation, the APU installation must: (1) Provide means to automatically shutdown the APU for the following conditions: (i) Exceedence of any APU parameter limit or existence of a detectable hazardous APU operating condition; and (ii) Bleed air duct fai lure between the APU and aeroplane unit served by the bleed air, unless it can be shown that no hazard exists to the aeroplane.

(2) Provide means to automatically shut off flammable fluids per CS 25J1189 in case of fire in the APU compartment.

(d) APU controls located elsewhere on the aeroplane, which are in addition to the flight deck controls, must meet the following requirements: (1) Each control must be located so that it cannot be inadvertently operated by p ersons entering, leaving, or moving normally in the area of the control; and (2) Each control must be able to maintain any set position without creep due to control loads, vibration, or other external forces resulting from the location.

Powered by EASA eRules Page 1230 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS APU CONTROLS AND ACCESSORIES (e) The portion of each APU control located in a designated fire zone that is required to be operated in the event of a fire must be at least fir e resistant.

[Amdt 25/1 ]

CS 25J 1163 APU accessories

ED Decision 200 5 / 006 /R (a) APU mounted accessories must be approved for installation on the APU concerned and use the provisions of the APU for mounting.

(b) Electrical equipment subject to arcing or sparking must be installed to minimise the probability of contact with any flammable fluids or vapours that might b e present in a free state.

(c) For essential APUs: If continued rotation of a failed aeroplane accessory driven by the APU affects the safe operation of the aeroplane, there must be means to prevent rotation without interfering with the continued operation of the APU.

[Amdt 25/1]

CS 25J1165 APU ignition systems

ED Decision 2005/006/R Each APU ignition system must be independent of any electrical circuit except those used for assisting, controlling, or analysing the operation of that system.

[ Amdt 25/1] Powered by EASA eRules Page 1231 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS APU FIRE PROTECTION

APU FIRE PROTECTION

CS 25J1181 Designated fire zones

ED Decision 200 5 / 006 /R (a) Any APU compartment is a designated fire zone.

(b) Each designated fire zone must meet the requirements of CS 25J1185 through CS 25J1203 .

[Amdt 25/1]

CS 25J 1183 Lines, fittings and components

ED Decision 200 5 / 006 /R (a) Except as provided in sub - paragraph (b) of this paragraph, e ach line, fitting, and other component carrying flammable fluid in any area subject to APU fire conditions, and each component which conveys or contains flammable fluid in a designated fire zone must be fire resistant, except that flammable fluid tanks and supports in a designated fire zone must be fireproof or be enclosed by a fireproof shield unless damage by fire to any non - fireproof part will not cause leakage or spillage of flammable fluid. Components must be shielded or located to safeguard against th e ignition of leaking flammable fluid.

(b) Sub - paragraph (a) of this paragraph does not apply to: (1) Lines and fittings already approved as part of an APU, and (2) Vent and drain lines, and their fittings, whose failure will not result in, or add to, a fire hazard.

(c) All components, including ducts, within a designated fire zone which, if damaged by fire could result in fire spreading to other regions of the aeroplane, must be fireproof. Those components within a designated fire zone, which could caus e unintentional operation of, or inability to operate essential services or equipment, must be fireproof.

[Amdt 25/1]

CS 25J 1185 Flammable fluids

ED Decision 200 5 / 006 /R (a) No tank or reservoir that is a part of a system containing flammable fluids or gases may be in a designated fire zone unless the fluid contained, the design of the system, the materials used in the tank, the shut - off means, and all connections, lines, and controls provide a degree of safety equal to that which would exist if the tank or reservoir were outside such a zone.

(b) There must be at least 12,7 mm of clear airspace between each tank or reservoir and each firewall or shroud isolating a designated fire zone.

(c) Absorbent materials close to flammable fluid system components tha t might leak must be covered or treated to prevent the absorption of hazardous quantities of fluids.

[Amdt 25/1] Powered by EASA eRules Page 1232 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS APU FIRE PROTECTION

CS 25J 1187 Drainage and ventilation of fire zones

ED Decision 200 5 / 006 /R (a) There must be complete drainage of each part of each designated fire zone to minimise the hazards resulting from failure or malfunctioning of any component containing flammable fluids.

The drainage means must be: (1) Effective under conditions expected to prevail when drainage is needed; and (2) Arranged so that no d ischarged fluid will cause an additional fire hazard.

(b) Each designated fire zone must be ventilated to prevent the accumulation of flammable vapours.

(c) No ventilation opening may be where it would allow the entry of flammable fluids, vapours, or flame from other zones.

(d) Each ventilation means must be arranged so that no discharged vapours will cause an additional fire hazard.

(e) Unless the extinguishing agent capacity and rate of discharge are based on maximum air flow through a zone, there must be means to allow the crew to shut off sources of force d ventilation to any fire zone.

[Amdt 25/1]

CS 25J 1189 Shut - off means

ED Decision 200 5 / 006 /R (See AMC 25.1189 ) (a) Each APU compartment specified in CS 25J1181(a) must have a means to shut - off or otherwise prevent hazardous quantities of flammable fluids, from flowing into, within, or through any designated fire zone, except th at shut - off means are not required for: (1) Lines, fittings and components forming an integral part of an APU; and (2) Oil systems for APU installations in which all external components of the oil system, including the oil tanks, are fireproof.

(b) The c losing of any fuel shut - off valve for any APU may not make fuel unavailable to the main engines.

(c) Operation of any shut - off may not interfere with the later emergency operation of other equipment.

(d) Each flammable fluid shut - off means and control must be fireproof or must be located and protected so that any fire in a fire zone will not affect its operation.

(e) No hazardous quantity of flammable fluid may drain into any designated fire zone after shut - off.

(f) There must be means to guard against inad vertent operation of the shut - off means and to make it possible for the crew to reopen the shut - off means in flight after it has been closed.

Powered by EASA eRules Page 1233 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS APU FIRE PROTECTION (g) Each tank to APU shut - off valve must be located so that the operation of the valve will not be affected by the APU mount structural failure.

(h) Each shut - off valve must have a means to relieve excessive pressure accumulation unless a means for pressure relief is ot herwise provided in the system.

[Amdt 25/1]

CS 25J 1191 Firewalls

ED Decision 200 5 / 006 /R (a) Each APU must be isolated from the rest of the aeroplane by firewalls, shrouds, or equivalent means.

(b) Each firewall and shroud must be: (1) Fireproof; (2) Constructed so that no hazardous quantity of air, fluid, or flame can pass from the comp artment to other parts of the aeroplane; (3) Constructed so that each opening is sealed with close fitting fireproof grommets, bushings, or firewall fittings; and (4) Protected against corrosion.

[Amdt 25/1]

CS 25 J 1193 APU compartment

ED Decision 2013 / 010 /R (a) Each compartment must be constructed and supported so that it can resist any vibration, inertia, and air load to which it may be subjected in operation.

(b) Each compartment must meet the drainage and ventilation requirements of CS 25J1187 .

(c) Reserved (d) Each part of the compartment subject to high temperatures due to its nearness to exhaust system parts or exhaust gas impingement must be fireproof.

(e) Each aeroplane must: (1) Be designed and constructed so that no fire originating in any APU fire zone can enter, either through openings or by burning through external skin, any other zone or region where it would cr eate additional hazards, (2) Meet sub - paragraph (e)(1) of this paragraph with the landing gear retracted (if applicable), and (3) Have APU compartment external skins, in areas subject to flame if a fire starts in an APU fire zone, complying with the foll owing: (i) For in - flight operations, APU compartment external skins must be fireproof in the complete concerned areas, and (ii) For ground operations, APU compar tment external skins must be : (a) Fireproof in the portions of the concerned areas where a skin burn through would affect critical areas of the aeroplane, and Powered by EASA eRules Page 1234 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS APU FIRE PROTECTION (b) Fire - resistant or compliant with subparagraph (e)(1) of this paragraph in the remaining portions of the concerned areas.

(See AMC 25.1193(e) ) [Amdt 25/1] [Amdt 25/13]

CS 25J 1195 Fire extinguisher systems

ED Decision 2016 / 010 /R (See AMC 25J1195) (a) There must be a fire extinguisher system serving the APU compartment.

(b) The fire extinguis hing system, the quantity of the extinguishing agent, the rate of discharge, and the discharge distribution must be adequate to extinguish fires. An individual 'one shot' system is acceptable. (See AMC 25J1195(b) .)

(c) The fire - extinguishing system for an APU compartment must be able to simultaneously protect each zone of the APU compartment for which protection is provided.

[Amdt 25/1] [Amdt 25/18]

AMC 25J 1195(b) Fire extinguisher s ystems

ED Decision 2018/010/R Acceptable methods to establish the adequacy of the fire extinguisher system are laid down in FAA Advisory Circular 20 – 100, with reference to Halon concentration levels. This AC is not applicable to extinguishing agents alternative to Halon .

[Amdt No: 25/1] [Amdt No: 25/22 ]

CS 25J 1197 Fire extinguishing agents

ED Decision 200 5 / 006 /R (a) Fire extinguishing agents must: (1) Be capable of extinguishing flames emanating from any burning of fluids or other combustible materials in the area protected by the fire extinguishing system; and (2) Have thermal stability over the temperature range likely to be experienced in the compartment in which they are stored.

(b) If any toxic extinguishing agent is used, provisions must be made to prevent h armful concentrations of fluid or fluid vapours (from leakage during normal operation of the aeroplane or as a result of discharging the fire extinguisher on the ground or in flight) from entering any personnel compartment, even though a defect may exist i n the extinguishing system.

[Amdt 25/1] Powered by EASA eRules Page 1235 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS APU FIRE PROTECTION

CS 25J 1199 Extinguishing agent containers

ED Decision 200 5 / 006 /R (a) Each extinguishing agent container must have a pressure relief to prevent bursting of the container by excessive internal pressures.

(b) The disc harge end of each discharge line from a pressure relief connection must be located so that discharge of the fire extinguishant agent would not damage the aeroplane. The line must be located or protected to prevent clogging caused by ice or other foreign ma tter.

(c) There must be a means for each fire extinguishing agent container to indicate that the container has discharged or that the charging pressure is below the established minimum necessary for proper functioning.

(d) The temperature of each containe r must be maintained, under intended operating conditions, to prevent the pressure in the container from: (1) Falling below that necessary to provide an adequate rate of discharge; or (2) Rising high enough to cause premature discharge.

(e) If a pyrotech nic capsule is used to discharge the extinguishing agent, each container must be installed so that temperature conditions will not cause hazardous deterioration of the pyrotechnic capsule.

[Amdt 25/1]

CS 25J 1201 Fire extinguishing system materials

ED Decision 200 5 / 006 /R (a) No material in any fire extinguishing system may react chemically with any extinguishing agent so as to create a hazard.

(b) Each system component in an APU compartment must be fireproof.

[Amdt 25/1]

CS 25J 1203 Fire - detector system

ED Decision 200 5 / 006 /R (a) There must be approved, quick acting fire or overheat detectors in each APU compartment in numbers and locations ensuring prompt detection of fire.

(b) Each fire detector system must be constructed and insta lled so that: (1) It will withstand the vibration, inertia, and other loads to which it may be subjected in operation; (2) There is a means to warn the crew in the event that the sensor or associated wiring within a designated fire zone is severed at one point, unless the system continues to function as a satisfactory detection system after the severing; and (3) There is a means to warn the crew in the event of a short circuit in the sensor or associated wiring within a designated fire zone, unless the s ystem continues to function as a satisfactory detection system after the short circuit.

(c) No fire or overheat detector may be affected by any oil, water, other fluids, or fumes that might be present.

Powered by EASA eRules Page 1236 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS APU FIRE PROTECTION (d) There must be means to allow the crew to check, in flight, the functioning of each fire or overheat detector electric circuit.

(e) Wiring and other components of each fire or overheat detector system in a fire zone must be at least fire - resistant.

(f) No fire or overheat detector system component for any fire zone may pass through another fire zone, unless: (1) It is protected against the possibility of false warnings resulting from fires in zones through which it passes; or (2) Each zone involved is simultaneously protected by the same detector and exti nguishing system.

(g) Each fire detector system must be constructed so that when it is in the configuration for installation it will not exceed the alarm activation time approved for the detectors using the response time criteria specified in ETSO - 2C11e or an acceptable equivalent, for the detector.

[Amdt 25/1]

CS 25J 1207 Compliance

ED Decision 200 5 / 006 /R Unless otherwise specified, compliance with the requirements of CS 25J1181 through CS 25J1203 must be shown by a full scale test or by one or more of the following methods: (a) Tests of similar APU installations.

(b) Tests of components.

(c) Service experience of aircraft with similar APU installat ions.

(d) Analysis unless tests are specifically required.

[Amdt 25/1 ] Powered by EASA eRules Page 1237 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS GENERAL

GENERAL

CS 25J 1305 APU instruments

ED Decision 200 5 / 006 /R (a) The following instruments are required for all installation: (1) A fire warning indicator.

(2) An indication than an APU auto - shutdown has occurred.

(3) Any other instrumentation necessary to assist the flight crew in: (i) Preventing the exceedence of established APU limits, and (ii) Maintaining continued safe operation of the APU.

(4) Instrumentatio n per subparagraph (3) need not be provided if automatic features of the APU and its installation provide a degree of safety equal to having the parameter displayed directly.

(b) For essential APUs: I n addition to the items required by CS 25J1305(a) , the following indicators are required for an essential APU installation : (1) An indicator to indicate the functioning of the ice protection system, if such a system is installed; and (2) An indicator to indicate the proper functioning of any heater used to prevent ice clogg ing of fuel system components.

[Amdt 25/1]

CS 25J 1337 APU instruments

ED Decision 200 5 / 006 /R (a) Reserved (b) Reserved (c) Reserved (d) There must be a stick gauge or equivalent means to indicate the quantity of oil in each tank.

[Amdt 25/1] Powered by EASA eRules Page 1238 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS OPERATING LIMITATIONS

OPERATING LIMITATIONS

CS 25J1501 General

ED Decision 2005/006/R (a) Reserved (b) The operating limitations and other information necessary for safe operation must be made available to the crew members as prescribed in CS 25J1549 , 25J1551 , and 25J1583 .

[Amdt 25/1]

CS 25J 1521 APU limitations

ED Decision 200 5 / 006 /R The APU limitations must be established so that they do not exceed the corresponding approved limits for the APU and its systems. The APU limita tions, including categories of operation, must be specified as operating limitations for the aeroplane.

[Amdt 25/1]

CS 25J 1527 Ambient air temperature and operating altitude

ED Decision 200 5 / 006 /R The extremes of the ambient air temperature and operating altitude for which operation is allowed, as limited by flight, structural, APU installation, functional, or equipment charact eristics, must be established.

[Amdt 25/1 ] Powered by EASA eRules Page 1239 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS MARKINGS AND PLACARDS

MARKINGS AND PLACARDS

CS 25J 1549 APU instruments

ED Decision 200 5 / 006 /R For each APU instrument either a placard or colour markings or an acceptable combination must be provided to convey information on the maximum and (where applicable) minimum operating limits.

Colour coding must comply with the following: (a) Each maxim um and, if applicable, minimum safe operating limit must be marked with a red radial or a red line; (b) Each normal operating range must be marked with a green arc or green line, not extending beyond the maximum and minimum safe limits; (c) Each precaution ary operating range must be marked with a yellow arc or a yellow line; and (d) Each APU speed range that is restricted because of excessive vibration stresses must be marked with red arcs or red lines.

[Amdt 25/1 ]

CS 25J 1551 Oil quantity indicator

ED Decision 200 5 / 006 /R Each oil quantity indicator must be marked with enough increments to indicate readily and accurately the quantity of oil.

[Amdt 25/1]

CS 25J1557 Miscellaneous markings and placards

ED Decision 2005/006/R (a) Reserved (b) APU fluid filler openings. The fol lowing applies: (1) Reserved (2) Oil filler openings must be marked at or near the fi ller cover with the word "oil".

[Amdt 25/1] Powered by EASA eRules Page 1240 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes SUBPART J – AUXILIARY POWER UNIT (CS - 25) INSTALLATIONS AEROPLANE FLIGHT MANUAL

AEROPLANE FLIGHT MANUAL

CS 25J 1583 Operating limitations

ED Decision 200 5 / 006 /R APU limitations established under CS 25J1521 and information to explain the instrument markings provided under CS 25J1549 and CS 25J1551 must be furnished.

[Amdt 25/1] Powered by EASA eRules Page 1241 of 1495 | Jan 2023

Next: APPENDICES TO CS-25 →

APPENDICES TO CS-25

Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix A

APPENDICES TO CS - 25

A PPENDIX A

ED Decision 2003/ 2/RM Powered by EASA eRules Page 1242 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix A Powered by EASA eRules Page 1243 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix A Powered by EASA eRules Page 1244 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix A Powered by EASA eRules Page 1245 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix A Powered by EASA eRules Page 1246 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix C

A PPENDIX C

Part I – Atmospheric Icing Conditions

ED Decision 2007/010/R (a) Continuous maximum icing. The maximum continuous intensity of atmospheric icing conditions (continuous maximum icing) is defined by the variables of the cloud liquid water content, the mean effective diameter of the cloud droplets, the ambient air temperature, and the interrelatio nship of these three variables as shown in Figure 1 of this Appendix. The limiting icing envelope in terms of altitude and temperature is given in Figure 2 of this Appendix. The interrelationship of cloud liquid water content with drop diameter and altitud e is determined from Figures 1 and 2. The cloud liquid water content for continuous maximum icing conditions of a horizontal extent, other than 32.2 km (17·4 nautical miles), is determined by the value of liquid water content of Figure 1, multiplied by the appropriate factor from Figure 3 of this Appendix.

(b) Intermittent maximum icing. The intermittent maximum intensity of atmospheric icing conditions (intermittent maximum icing) is defined by the variables of the cloud liquid water content, the mean effe ctive diameter of the cloud droplets, the ambient air temperature, and the interrelationship of these three variables as shown in Figure 4 of this Appendix. The limiting icing envelope in terms of altitude and temperature is given in Figure 5 of this Appen dix. The interrelationship of cloud liquid water content with drop diameter and altitude is determined from Figures 4 and 5. The cloud liquid water content for intermittent maximum icing conditions of a horizontal extent, other than 4.8 km (2·6 nautical mi les), is determined by the value of cloud liquid water content of Figure 4 multiplied by the appropriate factor in Figure 6 of this Appendix.

(c) Takeoff maximum icing . The maximum intensity of atmospheric icing conditions for takeoff (takeoff maximum icing) is defined by the cloud liquid water content of 0.35 g/m 3 , the mean effective diameter of the cloud droplets of 20 microns, and the ambient air temperature at ground level of minus 9 degrees Celsius ( - 9  C). The takeoff maximum icing conditi ons extend from ground level to a height of 457 m (1500 ft) above the level of the takeoff surface.

[Amdt 25/3]

Part II – Airframe Ice Accretions

ED Decision 2015/008/R (a) Ice accretions - General. The most critical ice accretion in terms of aeroplane per formance and handling qualities for each flight phase must be used to show compliance with the applicable aeroplane performance and handling requirements in icing conditions of subpart B of this part.

Applicants must demonstrate that the full range of atmo spheric icing conditions specified in part I of this appendix have been considered, including the mean effective drop diameter, liquid water content, and temperature appropriate to the flight conditions (for example, configuration, speed, angle - of - attack, and altitude). The ice accretions for each flight phase are defined as follows: (1) Take - off Ice is the most critical ice accretion on unprotected surfaces, and any ice accretion on the protected surfaces appropriate to normal ice protection system opera ti on, occurring between the end of the take - off distance and 122 m (400 ft) above the take - off surface, assuming accretion starts at the end of the take - off distance in the take - off maximum icing conditions of Part I , paragraph (c) of this Appendix.

Powered by EASA eRules Page 1247 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix C (2) Final Take - off Ice is the most critical ice accretion on unprotected surfaces, and any ice accretion on the protected surfaces appropriate to normal ice protection system operation, between 122 m (400 ft) and either 4 57 m (1500 ft) above the take - off surface, or the height at which the transition from the take - off to the en route configuration is completed and V is reached, whichever is higher. Ice accretion is assumed to start at FTO the end of the take - off distance in the take - off maximum icing conditions of Part I , paragraph (c) of this Appendix.

(3) En - route Ice is the critical ice accretion on the unprotected surfaces, and any ice accretion on the protected surfaces appropri ate to normal ice protection system operation, during the en - route phase.

(4) Holding Ice is the critical ice accretion on the unprotected surfaces, and any ice accretion on the protected surfaces appropriate to normal ice protection system operation, during the holding flight phase.

(5) Approach ice is the critical ice accretion on the unprot ected surfaces, and any ice accretion on the protected surfaces appropriate to normal ice protection system operation following exit from the holding flight phase and transition to the most critical approach configuration.

(6) Landing ice is the critical i ce accretion on the unprotected surfaces, and any ice accretion on the protected surfaces appropriate to normal ice protection system operation following exit from the approach flight phase and transition to the final landing configuration.

(b) In order to reduce the number of ice accretions to be considered when demonstrating compliance with the requirements of paragraph CS 25.21(g) , any of the ice accretions defined in sub - paragraph (a) of this section may be used for any other flight phase if it is shown to be more critical than the specific ice accretion defined for that flight phase. Configuration differences and their effects on ice accretions must be taken into account.

(c) The ice accretion that has the most adverse effect on handling characteristics may be used for aeroplane performance tests provided any difference in performance is conservatively taken into account.

(d) For both unprotected and protected parts, the ice accretion for the takeoff phase may b e determined by calculation, assuming the takeoff maximum icing conditions defined in appendix C, and assuming that: (1) Airfoils, control surfaces and, if applicable, propellers are free from frost, snow, or ice at the start of the take - off; (2) The ice accretion starts at the end of the take - off distance ; (3) The critical ratio of thrust/power - to - weight; (4) Failure of the critical engine occurs at V ; and EF (5) Crew activation of the ice protection system is in accordance with a normal operating procedure provided in the Aeroplane Flight Manual, except that after beginning the takeoff roll, it must be assumed that the crew takes no action to activate the ice protection system until the airplane is at least 122 m (400 ft) above the takeoff surface.

Powered by EASA eRules Page 1248 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix C (e) The ice accretion before the ice protection system has been activated and is performing its intended function is the critical ice accretion formed on the unprotected and normally protected surfaces before activation and effective operation of the i ce protection system in continuous maximum atmospheric icing conditions. This ice accretion only applies in showing compliance to CS 25.143(j) , 25.207(h) and 25.207(i) .

[Amdt 25/3] [Amdt 25/7] [Amdt 25/16] FIGURE 1 CONTINUOUS MAXIMUM (STRATIFORM CLOUDS) ATMOSPHERIC ICING CONDITIONS LIQUID WATER CONTENT VS MEAN EFFECTIVE DROP DIAMETER Source of data – NACA TN No. 1855, Class III – M, Continuous Maximum.

Powered by EASA eRules Page 1249 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix C FIGURE 2 CONTINUOUS MAXIMUM (STRATIFORM CLOUDS) ATMOSPHERIC ICING CONDITIONS AMBIENT TEMPERATURE VS PRESSURE ALTITUDE Source of data – NACA TN No. 2569.

Powered by EASA eRules Page 1250 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDI CES TO CS - 25 (CS - 25) Appendix C FIGURE 3 CONTINUOUS MAXIMUM (STRATIFORM CLOUDS) ATMOSPHERIC ICING CONDITIONS LIQUID WATER CONTENT FACTOR VS CLOUD HORIZONTAL DISTANCE Source of data – NACA TN No. 2738.

Powered by EASA eRules Page 1251 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix C FIGURE 4 INTERMITTENT MAXIMUM (CUMULIFORM CLOUDS) ATMOSPHERIC ICING CONDITIONS LIQUID WATER CONTENT VS MEAN EFFECTIVE DROP DIAMETER Source of data – NACA TN No. 1855, Class II – M, Intermittent Maximum Powered by EASA eRules Page 1252 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix C FIGURE 5 INTERMITTENT MAXIMUM (CUMULIFORM CLOUDS) ATMOSP HERIC ICING CONDITIONS AMBIENT TEMPERATURE VS PRESSURE ALTITUDE Source of data – NACA TN No. 2569.

Powered by EASA eRules Page 1253 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix D FIGURE 6 INTERMITTENT MAXIMUM (CUMULIFORM CLOUDS) ATMOSPHERIC ICING CONDITIONS VARIATION OF LIQUID WATER CONTENT FACTOR WITH CLOUD HORIZONTAL EXTENT Source of data – NACA TN No. 2738.

A PPENDIX D

ED Decision 2003/ 2/RM Criteria for determining minimum flight crew. The following are considered by the Agency in determining the minimum flight crew under CS 25.1523 .

(a) Basic workload functions. The following basic workload functions are considered: (1) Flight path control.

(2) Collision avoidance.

(3) Navigation.

(4) Communications.

(5) Operation and monitoring of aircraft engines and systems.

(6) Command decisions.

Powered by EASA eRules Page 1254 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix D (b) Workload factors. The following workload factors are considered significant when analysing and demonstrating workload for minimum flight crew determination: (1) The accessibility, ease and simplicity of operation of all necessary flight, power, and equipment controls, including emergency fuel shutoff valves, electrical controls, electronic controls, pressurisation system controls, and engine controls.

(2) The accessibility and conspicuity of all necessary instruments and failure wa rning devices such as fire warning, electrical system malfunction, and other failure or caution indicators. The extent to which such instruments or devices direct the proper corrective action is also considered.

(3) The number, urgency, and complexity of o perating procedures with particular consideration given to the specific fuel management schedule imposed by centre of gravity, structural or other considerations of an airworthiness nature, and to the ability of each engine to operate at all times from a s ingle tank or source which is automatically replenished if fuel is also stored in other tanks.

(4) The degree and duration of concentrated mental and physical effort involved in normal operation and in diagnosing and coping with malfunctions and emergencie s.

(5) The extent of required monitoring of the fuel, hydraulic, pressurisation, electrical, electronic, deicing, and other systems while en route.

(6) The actions requiring a crew member to be unavailable at his assigned duty station, including: observati on of systems, emergency operation of any control, and emergencies in any compartment.

(7) The degree of automation provided in the aircraft systems to afford (after failures or malfunctions) automatic crossover or isolation of difficulties to minimise the need for flight crew action to guard against loss of hydraulic or electrical power to flight controls or other essential systems.

(8) The communications and navigation workload.

(9) The possibility of increased workload associated with any emergency that may lead to other emergencies.

(10) Incapacitation of a flight - crew member whenever the applicable operating rule requires a minimum flight crew of at least two pilots.

(c) Kind of operation authorised. The determination of the kind of operat ion authorised requires consideration of the operating rules under which the aeroplane will be operated. Unless an applicant desires approval for a more limited kind of operation, it is assumed that each aeroplane certificated under this CS - 25 will operate under IFR conditions.

Powered by EASA eRules Page 1255 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F

A PPENDIX F

Part I – Test Criteria and Procedures for Showing Compliance with

CS 25.853, 25.855 or 25.869

ED Decision 2015 / 019 /R (a) Material test criteria – (1) Interior compartments occupied by crew or passengers.

(i) Interior ce iling panels, interior wall panels, partitions, galley structure, large cabinet walls, structural flooring, and materials used in the construction of stowage compartments (other than underseat stowage compartments and compartments for stowing small items s uch as magazines and maps) must be self - extinguishing when tested vertically in accordance with the applicable portions of Part I of this Appendix. The average burn length may not exceed 15 cm (6 inches) and the average flame time after removal of the flam e source may not exceed 15 seconds.

Drippings from the test specimen may not continue to flame for more than an average of 3 seconds after falling.

(ii) Floor covering, textiles (including draperies and upholstery), seat cushions, padding, decorative and nondecorative coated fabrics, leather, trays and galley furnishings, electrical conduit, air ducting, joint and edge covering, liners of Class B and E cargo or baggage compartments, floor panels of Class B, C, E or F cargo or baggage compart ments, cargo covers and transparencies, moulded and thermoformed parts, air ducting joints, and trim strips (decorative and chafing), that are constructed of materials not covered in sub - paragraph (iv) below, must be self - extinguishing when tested vertical ly in accordance with the applicable portions of Part I of this Appendix or other approved equivalent means. The average burn length may not exceed 20 cm (8 inches), and the average flame time after removal of the flame source may not exceed 15 seconds. Dr ippings from the test specimen may not continue to flame for more than an average of 5 seconds after falling.

(iii) Motion picture film must be safety film meeting the Standard Specifications for Safety Photographic Film PHI.25 (available from the American National Standards Institute, 1430 Broadway, New York, NY 10018). If the film travels through ducts, the ducts must meet the requirements of sub - paragraph (ii) of this paragraph.

(iv) Clear plastic windows and signs, parts constructed in whole or in part of elastomeric materials, edge lighted instrument assemblies consisting of two or more instruments in a common housing, seat belts, shoulder harnesses, and cargo and baggage tiedown equipment, including containers, bins, pallets, etc, used in pass enger or crew compartments, may not have an average burn rate greater than 64 mm (2·5 inches) per minute when tested horizontally in accordance with the applicable portions of this Appendix.

(v) Except for small parts (such as knobs, handles, rollers, fast eners, clips, grommets, rub strips, pulleys, and small electrical parts) that would not contribute significantly to the propagation of a fire and for electrical wire and cable insulation, materials in items not specified in paragraphs (a)(1)(i), (ii), (iii ), or (iv) of Part I of this Appendix may not have a burn rate greater than 102 mm/min (4·0 inches per minute) when tested horizontally in accordance with the applicable portions of this Appendix.

Powered by EASA eRules Page 1256 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (2) Cargo and baggage compartments not occupied by crew or passengers.

(i) Reserved.

(ii) A cargo or baggage compartment defined in CS 25.857 , as Class B or E must have a liner constructed of materials that meet the requirements of sub - paragraph (a)(1)(ii) of Part I of th is Appendix and separated from the aeroplane structure (except for attachments). In addition, such liners must be subjected to the 45 - degree angle test. The flame may not penetrate (pass through) the material during application of the flame or subsequent t o its removal. The average flame time after removal of the flame source may not exceed 15 seconds, and the average glow time may not exceed 10 seconds.

(iii) A cargo or baggage compartment defined in CS 25.857 as C lass B, C, E or F must have floor panels constructed of materials which meet the requirements of sub - paragraph (a)(1)(ii) of Part I of this Appendix and which are separated from the aeroplane structure (except for attachments). Such panels must be subjecte d to the 45 - degree angle test. The flame may not penetrate (pass through) the material during application of the flame or subsequent to its removal. The average flame time after removal of the flame source may not exceed 15 seconds, and the average glow ti me may not exceed 10 seconds.

(iv) Insulation blankets and covers used to protect cargo must be constructed of materials that meet the requirements of sub - paragraph (a)(1)(ii) of Part I of this Appendix. Tiedown equipment (including containers, bins, and p allets) used in each cargo and baggage compartment must be constructed of materials that meet the requirements of sub - paragraph (a)(1)(v) of Part I of this Appendix.

(3) Electrical system components . Insulation on electrical wire or cable installed in any area of the fuselage must be selfextinguishing when subjected to the 60 degree test specified in Part I of this Appendix. The average burn length may not exceed 76 mm (3 inches), and the average flame time after removal of the flame source may not exceed 3 0 seconds.

Drippings from the test specimen may not continue to flame for more than an average of 3 seconds after falling.

(b) Test Procedures – (1) Conditioning . Specimens must be conditioned to 21·11 ± 3°C (70 ± 5°F) and at 50% ± 5% relative humidity until moisture equilibrium is reached or for 24 hours. Each specimen must remain in the conditioning environment until it is subjected to the flame.

(2) Specimen c onfiguration. Except for small parts and electrical wire and cable insulation, materials must be tested either as a section cut from a fabricated part as installed in the aeroplane or as a specimen simulating a cut section, such as a specimen cut from a fl at sheet of the material or a model of the fabricated part. The specimen may be cut from any location in a fabricated part; however, fabricated units, such as sandwich panels, may not be separated for test. Except as noted below, the specimen thickness mus t be no thicker than the minimum thickness to be qualified for use in the aeroplane. Test specimens of thick foam parts, such as seat cushions, must be 13 mm (½ - inch) in thickness. Test specimens of materials that must meet the requirements of sub - paragrap h (a)(1)(v) of Part I of this Appendix must be no more than 3·2 mm (⅛ - inch) in thickness. Electrical wire and cable specimens must be the same size as used in the aeroplane. In the case of fabrics, both the warp and fill direction of the weave must be test ed to determine the most critical flammability condition. Specimens must be mounted in a metal frame so that the two long edges and the upper edge are held Powered by EASA eRules Page 1257 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F securely during the vertical test prescribed in sub - paragraph (4) of this paragraph and the two long edges and the edge away from the flame are held securely during the horizontal test prescribed in sub - paragraph (5) of this paragraph. The exposed area of the specimen must be at least 50 mm (2 inches) wide and 31 cm (12 inches) long, unless the actual si ze used in the aeroplane is smaller. The edge to which the burner flame is applied must not consist of the finished or protected edge of the specimen but must be representative of the actual cross - section of the material or part as installed in the aeropla ne. The specimen must be mounted in a metal frame so that all four edges are held securely and the exposed area of the specimen is at least 20 cm by 20 cm (8 inches by 8 inches) during the 45° test prescribed in sub - paragraph (6) of this paragraph.

(3) Ap paratus . Except as provided in sub - paragraph (7) of this paragraph, tests must be conducted in a draught - free cabinet in accordance with Federal Test Method Standard 191 Model 5903 (revised Method 5902) for the vertical test, or Method 5906 for horizontal test (av ailable from the General Services Administration, Business Service Centre, Region 3, Seventh & D Streets SW., Washington, DC 20407). Specimens, which are too large for the cabinet, must be tested in similar draught - free conditions.

(4) Vertical te st. A minimum of three specimens must be tested and results averaged. For fabrics, the direction of weave corresponding to the most critical flammability conditions must be parallel to the longest dimension. Each specimen must be supported vertically.

The specimen must be exposed to a Bunsen or Tirril burner with a nominal 9·5 mm (⅜ - inch) I.D. tube adjusted to give a flame of 38 mm (1½ inches) in height. The minimum flame temperature measured by a calibrated thermocouple pyrometer in the centre of the flame must be 843°C (1550°F). The lower edge of the specimen must be 19 mm (¾ - inch) above the top edge of the burner. The flame must be applied to the centre line of the lower edge of the specimen. For materials covered by sub - paragraph (a)(1)(i) of Part I of t his Appendix, the flame must be applied for 60 seconds and then removed. For materials covered by sub - paragraph (a)(1)(ii) of Part I of this Appendix, the flame must be applied for 12 seconds and then removed. Flame time, burn length, and flaming time of d rippings, if any, may be recorded. The burn length determined in accordance with subparagraph (8 ) of this paragraph must be measured to the nearest 2·5 mm (tenth of an inch).

(5) Horizontal test. A minimum of three specimens must be tested and the results averaged.

Each specimen must be supported horizontally. The exposed surface, when installed in the aircraft, must be face down for the test. The specimen must be exposed to a Bunsen or Tirrill burner with a nominal 9·5 mm (⅜ - inch) I.D. tube adjusted to gi ve a flame of 38 mm (1½ inches) in height. The minimum flame temperature measured by a calibrated thermocouple pyrometer in the centre of the flame must be 843°C (1550°F). The specimen must be positioned so that the edge being tested is centred 19 mm (¾ - in ch) above the top of the burner. The flame must be applied for 15 seconds and then removed.

A minimum of 25 cm (10 inches) of specimen must be used for timing purposes, approximately 38 mm (1½ inches) must burn before the burning front reaches the timing z one, and the average burn rate must be recorded.

(6) Forty - five degree test. A minimum of three specimens must be tested and the results averaged. The specimens must be supported at an angle of 45° to a horizontal surface.

The exposed surface when install ed in the aircraft must be face down for the test. The specimens must be exposed to a Bunsen or Tirrill burner with a nominal ⅜ - inch (9·5 mm) I.D. tube adjusted to give a flame of 38 mm (1½ inches) in height. The minimum flame temperature measured by a cal ibrated thermocouple pyrometer in the centre of the Powered by EASA eRules Page 1258 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F flame must be 843°C (1550°F). Suitable precautions must be taken to avoid draughts. The flame must be applied for 30 seconds with one - third contacting the material at the centre of the specimen and then r emoved. Flame time, glow time, and whether the flame penetrates (passes through) the specimen must be recorded.

(7) Sixty - degree test. A minimum of three specimens of each wire specification (make and size) must be tested. The specimen of wire or cable (i ncluding insulation) must be placed at an angle of 60° with the horizontal in the cabinet specified in sub - paragraph (3) of this paragraph with the cabinet door open during the test, or must be placed within a chamber approximately 61 cm (2 feet) high by 3 1 cm by 31 cm (1 foot by 1 foot), open at the top and at one vertical side (front), and which allows sufficient flow of air for complete combustion, but which is free from draughts. The specimen must be parallel to and approximately 15 cm (6 inches) from t he front of the chamber. The lower end of the specimen must be held rigidly clamped. The upper end of the specimen must pass over a pulley or rod and must have an appropriate weight attached to it so that the specimen is held tautly throughout the flammabi lity test. The test specimen span between lower clamp and upper pulley or rod must be 61 cm (24 inches) and must be marked 20 cm (8 inches) from the lower end to indicate the central point for flame application. A flame from a Bunsen or Tirrill burner must be applied for 30 seconds at the test mark. The burner must be mounted underneath the test mark on the specimen, perpendicular to the specimen and at an angle of 30° to the vertical plane of the specimen. The burner must have a nominal bore of 9·5 mm (⅜ - i nch) and be adjusted to provide a 76 mm (3 - inch) high flame with an inner cone approximately one - third of the flame height. The minimum temperature of the hottest portion of the flame, as measured with a calibrated thermocouple pyrometer, may not be less t han 954°C (1750°F). The burner must be positioned so that the hottest portion of the flame is applied to the test mark on the wire.

Flame time, burn length, and flaming time of drippings, if any, must be recorded. The burn length determined in accordance w ith sub - paragraph (8) of this paragraph must be measured to the nearest 2·5 mm (tenth of an inch). Breaking of the wire specimens is not considered a failure.

(8) Burn length. Burn length is the distance from the original edge to the farthest evidence of damage to the test specimen due to flame impingement, including areas of partial or complete consumption, charring, or embrittlement, but not including areas sooted, stained, warped, or discoloured, nor areas where material has shrunk or me lted away from t he heat source.

[Amdt 25/6] [Amdt 25/8] [Amdt 25/17] Powered by EASA eRules Page 1259 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F

Part II – Flammability of Seat Cushions

ED Decision 2015 / 019 /R (a) Criteria for Acceptance . Each seat cushion must meet the following criteria: (1) At least three sets of seat bottom and seat back cushion specimens must be tested.

(2) If the cushion is constructed with a fire blocking material, the fire blocking material must completely enclose the cushion foam core material.

(3) Each specimen tested must be fabricated using the principal components (i.e. foam core, flotation material, fire blocking material, if used, and dress covering) and assembly processes (representative seams and closures) intended for use in the production articles. If a different material combination is u sed for the back cushion than for the bottom cushion, both material combinations must be tested as complete specimen sets, each set consisting of a back cushion specimen and a bottom cushion specimen. If a cushion, including outer dress covering, is demons trated to meet the requirements of this Appendix using the oil burner test, the dress covering of that cushion may be replaced with a similar dress covering provided the burn length of the replacement covering, as determined by the test specified in CS 25.853(a) , does not exceed the corresponding burn length of the dress covering used on the cushion subjected to the oil burner test.

(4) For at least two - thirds of the total number of specimen sets tested, the burn length from the burner must not reach the side of the cushion opposite the burner. The burn length must not exceed 43 cm (17 inches). Burn length is the perpendicular distance from the inside edge of the seat frame closest to the burner to the farthes t evidence of damage to the test specimen due to flame impingement, including areas of partial or complete consumption, charring, or embrittlement, but not including areas sooted, stained, warped, or discoloured, or areas where material has shrunk or melte d away from the heat source.

(5) The average percentage weight loss must not exceed 10 percent. Also, at least twothirds of the total number of specimen sets tested must not exceed 10 percent weight loss. All droppings falling from the cushions and mountin g stand are to be discarded before the after - test weight is determined. The percentage weight loss for a specimen set is the weight of the specimen set before testing less the weight of the specimen set after testing expressed as the percentage of the weig ht before testing.

(b) Test Conditions. Vertical air velocity should average 13cm/s ± 5 cm/s (25 fpm ± 10 fpm) at the top of the back seat cushion. Horizontal air velocity should be below 51 mm/s (10 fpm) just above the bottom seat cushion. Air velocities should be measured with the ventilation hood operating and the burner motor off.

(c) Test Specimens (1) For each test, one set of cushion specimens representing a seat bottom and seat back cushion must be used.

(2) The seat bottom cushion specimen must b e 457 ± 3 mm (18 ± 0·125 inches) wide by 508 ± 3 mm (20 ± 0·125 inches) deep by 102 ± 3 mm (4 ± 0·125 inches) thick, exclusive of fabric closures and seam overlap.

Powered by EASA eRules Page 1260 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (3) The seat back cushion specimen must be 457 ± 3 mm (18 ± 0·125 inches) wide by 635 ± 3 mm (25 ± 0·125 inches) high by 51 ± 3 mm (2 ± 0·125 inches) thick, exclusive of fabric closures and seam overlap.

(4) The specimen s must be conditioned at 21 ± 2 ° C (70 ± 5 ° F) 55% ± 10% relative humidity for at least 24 hours before testing.

(d) Test Apparatu s. The arrangement of the test apparatus is shown in Figure 1 through 5 and must include the components described in this paragraph. Minor details of the apparatus may vary, depending on the model burner used.

(1) Specimen Mounting Stand. The mounting sta nd for the test specimens consists of steel angles, as shown in Figure 1. The length of the mounting stand legs is 305 ± 3mm (12 ± 0·125 inches). The mounting stand must be used for mounting the test specimen seat bottom and seat back, as shown in Figure 2 . The mounting stand should also include a suitable drip pan lined with aluminium foil, dull side up.

(2) Test Burner. The burner to be used in testing must – (i) Be a modified gun type; (ii) Have an 80 - degree spray angle nozzle nominally rated for 8.5 l /hr (2·25 US gallons/hour) at 690 KPa (100 psi); (iii) Have a 31 cm (12 - inch) burner cone installed at the end of the draft tube, with an opening 15 cm (6 inches) high and 28 cm (11 inches) wide, as shown in Figure 3; and (iv) Have a burner fuel pressure regulator that is adjusted to deliver a nominal 7.6 l/hr (2·0 US gallon/hour) of # 2 Grade kerosene or equivalent required for the test.

(3) Calorimeter (i) The calorimeter to be used in testing must be a 0 – 17·0 Watts/cm (0 – 15·0 BTU per ft sec) calorime ter, accurate ± 3%, mounted in a 15 by 31 cm (6 - inch by 12 - inch) by 19 mm (0·75 inch) thick calcium silicate insulating board which is attached to a steel angle bracket for placement in the test stand during burner calibration, as shown in Figure 4.

(ii) B ecause crumbling of the insulating board with service can result in misalignment of the calorimeter, the calorimeter must be monitored and the mounting shimmed, as necessary, to ensure that the calorimeter face is flush with the exposed plane of the insula ting board in a plane parallel to the exit of the test burner cone.

(4) Thermocouples. The seven thermocouples to be used for testing must be 1.59 to 3.18 mm (0·0625 to 0·125 inch) metal sheathed, ceramic packed, type K, grounded thermocouples with a nomin al 22 to 30 American wire gauge (AWG) - size conductor 0·643 mm (0·0253 inches) to 0·254 mm (0·010 inches) diameter. The seven thermocouples must be attached to a steel angle bracket to form a thermocouple rake for placement in the test stand during burner c alibration as shown in Figure 5.

(5) Apparatus Arrangement . The test burner must be mounted on a suitable stand to position the exit of the burner cone a distance of 102 ± 3 mm (4 ± 0·125 inches) from one side of the specimen mounting stand. The burner st and should have the capability of allowing the burner to be swung away from the specimen - mounting stand during warm - up periods.

Powered by EASA eRules Page 1261 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (6) Data Recording. A recording potentiometer or other suitable calibrated instrument with an appropriate range must be used to measure and record the outputs of the calorimeter and the thermocouples.

(7) Weight Scale. Weighing Device – A device must be used that with prop er procedures may determine the before and after test weights of each set of seat cushion specimens within 9 grams (0·02 pound). A continuous weighing system is preferred.

(8) Timing Device. A stopwatch or other device (calibrated to ± 1 second) must be u sed to measure the time of application of the burner flame and self - extinguishing time or test duration.

(e) Preparation of Apparatus. Before calibration, all equipment must be turned on and the burner fuel must be adjusted as specified in sub - paragraph ( d)(2).

(f) Calibration. To ensure the proper thermal output of the burner, the following test must be made: (1) Place the calorimeter on the test stand as shown in Figure 4 at a distance of 102 - ±3 mm (4 ± 0·125 inches) from the exit of the burner cone.

(2) Turn on the burner, allow it to run for 2 minutes for warm - up, and adjust the burner air 2 2 intake damper to produce a reading of 11·9 ± 0·6 Watts/cm (10·5 ± 0·5 BTU per ft sec) on the calorimeter to ensure steady state conditions have been achiev ed. Turn off the burner.

(3) Replace the calorimeter with the thermocouple rake (Figure 5).

(4) Turn on the burner and ensure that the ther mocouples are reading 1038 ± 56 ° C ( 1900 ± 100 ° F) to ensure steady state conditions have been achieved.

(5) If the cal orimeter and thermocouples do not read within range, repeat steps in sub - paragraphs 1 to 4 and adjust the burner air intake damper until the proper readings are obtained. The thermocouple rake and the calorimeter should be used frequently to maintain and r ecord calibrated test parameters. Until the specific apparatus has demonstrated consistency, each test should be calibrated. After consistency has been confirmed, several tests may be conducted with the pre - test calibration before and a calibration check a fter the series.

(g) Test Procedures. The flammability of each set of specimens must be tested as follows: (1) Record the weight of each set of seat bottom and seat back cushion specimens to be tested to the nearest 9 grams (0·02 pound).

(2) Mount the sea t bottom and seat back cushion test specimens on the test stand as shown in Figure 2, securing the seat back cushion specimen to the test stand at the top.

(3) Swing the burner into position and ensure that the distance from the exit of the burner cone to the side of the seat bottom cushion specimen is 102 ± 3 mm (4 ± 0·125 inches).

(4) Swing the burner away from the test position. Turn on the burner and allow it to run for 2 minutes to provide adequate warm - up of the burner cone and flame stabilization.

(5 ) To begin the test, swing the burner into the test position and simultaneously start the timing device.

(6) Expose the seat bottom cushion specimen to the burner flame for 2 minutes and then turn off the burner. Immediately swing the burner away from the test position. Terminate Powered by EASA eRules Page 1262 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F test 7 minutes after initiating cushion exposure to the flame by use of a n appropriate gaseous extinguishing agent.

(7) Determine the weight of the remains of the seat cushion specimen set left on the mounting stand to the nearest 9 grams (0·02 pound ) excluding all droppings.

(h) Test Report With respect to all specimen sets tested for a particular seat cushion for which testing of compliance is performed, the following information must be recorded: (1) An identification and descr iption of the specimens being tested.

(2) The number of specimen sets tested.

(3) The initial weight and residual weight of each set, the calculated percentage weight loss of each set, and the calculated average percentage weight loss for the total number of sets tested.

(4) The burn length for each set tested.

Powered by EASA eRules Page 1263 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Ap pendix F FIGURE 1 Powered by EASA eRules Page 1264 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F FIGURE 2 Powered by EASA eRules Page 1265 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F FIGURE 3 Powered by EASA eRules Page 1266 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F FIGURE 4 Powered by EASA eRules Page 1267 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F FIGURE 5 [Amdt 25/2] [Amdt 25/4] [Amdt 25/12] [Amdt 25/17] Powered by EASA eRules Page 1268 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F

Part III – Test Method to Determine Flame Penetration Resistance

of Cargo Compartment Liners

ED Decision 200 9 / 017 /R (a) Criteria for Acceptance (1) At least three specimens of cargo compartment sidewall or ceiling liner panels must be tested.

(2) Each specimen tested must simulate the cargo compartment sidewall or ceiling liner panel, including any design features, such as joints, lamp assemblies, etc., the failure of which would affect the capability of the liner to safely contain a fire.

(3) There must be no flame penetration of any specimen within 5 minutes after application of the flame source, and the peak temperature measured at 10 cm (4 inches) above the o o upper surface of the horizontal test sa mple must not exceed 204 C (400 F).

(b) Summary of Method. This method provides a labora tory test procedure for measuring the capability of cargo compartment lining materials to resist flame penetration within a 7.6 l/hr (2 US gallons/hour) # 2 Grade kerosene or equivalent burner fire source. Ceiling and sidewall liner panels may be tested in dividually provided a baffle is used to simulate the missing panel. Any specimen that passes the test as a ceiling liner panel may be used as a sidewall liner panel.

(c) Test Specimens (1) The specimen to be tested must measure 406 ± 3 mm (16 ± 0·125 inc hes) by 610 ± 3 mm (24 ± 0·125 inches).

o (2) The spec imens must be conditioned at 70 ° F ± 5 F (21 ° C ± 2 ° C) and 55% ± 5% humidity for at least 24 hours before testing.

(d) Test Apparatus . The arrangement of the test apparatus, which is shown in Figure 3 of Part II and Figures 1 through 3 of this Part of Appendix F, must include the components described in this paragraph. Minor details of the apparatus may vary, depending on the model of the burner used.

(1) Specimen M ounting Stand. The mounting stand for the test specimens consists of steel angles as shown in Figure 1.

(2) Test Burner. The burner to be used in testing must – (i) Be a modified gun type.

(ii) Use a suitable nozzle and maintain fuel pressure to yield a 7.6 l/hr (2 US gallons/hour) fuel flow. For example: an 80 - degree nozzle nominally rated at 8.5 l/hr (2·25 US gallons/hour) and operated at 586 Kpa (85 pounds per square inch) gauge to deliver 7.7 l/hr (2·03 US gallons/hour).

(iii) Have a 31 cm (12 inch) burner extension installed at the end of the draft tube with an opening 15 cm (6 inches) high and 28 cm (11 inches) wide as shown in Figure 3 of Part II of this Appendix.

(iv) Have a burner fuel pressure regulator that is adjusted to deliver a nominal 7.6 l/hr (2·0 US gallons/hour) of # 2 Grade kerosene or equivalent.

Powered by EASA eRules Page 1269 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (3) Calorimeter (i) The calorimeter to be used in testing must be a total heat flux Foil Type Gardon Gauge of an appropriate range, approximately 0 – 17·0 Watts/cm2 (0 to 15·0 BTU per ft2 sec). The calorimeter must be mounted in a 15 by 31 cm (6 inch by 12 inch) by 19 mm (0·75 of an inch) thick insulating block which is attached to a steel angle bracket for placement in the test stand during burner cal ibration as shown in Figure 2 of this Part of this Appendix.

(ii) The insulating block must be monitored for deterioration and the mounting shimmed as necessary to ensure that the calorimeter face is parallel to the exit plane of the test burner cone.

(4) Thermocouples. The seven thermocouples to be used for testing must be 1.59 mm (0·0625 of an inch) ceramic sheathed, type K, grounded thermocouples with a nominal 30 American wire gauge (AWG) - size conductor 0·254 mm (0·010 inches) diameter). The seven therm ocouples must be attached to a steel angle bracket to form a thermocouple rake for placement in the stand during burner calibration as shown in Figure 3 of this Part of this Appendix.

(5) Apparatus Arrangement. The test burner must be mounted on a suitable stand to position the exit of the burner cone a distance of 20 cm (8 inches) from the ceiling liner panel and 50 mm (2 inches) from the sidewall liner panel. The burner stand should have the capability of allo wing the burner to be swung away from the test specimen during warm - up periods.

(6) Instrumentation . A recording potentiometer or other suitable instrument with an appropriate range must be used to measure and record the outputs of the calorimeter and the thermocouples.

(7) Timing Device. A stopwatch or other device must be used to measure the time of flame application and the time of flame penetration, if it occurs.

(e) Preparation of Apparatus. Before calibration, all equipment must be turned on and al lowed to stabilize, and the burner fuel flow must be adjusted as specified in sub - paragraph (d)(2).

(f) Calibration. To ensure the proper thermal output of the burner the following test must be made: (1) Remove the burner extension from the end of the draft tube. Turn on the blower portion of the burner without turning the fuel or igniters on. Measure the air velocity using a hot wire anemometer in the centre of the draft tube across the face of the opening. Adjust the damper such that the air velocity is in the range of 7.9 m/s to 9.1 m/s (1550 to 1800 ft/min). If tabs are being used at the exit of the draft tube, they must be removed prior to this measurement. Reinstall the draft tube extension cone.

(2) Place the calorimeter on the test stand as shown in Figure 2 at a distance of 20 cm (8 inches) from the exit of the burner cone to simulate the position of the horizontal test specimen.

(3) Turn on the burner, allow it to run for 2 minutes for warm - up, and adjust the damper to 2 2 produce a calorimeter read ing of 9·1 ± 0·6 Watts/cm (8·0 ± 0·5 BTU per ft sec).

(4) Replace the calorimeter with the thermocouple rake (see Figure 3).

(5) Turn on the burner and ensure that each of the seven thermocouples reads 927 ° C ± 38 ° C (1700 ° F ± 100 ° F) to ensure steady state conditions have been achieved. If the Powered by EASA eRules Page 1270 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F temperature is out of this range, repeat steps 2 through 5 until proper readings are obtained.

(6) Turn off the burner and remove the thermocouple rake.

(7) Repeat (f)(1) to ensure that the burner is in the correct ra nge.

(g) Test Procedure (1) Mount a thermocouple of the same type as that used for calibration at a distance of 10 cm (4 inches) above the horizontal (ceiling) test specimen. The thermocouple should be centred over the burner cone.

(2) Mount the test spec imen on the test stand shown in Figure 1 in either the horizontal or vertical position. Mount the insulating material in the other position.

(3) Position the burner so that flames will not impinge on the specimen, turn the burner on, and allow it to run fo r 2 minutes. Rotate the burner to apply the flame to the specimen and simultaneously start the timing device.

(4) Expose the test specimen to the flame for 5 minutes and then turn off the burner. The test may be terminated earlier if flame penetration is o bserved.

(5) When testing ceiling liner panels, record the peak temperature measured 101 mm (4 inches) above the sample.

(6) Record the time at which flame penetration occurs if applicable.

(h) Test Report. The test report must include the following: (1) A complete description of the materials tested including type, manufacturer, thickness, and other appropriate data.

(2) Observations of the behaviour of the test specimens during flame exposure such as delamination, resin ignition, smoke, etc., including t he time of such occurrence.

(3) The time at which flame penetration occurs, if applicable, for each of three specimens tested.

(4) Panel orientation (ceiling or sidewall).

[Amdt 25/8] Powered by EASA eRules Page 1271 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F FIGURE 1 TEST APPARATUS FOR H ORIZONTAL AND VERTICAL MOUNTING Powered by EASA eRules Page 1272 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F FIGURE 2 CALORIMETER BRACKET Powered by EASA eRules Page 1273 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F FIG URE 3 THERMOCOUPLE RAKE BRACKET Powered by EASA eRules Page 1274 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F

Part IV – Test Method to Dete rmine the Heat Release Rate from

Cabin Materials Exposed to Radiant Heat

ED Decision 2016 / 010/R (See AMC to Appendix F, Part IV ) (a) Summary of Method (1) The specimen to be tested is injected into an environmental chamber through which a constant flow of air passes. The specimen’s exposure is determined by a radia nt heat source adjusted to produce the desired total heat flux on the specimen of 3·5 Watts/cm , using a calibrated calorimeter. The specimen is tested so that the exposed surface is vertical. Combustion is initiated by piloted ignition. The combustion pro ducts leaving the chamber are monitored in order to calculate the release rate of heat.

(b) Apparatus. The Ohio State University (OSU) rate of heat release apparatus as described below, is used. This is a modified version of the rate of heat release appar atus standardised by the American Society of Testing and Materials (ASTM), ASTM E - 906.

(1) This apparatus is shown in Figure 1. All exterior surfaces of the apparatus, except the holding chamber, shall be insulated with 25 mm thick, low density, high - temp erature, fibreglass board insulation. A gasketed door through which the sample injection rod slides forms an airtight closure on the specimen hold chamber.

(2) Thermopile . The temperature difference between the air entering the environmental chamber and th at leaving is monitored by a thermopile having five hot and five cold, 24 gauge Chromel - Alumel junctions. The hot junctions are spaced across the top of the exhaust stack 10 mm below the top of the chimney. One thermocouple is located in the geometric cent re; with the other four located 30 mm from the centre along the diagonal toward each of the corners (Figure 5). The cold junctions are located in the pan below the lower air distribution plate (see sub - paragraph (b)(4)). Thermopile hot junctions must be cl eared of soot deposits as needed to maintain the calibrated sensitivity.

(3) Radiation Source. A radiant heat source for generating a flux up to 100 kW/m2, using four silicon carbide elements, Type LL, 50·8 cm (20 inches) long by 15·8 mm (0·625 inch) O.D., nominal resistance 1·4 ohms, is shown in Figures 2A and 2B. The silicon carbide elements are mounted in the stainless steel panel box by inserting them through 15·9 mm holes in 0·8 mm thick ceramic fibreboard. Location of the holes in the pads and st ainless steel cover plates are shown in Figure 2B. The diamond shaped mask of 19 - gauge stainless steel is added to provide uniform heat flux over the area occupied by the 150 by 150 mm vertical sample.

(4) Air Distribution System . The air entering the env ironmental chamber is distributed by a 6·3 mm thick aluminium plate having eight, No. 4 drill holes, 51 mm from sides on 102 mm centres, mounted at the base of the environmental chamber. A second plate of 18 - gauge steel having 120, evenly spaced, No. 28 dr ill holes is mounted 150 mm above the aluminium plate. A well - regulated air supply is required. The air supply manifold at the base of the pyramidal section has 48, evenly spaced, No. 26 drill holes located 10 mm from the inner edge of the manifold so that 0·03 m /second of air flows between the pyramidal sections and 0·01 m /second flows through the environmental chamber when total air flow to apparatus is controlled at 0·04 m /second.

(5) Exhaust Stack. An exhaust stack, 133 mm by 70 mm in cross section , and 254 mm long, fabricated from 28 - gauge stainless steel, is mounted on the outlet of the pyramidal Powered by EASA eRules Page 1275 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F section. A 25 mm by 76 mm plate of 31 - gauge stainless steel is centred inside the stack, perpendicular to the airflow, 75 mm above the base of the stack.

(6) Specimen Holders. The 150 mm x 150 mm specimen is tested in a vertical orientation. The holder (Figure 3) is provided with a specimen holder frame, which touches the specimen (which is wrapped with aluminium foil as required by sub - paragraph (d)(3)) along only the 6 mm perimeter, and a “V” shaped spring to hold the assembly together. A detachable 12 mm x 12 mm x 150 mm drip pan and two 0.51 mm (0·020 inch) stainless steel wires (as shown in Figure 3) should be used for testing of materials prone to me lting and dripping. The positioning of the spring and frame may be changed to accommodate different specimen thicknesses by inserting the retaining rod in different holes on the specimen holder.

Since the radiation shield described in ASTM E - 906 is not us ed, a guide pin is added to the injection mechanism. This fits into a slotted metal plate on the injection mechanism outside of the holding chamber and can be used to provide accurate positioning of the specimen face after injection. The front surface of t he specimen shall be 100 mm from the closed radiation doors after injection.

The specimen holder clips onto the mounted bracket (Figure 3). The mounting bracket is attached to the injection rod by three screws, which pass through a wide area washer welded onto a 13 mm nut. The end of the injection rod is threaded to screw into the nut and a 5.1 mm thick wide area washer is held between two 13 mm nuts which are adjusted to tightly cover the hole in the radiation doors through which the injection rod or cali bration calorimeter pass.

(7) Calorimeter. A total - flux type calorimeter must be mounted in the centre of a 13 mm Kaowool “M” board inserted in the sample holder must be used to measure the total heat flux. The calorimeter must have a view an gle of 180 ° a nd be calibrated for incident flux.

The calorimeter calibration must be acceptable to the Agency.

(8) Pilot - Flame Positions. Pilot ignition of the specimen must be accomplished by simultaneously exposing the specimen to a lower pilot burner and an upper p ilot burner, as described in sub - paragraphs (b)(8)(i) and (b)(8)(ii), respectively. The pilot burners must remain lighted for the entire 5 - minute duration of the test.

(i) Lower Pilot Burner. The pilot - flame tubing must be 6·3 mm O.D., 0·8 mm wall, 3 3 stainl ess steel tubing. A mixture of 120 cm /min. of methane and 850 cm /min. of air must be fed to the lower pilot flame burner. The normal position of the end of the pilot burner tubing is 10 mm from and perpendicular to the exposed vertical surface of the spe cimen. The centreline at the outlet of the burner tubing must intersect the vertical centreline of the sample at a point 5 mm above the lower exposed edge of the specimen.

(ii) Upper Pilot Burner. The pilot burner must be a straight length of 6·3 mm O.D., 0·8 mm wall, stainless steel tubing 360 mm long. One end of the tubing shall be closed, and three No. 40 drill holes shall be drilled into the tubing, 60 mm apart, for gas ports, all radiating in the same direction. The first hole must be 5 mm from the cl osed end of the tubing. The tube is inserted into the environmental chamber through a 6·6 mm hole drilled 10 mm above the upper edge of the window frame.

The tube is supported and positioned by an adjustable “Z” shaped support mounted outside the environme ntal chamber, above the viewing window. The tube is positioned above and 20 mm behind the exposed upper edge of the specimen. The middle hole must be in the vertical plane perpendicular to the Powered by EASA eRules Page 1276 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F exposed surface of the specimen, which passes through its verti cal centreline and must be pointed toward the radiation source. The gas supplied to the burner must be methane adjusted to produce flame lengths of 25 mm.

(c) Calibration of Equipment (1) Heat Release Rate. A burner as shown in Figure 4 must be placed ov er the end of the lower pilot flame tubing using a gas - tight connection. The flow of gas to the pilot flame must be at least 99% methane and must be accurately metered. Prior to usage, the wet test meter is properly levelled and filled with distilled water to the tip of the internal pointer while no gas is flowing. Ambient temperature and pressure of the water, are based on the internal wet test meter temperature. A baseline flow rate of approximately 1 litre/min. is set and increased to higher preset flows of 4, 6, 8, 6 and 4 litres/min. The rate is determined by using a stopwatch to time a complete revolution of the west test meter for both the baseline and higher flow, with the flow returned to baseline before changing to the next higher flow. The thermop ile baseline voltage is measured. The gas flow to the burner must be increased to the higher preset flow and allowed to burn for 2·0 minutes, and the thermopile voltage must be measured. The sequence is repeated until all five values have been determined. The average of the five values must be used as the calibration factor. The procedure must be repeated if the percent relative standard deviation is greater than 5%. Calculations are shown in paragraph (f).

(2) Flux Uniformity. Uniformity of flux over the specimen must be checked periodically and after each heating element change to determine if it is within acceptable limits of ± 5%.

(d) Sample Preparation (1) The standard size for vertically mounted specimens is 150 x 150 mm with thicknesses up to 45 mm.

(2) Conditioning . Specimens must be conditioned as described in Part 1 of this Appendix.

(3) Mounting . Only one surface of a specimen will be exposed during a test. A single layer of 0·025 mm aluminium foil is wrapped tightly on all unexposed sides.

(e) Procedure (1) The power supply to the radiant panel is set to produce a radiant flux of 3·5 Watts/cm .

The flux is measured at the point, which the centre of the specimen surface will occupy when positioned for test. The radiant flux is measured after the airflow through the equipment is adjusted to the desired rate. The sample should be tested in its end use thickness.

(2) The pilot flames are lighted and their position, as described in sub - paragraph (b)(8), is checked.

(3) The airflow to the equipment is set at 0·04 ± 0·001 m /s at atmospheric pressure. Proper air flow may be set and monitored by either: (1) An orifice meter designed to produce a pressure drop of at least 200 mm of the manometric fluid, or by (2) a rotometer (variable orifice meter) with a scale capable of being read to ± 0·0004 m /s. The stop on the vertical specimen holder rod is adjuste d so that the exposed surface of the specimen is positioned 100 mm from the entrance when injected into the environmental chamber.

(4) The specimen is placed in the hold chamber with the radiation doors closed. The airtight outer door is secured, and the r ecording devices are started. The specimen must be retained in the hold chamber for 60 seconds ± 10 seconds, before injection. The thermopile “zero” value is determined during the last 20 seconds of the hold period.

Powered by EASA eRules Page 1277 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (5) When the specimen is to be injected , the radiation doors are opened, the specimen is injected into the environmental chamber, and the radiation doors are closed behind the specimen.

(6) Reserved.

(7) Injection of the specimen and closure of the inner door marks time zero. A continuous recor d of the thermopile output with at least one data point per second must be made during the time the specimen is in the environmental chamber.

(8) The test duration time is five minutes.

(9) A minimum of three specimens must be tested.

(f) Calculations (1) The calibration factor is calculated as follows: ( 𝐹 − 𝐹 ) ( 210 ∙ 8 − 22 ) 𝑘𝑐𝑎𝑙 273 𝑃 − 𝑃 𝑚𝑜𝑙𝑒 𝐶𝐻 4 𝑆𝑇𝑃 1 0 𝑉 𝐾 = × × × × ℎ ( 𝑉 − 𝑉 ) 𝑚𝑜𝑙𝑒 𝑇 760 22 ∙ 41 1 2 𝑎 𝑊𝐴𝑇𝑇 𝑘𝑊 𝑚𝑖𝑛 × × . 01433 𝑘𝑐𝑎𝑙 1000 𝑊 F = Flow of methane at baseline (1pm) F = Higher preset flow of meth ane (1pm) V = Thermopile voltage at baseline (mv) V = Thermopile voltage at higher flow (mv) T = Ambient temperature (K) a P = Ambient pressure (mm Hg) P = Water vapour pressure (mm Hg) v (2) Heat release rates may be calculated from the reading of the thermopile output voltage at any instant of time as: 𝑉 − 𝑉 𝑚 𝑏 𝐻𝑅𝑅 = × 𝐾 ℎ ∙ 02323 𝑚 HRR = Heat Release Rate kW/m V = Measured thermopile voltage (mv) m V = Baseline voltage (mv) b K = Calibration Factor (kW/mv) h (3) The integral of the heat release rate is the total heat release as a function of time and is calculated by multiplying the rate by the data sampling frequency in minutes and summing the time from zero to two minutes.

(g) Cri teria . The total positive heat release over the first two minutes of exposure for each of the three or more samples tested must be averaged, and the peak heat release rate for each of the samples must be averaged. The average total heat release must not ex ceed 65 kilowatt - minutes per square metre, and the average peak heat release rate must not exceed 65 kilowatts per square metre.

(h) Report . The test report must include the following for each specimen tested: (1) Description of the specimen.

Powered by EASA eRules Page 1278 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (2) Radiant heat flux to the specimen, expressed in Watts/cm .

(3) Data giving release rates of heat (in kW/m ) as a function of time, either graphically or tabulated at intervals no greater than 10 seconds. The calibration factor (K ) must be h recorded.

(4) If meltin g, sagging, delaminating, or other behaviour that affects the exposed surface area or the mode of burning occurs, these behaviours must be reported, together with the time at which such behaviours were observed.

(5) The peak heat release and the 2 minute i ntegrated heat release rate must be reported.

[Amdt 25/18] Powered by EASA eRules Page 1279 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F FIGURE 1. RELEASE RATE APPARATUS Powered by EASA eRules Page 1280 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (Un less denoted otherwise, all dimensions are in millimetres.)

FIGURE 2A. “GLOBAR” RADIANT PANEL Powered by EASA eRules Page 1281 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes A PPENDICES TO CS - 25 (CS - 25) Appendix F (Un less denoted otherwise, all dimensions are in millimetres.)

FIGURE 2B. “GLOBAR” RADIANT PANEL Powered by EASA eRules Page 1282 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (Un less denoted otherwise, all dimensions are in millimetres.)

FIGURE 3.

Powered by EASA eRules Page 1283 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (Un less denoted otherwise, all dimensions are in millimetres.)

FIGURE 4.

FIGURE 5. THERMOCOUPLE POSITION Powered by EASA eRules Page 1284 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F

AMC to Appendix F, Part IV – Test Method to Determine the Heat

Release Rate from Cabin Materials Exposed to Radiant Heat

ED Decision 2003/ 2/RM Appendix F, Part IV (b)(4) Air Distribution System.

The air distribution is to be determined by the equipment design. The 3 - to - 1 ratio described in this paragraph is approximate. An external air distribution system which will deliver that ratio precisely is not permitted as a substitute for the air distributor plates.

Appendix F, P art IV (b)(6) Specimen Holders.

In order to accommodate specimens which distort and delaminate during testing, two 0·508 mm (0·020 - inch) stainless steel wires should be used to secure the specimens to the holder during the testing.

These wires should be used with all specimens and are in addition to the drip pan that should be used for materials which are prone to melting and dripping.

Appendix F, Part IV (b)(8) Pilot - Flame Positions.

Various installations have experienced difficulties with the pilot bu rners being extinguished during the test.

The following revisions to the pilot burner configurations have been found to be acceptable: (1) For the lower pilot burner – a sparking device which either sparks automatically at approximately ½ to 1 second int ervals or is manually operated, which requires continuous monitoring of the pilot flame.

Note: This requires that the laboratory test procedure specifies that the technician must continuously monitor the pilot for each test and that failure to do so will i nvalidate the test results.

(2) For the upper pilot burner – a manual or automatic sparking device or a revision to the hole system in the burner. One approved deviation utilises 14 holes using a number 59 drill bit.

Appendix F, Part IV (c)(1) Heat Releas e Rate.

The use of a flowmeter is not acceptable.

The thermopile voltage should be measured for 10 seconds and then averaged.

Appendix F, Part IV (e) Procedure.

The outer door should be closed between tests to maintain the heat within the chamber. It i s recommended that the outer door be hinged to facilitate implementing this recommendation. If a detachable door is used, a separate door should be installed during sample holder preparation and installation. This recommendation is based on the 40 - seconds holding time (60 seconds less 20 seconds of data acquisition time) required in (e)(4), being insufficient to allow the chamber to reach equilibrium, if the outer door is open for too long between tests.

Appendix F, Part IV (f) Calculations.

It has been f ound that a typical range for the calibration factor is 8 to 15. If a calibration factor is calculated which falls outside this range, the calculation should be reviewed.

If the factor continues to fall outside this range, the Agency should be contacted.

Powered by EASA eRules Page 1285 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Append ix F

Part V – Test Method to Determine the Smoke Emission

Characteristics of Cabin Materials

ED Decision 2003/ 2/RM (a) Summary of Method. The specimens must be constructed, conditioned, and tested in the flaming mode in accordance with American Society of Testing and Materials (ASTM) Standard Test Method ASTM F814 - 83.

(b) Acceptance Criteria. The specific optical smoke density (Ds) which i s obtained by averaging the reading obtained after 4 minutes with each of the three s pecimens, shall not exceed 200.

Part VI – Test Method t o Determine the Flammability and Flame

Propagation Characteristics of Thermal/Acoustic Insulation

Materials

ED Decision 2009/010/R Use this test method to evaluate the flammability and flame propagation characteristics of thermal/acoustic insulation when exposed to both a radiant heat source and a flame.

(a ) Definitions.

‘‘Flame propagation’’ means the furthest d istance of the propagation of visible flame towards the far end of the test specimen, measured from the midpoint of the ignition source flame.

Measure this distance after initially applying the ignition source and before all flame on the test specimen is e xtinguished. The measurement is not a determination of burn length made after the test.

‘‘Radiant heat source’’ means an electric or air propane panel.

‘‘Thermal/acoustic insulation’’ means a material or system of materials used to provide thermal and/or acoustic protection. Examples include fibreglass or other batting material encapsulated by a film covering and foams.

‘‘Zero point’’ means the point of application of the pilot burner to the test specimen.

(b ) Test apparatus.

Powered by EASA eRules Page 1286 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (1 ) Radiant panel tes t chamber. Conduct tests in a radiant panel test chamber (see figure 1 above ) . Place the test chamber under an exhaust hood to facilitate clearing the chamber of smoke after each test. The radiant panel test chamber must be an enclosure 1397 mm (55 inches ) long by 495 mm (19.5 inches ) deep by 710 mm (28 inches ) to 762 mm (maximum ) (30 inches ) above the test specimen. Insulate the sides, ends, and top with a fibrous ceramic insulation, such as Kaowool MTM board. On the front side, provide a 52 by 12 - inch (13 21 by 305 mm ) draft - free, high - temperature, glass window for viewing the sample during testing. Place a door below the window to provide access to the movable specimen platform holder. The bottom of the test chamber must be a sliding steel platform that ha s provision for securing the test specimen holder in a fixed and level position. The chamber must have an internal chimney with exterior dimensions of 129 mm (5.1 inches ) wide, by 411 mm (16.2 inches ) deep by 330 mm (13 inches ) high at the opposite end of the chamber from the radiant energy source. The interior dimensions must be 114 mm (4.5 inches ) wide by 395 mm (15.6 inches ) deep. The chimney must extend to the top of the chamber (see figure 2 ) .

Powered by EASA eRules Page 1287 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (2 ) Radiant heat source. Mount the radiant heat energy source in a cast iron frame or equivalent. An electric panel must have six, 76 mm (3 - inch ) wide emitter strips. The emitter strips must be perpendicular to the length of the panel. The panel must have a radiation surface of 327 by 470 mm (12⅞ by 18½ inches ) . The panel must be capable of operating at temperatures up to 704°C (1300°F ) . An air propane panel must be made of a porous refractory material and have a radiation surface of 305 by 457 mm (12 by 18 inches ) . The panel must be capable of op erating at temperatures up to 816°C (1500°F ) .

See figures 3a and 3b.

Powered by EASA eRules Page 1288 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F Powered by EASA eRules Page 1289 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (i ) Electric radiant panel. The radiant panel must be 3 - phase and operate at 208 volts.

A single - phase, 240 volt panel is also acceptable. Use a solid - state power controller and mi croprocessor - based controller to set the electric panel operating parameters.

(ii ) Gas radiant panel. Use propane (liquid petroleum gas — 2.1 UN 1075 ) for the radiant panel fuel. The panel fuel system must consist of a venturi - type aspirator for mixing gas and air at approximately atmospheric pressure. Provide suitable instrumentation for monitoring and controlling the flow of fuel and air to the panel.

Include an air flow gauge, an air flow regulator, and a gas pressure gauge.

(iii ) Radiant panel placeme nt. Mount the panel in the chamber at 30° to the horizontal specimen plane, and 19 cm (7 ½ inches ) above the zero point of the specimen.

(3 ) Specimen holding system.

(i ) The sliding platform serves as the housing for test specimen placement. Brackets may be attached (via wing nuts ) to the top lip of the platform in order to accommodate various thicknesses of test specimens. Place the test specimens on a sheet of Kaowool MTM board or 1260 Standard Board (manufactured by Thermal Ceramics and available in Eu rope ) or equivalent, either resting on the bottom lip of the sliding platform or on the base of the brackets. It may be necessary to use Powered by EASA eRules Page 1290 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F multiple sheets of material based on the thickness of the test specimen (to meet the sample height requirement ) . Typica lly, these non - combustible sheets of material are available in 6 mm (¼ inch ) thicknesses. See figure 4. A sliding platform that is deeper than the 50.8 mm (2 - inch ) platform shown in figure 4 is also acceptable as long as the sample height requirement is me t.

(ii ) Attach a 13 mm (½ inch ) piece of Kaowool MTM board or other high temperature material measuring 1054 by 210 mm (41½ by 8¼ inches ) to the back of the platform. This board serves as a heat retainer and protects the test specimen from excessive preheating. The height of this board must not impede the sliding platform movement (in and out of the test chamber ) . If the platform has been f abricated such that the back side of the platform is high enough to prevent excess preheating of the specimen when the sliding platform is out, a retainer board is not necessary.

(iii ) Place the test specimen horizontally on the non - combustible board(s ) . Place a steel retaining/securing frame fabricated of mild steel, having a thickness of 3.2 mm (⅛ inch ) and overall dimensions of 584 by 333 mm (23 by 13⅛ inches ) with a specimen opening of 483 by 273 mm (19 by 10¾ inches ) over the test specimen.

The fron t, back, and right portions of the top flange of the frame must rest on the top of the sliding platform, and the bottom flanges must pinch all 4 sides of the test specimen. The right bottom flange must be flush with the sliding platform. See figure 5.

Powered by EASA eRules Page 1291 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (4 ) Pilot Burner. The pilot burner used to ignite the specimen must be a BernzomaticTM (or equivalent ) commercial propane venturi torch with an axially symmetric burner tip and a propane supply tube with an orifice diameter of 0.15 mm (0.006 inches ) . The length of the burner tube must be 71 mm (2⅞ inches ) . The propane flow must be adjusted via gas pressure through an in - line regulator to produce a blue inner cone length of 19 mm (¾ inch ) . A 19 mm (¾ inch ) guide (such as a thin strip of metal ) may be sold ered to the top of the burner to aid in setting the flame height. The overall flame length must be approximately 127 mm (5 inches ) long. Provide a way to move the burner out of the ignition position so that the flame is horizontal and at least 50 mm (2 inc hes ) above the specimen plane. See figure 6.

Powered by EASA eRules Page 1292 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (5 ) Thermocouples. Install a 24 American Wire Gauge (AWG ) Type K (Chromel - Alumel ) thermocouple in the test chamber for temperature monitoring. Insert it into the chamber through a small hole drilled through t he back of the chamber. Place the thermocouple so that it extends 279 mm (11 inches ) out from the back of the chamber wall, 292 mm (11½ inches ) from the right side of the chamber wall, and is 51 mm (2 inches ) below the radiant panel. The use of other therm ocouples is optional.

(6 ) Calorimeter. The calorimeter must be a one - inch cylindrical water - cooled, total heat flux density, foil type Gardon Gage that has a range of 0 to 5.7 Watts/cm (0 to 5 BTU/ft2 sec ) .

(7 ) Calorimeter calibration specification and pr ocedure.

(i ) Calorimeter specification.

(A ) Foil diameter must be 6.35 ± 0.13 mm (0.25 ± 0.005 inches ) .

(B ) Foil thickness must be 0.013 ± 0.0025 mm (0.0005 ± 0.0001 inches ) .

(C ) Foil material must be thermocouple grade Constantan.

(D ) Temperature measurement must be a Copper Constantan thermocouple.

(E ) The copper center wire diameter must be 0.013 mm (0.0005 inches ) .

(F ) The entire face of the calorimeter must be lightly coated with ‘‘Black Velvet’’ paint having an emissivity of 96 or greater.

(ii ) Calorimeter calibration.

(A ) The calibration method must be by comparison to a like standardized transducer.

(B ) The standardized transducer must meet the specifications given in paragraph (b ) (6 ) of Part VI of this Appendix.

(C ) Calibrate the standard transducer against a primary standard traceable to the National Institute of Standards and Technology (NIST ) .

(D ) The method of transfer must be a heated graphite plate.

(E ) The graphite plate must be electrically heated, have a clear surface are a on each side of the plate of at least 51 by 51 mm (2 by 2 inches ) , and be 3.2 ± 1.6 mm (⅛± 1⁄16 inch ) thick.

Powered by EASA eRules Page 1293 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (F ) enter the 2 transducers on opposite sides of the plates at equal distances from the plate.

(G ) The distance of the calorimeter to the plate m ust be no less than 1.6 mm (0.0625 inches ) , nor greater than 9.5 mm (0.375 inches ) .

(H ) The range used in calibration must be at least 0 – 3.9 Watts/cm (0 – 3.5 2 2 2 BTUs/ft sec ) and no greater than 0 – 6.4 Watts/cm (0 – 5.7 BTUs/ft sec ) .

(I ) The recording device used must record the 2 transducers simultaneously or at least within 1⁄10 of each other.

(8 ) Calorimeter fixture. With the sliding platform pulled out of the chamber, install the calorimeter holding frame and place a sheet of non - comb ustible material in the bottom of the sliding platform adjacent to the holding frame. This will prevent heat losses during calibration. The frame must be 333 mm (13⅛ inches ) deep (front to back ) by 203 mm (8 inches ) wide and must rest on the top of the sliding platform. It must be fabricated of 3.2 mm (⅛ inch ) flat stock steel and have an opening that accommodates a 12.7 mm (½ inch ) thick piece of refractory board, which is level with the top of the sliding platform.

The board must have three 25.4 mm (1 inch ) diameter holes drilled through the board for calorimeter insertion. The distance to the radiant panel surface from the centreline of the first hole (‘‘zero’’ position ) must be 191 ± 3 mm (7½ ± ⅛ inches ) . The dist ance between the centreline of the first hole to the centreline of the second hole must be 51 mm (2 inches ) . It must also be the same distance from the centreline of the second hole to the centreline of the third hole. See figure 7. A calorimeter holding f rame that differs in construction is acceptable as long as the height from the centreline of the first hole to the radiant panel and the distance between holes is the same as described in this paragraph.

Powered by EASA eRules Page 1294 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO C S - 25 (CS - 25) Appendix F (9 ) Instrumentation. Provide a calibrated recordi ng device with an appropriate range or a computerized data acquisition system to measure and record the outputs of the calorimeter and the thermocouple. The data acquisition system must be capable of recording the calorimeter output every second during cal ibration.

(10 ) Timing device. Provide a stopwatch or other device, accurate to ± 1 second/hour, to measure the time of application of the pilot burner flame.

(c ) Test specimens.

(1 ) Specimen preparation. Prepare and test a minimum of three test specimen s. If an oriented film cover material is used, prepare and test both the warp and fill directions.

(2 ) Construction. Test specimens must include all materials used in construction of the insulation (including batting, film, scrim, tape etc. ) . Cut a piece of core material such as foam or fiberglass, and cut a piece of film cover material (if used ) large enough to cover the core material. Heat sealing is the preferred method of preparing fiberglass samples, since they can be made without compressing the fibe rglass (‘‘box sample’’ ) . Cover materials that are not heat sealable may be stapled, sewn, or taped as long as the cover material is over - cut enough to be drawn down the sides without compressing the core material. The fastening means should be as continuou s as possible along the length of the seams. The specimen thickness must be of the same thickness as installed in the airplane.

(3 ) Specimen Dimensions. To facilitate proper placement of specimens in the sliding platform housing, cut non - rigid core materi als, such as fibreglass, 318 mm (12½ inches ) wide by 584 mm (23 inches ) long. Cut rigid materials, such as foam, 292 ± 6 mm (11½ ± ¼ inches ) wide by 584 mm (23 inches ) long in order to fit properly in the sliding platform housing and provide a flat, expose d surface equal to the opening in the housing.

(d ) Specimen conditioning. Condition the test specimens at 21 ± 2°C (70 ± 5°F ) and 55% ± 10% relative humidity, for a minimum of 24 hours prior to testing.

(e ) Apparatus Calibration.

(1 ) With the sliding p latform out of the chamber, install the calorimeter holding frame. Push the platform back into the chamber and insert the calorimeter into the first hole (‘‘zero’’ position ) . See figure 7. Close the bottom door located below the sliding platform. The dista nce from the centerline of the calorimeter to the radiant panel surface at this point must be 191 ± 3 mm (7½ ± ⅛ inches ) . Prior to igniting the radiant panel, ensure that the calorimeter face is clean and that there is water running through the calorimeter .

(2 ) Ignite the panel. Adjust the fuel/air mixture to achieve 1.7 Watts/cm2 ± 5% (1.5 BTUs/ft sec ± 5% ) at the ‘‘zero’’ position. If using an electric panel, set the power controller to achieve the proper heat flux. Allow the unit to reach steady state (this may take up to 1 hour ) . The pilot burner must be off and in the down position during this time.

(3 ) After steady - state conditions have been reached, move the calorimeter 51 mm (2 inches ) from the ‘‘zero’’ position (first hole ) to position 1 and record the heat flux. Move the calorimeter to position 2 and record the heat flux. Allow enough time at each position for the calorimeter to stabilize. Table 1 depicts typical calibration values at the three positions.

Powered by EASA eRules Page 1295 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F TABLE 1. — CALIBRATION TABLE 2 2 Position BTU’s/ft sec Watts/cm ‘‘Zero’’ Position. 1.5 1.7 Position 1 1.51 – 1.50 – 1.49 1.71 – 1.70 – 1.69 Position 2 1.43 – 1.44 1.62 – 1.63 (4 ) Open the bottom door. Remove the calorimeter and holder fixture. Use caution as the fixture is very hot.

(f ) Test Procedure.

(1 ) Ignite the pilot burner. Ensure that it is at least 51 mm (2 inches ) above the top of the platform. The burner must not cont act the specimen until the test begins.

(2 ) Place the test specimen in the sliding platform holder. Ensure that the test sample surface is level with the top of the platform. At ‘‘zero’’ point, the specimen surface must be 191 ± 3 mm (7 ½ ± ⅛ inches ) belo w the radiant panel.

(3 ) Place the retaining/securing frame over the test specimen. It may be necessary (due to compression ) to adjust the sample (up or down ) in order to maintain the distance from the sample to the radiant panel 191 ± 3 mm (7½ ± ⅛ inches ) at ‘‘zero’’ position ) . With film/fiberglass assemblies, it is critical to make a slit in the film cover to purge any air inside. This allows the operator to maintain the proper test specimen position (level with the top of the platform ) and to allow vent ilation of gases during testing. A longitudinal slit, approximately 2 inches (51 mm ) in length, must be centered 76 ± 13 mm (3 ± ½ inches ) from the left flange of the securing frame. A utility knife is acceptable for slitting the film cover.

(4 ) Immediately push the sliding platform into the chamber and close the bottom door.

(5 ) Bring the pilot burner flame into contact with the center of the specimen at the ‘‘zero’’ point and simultaneously start the timer. The pilot burner must be at a 27° ang le with the sample and be approximately ½ inch (12 mm ) above the sample. See figure 7. A stop, as shown in figure 8, allows the operator to position the burner correctly each time.

Powered by EASA eRules Page 1296 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (6 ) Leave the burner in position for 15 seconds and then remove to a po sition at least 51 mm (2 inches ) above the specimen.

(g ) Report.

(1 ) Identify and describe the test specimen.

(2 ) Report any shrinkage or melting of the test specimen.

(3 ) Report the flame propagation distance. If this distance is less than 51 mm (2 in ches ) , report this as a pass (no measurement required ) .

(4 ) Report the after - flame time.

(h ) Requirements.

(1 ) There must be no flame propagation beyond 51 mm (2 inches ) to the left of the centerline of the pilot flame application.

(2 ) The flame time a fter removal of the pilot burner may not exceed 3 seconds on any specimen.

[Amdt 25/6] Powered by EASA eRules Page 1297 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F

Part VII – Test Method t o Determine the Burnthrough Resistance of

Therma l/Acoustic Insulation Materials

ED Decision 2009/010/R Use the following test method to evaluate the burnthrough resistance characteristics of aircraft thermal/acoustic insulation materials when exposed to a high intensity open flame.

(a) Definitions.

Burnthrough time means the time, in seconds, for the bur ner flame to penetrate the test 2 2 specimen, and/or the time required for the heat flux to reach 2.27 W/cm (2.0 Btu/ft sec) on the inboard side, at a distance of 30.5 cm (12 inches) from the front surface of the insulation blanket test frame, whichever is s ooner. The burnthrough time is measured at the inboard side of each of the insulation blanket specimens.

Insulation blanket specimen means one of two specimens positioned in either side of the test rig, at an angle of 30° with respect to vertical.

Specim en set means two insulation blanket specimens. Both specimens must represent the same production insulation blanket construction and materials, proportioned to correspond to the specimen size.

(b) Apparatus.

(1) The arrangement of the test apparatus is shown in figures 1 and 2 and must include the capability of swinging the burner away from th e test specimen during warm - up.

Powered by EASA eRules Page 1298 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F Figure 1 – Burnthrough Test Apparatus Specimen Holder (2) Test burner. The test burner must be a modified gun - type such as the P ark Model DPL 3400 or equivalent.

Flame characteristics are highly dependent on actual burner setup. Parameters such as fuel pressure, nozzle depth, stator position, and intake airflow must be properly adjusted to achieve the correct flame output.

Powered by EASA eRules Page 1299 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F Figure 2 – Burnthrough Test Apparatus (i) Nozzle. A nozzle must maintain the fuel pressure to yield a nominal 0.378 l/min (6.0 gal/hr) fuel flow. A Monarch - manufactured 80° PL (hollow cone) nozzle nominally rated at 6.0 gal/hr at 100 lb/in (0.71 MPa) delivers a proper spray pattern.

(ii) Fuel Rail. The fuel rail must be adjusted to position the fuel nozzle at a depth of 8 mm (0.3125 inch) from the end plane of the exit stator, which must be mounted in the end of the draft tube.

Powered by EASA eRules Page 1300 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (iii) Internal Stator. The in ternal stator, located in the middle of the draft tube, must be positioned at a depth of 95 mm (3.75 inches) from the tip of the fuel nozzle. The stator must also be positioned such that the integral igniters are located at an angle midway between the 10 a nd 11 o’clock position, when viewed looking into the draft tube. Minor deviations to the igniter angle are acceptable if the temperature and heat flux requirements conform to the requirements of paragraph (e) of Part VII of this Appendix.

(iv) Blower Fan. The cylindrical blower fan used to pump air through the burner must measure 133 mm (5.25 inches) in diameter by 89 mm (3.5 inches) in width.

(v) Burner cone. Install a 305 ± 3 - mm (12 ± 0.125 - inch) burner extension cone at the end of the draft tube. The cone must have an opening 152 ± 3 mm (6 ± 0.125 inches) high and 280 ± 3 mm (11 ± 0.125 inches) wide (see figure 3).

(vi) Fuel. Use JP – 8, Jet A, or their international equivalent, at a flow rate of 0.378 ± 0.0126 l/min (6.0 ± 0.2 gal/hr). If t his fuel is unavailable, ASTM K2 fuel (Number 2 grade kerosene) or ASTM D2 fuel (Number 2 grade fuel oil or Number 2 diesel fuel) are acceptable if the nominal fuel flow rate, temperature, and heat flux measurements conform to the requirements of paragraph (e) of Part VII of this Appendix.

(vii) Fuel pressure regulator. Provide a fuel pressure regulator, adjusted to deliver a nominal 0.378 l/min (6.0 gal/hr) flow rate. An operating fuel pressure of 0.71 MPa (100 lb/in ) for a nominally rated 6.0 gal/hr 80 ° spray angle nozzle (such as a PL type) delivers 0.378 ± 0.0126 l/ min (6.0 ± 0.2 gal/hr).

Powered by EASA eRules Page 1301 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F Figure 3 – Burner Draft Tube Extension Cone Diagram Powered by EASA eRules Page 1302 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (3) Calibration rig and equipment.

(i) Construct individual calibration rigs to incorporate a calorimeter and thermocouple rake for the measurement of heat flux and temperature. Position the calibration rigs to allow movement of the burner from the test rig position to either the heat flux or t emperature position with minimal difficulty.

(ii) Calorimeter. The calorimeter must be a total heat flux, foil type Gardon Gage of an appropriate range such as 0 – 22.7 W/cm2 (0 – 20 Btu/ft sec), accurate to ± 3% of the indicated reading. The heat flux cali bration method must be in accordance with paragraph (b)(7) of Part VI of this Appendix.

(iii) Calorimeter mounting. Mount the calorimeter in a 152 by 305 ± 3 mm (6 by 12 ± 0.125 inches) by 19 ± 3 mm (0.75 ± 0.125 inches) thick insulating block which is attached to the heat flux calibration rig during calibration (figure 4). Monitor the insulating block for deterioration and replace it when necessary. Adjust the mounting as necessary to ensure that the calorimeter face is parallel to the exit plane of the test burner cone.

Powered by EASA eRules Page 1303 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPEN DICES TO CS - 25 (CS - 25) Appendix F Figure 4 – Calorimeter Position Relative to Burner Cone Powered by EASA eRules Page 1304 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F Figure 5 – Thermocouple Rake Position Relative to Burner Cone (iv) Thermocouples. Provide seven 3.2 mm (⅛ - inch) ceramic packed, metal sheathed, type K (Chromel - alumel), groun ded junction thermocouples with a nominal 24 American Wire Gauge (AWG) size conductor for calibration. Attach the thermocouples to a steel angle bracket to form a thermocouple rake for placement in the calibration rig during burner calibration (figure 5).

(v) Air velocity meter. Use a vane - type air velocity meter to calibrate the velocity of air entering the burner. An Omega Engineering Model HH30A or equivalent is satisfactory. Use a suitable adapter to attach the measuring device to the inlet side Powered by EASA eRules Page 1305 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F of th e burner to prevent air from entering the burner other than through the measuring device, which would produce erroneously low readings. Use a flexible duct, measuring 102 mm (4 inches) wide by 6.1 meters (20 feet) long, to supply fresh air to the burner in take to prevent damage to the air velocity meter from ingested soot. An optional airbox permanently mounted to the burner intake area can effectively house the air velocity meter and provide a mounting port for the flexible intake duct.

(4) Test specimen mounting frame. Make the mounting frame for the test specimens of 3.2 mm (⅛ - inch) thick steel as shown in figure 1, except for the centre vertical former, which should be 6.4 mm (¼ - inch) thick to minimize warpage. The specimen mounting frame stringers (horizontal) should be bolted to the test frame formers (vertical) such that the expansion of the stringers will not cause the entire structure to warp. Use the mounting frame for mounting the two insulation blanket test specimens as shown in fig ure 2.

(5) Backface calorimeters. Mount two total heat flux Gardon type calorimeters behind the insulation test specimens on the back side (cold) area of the test specimen mounting frame as shown in figure 6. Position the calorimeters along the same plan e as the burner cone centreline, at a distance of 102 mm (4 inches) from the vertical centreline of the test frame.

Powered by EASA eRules Page 1306 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F Figure 6 – Position of Backface Calorimeters Relative to Test Specimen Frame (i) The calorimeters must be a total heat flux, foil type Ga rdon Gage of an appropriate range such as 0 – 5.7 W/cm2 (0 – 5 Btu/ft sec), accurate to ± 3% of the indicated reading. The heat flux calibration method must comply with paragraph (b)( 7) of Part VI of this Appendix.

(6) Instrumentation. Provide a recording pot entiometer or other suitable calibrated instrument with an appropriate range to measure and record the outputs of the calorimeter and the thermocouples.

Powered by EASA eRules Page 1307 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (7) Timing device. Provide a stopwatch or other device, accurate to ± 1%, to measure the time of appl ication of the burner flame and burnthrough time.

(8) Test chamber. Perform tests in a suitable chamber to reduce or eliminate the possibility of test fluctuation due to air movement. The chamber must have a minimum floor area of 305 by 305 cm (10 by 10 feet).

(i) Ventilation hood. Provide the test chamber with an exhaust system capable of removing the products of combustion expelled during tests.

(c) Test Specimens.

(1) Specimen preparation. Prepare a minimum of three specimen sets of the same construction and configuration for testing.

(2) Insulation blanket test specimen.

(i) For batt - type materials such as fibreglass, the constructed, finished blanket specimen asse mblies must be 81.3 wide by 91.4 cm long (32 inches by 36 inches), exclusive of heat sealed film edges.

(ii) For rigid and other non - conforming types of insulation materials, the finished test specimens must fit into the test rig in such a manner as to re plicate the actual in - service installation.

(3) Construction. Make each of the specimens tested using the principal components (i.e., insulation, fire barrier material if used, and moisture barrier film) and assembly processes (representative seams and c losures).

(i) Fire barrier material. If the insulation blanket is constructed with a fire barrier material, place the fire barrier material in a manner reflective of the installed arrangement For example, if the material will be placed on the outboard si de of the insulation material, inside the moisture film, place it the same way in the test specimen.

(ii) Insulation material. Blankets that utilize more than one variety of insulation (composition, density, etc.) must have specimen sets constructed that reflect the insulation combination used. If, however, several blanket types use similar insulation combinations, it is not necessary to test each combination if it is possible to bracket the various combinations.

(iii) Moisture barrier film. If a produc tion blanket construction utilizes more than one type of moisture barrier film, perform separate tests on each combination. For example, if a polyimide film is used in conjunction with an insulation in order to enhance the burnthrough capabilities, also te st the same insulation when used with a polyvinyl fluoride film.

(iv) Installation on test frame. Attach the blanket test specimens to the test frame using 12 steel spring type clamps as shown in figure 7. Use the clamps to hold the blankets in place in both of the outer vertical formers, as well as the centre vertical forme r (4 clamps per former). The clamp surfaces should measure 25.4 by 51 mm (1 inch by 2 inches). Place the top and bottom clamps 15.2 cm (6 inches) from the top and bottom of the test frame, respectively. Place the middle clamps 20.3 cm (8 inches) from the t op and bottom clamps.

Powered by EASA eRules Page 1308 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F Figure 7 – Test Specimen Installation on Test Frame (Note: For blanket materials that cannot be installed in accordance with figure 7 above, the blankets must be installed in a manner approved by the Agency.)

(v) Conditioning. Co ndition the specimens at 21° ± 2°C (70° ± 5°F) and 55% ± 10% relative humidity for a minimum of 24 hours prior to testing.

(d) Preparation of apparatus.

(1) Level and centre the frame assembly to ensure alignment of the calorimeter and/or thermocouple rake with the burner cone.

(2) Turn on the ventilation hood for the test chamber. Do not turn on the burner blower.

Measure the airflow of the test chamber using a vane anemometer or equivalent measuring device. The vertical air velocity just behind the top of the upper insulation blanket test specimen must be 100 ± 50 ft/min (0.51±0.25 m/s). The horizontal air velocity at this point must be less than 50 ft/min (0.25 m/s).

(3) If a calibrated flow meter is not available, measure the fuel flow rate using a graduated cylinder of appropriate size. Turn on the burner motor/fuel pump, after insuring that the igniter system is turned off. Collect the fuel via a plastic or rubber tube into the graduated cylinder for a 2 - minute period. Determine the flow rate in gallons per hour. The fuel flow rate must be 0.378 ± 0.0126 l/min (6.0 ± 0.2 gallons per hour).

Powered by EASA eRules Page 1309 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (e) Calibration.

(1) Position the burner in front of the calorimeter so that it is centred and the vertical plane of the burner cone exit is 4 ± 0.125 inch es (102 ± 3 mm) from the calorimeter face. Ensure that the horizontal centreline of the burner cone is offset 1 inch below the horizontal centreline of the calorimeter (figure 8). Without disturbing the calorimeter position, rotate the burner in front of t he thermocouple rake, such that the middle thermocouple (number 4 of 7) is centred on th e burner cone.

Figure 8 – Burner Information and Calibration Settings Ensure that the horizontal centreline of the burner cone is also offset 25.4 mm (1 inch) below the horizontal centreline of the thermocouple tips. Re - check measurements by rotating the burner to each position to ensure proper alignment between the cone and the calorimeter and thermocouple rake. (Note: The test burner mounting system must incorporate ‘‘detents’’ that ensure proper centring of the burner cone with respect to both the calorimeter and the thermocouple rakes, so that rapid positioning of the bur ner can be achieved during the calibration procedure.)

(2) Position the air velocity meter in the adapter or airbox, making certain that no gaps exist where air could leak around the air velocity measuring device. Turn on the blower/motor while ensuring that the fuel solenoid and igniters are off. Adjust the air intake velocity to a level of 10.92 m/s, (2150 ft/min) then turn off the blower/motor. (Note: The Omega HH30 air velocity meter measures 66.7 mm (2.625 inches) in diameter. To calculate the 2 2 intake airflow, multiply the cross - sectional area 0.0035 m (0.03758 ft ) by the air velocity 3 3 10.92 m/s (2150 ft/min) to obtain 2.29 m /min (80.80 ft /min). An air velocity meter other m3 than the HH30 unit can be used, provided the calculated airflow of 2.29 /min (80.80 ft /min) is equivalent.)

Powered by EASA eRules Page 1310 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (3) Rotate the burner from the test position to the warm - up position. Prior to lighting the burner, ensure that the calorimeter face is clean of soot deposits, and there is water running through the calorimeter. Exami ne and clean the burner cone of any evidence of build - up of products of combustion, soot, etc. Soot build - up inside the burner cone may affect the flame characteristics and cause calibration difficulties. Since the burner cone may distort with time, dimens ions should be checked periodically.

(4) While the burner is still rotated to the warm - up position, turn on the blower/motor, igniters and fuel flow, and light the burner. Allow it to warm up for a period of 2 minutes.

Move the burner into the calibratio n position and allow 1 minute for calorimeter stabilization, then record the heat flux once every second for a period of 30 seconds. Turn off burner, rotate out of position, and allow to cool. Calculate the average heat flux over this 30 - second duration. T he average heat flux should be 18.2 ± 0.9 W/cm (16.0 ± 0.8 Btu/ft sec).

(5) Position the burner in front of the thermocouple rake. After checking for proper alignment, rotate the burner to the warm - up position, turn on the blower/motor, igniters and fu el flow, and light the burner. Allow it to warm up for a period of 2 minutes. Move the burner into the calibration position and allow 1 minute for thermocouple stabilization, then record the temperature of each of the 7 thermocouples once every second for a period of 30 seconds. Turn off burner, rotate out of position, and allow to cool. Calculate the average temperature of each thermocouple over this 30 - second period and record. The average temperature of each of the 7 thermocouples should be 1038 ± 56°C ( 1900 ± 100°F).

(6) If either the heat flux or the temperatures are not within the specified range, adjust the burner intake air velocity and repeat the procedures of paragraphs (4) and (5) above to obtain the proper values. Ensure that the inlet air velo city is within the range of 10.92 ± 0.25 m/s (2150 ft/min ± 50 ft/min).

(7) Calibrate prior to each test until consistency has been demonstrated. After consistency has been confirmed, several tests may be conducted with calibration conducted before and a fter a series of tests.

(f) Test procedure.

(1) Secure the two insulation blanket test specimens to the test frame. The insulation blankets should be attached to the test rig centre vertical former using four spring clamps positioned as shown in figure 7 (according to the criteria of paragraph (c)(3)(iv) of Part VII of this Appendix).

(2) Ensure that the vertical plane of the burner cone is at a distance of 102 ± 3 mm (4 ± 0.125 inch) from the outer surface of the horizontal stringers of the test spec imen frame, and that the burner and test frame are both situated at a 30° angle with respect to vertical.

(3) When ready to begin the test, direct the burner away from the test position to the warm - up position so that the flame will not impinge on the sp ecimens prematurely. Turn on and light the burner and allow it to stabilize for 2 minutes.

(4) To begin the test, rotate the burner into the test position and simultaneously start the timing device.

(5) Expose the test specimens to the burner flame for 4 minutes and then turn off the burner.

Immediately rotate the burner out of the test position.

Powered by EASA eRules Page 1311 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (6) Determine (where applicable) the burnthrough time, or the point at which the heat flux 2 2 exceeds 2.27 W/cm (2.0 Btu/ft sec).

(g) Report.

(1) Identify and describe the specimen being tested.

(2) Report the number of insulation blanket specimens tested.

(3) Report the burnthrough time (if any), and the maximum heat flux on the back face of the insulation blanket test specimen, and the time at which t he maximum occurred.

(h) Requirements.

(1) Each of the two insulation blanket test specimens must not allow fire or flame penetration in less than 4 minutes.

(2) Each of the two insulation blanket test specimens must not allow more than 2.27 W/cm (2.0 Btu/ft sec) on the cold side of the insulation specimens at a point 30.5 cm (12 inches) from the face of the test rig.

[Amdt 25/6] Powered by EASA eRules Page 1312 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F

A PPENDIX H – I NSTRUCTIONS FOR C ONTINUED A IRWORTHINESS

ED Decision 2016/010/R (See AMC to Appendix H )

H25.1 General

ED Decision 2017/015 /R (a) This Appendix specifies requirements for the preparation of Instructions for Continued Airworthiness as required by CS 25.1529 and CS 25.1729 (b) The Instructions for Cont inued Airworthiness for each aeroplane must include the Instructions for Continued Airworthiness for each engine and propeller (hereinafter designated ‘products’), for each appliance required by this CS - 25 and any required information relating to the inter face of those appliances and products with the aeroplane. If Instructions for Continued Airworthiness are not supplied by the manufacturer of an appliance or product installed in the aeroplane, the Instructions for Continued Airworthiness for the aeroplane must include the information essential to the continued airworthiness of the aeroplane.

(c) The applicant must consider the effect of ageing structures in the Instructions for Continued Airworthiness (see AMC 20 - 20).

[Amdt 25/5] [Amdt 25/19]

H25.2 Format

ED Decision 2003/2/RM (a) The Instructions for Continued Airworthiness must be in the form of a manual or manuals as appropriate for the quantity of data to be provided.

(b) The format of the manual or manuals must provide for a practical arrangement.

H2 5.3 Content

ED Decision 2003/ 2/RM The contents of the manual or manuals must be prepared in a language acceptable to the Agency. The Instructions for Continued Airworthiness must contain the following manuals or sections, as appropriate, and information: (a) Aeroplane maintenance manual or section (1) Introduction information that includes an explanation of the aeroplane’s features and data to the extent necessary for maintenance or preventive maintenance.

(2) A description of the aeroplane an d its systems and installations including its engines, propellers, and appliances.

(3) Basic control and operation information describing how the aeroplane components and systems are controlled and how they operate, including any special procedures and lim itations that apply.

(4) Servicing information that covers details regarding servicing points, capacities of tanks, reservoirs, types of fluids to be used, pressures applicable to the various systems, location Powered by EASA eRules Page 1313 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F of access panels for inspection and servicing, locations of lubrication points, lubricants to be used, equipment required for servicing, tow instructions and limitations, mooring, jacking, and levelling information.

(b) Maintenance Instructions (1) Scheduling information for each part of the aeroplane and its engines, auxiliary power units, propellers, accessories, instruments, and equipment that provides the recommended periods at which they should be cleaned, inspected, adjusted, tested, and lubricated, and the degree of inspection, the applicable we ar tolerances, and work recommended at these periods. However, reference may be made to information from an accessory, instrument or equipment manufacturer as the source of this information if it is shown that the item has an exceptionally high degree of c omplexity requiring specialized maintenance techniques, test equipment, or expertise. The recommended overhaul periods and necessary cross references to the Airworthiness Limitations section of the manual must also be included. In addition, an inspection p rogramme that includes the frequency and extent of the inspections necessary to provide for the continued airworthiness of the aeroplane must be included.

(2) Troubleshooting information describing probable malfunctions, how to recognise those malfunctions , and the remedial action for those malfunctions.

(3) Information describing the order and method of removing and replacing products and parts with any necessary precautions to be taken.

(4) Other general procedural instructions including procedures for sy stem testing during ground running, symmetry checks, weighing and determining the centre of gravity, lifting and shoring, and storage limitations.

(c) Diagrams of structural access plates and information needed to gain access for inspections when access pl ates are not provided.

(d) Details for the application of special inspection techniques including radiographic and ultrasonic testing where such processes are specified.

(e) Information needed to apply protective treatments to the structure after inspection.

(f) All data relative to structural fasteners such as identification, discard recommendations, and torque values.

(g) A list of special tools needed.

H 25.4 Airworthiness Limitations S ection

ED Decision 2020/024/R (a) The Instructions for Cont inued Airworthiness must contain a section titled Airworthiness Limitations that is segregated and clearly distinguishable from the rest of the document. This section must set forth - (1) E ach mandatory modification time, replacement time, structural insp ection interval, and related structural inspection procedure approved under CS 25.571 ; (2) Each mandatory replacement time, inspection interval, related inspection procedure, and all the critical design configuration control limitations approved under CS 25.981 for the fuel tank system.

Powered by EASA eRules Page 1314 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F (3) Any mandatory replacement time of EWIS components as defined in CS 25.1701 (see AMC Appendix H 25.4(a)(3) ).

(4) A limit of validity (LOV) of the engineering data that supports the struc tural maintenance programme, stated as a total number of accumulated flight cycles or flight hours or both, approved under CS 25.571 . Until the full - scale fatigue testing is completed and the LOV is approved, the A irworthiness Limitations Section must specify an interim limitation restricting aircraft operation to not more than half the number of the cycles accumulated on the fatigue test article.

(5 ) Each Certification Maintenance Requirement established to comply with any of the applicable requirements of CS - 25 (see AMC 25 - 19 ).

(6) Each mandatory replacement time, inspection interval, and related inspection and test procedure, and each critical design configuration control limitation for each lightning protection feature approved under CS 25.954 .

(b) If the Instructions for Continued Airworthiness consist of multiple documents, the section required by this paragraph must be included in the principal manual. This section must contain a legible statement in a prominent location that reads: ‘The Airworthiness Limitations Section is approved and variations must also be approved’.

[Amdt 25/5] [Amdt 25/19] [Amdt 25/20] [Amdt 25/26]

AMC to Appendix H, H25.4(a)(3) Mandatory replacement time of

EWIS components as defined in CS 25.1701

ED Decision 2008/006/R In accordance with subparagraph H25.4(a)(3) applicants are required to include in the Ai rworthiness Limitations section of the Instructions for Continued Airworthiness any mandatory replacement times for EWIS components. EWIS components are those defined by CS 25.1701 . Generally, EWIS components are d esigned and selected to last for the service life of the aeroplane. Any EWIS component that must be replaced at regular intervals to maintain the airworthiness of the associated system or aeroplane must be specified, with its required replacement interval, in the Airworthiness Limitations section of the ICA.

[Amdt 25/5]

H25.5 Electrical Wiring Interconnection System Instructions for

Continued Airworthiness

ED Decision 200 9 / 017 /R T he applicant must prepare Instructions for Continued Airworthiness applicable to Electrical Wiring Interconnection System as defined in CS 25.1701 . (see AMC Appendix H 25.5 ) [Amdt 25/5] [Amdt 25/8] Powered by EASA eRules Page 1315 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F

AMC to Appendix H , H25.5 Instructions for Continued

Airworthiness applicable to EWIS

ED Decision 2008/006/R In accordance with subparagraph H25.5 the applicant must prepare Instructions for Continued Airworthiness (ICA) applicable to EWIS as defined by 25.1701 that should include the following: 1 Maintenance and inspection requirements for the EWIS developed with the use of an enhanced zonal analysis procedure (EZAP) that includes: a. Identi fication of each zone of the aeroplane.

b. Identification of each zone that contains EWIS.

c. Identification of each zone containing EWIS that also contains combustible materials.

d. Identification of each zone in which EWIS is in close proximity to both primary and back - up hydraulic, mechanical, or electrical flight controls and lines.

e. Identification of − — Tasks, and the intervals for performing those tasks, that will reduce the likelihood of ignition sources and accumulation of combustible material, an d — Procedures, and the intervals for performing those procedures, that will effectively clean the EWIS components of combustible material if there is not an effective task to reduce the likelihood of combustible material accumulation.

f. Instructions for protections and caution information that will minimize contamination and accidental damage to EWIS, as applicable, during the performance of maintenance, alteration, or repairs.

2 Acceptable EWIS maintenance practices in a standard format: Applicants shoul d document EWIS maintenance practices in a standard format. This is typically accomplished with publication of a standard wiring practices manual (SWPM). The rule is not intended to require that every manufacturer’s SWPM is identical. The intent is to enab le people performing EWIS maintenance and repairs to find information in the SWPM more quickly and easily, regardless of what aeroplane model they are currently working on. Standard wiring practices include procedures and practices for the installation, re pair, and removal of EWIS components, including information about wire splices, methods of bundle attachment, connectors and electrical terminal connections, bonding, and grounding. A SWPM is not a design manual, and designers of EWIS modifications for spe cific aeroplane models should not use it as such. But it does provide the designer with insight into the types of EWIS components used by the TC holder and the procedures recommended by the manufacturer for maintenance or repair that supports continued air worthiness of the components. AMC 20 - 23 “Development of Standard Wiring Practices Documentation,” provides guidance on how to comply.

3 Wire separation requirements as determined under 25.1707 : Applicants should include EWIS separation requirements in the ICA. EWIS separation guidelines are important for maintaining the safe operation of the aeroplane. Maintenance personnel need to be aware of the type certificate holder’s separation requirements so they do not compromise separation in previously certified systems.

Determination of EWIS separation requirements is required by 25.1707 . To comply with H25.5 , the appli cant should develop a way to convey these separation requirements and place them in the ICA. For example, if an aeroplane has a fly - by - wire flight control system and a minimum Powered by EASA eRules Page 1316 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F of 2 inches of physical separation is needed between the EWIS associated with th e flight control system and other EWIS, this information should be available in the ICA.

Similarly, the separation of certain wires in fuel tank systems may be critical design configuration control items and therefore qualify as an airworthiness limitation . Maintenance personnel need these guidelines and limitations because many times wire bundles must be moved or removed to perform maintenance.

The separation data included in the ICA can take many forms. If a particular aeroplane model has fly - by - wire fli ght controls, the manufacturer may designate the EWIS associated with the flight control systems by a certain identification scheme (as required by 25.1711 ), and in the ICA state that EWIS so designated must be mai ntained with XX amount of separation from all other EWIS and YY amount of separation from other aeroplane systems and structure. The manufacturer can then repeat this information for other EWIS associated with other aeroplane systems. The ICA could indicat e how EWIS associated with IFE and other passenger convenience systems is identified, and that this EWIS must be maintained XX inches from other categories of EWIS or structure.

It is not the intent of the regulation to require a type design holder or an a pplicant to divulge proprietary information in order to comply. Certain information, however, needs to be made available to modifiers and maintainers to ensure that future modifications and repairs do not invalidate previously certified designs.

4 Information explaining the EWIS identification method and requirements for identifying any changes to EWIS under CS 25.1711 . This paragraph requires that the ICA contain information explaining the EWIS identificati on method and requirements for identifying any changes to EWIS. This requirement is intended to ensure that future modifications that add EWIS, identify the added EWIS with the same type of identification scheme used by the original aeroplane manufacturer. This information will help modification designers and modification personnel avoid improper modification and repair of existing EWIS or improper installation of new EWIS.

These personnel need to review the applicable standard wiring practices, EWIS identi fication requirements, and electrical load data for the aeroplane they are modifying.

5 Electrical load data and instructions for updating that data. The ICA should contain electrical load data and instructions for updating that data. Electrical load data and the instructions for updating that data are necessary to help ensure that future modifications or additions of equipment that consume electrical power do not exceed the generating capacity of the onboard electrical generation and distribution system. Maintaining a record of actual airplane electrical loads is important to ensure that modifications to the original design do not impose electrical loads on the electrical generating system in excess of the system’s capability to provide the necessary powe r and maintain necessary margins. To comply with the requirements of this paragraph applicants need to provide: a. Electrical generating capacity of each source of normal electrical power generation.

b. Electrical generating capacity of each source of emer gency power generation.

c. Electrical load capacity of each of electrical bus.

d. Actual electrical loading of each electrical bus.

6 The ICA must be in the form of a document appropriate for the information to be provided, and they must be easily recogni zable as EWIS ICA.

[Amdt 25/5] Powered by EASA eRules Page 1317 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix F

H25.6 Information system security Instructions for Continued

Airworthiness

ED Decision 2020/006/R The applicant must prepare Instructions for Continued Airworthiness (ICA) that are applicable to aircraft information system security protection as required by CS 25.1319 (see AMC 20 - 42 Section 9 ).

[Amdt 25/25] Powered by EASA eRules Page 1318 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix I – Automatic Takeoff Thrust Control System (ATTCS)

A PPENDIX I – A UTOMATIC T AKEOFF T HRUST C ONTROL S YSTEM

(ATTCS)

I 25.1 General

ED Decision 2003/ 2/RM (a) This Appendix specifies additional requirements and limitations for aeroplanes equipped with an engine control system that automatically resets thrust or power on the operating engine(s) when any engine fails during take - off, and for which performance credit is li mited to that of paragraph 25.3(b) of this Appendix. When performance credit is not so limited, Special Conditions will apply.

(b) With the ATTCS system and associated systems functioning normally as designed, a ll applicable requirements of CS - 25, except as provided in this Appendix, must be met without requiring any action by the crew to increase thrust or power.

I 25.2 Definitions

ED Decision 2003/ 2/RM (a) AutomaticTakeoff Thrust Control System (ATTCS) . An AT TCS system is defined as a system which automatically resets thrust or power on the operating engine(s) when any engine fails during take - off. For the purpose of the requirements in this Appendix, the ATTCS system comprises all elements of equipment necess ary for the control and performance of each intended function, including all devices both mechanical and electrical that sense engine failure, transmit signals and actuate fuel controls or power levers of the operating engine(s) to achieve scheduled thrust or power increases, the engine control system and devices which furnish cockpit information on system operation.

(b) Critical Time Interval. When conducting an ATTCS take - off, the critical time interval is between one second before reaching V , and the p oint on the gross take - off flight path with all engines operating where, assuming a simultaneous engine and ATTCS system failure, the resulting flight path thereafter intersects the gross flight path, determined in accordance with CS 25.115 , at not less than 122 m (400 feet) above the take - off surface. This definition is shown in the following figure: Powered by EASA eRules Page 1319 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix I – Automatic Takeoff Thrust Control System (ATTCS)

I 25.3 Performance requirements

ED Decision 2003/ 2/RM All applicable performance requirements of CS - 25 must be met with the ATTCS system functioning normally as designed, except that the propulsive thrust obtained from each operating engine after failure of the critical engine during take - off, and the thrust at which compliance with the one - engine - inoperative climb requirements in CS 25.121(a) and (b) is shown, must be assumed to be not greater than the lesser of – (a) The actual propulsive thrust resulting from the i nitial setting of power or thrust controls with the ATTCS system functioning normally as designed, without requiring any action by the crew to increase thrust or power until the aeroplane has achieved a height of 122 m (400 feet) above the take - off surface ; or (b) 111 percent of the propulsive thrust which would have been available at the initial setting of power or thrust controls in the event of failure of the ATTCS system to reset thrust or power, without any action by the crew to increase thrust or power until the aeroplane has achieved a height of 122 m (400 feet) above the take - off surface.

Note 1. The limitation of performance credit for ATTCS system operation to 111 percent of the thrust provided at the initial setting is intended to: (i) Assure an adequate level of climb performance with all engines operating at the initial setting of power or thrust controls, and (ii) Limit the degradation of performance in the event of a critical engine failure combined with failure of the ATTCS system to oper ate as designed.

Note 2. For propeller - driven aeroplanes, propulsive thrust means the total effective propulsive force obtained from an operating engine and its propeller.

Powered by EASA eRules Page 1320 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix I – Automatic Takeoff Thrust Control System (ATTCS)

I 25.4 Reliability requirements

ED Decision 2003/2/RM (See CS 25.1309 and AMC 25.1309 ) (a) The occurrence of an ATTCS system failure or a combination of failures in the ATTCS system during the critical time interval which – (1) Prevents the insertion of the required thrust or power, must be shown to be Improbable; (2) Results in a significant loss or reduction in thrust or power, must be shown to be Extremely Improbable.

(b) The concurrent existence of an ATTCS system failure and an engine failure during the critical time interval must be shown to be Extremely Improbable.

(c) The inadvertent operation of the ATTCS system must be shown either to be Remote or to have no more than a minor effect.

I 25.5 Thrust or power setting

ED Decision 2003/2/RM The initi al setting of thrust or power controls on each engine at the beginning of the take - off roll may not be less than the lesser of – (a) That required to permit normal operation of all safety - related systems and equipment dependent upon engine thrust or power lever position; or (b) That shown to be free of hazardous engine response characteristics when thrust or power is increased from the initial take - off thrust or power level to the maximum approved take - off thrust or power.

I 25.6 Powerplant controls

ED Decision 2003/ 2/RM (a) General (1) In addition to the requirements of CS 25.1141 , no single failure or malfunction, or probable combination thereof, of the ATTCS system, including associated systems, may cause the failure of any powerplant function necessary for safety.

(2) The ATTCS system must be designed to perform accurately its intended function without exceeding engine operating limits under all reasonably expected conditions.

(b) Thrust or Power Lever Control. The ATTCS system must be designed to permit manual decrease or increase in thrust or power up to the maximum thrust or power approved for use following engine failure during take - off through the use of the normal thrust or power co ntrols, except that, for aeroplanes equipped with limiters that automatically prevent engine operating limits from being exceeded, other means may be used to increase thrust or power provided that the means is located in an accessible position on or close to the thrust or power levers, is easily identified, and operated under all operating conditions by a single action of either pilot with the hand that is normally used to actuate the thrust or power levers.

Powered by EASA eRules Page 1321 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix I – Automatic Takeoff Thrust Control System (ATTCS) (c) System Control and Monitoring. The ATTCS sy stem must be designed to provide – (1) A means for checking prior to takeoff that the system is in an operable condition; and (2) A means for the flight crew to deactivate the automatic function. This means must be designed to prevent inadvertent deactiva tion.

I 25.7 Powerplant instruments

ED Decision 2003/2/RM (a) System Control and Monitoring. A means must be provided to indicate when the ATTCS system is in the armed or ready condition.

(b) Engine Failure Warning. If the inherent flight c haracteristics of the aeroplane do not provide adequate warning that an engine has failed, a warning system which is independent of the ATTCS system must be provided to give the pilot a clear warning of engine failure during take - off.

Powered by EASA eRules Page 1322 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix I – Automatic Takeoff Thrust Control System (ATTCS)

A PPENDIX J – E MERGEN CY D EMONSTRATION

ED Decision 2020/024/R The following test criteria and procedures must be used for showing compliance with CS 25.803 : (a) The emergency evacuation must be conducted with exterior ambient light le vels of no greater than 3.2 lux (0.3 foot - candle) prior to the activation of the aeroplane emergency lighting system.

The source(s) of the initial exterior ambient light level may remain active or illuminated during the actual demonstration. There must, ho wever, be no increase in the exterior ambient light level except for that due to activation of the aeroplane emergency lighting system.

(b) The aeroplane must be in a normal attitude with landing gear extended.

(c) Unless the aeroplane is equipped with an off - wing descent means, stands or ramps may be used for descent from the wing to the ground. Safety equipment such as mats or inverted life rafts may be placed on the floor or ground to protect participants. No other equipment that is not part of the aerop lane’s emergency evacuation equipment may be used to aid the participants in reaching the ground.

(d) Except as provided in paragraph (a) of this Appendix, only the aeroplane’s emergency lighting system may provide illumination.

(e) All emergency equipment required for the planned operation of the aeroplane must be installed.

(f) Each external door and exit, and each internal door or curtain, must be in the take - off configuration.

(g) Each crew member must be seated in the normally assigned seat for take - off and must remain in the seat until receiving the signal for commencement of the demonstration. Each crewmember must be a person having knowledge of the operation of exits and emergency equipment and, if compliance with the applicable Operating Rule s is also being demonstrated, each cabin crewmember must be a member of a regularly scheduled line crew.

(h) A representative passenger load of persons in normal health must be used as follows: (1) At least 40% of the passenger load must be females.

(2) At least 35% of the passenger load must be over 50 years of age.

(3) At least 15% of the passenger load must be female and over 50 years of age.

(4) Three life - size dolls, not included as part of the total passenger load, must be carried by pa ssengers to simulate live infants 2 years old or younger.

(5) Crew members, mechanics, and training personnel who maintain or operate the aeroplane in the normal course of their duties, may not be used as passengers.

(i) No passenger may be assigned a spec ific seat except as the Agency may require. Except as required by sub - paragraph (g) of this Appendix, no employee of the applicant may be seated next to an emergency exit.

(j) Seat belts and shoulder harnesses (as required) must be fastened.

(k) Before the start of the demonstration, approximately one - half of the total average amount of carry - on baggage, blankets, pillows, and other similar articles must be distributed at several locations in aisles and emergency exit access ways to create minor obstruction s.

Powered by EASA eRules Page 1323 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix I – Automatic Takeoff Thrust Control System (ATTCS) (l) No prior indication may be given to any crewmember or passenger of the particular exits to be used in the demonstration.

(m) There must not be any practising, rehearsing or description of the demonstration for the participants nor may any participan t have taken part in this type of demonstration within the preceding 6 months.

(n) The pre take - off passenger briefing required by the applicable Operating Rules may be given.

The passengers may also be advised to follow directions of crewmembers but not b e instructed on the procedures to be followed in the demonstration.

(o) If safety equipment as allowed by subparagraph (c) of this Appendix is provided, either all passenger and cockpit windows must be blacked out or all of the emergency exits must have sa fety equipment in order to prevent disclosure of the available emergency exits.

(p) Not more than 50% of the emergency exits in the sides of the fuselage of an aeroplane that meets all of the requirements applicable to the required emergency exits for that aeroplane may be used for the demonstration. Exits that are not to be used in the demonstration must have the exit handle deactivated or must be indicated by red lights, red tape, or other acceptable means placed outside the exits to indicate fire or othe r reason why they are unusable. The exits to be used must be representative of all of the emergency exits on the aeroplane and must be designated prior to the demonstration and subject to approval by the Agency. At least one floor level exit must be used.

(q) Except as provided in sub - paragraph (c) of this paragraph, all evacuees must leave the aeroplane by a means provided as part of the aeroplane’s equipment.

(r) The applicant’s approved procedures must be fully utilised, except the flight - crew must take no active role in assisting others inside the cabin during the demonstration.

(s) The evacuation time period is completed when the last occupant has evacuated the aeroplane and is on the ground. Provided that the acceptance rate of the stand or ramp is no greater than the acceptance rate of the means available on the aeroplane for descent from the wing during an actual crash situation, evacuees using stands or ramps allowed by sub - paragraph (c) of this Appendix are considered to be on the ground when they a re on the stand or ramp.

[Amdt 25/2] [Amdt 25/26] Powered by EASA eRules Page 1324 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix K – Interaction of Systems and Structure

A PPENDIX K – I NTERACTION OF S YSTEMS AND S TRUCTURE

K25.1 General

ED Decision 2005 / 006/R The following criteria must be used for showing compliance with CS 25.302 for aeroplanes equipped with flight control systems, autopilots, stability augmentation systems, load alleviation systems, flutter control systems, and fuel management systems. If this appendix is used for other systems, it may be necessary to a dapt the criteria to the specific system.

(a) The criteria defined herein only address the direct structural consequences of the system responses and performances and cannot be considered in isolation but should be included in the overall safety evaluation of the aeroplane. These criteria may in some instances duplicate standards already established for this evaluation. These criteria are only applicable to structure whose failure could prevent continued safe flight and landing. Specific criteria that defin e acceptable limits on handling characteristics or stability requirements when operating in the system degraded or inoperative mode are not provided in this appendix.

(b) Depending upon the specific characteristics of the aeroplane, additional studies may be required that go beyond the criteria provided in this appendix in order to demonstrate the capability of the aeroplane to meet other realistic conditions such as alternative gust or manoeuvre descriptions for an aeroplane equipped with a loa d alleviation system.

(c) The following definitions are applicable to this appendix.

Structural performance: Capability of the aeroplane to meet the structural requirements of CS - 25.

Flight limitations: Limitations that can be applied to the aeroplane flight conditions following an in - flight occurrence and that are included in the flight manual (e.g., speed limitations, avoidance of severe weather conditions, etc.).

Operational limitations: Limitations, including flight limitations, that can b e applied to the aeroplane operating conditions before dispatch (e.g., fuel, payload and Master Minimum Equipment List limitations).

Probabilistic terms: The probabilistic terms (probable, improbable, extremely improbable) used in this appendix are the sam e as those used in CS 25.1309 .

Failure condition: The term failure condition is the same as that used in CS 25.1309 , however this appendix applies only to system failure co nditions that affect the structural performance of the aeroplane (e.g., system failure conditions that induce loads, change the response of the aeroplane to inputs such as gusts or pilot actions, or lower flutter margins).

[Amdt 25/1]

K25.2 Effects of Syst ems on Structures

ED Decision 2005 / 006/R (a) General . The following criteria will be used in determining the influence of a system and its failure conditions on the aeroplane structure.

(b) System fully operative . With the system fully operative, the follo wing apply: (1) Limit loads must be derived in all normal operating configurations of the system from all the limit conditions specified in Subpart C, taking into account any special behaviour of Powered by EASA eRules Page 1325 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix K – Interaction of Systems and S tructure such a system or associated functions or any effect on the structural performance of the aeroplane that may occur up to the limit loads. In particular, any significant nonlinearity (rate of displacement of control surface, thresholds or any other system nonlinearities) must be accounted for in a realistic or conse rvative way when deriving limit loads from limit conditions.

(2) The aeroplane must meet the strength requirements of CS - 25 (Static strength, residual strength), using the specified factors to derive ultimate loads from the limit loads defined above. The e ffect of nonlinearities must be investigated beyond limit conditions to ensure the behaviour of the system presents no anomaly compared to the behaviour below limit conditions. However, conditions beyond limit conditions need not be considered when it can be shown that the aeroplane has design features that will not allow it to exceed those limit conditions.

(3) The aeroplane must meet the aeroelastic stability requirements of CS 25.629 .

(c) System in the failure c ondition . For any system failure condition not shown to be extremely improbable, the following apply: (1) At the time of occurrence. Starting from 1 - g level flight conditions, a realistic scenario, including pilot corrective actions, must be established t o determine the loads occurring at the time of failure and immediately after failure.

(i) For static strength substantiation, these loads multiplied by an appropriate factor of safety that is related to the probability of occurrence of the failure are ulti mate loads to be considered for design. The factor of safety (F.S.) is defined in Figure 1.

Figure 1 Factor of safety at the time of occurrence (ii) For residual strength substantiation, the aeroplane must be able to withstand two thirds of the ultimate loads defined in subparagraph (c)(1)(i). For pressurised cabins, these loads must be combined with the normal operating differential pressure.

(iii) F reedom from aeroelastic instability must be shown up to the speeds defined in CS 25.629(b)(2) . For failure conditions that result in speed increases beyond V /M , C C freedom from aeroelastic instability must be shown to increased speeds, so that the margins intended by CS 25.629(b)(2) are maintained.

Powered by EASA eRules Page 1326 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix K – Interaction of Systems and Structure (iv) Failures of the system that result in forced structural vibrations (oscillatory failures) must not produce loads that could result in detrimental deformation of primary structure.

(2) For the continuation of the flight. For the aeroplane, in the system failed state and considering any appropriate reconfiguration and flight limitations, the following apply: (i) The loads derived from the following conditions at speeds up to V / M , or the C C speed limitation prescribed for the remainder of the flight must be determined: (A) the limit symmetrical manoeuvring conditions specified in CS 25.331 and in CS 25.345 .

(B) the limit gust and turbulence conditions specified in CS 25.341 and in CS 25.345 .

(C) the limit rolling conditions specified in CS 25.349 and the limit unsymmetrical conditions specified in CS 25.367 and CS 25.427(b) and (c) .

(D) the limit yaw manoeuvring conditions specified in CS 25.351 .

(E) the limit ground loading conditions specified in CS 25.473 and CS 25.491 .

(ii) For static strength substantiation, e ach part of the structure must be able to withstand the loads in subparagraph (2)(i) of this paragraph multiplied by a factor of safety depending on the probability of being in this failure state. The factor of safety is defined in Figure 2.

Figure 2 Fac tor of safety for continuation of flight Qj = (Tj)(Pj) where: Tj = Average time spent in failure condition j (in hours) Pj = Probability of occurrence of failure mode j (per hour) Note: If Pj is greater than 10 - 3, per flight hour then a 1.5 factor of safety must be applied to all limit load conditions specified in Subpart C.

(iii) For residual strength substantiation, the aeroplane must be able to withstand two thirds of the ultimate loads defined in subparagraph (c)(2)(ii). For pressurised cabins, these loads must be combined with the normal operating differential pressure.

Powered by EASA eRules Page 1327 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix K – Interaction of Systems and Structure (iv) I f the loads induced by the failure condition have a significant effect on fatigue or damage tolerance then their effects must be taken into account.

(v) Freedom from aeroelastic instability must be shown up to a speed determined from Figure 3. Flutter clea rance speeds V' and V'' may be based on the speed limitation specified for the remainder of the flight using the margins defined by CS 25.629(b) .

Figure 3: Clearance speed V' = Clearance speed as defined by CS 25.629(b)(2) .

V'' = Clearance speed as defined by CS 25.629(b)(1) .

Qj = (Tj)(Pj) where: Tj = Average time spent in failure condition j (in hours) Pj = Probability of occurrence of failure mode j (per hour) Note: If Pj is greater than 10 - 3 per flight hour, then the flutter clearance speed must not be less than V''.

(vi) Freedom from aeroelastic instability must also be shown up to V' in Figure 3 above, for any probable system failure condition combined with any damage required or selected for in vestigation by CS 25.571(b) .

(3) Consideration of certain failure conditions may be required by other Subparts of CS - 25 regardless of calculated system reliability. Where analysis shows the probability of these - 9 fai lure conditions to be less than 10 , criteria other than those specified in this paragraph may be used for structural substantiation to show continued safe flight and landing.

(d) Failure indications . For system failure detection and indication, the follo wing apply: (1) The system must be checked for failure conditions, not extremely improbable, that degrade the structural capability below the level required by CS - 25 or significantly reduce the reliability of the remaining system. As far as reasonably prac ticable, the flight crew must be made aware of these failures before flight. Certain elements of the control system, such as mechanical and hydraulic components, may use special periodic inspections, and electronic components may use daily checks, in lieu of detection and indication systems to achieve the objective of this requirement. These certification maintenance requirements must be limited to components that are not readily Powered by EASA eRules Page 1328 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix L detectable by normal detection and indication systems and where service histor y shows that inspections will provide an adequate level of safety.

(2) The existence of any failure condition, not extremely improbable, during flight that could significantly affect the structural capability of the aeroplane and for which the associated r eduction in airworthiness can be minimised by suitable flight limitations, must be signalled to the flight crew. For example, failure conditions that result in a factor of safety between the aeroplane strength and the loads of Subpart C below 1.25, or flut ter margins below V", must be signalled to the crew during flight.

(e) Dispatch with known f ailure conditions. If the aeroplane is to be dispatched in a known system failure condition that affects structural performance, or affects the reliability of the r emaining system to maintain structural performance, then the provisions of CS 25.302 must be met for the dispatched condition and for subsequent failures. Flight limitations and expected operational limitations may be taken into account in establishing Qj as the combined probability of being in the dispatched failure condition and the subsequent failure condition for the safety margins in Figures 2 and 3. These limitations must be such that the probability of being in this combined failure state and then subsequently encountering limit load conditions is extremely improbable. No reduction in these safety margins is allowed if the subsequent system failure - 3 rate is greater than 10 per hour.

[Amdt 25/1]

A PPENDIX L

ED Decision 2005 / 006/R Strength Value Element of System Remarks Proof Ultimate Rigid pipes and ducts 1·5 P W 3·0 P W Couplings 1·5 P W 3·0 P W Flexible hoses 2·0 P 4·0 P W W Return line elements – 1·5 P P The maximum pressure applied during failure f f conditions.

Components other than pipes, 1·5 P 2·0 P W W couplings, ducts or pressure vessels Pressure vessels fabr icated from metallic materials.

(For non - metallic materials see CS 25.1436(b)(7) ) Pressure vessels connected to a line 3·0 P L or 4·0 P L or The lower values are conditional upon source of pressure 1·5 P 2·0 P justification by a fatigue endurance test from L L Powered by EASA eRules Page 1329 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix L Strength Value Element of System Remarks Proof Ultimate which a permissible fatigue life is declared, and upon the ultimate load test being made on the test specimen used for the fatigue life test.

Pressure vessels not connected to a 2·5 P or 3·0 P or The lower values are condit ional upon L L line source of pressure, e.g. 1·5 P 2·0 P justification by a life endurance test of a L L emergency vessels inflated from a suitably factored permissible number of ground source inflation/deflation cycles, including temperature fluctuation results in a significant pressure variation, and upon the ultimate load test being made on the test specimen used for the life endurance test.

For all pressure vessels: (1) The minimum acceptable conditions for storage, handling and inspection are to be defined in the appropriate manual.

See CS 25.1529 .

(2) Th e proof factor is to be sustained for at least three minutes.

(3) The ultimate factor is to be sustained for at least one minute. The factor having been achieved, the pressure vessel may be isolated from the pressure source for the remaining portion of the test period.

[Amdt 25/1] Powered by EASA eRules Page 1330 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix M – Fuel Tan k Flammability Reduction Means (FRM)

A PPENDIX M – F UEL T ANK F LAMMABILITY R EDUCTION M EANS (FRM)

M25.1 Fuel tank flammability exposure requirements

ED Decision 2009/010/R (a) The Fleet Average Flammability Exposure level of each fuel tank, as determined in accordance with Appendix N of CS - 25, must not exceed 3 percent of the Flammability Exposure Evaluation Time (FEET), as defined in Appendix N of CS - 25. If flammability reducti on means (FRM) are used, neither time periods when any FRM is operational but the fuel tank is not inert, nor time periods when any FRM is inoperative may contribute more than 1.8 percent to the 3 percent average fleet flammability exposure of a tank.

(b) The Fleet Average Flammability Exposure, as defined in Appendix N of this part, of each fuel tank for ground, takeoff/climb phases of flight during warm days must not exceed 3 percent of FEET in each of these phases. The analysis must consider the follo wing conditions.

(1) The analysis must use the subset of flights starting with a sea level ground ambient temperature of 26.7°C [80° F] (standard day plus 11.7°C (21° F) atmosphere) or more, from the flammability exposure analysis done for overall performance.

(2) For the gr ound, takeoff/climb phases of flight, the average flammability exposure must be calculated by dividing the time during the specific flight phase the fuel tank is flammable by the total time of the specific flight phase.

(3) Compliance with this paragraph may be shown using only those flights for which the aeroplane is dispatched with the flammability reduction means operational.

[Amdt 25/6]

M25.2 Showing compliance

ED Decision 2009/010/R (a) The applicant must provide data from analysis, ground testing, and flight testing, or any combination of these, that: (1) validate the parameters used in the analysis required by paragraph M25.1 ; (2) substantiate that the FRM is effective at limiting flammability e xposure in all compartments of each tank for which the FRM is used to show compliance with paragraph M25.1 ; and (3) describe the circumstances under which the FRM would not be operated during each phase of flight.

(4) identify critical features of the fuel tank system to prevent an auxiliary fuel tank installation from increasing the flammability exposure of main tanks above that p ermitted under paragraphs M25.1 (a) and (b) of this appendix and to prevent degradati on of the performance and reliability of the FRM.

(b) The applicant must validate that the FRM meets the requirements of paragraph M25.1 of this appendix with any aeroplane or engine configuration affecting the pe rformance of the FRM for which approval is sought.

(c) Any FRM failures or failures that could affect the FRM, with potential catastrophic consequences shall not result from a single failure or a combination of failures not shown to be extremely improba ble.

Powered by EASA eRules Page 1331 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix M – Fuel Tank Flammability Reduction Means (FRM) (d) It must be shown that the fuel tank pressures will remain within limits during normal operating conditions and failure conditions.

(e) Oxygen - enriched air produced by the FRM must not create a hazard during normal operating conditions.

[Amdt 25/6 ]

M25.3 Reliability indications and maintenance access

ED Decision 2009/010/R (a) Reliability indications must be provided to identify failures of the FRM that would otherwise be latent and whose identification is necessary to ensure the fuel tank with an FRM meets the fleet average flammability exposure listed in paragraph M25.1 of this appendix, including when the FRM is inoperative.

(b) Sufficient accessibility to FRM reliability indications must be provided for maintenance personnel or the flight crew.

(c) The accesses to the fuel tanks with FRMs (including any tanks that communicate with a tank via a vent system), and to any other confined spaces or enclosed areas that could contain hazardous atmosphere under normal conditions or failure conditions must be permanently stencilled, marked, or placarded to warn maintenance personnel of the possible presence of a potentially hazardous atmosphere. Those stencils, markings or placards must be installed such as to remain permanently visible during maintenance operations.

[Amdt 25/6]

M25.4 Airworthin ess limitations and procedures

ED Decision 2009/010/R The FRM shall be subject to analysis using conventional processes and methodology to ensure that the minimum scheduled maintenance tasks required for securing the continuing airworthiness of the system and installation are identified and published as part of the CS 25.1529 compliance.

Maintenance tasks arising from either the Monte Carlo analysis or a CS 25.1309 safety a ssessment shall be dealt with in accordance with the principles laid down in AMC 25.1309 .

(a) If FRM is used to comply with paragraph M25.1 , Airworthiness Limitations must be identified for all maintenance or inspection tasks required to identify failures of components within the FRM that are needed to meet paragraph M25.1 .

(b) Maintenance procedures must be developed to identify any hazards to be considered during maintenance of the fuel system and of the FRM. These procedures must be included in the instructions for continued airworthiness (ICA).

[Amdt 25/6] Powered by EASA eRules Page 1332 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPEN DICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure

A PPENDIX N – F UEL T ANK F LAMMABILITY E XPOSURE

ED Decision 2016/010/R (See AMC to Appendix N )

N25.1 General

ED Decision 2009/010/R (a) This appendix specifies the requirements for conducting fuel tank fleet average flammability exposure analyses required to mee t CS 25.981(b) and Appendix M. This appendix defines parameters affecting fuel tank flammability that must be used in performing the analysis. These include parameters that af fect all aeroplanes within the fleet, such as a statistical distribution of ambient temperature, fuel flash point, flight lengths, and aeroplane descent rate.

Demonstration of compliance also requires application of factors specific to the aeroplane model being evaluated. Factors that need to be included are maximum range, cruise mach number, typical altitude where the aeroplane begins initial cruise phase of flight, fuel temperature during both ground and flight times, and the performance of an FRM if inst alled (See AMC to appendix N, N25.1(a) ).

(b) For fuel tanks installed in aluminium wings, a qualitative assessment is sufficient if it substantiates that the tank is a conventional unheated aluminium wing tank (See AMC to Appendix N25.1(b) ).

[Amdt 25/6]

AMC to Appendix N, N25.1(a) Fuel tank flammability assessment

method

ED Decision 2009/010/R The Monte - Carlo program as well as the method and procedures set forth in FAA docu ment, “Fuel Tank Flammability Assessment Method Users Manual” DOT/FAA/AR - 05/8 dated May 2008 (or the latest existing revision on the condition that it is accepted by EASA), is an acceptable means of compliance to conduct the flammability assessment specifi ed in Appendix N25.1(a) . A copy may be obtained from the Office of the Federal Register, 800 North Capitol Street, N.W., Suite 700, Washington, D.C. The following definitions, input variables, and data tables that are used in the program to determine fleet average flammability exposure for a specific aeroplane model are the ones included into paragraph N25.2 Definitions and N25.4 Var iables and data tables.

[Amdt 25/6]

AMC to Appendix N, N25.1(b) Qualitative fuel tank flammability

assessment

ED Decision 2009/010/R (a) A conventional unheated aluminium wing tank is a conventional aluminium structure, integral tank of a subsonic transport aeroplane wing, with minimal heating from aeroplane systems or other fuel tanks and cooled by ambient airflow during flight. Heat sourc es that have the potential for significantly increasing the flammability exposure of a fuel tank would preclude the tank from being considered “unheated.” Examples of such heat sources that may have this effect are heat exchangers, adjacent heated fuel tan ks, transfer of fuel from a warmer tank, and adjacent air conditioning equipment. Thermal anti - ice systems and thermal anti - ice blankets Powered by EASA eRules Page 1333 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure typically do not significantly increase flammability of fuel tanks. For these tanks, a qualitative assessment showing e quivalency to the unheated aluminium wing fuel tank may be acceptable when considered with the following: 1 A description of the aeroplane configuration, (including subsonic, wing construction, etc.), 2 A listing of any heat sources in or adjacent to the fuel tank, 3 The type of fuel approved for the aeroplane, 4 The tank operating pressure relative to ambient static pressure, 5 The tank is uninsulated and made of aluminium, and 6 The tank has a large aerodynamic surface area exposed to outside air to transfer heat from the tank.

(b) Fuel tanks with an aerodynamic surface area to volume ratio (surface area/volume) greater than 1.0 have been shown to meet these criteria. Fuel tanks with a ratio less than 1.0 are not considered conventional unheated a luminium wing tanks. The aerodynamic surface area includes the area of the integral aluminium wing fuel tank that is exposed to outside air. It does not include any portion of a fuel tank that is shielded from free stream airflow, such as the front and rea r spar, or an area under a fairing or wing thermal blanket.

[Amdt 25/6]

N25.2 Definitions

ED Decision 2009/010/R (a) Bulk Average Fuel Temperature means the average fuel temperature within the fuel tank or different sections of the tank if the tank is sub divided by baffles or compartments.

(b) Flammability Exposure Evaluation Time (FEET). The time from the start of preparing the aeroplane for flight, through the flight and landing, until all payload is unloaded, and all passengers and crew have disembark ed. In the Monte Carlo program, the flight time is randomly selected from the Flight Length Distribution (Table 2), the pre - flight times are provided as a function of the flight time, and the post - flight time is a constant 30 minutes.

(c) Flammable . With r espect to a fluid or gas, flammable means susceptible to igniting readily or to exploding (ref. CS - Definitions). A non - flammable ullage is one where the fuel - air vapour is too lean or too rich to burn or is inert as defined below. For the purposes of this appendix, a fuel tank that is not inert is considered flammable when the bulk average fuel temperature within the tank is within the flammable range for the fuel type being used. For any fuel tank that is subdivided into sections by baffles or compartment s, the tank is considered flammable when the bulk average fuel temperature within any section of the tank, that is not inert, is within the flammable range for the fuel type being used.

(d) Flash Point . The flash point of a flammable fluid means the lowes t temperature at which the application of a flame to a heated sample causes the vapour to ignite momentarily, or “flash.” Table 1 of this appendix provides the flash point for the standard fuel to be used in the analysis.

(e) Fleet average flammability e xposure is the percentage of the flammability exposure evaluation time (FEET) the fuel tank ullage is flammable for a fleet of an aeroplane type operating over the range of flight lengths in a world - wide range of environmental conditions and fuel propertie s as defined in this appendix.

Powered by EASA eRules Page 1334 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICE S TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure (f) Gaussian Distribution is another name for the normal distribution, a symmetrical frequency distribution having a precise mathematical formula relating the mean and standard deviation of the samples. Gaussian distributions yield bell shaped frequency curves having a preponderance of values around the mean with progressively fewer observations as the curve extends outward.

(g) Hazardous atmosphere . An atmosphere that may expose maintenance personnel, passengers or flight cre w to the risk of death, incapacitation, impairment of ability to self - rescue (that is, escape unaided from a confined space), injury, or acute illness.

(h) Inert . For the purpose of this appendix, the tank is considered inert when the bulk average oxygen concentration within each compartment of the tank is 12 percent or less from sea level up to 10,000 feet altitude, then linearly increasing from 12 percent at 10,000 feet to 14.5 percent at 40,000 feet altitude, and extrapolated linearly above that altitude.

(i) Inerting . A process where a non - combustible gas is introduced into the ullage of a fuel tank so that the ullage becomes non - flammable.

(j) Monte Carlo Analysis . The analytical method that is specified in this appendix as the compliance means for assessing the fleet average flammability exposure time for a fuel tank.

(k) Oxygen evolution occurs when oxygen dissolved in the fuel is released into the ullage as the pressure and temperature in the fuel tank are reduced.

(l) Standard deviation is a statistical measure of the dispersion or variation in a distribution, equal to the square root of the arithmetic mean of the squares of the deviations from the arithmetic means.

(m) Transport Effects . For purposes of this appendix, transport effects are the change in fuel vapour concentration in a fuel tank caused by low fuel conditions and fuel condensation and vaporization.

(n) Ullage . The volume within the fuel tank not occupied by liquid fuel.

[Amdt 25/6]

N25.3 Fuel tank flammability exposure analysi s

ED Decision 2009/010/R (a) A flammability exposure analysis must be conducted for the fuel tank under evaluation to determine fleet average flammability exposure for the aeroplane and fuel types under evaluation. For fuel tanks that are subdivided by baffles or compartments, an anal ysis must be performed either for each section of the tank, or for the section of the tank having the highest flammability exposure. Consideration of transport effects is not allowed in the analysis.

(b) The following parameters are defined in the Monte Carlo analysis an d provided in paragraph N25.4 : (1) Cruise Ambient Temperature – as defined in this appendix.

(2) Ground Temperature – as defined in this appendix.

(3) Fuel Flash Point – as defined in this appendix .

(4) Flight length Distribution – that must be used is defined in Table 2 of this appendix.

(c) Parameters that are specific to the particular aeroplane model under evaluation that must be provided as inputs to the Monte Carlo analysis are: Powered by EASA eRules Page 1335 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure (1) Aeroplane Cruise Altitude (2) Fuel Tank quantities. If fuel quantity affects fuel tank flammability, inputs to the Monte Carlo analysis must be provided that represent the actual fuel quantity within the fuel tank or compartment of the fuel tank throughout each of the flights being evaluated.

Input values for this data must be obtained from ground and flight test data or the EASA approved fuel management procedures.

(3) Aeroplane cruise Mach Number.

(4) Aeroplane maximum Range (5) Fuel Tank Thermal Characteristi cs. If fuel temperature affects fuel tank flammability, inputs to the Monte Carlo analysis must be provided that represent the actual bulk average fuel temperature within the fuel tank throughout each of the flights being evaluated. For fuel tanks that are subdivided by baffles or compartments, bulk average fuel temperature inputs must be provided either for each section of the tank or for the section of the tank having the highest flammability exposure. Input values for this data must be obtained from grou nd and flight test data or a thermal model of the tank that has been validated by ground and flight test data.

(6) Maximum aeroplane operating temperature limit as defined by any limitations in the Aeroplane Flight Manual.

(7) Aeroplane Utilization. The applicant must provide data supporting the number of flights per day and the number of hours per flight for the specific aeroplane model under evaluation. If there is no existing aeroplane fleet data to support the aeroplane being evaluate d, the applicant must provide substantiation that the number of flights per day and the number of hours per flight for that aeroplane model is consistent with the existing fleet data they propose to use.

(8) Aeroplane climb & descent profiles in accordanc e with the aircraft performance data documented in the Aircraft Flight Manual.

(d) Fuel Tank FRM Model. If FRM is used, an Agency approved Monte Carlo program must be used to show compliance with the flammability requirements of CS 25.981 and Appendix M of this part. The program must determine the time periods during each flight phase when the fuel tank or compartment with the FRM would be flammable. The following factors must be considered in establishing these time periods: (1) Any time periods through out the flammability exposure evaluation time and under the full range of expected operating conditions, when the FRM is operating properly but fails to maintain a non - flammable fuel tank because of the effects of the fuel tank vent system or other causes, (2) If dispatch with the system inoperative under the Master Minimum Equipment List (MMEL) is requested, the time period assumed in the reliability analysis shall be consistent with the proposed rectification interval, depending on aeroplane utilisation, (3) Frequency and duration of time periods of FRM inoperability, substantiated by test or analysis, caused by latent or known failures, including aeroplane system shut - downs and failures that could cause the FRM to shut down or become inoperative, (4) E ffects of failures of the FRM that could increase the flammability exposure of the fuel tank, Powered by EASA eRules Page 1336 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure (5) Oxygen Evolution: If an FRM is used that is affected by oxygen concentrations in the fuel tank, the time periods when oxygen evolution from the fuel results in the fuel tank or compart ment exceeding the inert level. The applicant must include any times when oxygen evolution from the fuel in the tank or compartment under evaluation would result in a flammable fuel tank. The oxygen evolution rate that must be us ed is defined in the FAA document “Fuel Tank Flammability Assessment Method User's Manual”, dated May 2008 (or latest revision), document number DOT/FAA/AR – 05/8.

(6) If an inerting system FRM is used, the effects of any air that may enter the fuel tank fo llowing the last flight of the day due to changes in ambient temperature, as defined in Table 4, during a 12 - hour overnight period.

[Amdt 25/6]

N25.4 Variables and data tables

ED Decision 2009/010/R The following data must be used when conducting a flammability exposure analysis to determine the fleet average flammability exposure. Variables used to calculate fleet flammability exposure must include atmospheric ambient temperatures, flight length, fla mmability exposure evaluation time, fuel flash point, thermal characteristics of the fuel tank, overnight temperature drop, and oxygen evolution from the fuel into the ullage.

(a) Atmospheric Ambient Temperatures and Fuel Properties.

(1) In order to p redict flammability exposure during a given flight, the variation of ground ambient temperatures, cruise ambient temperatures, and a method to compute the transition from ground to cruise and back again must be used. The variation of the ground and cruise ambient temperatures and the flash point of the fuel is defined by a Gaussian curve, given by the 50 percent value and a  1 - standard deviation value.

(2) Ambient Temperature: Under the program, the ground and cruise ambient temperatures are linked by a set of assumptions on the atmosphere. The temperature varies with altitude following the International Standard Atmosphere (ISA) rate of change from the gro und ambient temperature until the cruise temperature for the flight is reached.

Above this altitude, the ambient temperature is fixed at the cruise ambient temperature.

This results in a variation in the upper atmospheric temperature. For cold days, an i nversion is applied up to 10,000 feet, and then the ISA rate of change is used.

(3) Fuel properties: (i) For Jet A and Jet A - 1 fuel, the variation of flash point of the fuel is defined by a Gaussian curve, given by the 50 percent value and a  1 - sta ndard deviation, as shown in Table 1.

( ii) The flammability envelope of the fuel that must be used for the flammability exposure analysis is a function of the flash point of the fuel selected by the Monte Carlo for a given flight. The flammability envelop e for the fuel is defined by the upper flammability limit (UFL) and lower flammability limit (LFL) as follows: (A) LFL at sea level = flash point temperature of the fuel at sea level minus 5.5°C (10  F). LFL decreases from sea level value with increasing al titude at a rate o of 0.55 °C (1 F) per 808 feet.

Powered by EASA eRules Page 1337 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure (B) UFL at sea level = flash point temperature of the fuel at sea level plus 19.5°C o (63.5 F). UFL decreases from the sea level value with increasing altitude at a o rate of 0.55°C (1 F) per 512 feet.

(4) For each flight analyzed, a separate random number must be generated for each of the three parameters (ground ambient temperature, cruise ambient temperature, and fuel flash point) using the Gaussia n distribution defined in Table 1.

Table 1. Gaussian Distribut ion for Ground Ambient Temperature, Cruise Ambient Temperature, and Fuel Flash Point Temperature in Deg C/Deg F Parameter Ground Ambient Cruise ambient Fuel Flash Point (FP) Temperature. Temperature.

Mean Temp 15.53/59.95 _ - 56.67/ - 70 48.89/ 120 Neg 1 std dev 11.18/ 20.14 4.4/ 8 4.4/ 8 Pos 1 std dev 9.6/ 17.28 4.4/ 8 4.4/8 (b) The Flight Length Distribution defined in Table 2 must be used in the Monte Carlo analysis.

Table 2. Flight Length Distribution Aeroplane Maximum Range – Nautical Miles (NM) 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 Flight Length Distribution of flight lengths (Percentage of total) (NM) From To 0 200 11.7 7.5 6.2 5.5 4.7 4.0 3.4 3.0 2.6 2.3 200 400 27.3 19.9 17.0 15.2 13.2 11.4 9.7 8.5 7.5 6.7 400 600 46.3 40.0 35.7 32.6 28.5 24.9 21.2 18.7 16.4 14.8 600 800 10.3 11.6 11.0 10.2 9.1 8.0 6.9 6.1 5.4 4.8 800 1000 4.4 8.5 8.6 8.2 7.4 6.6 5.7 5.0 4.5 4.0 1000 1200 0.0 4.8 5.3 5.3 4.8 4.3 3.8 3.3 3.0 2.7 1200 1400 0.0 3.6 4.4 4.5 4.2 3.8 3.3 3.0 2.7 2.4 1400 1600 0.0 2.2 3.3 3.5 3.3 3.1 2.7 2.4 2.2 2.0 1600 1800 0.0 1.2 2.3 2.6 2.5 2.4 2.1 1.9 1.7 1.6 1800 2000 0.0 0.7 2.2 2.6 2.6 2.5 2.2 2.0 1.8 1.7 2000 2200 0.0 0.0 1.6 2.1 2.2 2.1 1.9 1.7 1.6 1.4 2200 2400 0.0 0.0 1.1 1.6 1.7 1.7 1.6 1.4 1.3 1.2 2400 2600 0.0 0.0 0.7 1.2 1.4 1.4 1.3 1.2 1.1 1.0 2600 2800 0.0 0.0 0.4 0.9 1.0 1.1 1.0 0.9 0.9 0.8 2800 3000 0.0 0.0 0.2 0.6 0.7 0.8 0.7 0.7 0.6 0.6 3000 3200 0.0 0.0 0.0 0.6 0.8 0.8 0.8 0.8 0.7 0.7 3200 3400 0.0 0.0 0.0 0.7 1.1 1.2 1.2 1.1 1.1 1.0 3400 3600 0.0 0.0 0.0 0.7 1.3 1.6 1.6 1.5 1.5 1.4 3600 3800 0.0 0.0 0.0 0.9 2.2 2.7 2.8 2.7 2.6 2.5 3800 4000 0.0 0.0 0.0 0.5 2.0 2.6 2.8 2.8 2.7 2.6 4000 4200 0.0 0.0 0.0 0.0 2.1 3.0 3.2 3.3 3.2 3.1 4200 4400 0.0 0.0 0.0 0.0 1.4 2.2 2.5 2.6 2.6 2.5 Powered by EASA eRules Page 1338 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure Aeroplane Maximum Range – Nautical Miles (NM) 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 Flight Length Distribution of flight lengths (Percentage of total) (NM) 4400 4600 0.0 0.0 0.0 0.0 1.0 2.0 2.3 2.5 2.5 2.4 4600 4800 0.0 0.0 0.0 0.0 0.6 1.5 1.8 2.0 2.0 2.0 4800 5000 0.0 0.0 0.0 0.0 0.2 1.0 1.4 1.5 1.6 1.5 5000 5200 0.0 0.0 0.0 0.0 0.0 0.8 1.1 1.3 1.3 1.3 5200 5400 0.0 0.0 0.0 0.0 0.0 0.8 1.2 1.5 1.6 1.6 5400 5600 0.0 0.0 0.0 0.0 0.0 0.9 1.7 2.1 2.2 2.3 5600 5800 0.0 0.0 0.0 0.0 0.0 0.6 1.6 2.2 2.4 2.5 5800 6000 0.0 0.0 0.0 0.0 0.0 0.2 1.8 2.4 2.8 2.9 6000 6200 0.0 0.0 0.0 0.0 0.0 0.0 1.7 2.6 3.1 3.3 6200 6400 0.0 0.0 0.0 0.0 0.0 0.0 1.4 2.4 2.9 3.1 6400 6600 0.0 0.0 0.0 0.0 0.0 0.0 0.9 1.8 2.2 2.5 6600 6800 0.0 0.0 0.0 0.0 0.0 0.0 0.5 1.2 1.6 1.9 6800 7000 0.0 0.0 0.0 0.0 0.0 0.0 0.2 0.8 1.1 1.3 7000 7200 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.4 0.7 0.8 7200 7400 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.3 0.5 0.7 7400 7600 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.2 0.5 0.6 7600 7800 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.1 0.5 0.7 7800 8000 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.1 0.6 0.8 8000 8200 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.5 0.8 8200 8400 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.5 1.0 8400 8600 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.6 1.3 8600 8800 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.4 1.1 8800 9000 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.2 0.8 9000 9200 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.5 9200 9400 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.2 9400 9600 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.1 9600 9800 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.1 9800 10000 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.1 (c) Overnight Temperature Drop. For aeroplanes on which FRM is installed, the overnight temperature drop for this appendix is defined using: (1) A temperature at the beginning of the overnight period that equals the landing temperature of the previous flight that is a random value based on a Gaussian distribution; and (2) An overnight temperature drop that is a random value based on a Gaussian distribution.

(3) For any flight that wi ll end with an overnight ground period (one flight per day out of an average of number of flights per day, depending on utilization of the particular aeroplane model being evaluated), the landing outside air temperature (OAT) is to be chosen as a random v alue from the following Gaussian curve: Powered by EASA eRules Page 1339 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure Table 3. Landing Outside Air Temperature Parameter Landing Outside Air Temperature °C/ °F Mean Temperature 14.82/ 58.68 negative 1 std dev 11.41/ 20.55 positive 1 std dev 7.34/ 13.21 (4) The outside ambient air temperature (OAT) overnight temperature drop is to be chosen as a random value from the following Gaussian curve: Table 4. Outside Air Temperature (OAT) Drop Parameter OAT Drop Temperature °C/ °F Mean Temp - 11.11/ 12.0 1 std dev 3.3/ 6.0 (d) Number of Simulated Flights Required in Analysis. In order for the Monte Carlo analysis to be valid for showing compliance with the fleet average and warm day flammability exposure requirements, the applicant must run the analysis for a minimum numbe r of flights to ensure that the fleet average and warm day flammability exposure for the fuel tank under evaluation meets the applicable flammability limits defined in Table 5.

Table 5. Flammability Exposure Limit Minimum Number of Maximum Acceptable Monte Carlo Maximum Acceptable Monte Flights in Monte Carlo Average Fuel Tank Flammability Carlo Average Fuel Tank A nalysis Exposure (%) to meet 3% Flammability Exposure (%) to requirements meet 7% requirements 10,000 2.91 6.79 100,000 2.98 6.96 1,000,000 3.00 7.00 [Amdt 25/6] Powered by EASA eRules Page 1340 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Ap pendix N – Fuel Tank Flammability Exposure

A PPENDIX O – S UPERCOOLED L ARGE D ROP ICING CONDITIONS

ED Decision 2015/008/R Appendix O consists of two parts. Part I defines Appendix O as a description of supercooled large drop (SLD) icing conditions in which the drop median volume diameter (MVD) is less than or greater than 40 μm, the maximum mean effective drop diameter (MED) of Appendix C continuous maximum (stratiform clouds) icing conditions. For Appendix O, SLD icing conditions consist of freezing drizzle and freezing rain occurring in and/or below stratiform clouds. Part II defines ice accretions used to show compliance with CS - 25 specifications.

[Amdt 25/16 ]

Part I – Meteorology

ED Decision 2015/008/R Appendix O icing conditions are d efined by the parameters of altitude, vertical and horizontal extent, temperature, liquid water content, and water mass distribution as a function of drop diameter distribution.

(a) Freezing Drizzle (Conditions with spectra maximum drop diameters from 100 μm to 500 μm): (1) Pressure altitude range: 0 to 6 706 m (22 000 feet) MSL.

(2) Maximum vertical extent: 3 656 m (12 000 feet).

(3) Horizontal extent: standard distance of 32.2 km (17.4 nautical miles).

(4) Total liquid water content: Note: Liquid w ater content (LWC) in grams per cubic meter (g/m ) based on horizontal extent standard distance of 32.2 km (17.4 nautical miles).

Figure 1 – Appendix O, Freezing Drizzle, Liquid Water Content Powered by EASA eRules Page 1341 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure (5) Drop diameter distribution: Figure 2 – Appendix O, Freez ing Drizzle, Drop Diameter Distribution Powered by EASA eRules Page 1342 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Append ix N – Fuel Tank Flammability Exposure (6) Altitude and temperature envelope: Figure 3 – Appendix O, Freezing Drizzle, Altitude and Temperature (b) Freezing Rain (Conditions with spectra maximum drop diameters greater than 500 μm): (1) Pressure altitude range: 0 to 3656 m (12000 ft) MSL.

(2) Maximum vertical extent: 2134 m (7000 ft).

(3) Horizontal extent: standard distance of 32.2 km (17.4 nautical miles).

(4) Total liquid water content: Note: LWC in grams per cubic meter (g/m ) base d on horizontal e xtent standard distance of 32.2 km (17.4 nautical miles).

Figure 4 – Appendix O, Freezing Rain, Liquid Water Content Powered by EASA eRules Page 1343 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure (5) Drop diameter distribution: Figure 5 – Appendix O, Freezing Rain, Drop Diameter Distribution Powered by EASA eRules Page 1344 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure (6) Altitude and temperature envelope: Figure 6 – Appendix O, Freezing Rain, Altitude and Temperature (c) Horizontal extent The liquid water content for freezing drizzle and freezing rain conditions for horizontal extents other than the standard 32.2 km (1 7.4 nautical miles) can be determined by the value of the liquid water content determined from Figure 1 or Figure 4, multiplied by the factor provided in Figure 7, which is defined by the following equation: S = 1.266 – 0.213 log (H) Where S = Liquid Wate r Content Scale Factor (dimensionless) and H = horizontal extent in nautical miles Figure 7 – Appendix O, Horizontal Extent, Freezing Drizzle and Freezing Rain Powered by EASA eRules Page 1345 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure [Amdt 25/16]

Part II – Airframe ice accretions

ED Decision 2015/008/R (a) General.

The most critical ice accretion in terms of aeroplane performance and handling qualities for each flight phase must be used to show compliance with the applicable aeroplane performance and handling qualities requirements for icing conditions contained in Subpa rt B. Applicants must demonstrate that the full range of atmospheric icing conditions specified in part I of this appendix have been considered, including drop diameter distributions, liquid water content, and temperature appropriate to the flight conditio ns (for example, configuration, speed, angle - of - attack, and altitude).

(1) For an aeroplane certified in accordance with CS 25.1420(a)(1) , the ice accretions for each flight phase are defined in part II, paragraph (b) of this appendix.

(2) For an aeroplane certified in accordance with CS 25.1420(a)(2), the most critical ice accretion for each flight phase defined in part II, paragraphs (b) and (c) of this appendix, must be used. For the ice accretions defined in p art II, paragraph (c) of this appendix, only the portion of part I of this appendix in which the aeroplane is capable of operating safely must be considered.

(3) For an aeroplane certified in accordance with CS 25 .1420(a)(3), the ice accretions for each flight phase are defined in part II, paragraph (c) of this appendix.

Powered by EASA eRules Page 1346 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – F uel Tank Flammability Exposure (b) Ice accretions for aeroplanes certified in accordance with CS 25.1420(a)(1) or (a)(2).

(1) En - route ice is the en - route ice as defined by part II, paragraph (c)(3), of this appendix, for an aeroplane certified in accordance with CS 25.1420(a)(2), or defined by part II , paragraph (a)(3), of Appendix C, fo r an aeroplane certified in accordance with CS 25.1420(a)(1) , plus: (i) Pre - detection ice as defined by part II paragraph (b)(5) of this appendix; and (ii) The ice accumulated during the transit of one cloud with a horizontal extent of 32.2 km (17.4 naut ical miles) in the most critical of the icing conditions defined in part I of this appendix and one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the continuous maximum icing conditions defined in Appendix C .

(2) Holding ice is the holding ice defined by part II, paragraph (c)(4), of this appendix, for an aeroplane certified in accordance with CS 25.1420(a)(2), or defined by part II , paragraph (a)(4) of Appendix C, for an aeroplane certified in accordance with CS 25.1420(a)(1) , plus: (i) Pre - detection ice as defined by part II, paragraph (b)(5) of this appendix; and (ii) The ice accumulated during the transit of one cloud with a 32.2 km (17.4 nautical miles) horizontal extent in the most critical of the icing conditions defined in part I of this appendix and one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the continuous maximum icing conditions defined in Appendix C .

(iii) Except the total exposure to holding ice conditions does not need to exceed 45 minutes (3) Approach ice is the more critical of the holding ice defined by part II, paragraph (b)(2) of this appendix, or the ice calculated in the applicable paragraph (b)(3)(i) or (ii) of part II of this appendix: (i) For an aeroplane certified in accordance with CS 25.1420(a)(2), the ice accumulated during descent from the maximum vertical extent of the icing conditions defined i n part I of this appendix to 610 m (2 000 feet) above the landing surface in the cruise configuration, plus transition to the approach configuration, plus: (A) Pre - detection ice, as defined by part II, paragraph ( b)(5) of this appendix; and (B) The ice accumulated during the transit at 610 m (2 000 feet) above the landing surface of one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the most critical of the icing conditions defined in part I of this appendix and one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the continuous maximum icing conditions defined in Appendix C .

(ii) For an aeropl ane certified in accordance with CS 25.1420(a)(1) , the ice accumulated during descent from the maximum vertical extent of the maximum continuous icing conditions defined in part I of Appendix C to 610 m (2 000 feet ) above the landing surface in the cruise configuration, plus transition to the approach configuration, plus: (A) Pre - detection ice, as defined by part II, paragraph (b)(5) of this appendix; and Powered by EASA eRules Page 1347 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure (B) The ice accumulated during the transit at 610 m (2 000 feet) above the landing surface of one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the most critical of the icing conditions defined in part I of this appendix and one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the continuous maximum icing conditions defined in Appendix C .

(4) Landing ice is the more critical of the holding ice as defined by part II, paragraph (b)(2) of this ap pendix, or the ice calculated in the applicable paragraph (b)(4)(i) or (ii) of part II of this appendix: (i) For an aeroplane certified in accordance with CS 25.1420(a)(2), the ice accretion defined by part II, paragraph (c)(5)(i) of this appendix, plus a descent from 610 m (2 000 feet) above the landing surface to a height of 61 m (200 feet) above the landing surface with a transition to the landing configuration in the icing conditions defined in part I of this a ppendix, plus: (A) Pre - detection ice, as defined in part II, paragraph (b)(5) of this appendix; and (B) The ice accumulated during an exit manoeuvre, beginning with the minimum climb gradient required by CS 25.119, from a height of 61 m (200 feet) above the landing surface through one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the most critical of the icing conditions defined in part I of this appendix and one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the continuous maximum icing conditions defined in Appendix C .

(ii) For an aeroplane certified in accordance with CS 25.1420(a)(1) , the ice accumulated in the maximum continuous icing conditions defined in Appendix C , during a descent from the maximum vertical extent of the icing conditions defined in Appendix C, to 610 m (2 000 feet) above t he landing surface in the cruise configuration, plus transition to the approach configuration and flying for 15 minutes at 610 m (2 000 feet) above the landing surface, plus a descent from 610 m (2 000 feet) above the landing surface to a height of 61 m (2 00 feet) above the landing surface with a transition to the landing configuration, plus: (A) Pre - detection ice, as described by part II, paragraph (b)(5) of this appendix; and (B) The ice accumulated during an exit manoeuvre, beginning with the minimum c limb gradient required by CS 25.119 , from a height of 61 m (200 feet) above the landing surface through one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the most critical of the icing conditio ns defined in part I of this appendix and one cloud with a horizontal extent of 32.2 km (17.4 nautical miles) in the continuous maximum icing conditions defined in Appendix C .

(5) Pre - detection ice is the ice accretion before detection of Appendix O conditions that require exiting per CS 25.1420(a)(1) and (a)(2). It is the pre - existing ice accretion that may exist from operating in icing conditions in which the aeroplane is approved to operate prior to encountering the icing conditions requiring an exit, plus the ice accumulated during the time needed to detect the icing conditions, followed by two minutes of further ice accumulation to take into account the time for the fli ght crew to take action to exit the icing conditions, including coordination with air traffic control.

Powered by EASA eRules Page 1348 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure (i) For an aeroplane certified in accordance with CS 25.1420(a)(1) , the pre - existing ice accretion must be based on the icing conditions defined in Appe ndix C.

(ii) For an aeroplane certified in accordance with CS 25.1420(a)(2), the pre - existing ice accretion must be based on the more critical of the icing conditions defined in Appendix C, or the icing conditions defined in part I of this appendix in whi ch the aeroplane is capable of safely operating.

(c) Ice accretions for aeroplanes certified in accordance with CS 25.1420(a)(2) or CS 25.1420(a)(3).

For an aeroplane certified in accordance with CS 25.1420(a)(2), only the portion of the icing conditions of part I of this appendix in which the aeroplane is capable of operating safely must be considered.

(1) Take - off ice is the most critical ice accretion on unprotected surfaces, and any ice accretion on the protected surfaces appropriate to nor mal ice protection system operation, occurring between the end of the take - off distance and 122 m (400 feet) above the take - off surface, assuming accretion starts at the end of the take - off distance in the take - off maximum icing conditions defined in part I of this appendix.

(2) Final take - off ice is the most critical ice accretion on unprotected surfaces, and any ice accretion on the protected surfaces appropriate to normal ice protection system operation, between 122 m (400 feet) and either 457 m (1 500 f eet) above the take - off surface, or the height at which the transition from the take - off to the en - route configuration is completed and V is reached, whichever is higher. Ice accretion is FTO assumed to start at lift - off the end of the take - off distance in the icing conditions defined in part I of this appendix.

(3) En - route ice is the most critical ice accretion on the unprotected surfaces, and any ice accretion on the protected surfaces appropriate to normal ice protection system operation, during the en - route flight phase in the icing conditions defined in part I of this appendix.

(4) Holding ice is the most critical ice accretion on the unprotected surfaces, and any ice accretion on the protected surfaces approp riate to normal ice protection system operation, resulting from 45 minutes of flight within a cloud with a 32.2 km (17.4 nautical miles) horizontal extent in the icing conditions defined in part I of this appendix, during the holding phase of flight.

(5) Approach ice is the ice accretion on the unprotected surfaces, and any ice accretion on the protected surfaces appropriate to normal ice protection system operation, resulting from the more critical of the: (i) Ice accumulated in the icing conditions defined in part I of this appendix during a descent from the maximum vertical extent of the icing conditions defined in part I of this appendix, to 610 m (2 000 feet) above the landing surface in the cruise configuration, plus transition to the approach configuration and flying for 15 minutes at 610 m (2 000 feet) above the landing surface; or (ii) Holding ice as defined by part II, paragraph (c)(4) of this appendix.

(6) Landing ice is the ice accretion on the unprotected surfaces, and any ice a ccretion on the protected surfaces appropriate to normal ice protection system operation, resulting from the more critical of the: (i) Ice accretion defined by part II, paragraph (c)(5)(i), of this appendix, plus ice accumulated in the icing conditions de fined in part I of this appendix during a Powered by EASA eRules Page 1349 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix N – Fuel Tank Flammability Exposure descent from 610 m (2 000 feet) above the landing surface to a height of 61 m (200 feet) above the landing surface with a transition to the landing configuration, followed by a go - around at the minimum climb gradie nt required by CS 25.119 , from a height of 61 m (200 feet) above the landing surface to 610 m (2 000 feet) above the landing surface, flying for 15 minutes at 610 m (2 000 feet) above the landing surface in the approach configuration, and a descent to the landing surface (touchdown) in the landing configuration; or (ii) Holding ice as defined by part II paragraph (c)(4) of this appendix.

(7) For both unprotected and protected parts, the ice accretion for the take - off phase must be determined for the icing conditions defined in part I of this appendix, using the following assumptions: (i) The aerofoils, control surfaces, and, if applicable, propellers are free from frost, snow, or ice at the start of take - off; (ii) The ice accretion begins at lift - off; (i ii) The critical ratio of thrust/power - to - weight; (iv) Failure of the critical engine occurs at V ; and EF (v) Crew activation of the ice protection system is in accordance with a normal operating procedure provided in the Aeroplane Flight Manual, except that after beginning the take - off roll, it must be assumed that the crew takes no action to activate the ice protection system until the aeroplane is at least 122 m (400 feet) above the take - off surface.

(d) The ice accretion before the ice protection sys tem has been activated and is performing its intended function is the critical ice accretion formed on the unprotected and normally protected surfaces before activation and effective operation of the ice protection system in the icing conditions defined in part I of this appendix. This ice accretion only applies in showing compliance to CS 25.143(j) and 25.207(h) .

(e) In order to reduce the number of ice accretions to be con sidered when demonstrating compliance with the requirements of CS 25.21(g) , any of the ice accretions defined in this appendix may be used for any other flight phase if it is shown to be at least as critical as the specific ice accretion defined for that flight phase. Configuration differences and their effects on ice accretions must be taken into account.

(f) The ice accretion that has the most adverse effect on handling qualities may be used for aeroplane perform ance tests provided any difference in performance is conservatively taken into account.

[Amdt 25/16] Powered by EASA eRules Page 1350 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPEN DICES TO CS - 25 (CS - 25) Appendix P – Mixed phase and ice crystal icing envelope (Deep convective clouds)

A PPENDIX P – M IXED PHASE AND ICE CRYSTAL ICING ENVELOPE (D EEP

CONVECTIVE CLOUDS )

ED Decision 2015/008/R The ice crystal icing envelope is depicted in Figure 1 below.

Figure 1 – Convective Cloud Ice Crystal Envelope Within the envelope, total water content (TWC) in g/m3 has been determined based upon the adiabatic lapse defined by the convective rise of 90 % relative humidity air from sea level to higher altitudes and scaled by a factor of 0.65 to a standard cloud length of 32.2 km (17.4 nautical miles). Figure 2 displays TWC for this distance over a range of ambient temperature within the boundaries of the ice crystal envelope specified in Figure 1.

Powered by EASA eRules Page 1351 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix P – Mixed phase and ice crystal ici ng envelope (Deep convective clouds) Figure 2 – Total Water Content Ice crystal size median mass dimension (MMD) range is 50 – 200 microns (equivalent spherical size) based upon measurements near convective storm cores. The TWC can be treated as completely g laciated (ice crystal) except as noted in the Table 1.

Table 1 – Supercooled Liquid Portion of TWC Temperature range – deg C Horizontal cloud length LWC – g/m 0 to - 20 ≤92.6 km (50 nautical miles) ≤1.0 0 to - 20 Indefinite ≤0.5 < - 20 0 The TWC levels displayed in Figure 2 represent TWC values for a standard exposure distance (horizontal cloud length) of 32.2 km (17.4 nautical miles) that must be adjusted with length of icing exposure.

Powered by EASA eRules Page 1352 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix P – Mixed phase and ice crystal icing envelope (Deep convective clouds) Figure 3 – Exposure Length Influence on TWC [ Amdt 25/16 ] Powered by EASA eRules Page 1353 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix P – Mixed phase and ice crystal icing envelope (Deep convective clouds)

A PPENDIX Q – A DDITIONAL AIRWORTHINESS REQUIREMENTS FOR APPROVAL OF

A S TEEP A PPROACH L ANDING (SAL) CAPABILITY

ED Decision 2016/010/R (See AMC to Appendix Q )

(SAL) 25.1 Applicability

ED Decision 2013/010/R This Appendix contains airworthiness requirements that enable an aeroplane to obtain approval for a steep approach landing capability using an approach path angle greater than or equal to 4.5° (a gradient of 7.9 %).

The requirements of this Appe ndix cover only CS - 25 Subparts B and G and they apply in lieu of CS 25.121(d) . They also apply in lieu of CS 25.125 if a reduced landing distance is sought, or if the landi ng procedure (speed, configuration, etc.) differs significantly from normal operation, or if the screen height is greater than 50 ft. Additional requirements may apply with respect to aeroplane systems or equipment or other relevant items such as autopilot , flight guidance, or GPWS. It is likely that the GPWS mode 1 (sink rate) envelope will need modification to prevent nuisance alerts. Also, the structural implications of the increased probability of high rates of descent at touchdown must be considered.

I f a steep approach approval is required for flight in icing conditions, substantiation must be provided accordingly for the steep approach condition.

An applicant may choose to schedule information for an all - engines approach or for an approach with one en gine inoperative. If an all - engines approach is scheduled, it is assumed that a diversion is required if an engine failure occurs prior to the decision to land.

[Amdt 25/13]

(SAL) 25.2 Definitions

ED Decision 2013/010/R For the purposes of this Appendix: — Steep Approach Landing: An approach to land made using a glide path angle greater than or equal to 4.5°, as selected by the applicant.

— Screen Height: The reference height above the runway surface from which the landing distance is measured. The s creen height is a height selected by the applicant, at 50 ft or another value from 35 to 60 ft.

— V is the calibrated airspeed selected by the applicant used during the stabilised approach REF(SAL) at the selected approach path angle and maintained down to th e screen height defined above.

V ) may not be less than 1.23 V , V , or a speed that provides the manoeuvring capability REF(SAL SR MCL specified in CS 25.143(h) , whichever is greater and may be different from the VREF u sed for standard approaches.

Powered by EASA eRules Page 1354 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix P – Mixed phase and ice crystal icing envelope (Deep convective clouds) — V is the calibrated airspeed selected by the applicant used during the stabilised one - REF(SAL) - 1 engine - inoperative approach at the selected approach path angle and maintained down to the screen height defined above. V may not be less than V REF(SAL) - 1 REF(SAL).

[Amdt 25/13]

(SAL) 25.3 Steep Approach Landing Distance

ED Decision 2013/010/R (Applicable only if a reduced landing distance is sought, or if the landing procedure (speed, configuration, etc.) differs significantly from normal operation, or if the screen height is greater than 50 ft.)

(a) The steep approach landing distance is the horizontal distance necessary to land and to come to a complete stop from the landing screen height and must be determined (for standard temper atures, at each weight, altitude and wind within the operational limits established by the applicant for the aeroplane) as follows: (1) The aeroplane must be in the all - engines - operating or one - engine - inoperative steep approach landing configuration, as ap plicable.

(2) A stabilised approach, with a calibrated airspeed of V or V as appropriate, and REF(SAL) REF(SAL) - 1 at the selected approach angle must be maintained down to the screen height.

(3) Changes in configuration, power or thrust, and speed must be made in accordance with the established procedures for service operation (see AMC 25.125(b)(3) ).

(4) The landing must be made without excessive vertical acceleration, tendency to bounce, nose over or ground loop and with a vertical touchdown velocity not greater than 6 ft/sec.

(5) The landings may not require exceptional piloting skill or alertness.

(b) The landing distance must be determined on a level, s mooth, dry, hard - surfaced runway (see AMC 25.125(c) ). In addition, (1) The pressures on the wheel braking systems may not exceed those specified by the brake manufacturer; (2) The brakes may not be used so as to ca use excessive wear of brakes or tyres (see AMC 25.125(c)(2) ); and (3) Means other than wheel brakes may be used if that means (i) Is safe and reliable; (ii) Is used so that consistent results can be expected in se rvice; and (iii) Is such that exceptional skill is not required to control the aeroplane.

(c) Reserved.

(d) Reserved.

(e) The landing distance data must include correction factors for not more than 50 % of the nominal wind components along the landing path opposite to the direction of landing, and not less than 150 % of the nominal wind components along the landing path in the direction of landing.

Powered by EASA eRules Page 1355 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix P – Mixed p hase and ice crystal icing envelope (Deep convective clouds) (f) If any device is used that depends on the operation of any engine, and if the landing distance would be noticeably increased when a landing is made with that engine assumed to fail during the final stages of an all - engines - operating steep approach, the steep approach landing distance must be determined with that engine inoperative unless the use of compensat ing means will result in a landing distance not more than that with each engine operating.

[Amdt 25/13]

(SAL) 25.4 Climb: One - engine - inoperative

ED Decision 2013/010/R In a configuration corresponding to the normal all - engines - operating procedure in which V for this SR configuration does not exceed 110 % of the V for the related all - engines - operating steep approach SR landing configuration, the steady gradient of climb may not be less than 2.1 % for two - engined aeroplanes, 2.4 % for three - engined aeroplanes, and 2.7 % for four - engined aeroplanes, with: (a) The critical engine inoperative, the remaining engines at the go - around power or thrust setting; (b) The maximum landing weight; (c) A climb speed of V ; and REF(SAL) (d) The landing gear retracted.

[Amdt 25/13]

(SAL) 25.5 Safe operational and flight characteristics

ED Decision 2018/005 /R (a) It must be demonstrated that it is possible to complete a stabilised approach in calm air down to the commencement of the landing flare, followed by a touchdown and la nding without displaying any hazardous characteristics for the following conditions (see AMC to Appendix Q, (SAL) 25.5 ): (1) The selected approach path angle at V or V as appropriate; REF(SAL) REF(SAL) - 1 (2) An appr oach path angle 2° steeper than the selected approach path angle, at V or REF(SAL) V as appropriate; and REF(SAL) - 1 (3) The selected approach path angle at V minus 5 knots or V minus 5 knots as REF(SAL) REF(SAL) - 1 appropriate.

(b) For conditions (a) (1), (a) (2 ), and (a) (3): (1 ) The demonstration must be conducted at the most critical weight and centre of gravity, either with all - engines - operating or with the critical engine inoperative, as appropriate; (2 ) The rate of descent must be reduced to 3 feet per secon d or less before touchdown; (3 ) Below a height of 200 ft no action shall be taken to increase power or thrust apart from those small changes which are necessary to maintain an accurate approach; (4 ) No nose depression by use of longitudinal control shall be made after initiating the flare other than those small changes necessary to maintain a continuous and consistent flare flight path; and (5 ) The flare, touchdown and landing may not require exceptional piloting skill or alertness.

Powered by EASA eRules Page 1356 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix P – Mixed phase and ice crystal icing envelope (Deep convective cloud s) (c) For c onditions (a) (1) and (a) (3), the flare must not be initiated above the screen height.

(d) For condition (a) (2), it must be possible to achieve an approach path angle 2° steeper than the selected approach path angle in all configurations which exist down to the initiation of the flare, which must not occur above 150 % of the screen height. The flare technique used must be substantially unchanged from that recommended for use at the selected approach path angle.

(e) All - engines - operating steep approach.

It m ust be demonstrated that the aeroplane can safely transition from the all - engines - operating steep landing approach to : (1) the all - engines - operating go - around as per standard procedure; and (2) the one - engine - inoperative approach climb configuration wi th one engine having been made inoperative , for the following conditions: (i ) The selected steep approach angle; (ii ) An approach speed of V REF(SAL) ; (iii ) The most critical weight and centre of gravity; and (iv ) For propeller - powered aeroplanes, the propeller of the inoperative engine shall be at the position it automatically assumes following an engine failure at high power.

(f) In addition, for propeller - powered aeroplanes, it must be demonstrated that controllability is maintained f ollowing an engine failure at approach power and with the propeller at the position it automatically assumes.

(g) The height loss during the manoeuvre required by subparagraph (SAL) 25.5(e) must be determined.

(h) It must be demonstrated that the aeroplane is safely controllable during a landing with one engine having been made inoperative during the final stages of an all - engines - operating steep approach for the following conditions: (1) The selected steep approach angle; (2) An approach speed of V ; REF(SAL) (3) The most critical weight and centre of gravity; and (4) For propeller - powered aeroplanes, the propeller of the inoperative engine shall be at the position it automatically assumes following an engine failure at approach power.

(i) One - engine - inoperat ive steep approach.

It must be demonstrated that the aeroplane can safely transition from the one - engine - inoperative steep landing approach to the approach climb configuration for the following conditions: (1) The selected steep approach angle; (2) An appr oach speed of V ; REF(SAL) - 1 (3) The most critical weight and centre of gravity; and (4) For propeller - powered aeroplanes, the propeller of the inoperative engine may be feathered.

[Amdt 25/13] Powered by EASA eRules Page 1357 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix P – Mixed phase and ice crystal icing envelope (Deep convective clouds) [Amdt 25/21]

AMC to Appendix Q, (SAL) 25.5 Safe operational and flight

characteristics

ED Decision 2016 /010/R (a) For the approach demonstrations required by (SAL) 25.5(a) , due account should be taken of: (1) The systems’ aspects of the power/thrust levers bein g at idle (e.g. arming of ground lift dump); (2) The most adverse flight idle power/thrust (e.g. effects of engine bleeds or FADEC idle power/thrust control); and (3) The effects on controllability from the use of auxiliary drag devices such as flight sp oilers (e.g. increased stall warning and stall speeds, loss of manoeuvrability).

(b) For the flare, touchdown and landing demonstrations required by (SAL) 25.5(a) , there should not be any occurrence of: (1) Stall warning; (2) Tail strike; or (3) Any other characteristic that would interfere with the completion of the landing (e.g.

automatic thrust increase).

(c) For the go - around demonstrations required by (SAL) 25.5(e) and (i), due account should be taken of time delays associated with automatic or manual retraction of auxiliary drag devices.

[Amdt No: 25/13] [Amdt No: 25/18]

(SAL) 25.6 Aeroplane Flight Manual

ED Decision 2013/010/R For steep approach landing, the AFM shall include the following: (a) The steep approach landing distance determin ed in accordance with paragraph (SAL) 25.3 of this Appendix for the selected screen height and aeroplane configuration. The landing distance data may additionally include correction factors for runway slope and tem perature other than standard, within the operational limits of the aeroplane, and may provide the required landing field length including the appropriate factors for operational variations prescribed in the relevant operating regulation.

(b) The more lim iting of the landing weight, altitude and temperature (WAT) limits derived in accordance with: (1) CS 25.119 , and (2) The one - engine - inoperative approach climb requirement of paragraph (SAL) 25.4 of this Appendix.

(c) Appropriate limitations and detailed normal, non - normal, and emergency procedures. Where an aeroplane is not approved for deliberate one - engine - inoperative steep approach landings, this limitation shall b e stated.

Powered by EASA eRules Page 1358 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix P – Mixed phase and ice crystal icing envelope (Deep convective clouds) (d) A statement that the presentation of the steep approach limitations, procedures, and performance reflects the capability of the aeroplane to perform steep approach landings but that it does not constitute operational approval.

(e) A statement of headwind and crosswind limitations if they are different from those for non - steep approaches. The tailwind limitation is 5 knots unless test evidence shows that more than 5 knots is acceptable.

(f) The reference steep approach glide slope angle and the screen height used for determination of the landing distance.

(g) The height loss during a go - around from the all - engines - operating steep landing approach to the approach climb configuration with one engine made inoperative, determined in ac cordance with (SAL) 25.5(g) .

[Amdt No: 25/13]

A PPENDIX R – HIRF E NVIRONMENTS AND E QUIPMENT HIRF T EST L EVELS

ED Decision 2015/019/R This Appendix specifies the HIRF environments and equipment HIRF test levels for el ectrical and electronic systems under CS 25.1317 . The field strength values for the HIRF environments and equipment HIRF test levels are expressed in root - mean - square units measured during the peak of the modulatio n cycle.

(a) HIRF environment I is specified in the following table: Table 1 — HIRF environment I FIELD STRENGTH (V/m) FREQUENCY PEAK AVERAGE 10 kHz – 2 MHz 50 50 2 MHz – 30 MHz 100 100 30 MHz – 100 MHz 50 50 100 MHz – 400 MHz 100 100 400 MHz – 700 MHz 700 50 700 MHz – 1 GHz 700 100 1 GHz – 2 GHz 2 000 200 2 GHz – 6 GHz 3 000 200 6 GHz – 8 GHz 1 000 200 8 GHz – 12 GHz 3 000 300 12 GHz – 18 GHz 2 000 200 18 GHz – 40 GHz 600 200 In this table, the higher field strength applies to the frequency band edges.

(b) HIRF environment II is specified in the following table: Table 2 — HIRF environment II FIELD STRENGTH (V/m) FREQUENCY PEAK AVERAGE 10 kHz – 500 kHz 20 20 Powered by EASA eRules Page 1359 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO C S - 25 (CS - 25) Appendix P – Mixed phase and ice crystal icing envelope (Deep convective clouds) FIELD STRENGTH (V/m) FREQUENCY PEAK AVERAGE 500 kHz – 2 MHz 30 30 2 MHz – 30 MHz 100 100 30 MHz – 100 MHz 10 10 100 MHz – 200 MHz 30 10 200 MHz – 400 MHz 10 10 400 MHz – 1 GHz 700 40 1 GHz – 2 GHz 1 300 160 2 GHz – 4 GHz 3 000 120 4 GHz – 6 GHz 3 000 160 6 GHz – 8 GHz 400 170 8 GHz – 12 GHz 1 230 230 12 GHz – 18 GHz 730 190 18 GHz – 40 GHz 600 150 In this table, the higher field strength applies to the frequency band edges.

(c) Equipment HIRF test level 1.

(1) From 10 kilohertz (kHz) to 400 megahertz (MHz), use conducted susceptibility tests with Continuous Wave (CW) and 1 kHz square wave modulation with 90 % depth or greater.

The conducted susceptibility current must start at a minimum of 0.6 milliamperes (mA) at 10 kHz, increasing 20 decibels (dB) per frequency decade to a minimum of 30 mA at 500 kHz.

(2) From 500 kHz to 40 MHz, the condu cted susceptibility current must be at least 30 mA.

(3) From 40 MHz to 400 MHz, use conducted susceptibility tests, starting at a minimum of 30 mA at 40 MHz, decreasing 20 dB per frequency decade to a minimum of 3 mA at 400 MHz.

(4) From 100 MHz to 400 MHz , use radiated susceptibility tests at a minimum of 20 volts per meter (V/m) peak with CW and 1 kHz square wave modulation with 90 % depth or greater.

(5) From 400 MHz to 8 gigahertz (GHz), use radiated susceptibility tests at a minimum of 150 V/m peak wit h pulse modulation of 4 % duty cycle with a 1 kHz pulse repetition frequency. This signal must be switched on and off at a rate of 1 Hz with a duty cycle of 50 %.

(d) Equipment HIRF test level 2. Equipment HIRF test level 2 is HIRF environment II in Table II of this Appendix reduced by acceptable aircraft transfer function and attenuation curves. Testing must cover the frequency band of 10 kHz to 8 GHz.

Powered by EASA eRules Page 1360 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix P – Mixed phase and ice crystal icing envelop e (Deep convective clouds) (e) Equipment HIRF test level 3.

(1) From 10 kHz to 400 MHz, use conducted susceptibility tests, start ing at a minimum of 0.15 mA at 10 kHz, increasing 20 dB per frequency decad e to a minimum of 7.5 mA at 500 kHz.

(2) From 500 kHz to 40 MHz, use conducted susceptibility tests at a minimum of 7.5 mA.

(3) From 40 to 400 MHz, use conducted susceptibility test s, starting at a minimum of 7.5 mA at 40 MHz, decreasing 20 dB per frequency decade to a minimum of 0.75 mA at 400 MHz.

(4) From 100 MHz to 8 GHz, use radiated susceptibility tests at a minimum of 5 V/m.

[Amdt 25/17] Powered by EASA eRules Page 1361 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes

A PPENDIX S – A IRWORTHINES S REQUIREMENTS FOR NON -

COMMERCIALLY OPERATED AEROPLANES AND LOW - OCCUPANCY

AEROPLANES

ED Decision 2017/015/R (See AMC to Appendix S)

S25.1 General

ED Decision 2017/015/R (a) Applicability: unless otherwise specified within, the requirements of this Appendix are applicable to the passenger or crew compartments (interiors) of: (1) non - commercially operated aeroplanes with a passenger seating configuration of: (i) up to and including 19 passengers; or (ii) up to and including one half of the maximum passenger s eating capacity of the type - certified aeroplane as indicated in the aeroplane type certificate data sheet (TCDS), provided that: (A) the total number of passengers approved for occupancy during taxiing, take - off or landing does not exceed 150 per deck; and (B) the total number of passengers approved for occupancy during taxiing, take - off or landing on a deck does also not exceed one half of the maximum passenger seating capacity for that deck as indicated in the aeroplane TCDS.

(2) low - occupancy a eroplanes irrespective of the type of operations (commercial or non - commercial). A low - occupancy aeroplane is defined as an aeroplane which has a passenger seating configuration of: (i) up to and including 19; or (ii) up to and including one third of the m aximum passenger seating capacity of the type - certified aeroplane as indicated in the aeroplane TCDS, provided that: (A) the total number of passenger seats approved for occupancy during taxiing, take - off, or landing does not exceed 100 per deck; and (B) t he total number of passenger seats approved for occupancy during taxiing, take - off, or landing in any individual zone between pairs of emergency exits (or any dead end zone) does also not exceed one - third of the sum of the passenger seat allowances for the emergency exit pairs bounding that zone, using the passenger seat allowance for each emergency exit pair as defined by the applicable certification basis of the aeroplane. For the purpose of determining compliance with this zonal limitation, in the case o f an aeroplane which has deactivated emergency exits, it shall be assumed that all emergency exits are functional.

Powered by EASA eRules Page 1362 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes (b) Aeroplane Flight Manual (AFM) Limitation: if compliance with any part of this Appendix limits the aeroplane to non - commercial operation s, this limitation must be included in the ‘Limitations’ Section of the AFM.

[Amdt 25/19]

AMC to Appendix S, S25.1 Passenger seating configuration

ED Decision 2017/015/R Where this term is used in Appendix S: ‘Passenger seating configuration’ means the passenger seating capacity established during the certification process (either type certificate (TC), supplemental type certificate (STC) or change to the TC or STC, as relevant), conducted for the particular ca bin interior and emergency exit arrangement of the aeroplane considered.

The passenger seating configuration is equal to, or less than, the maximum passenger seating capacity of the relevant type - certified aeroplane as indicated in the aeroplane type cert ificate data sheet (TCDS).

The passenger seating configuration may be less than the total number of passenger seats in the aeroplane that are approved for occupancy during taxiing, take - off, and landing, if seats in excess are installed; in such a case th e requirement S25.40(c) Seats in Excess must be complied with.

[Amdt 25/19]

S25.10 General Cabin Arrangement

ED Decision 2017/015/R (a) Interior Doors on Non - Commercially Operated Aeroplanes (See AMC to Appendix S, S25.10(a) ): For a non - commercially operated aeroplane, installation of doors that results in non - compliance with CS 25.813(e) is acceptable provided that it is ensured by design and procedure that: (1) each door is open before entering any of the taxiing, take - off, and landing phases; (2) each door remains open during taxiing, take - off, and landing, and especially during and after a crash landing; and (3) in the case of any probable failure or jamming of a door in a position other than fully open, any occupant is able, from any compartment separated by that door, to restore in an easy and simple manner a sufficient opening to access the compartment on the other side of the door.

(b) Interior Doors on Commercially Operated Aeroplanes (See AMC to Appendix S, S25.10(b) ): For a low - occupancy aeroplane having a passenger seating configuration of 19 or less, installation of doors that results in non - compliance with CS 25.813(e) is acceptable provided that the conditions of S25.10(a)(1), S25.10(a)(2) and S25.10(a)(3) are complied with and the following additional requirements are met for each passenger compartment created by a door or doors: (1) Within the compartmen t, there is at least one emergency exit above the waterline on each side of the fuselage that meets at least the requirements of a type IV emergency exit for a compartment that has a passenger seating configuration of nine seats or less, or of a type III e mergency exit otherwise; or Powered by EASA eRules Page 1363 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes (2) Within the compartment, there is at least one emergency exit above the waterline on one side of the fuselage that meets at least the requirements of a type IV emergency exit for a compartment that has a passenger seating con figuration of nine seats or less, or of a type III emergency exit otherwise, and: (i) an occupant of the compartment would not need to go through more than one door to access an emergency exit above the waterline on the other side of the fuselage; and (ii) the demonstration of compliance with the provisions S25.10(a)(1) and (2) does not rely on any passenger action, nor involve any flight crew member leaving their position in the cockpit.

(c) Isolated Compartments: each cabin compartment isolated from the r est of the cabin such that a fire starting in the compartment would not be directly and quickly detected by the occupants of another compartment, in an aeroplane that has a passenger seating configuration of 20 or more, or which has a cabin length of more than 18.29 m (60 ft), must be equipped with a smoke/fire detection system or equivalent which allows detection within one minute after the start of a fire and provides a visual indication in the cockpit, or a visual indication or audible warning in the pas senger cabin that would be readily detected by a cabin crew member.

However, if it can be demonstrated that a fire would be directly and quickly detected because the compartment is likely to be occupied for the majority of the flight time, such a system is not required (See AMC to Appendix S, S25.10(c) ).

(d) Deactivation of existing Emergency Exits: Deactivation of one of more emergency exits that results in non - compliance with CS 25.807(e) is acceptable, provided that compliance with the following requirements is shown (See AMC to Appendix S, S25.10(d) and (e) ): (1) the number of passenger seats allowed in a zone between two remainin g adjacent pairs of emergency exits is limited to one half of the combined rated capacity of the two pairs of emergency exits (rounded to the nearest whole number); (2) the number of passenger seats allowed in a zone with only one remaining pair of emergen cy exits at one end (a so called dead end zone) is limited to one half of the rated capacity of the pair of emergency exits (rounded to the nearest whole number); and (3) the distance from each passenger seat to at least one remaining emergency exit, on ea ch side of the fuselage, remains compatible with easy egress from the aeroplane.

(e) Distance between Emergency Exits: deactivation of emergency exits which results in non - compliance with CS 25.807(f)(4) is acceptable on non - commercially operated aeroplane s only, provided that: (1) compliance with S25.10(d) is shown; and (2) a distance of more than 18.29 m (60 ft) between adjacent remaining emergency exits is created only once per side of the fuselage on each deck (See AMC to Appendix S, S25.10(d) and (e) ).

[Amdt 25/19] Powered by EASA eRules Page 1364 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes

AMC to Appendix S, S25.10(a) Interior Doors on Non - Commercially

Operated Aeroplanes

ED Decision 2017/015/R ( 1) The following provides acceptable means to ensure that a door is open before entering any of the taxiing, take - off, and landing phase, as required by S25.10(a)(1) : (a) The door should be conspicuously placarded o n both sides to be in the safe (i.e. open and secured) position during taxiing, take - off, and landing; (b) The operation of the door and the requirement that the door be secured open for taxiing, take - off, and landing must be the subject of a passenger b riefing, and the requirement for this briefing must be part of the AFM; for the purpose of this briefing, a description of the operation of the internal door should be made available to the flight crew; and (c) There should be a means to signal to the fl ight crew in a timely manner if the door is not open and secured in a safe position before entering any of the taxiing, take - off, or landing phases. The indication should be triggered during the descent phase, early enough to enable the flight crew to take appropriate action before entering the approach phase, unless the aeroplane is required to have at least one cabin crew member on board.

Appropriate procedures for crew action should be established.

(2) The following provides acceptable means to ensure that the door remains open during taxiing, take - off, and landing, and especially during and after a crash landing, as required by S25.10(a)(2) : (a) Dual means should be provided to secure the door in the open pos ition for taxiing, take - off, and landing. Each of those dual means should be capable of reacting to the inertia loads specified in CS 25.561 ; and (b) The indication to the flight crew mentioned in the above condi tion (1)(c) should be triggered without delay and remain active whenever the door is not in the safe position during any of the taxiing, take - off, and landing flight phases. Appropriate procedures for crew action should be established.

(3) Regarding the indication mentioned in the above paragraphs (1)(c) and (2)(b), if several interior doors are installed, it might not be necessary to provide a distinct indication for each door on the flight deck. Door position indication in the cockpit may be achieved by means of a single visual indication serving all interior doors installed in the aeroplane, provided that at least one of the following two conditions is met: (a) The number and location of the interior doors is such that quick identificati on of the incorrectly positioned door can be made by cabin occupants. A cabin layout which may be accepted as meeting this condition may be one in which all interior doors can be easily viewed during a direct walk from the front to the rear of the cabin.

(b) There is a simultaneous indication provided to a required cabin crew member which allows easy identification of the interior door in the incorrect position. An associated procedure for coordination between the flight and cabin crew should be included in the AFM.

Powered by EASA eRules Page 1365 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes (4) The following provides acceptable means to comply with the requirement S25.10(a)(3) : (a) In case the door is operated (opening, closing and/or latching) manually: the door should be easily operable from both sides, and if a latch is installed to restrain the door in the closed position, the door should be capable of being unlatched from both s ides without the aid of any tool and without the need of any item (it is not acceptable to require the use of even common items such as coins, credit cards, pens, etc.); b) In case the door is operated (opening, closing and/or latching) electrically: the re should be a manual override that satisfies the above condition (4)(a), unless the electrical opening and retention in the open and secured position continues to function following complete loss of normal electrical power, and it is demonstrated that fol lowing any probable electrical failure, the door defaults to the fully open and secured position; (c) The door should be frangible (or equivalent, e.g. it has a removable panel) in both directions. An assessment should be made of the moveable cabin featu res adjacent to the door in order to ensure that sufficient clearance on each side of the door, during all phases of flight, is assured by design such that the frangibility feature(s) will work as intended. Alternatively, it may be shown that, irrespective of the positioning of moveable cabin features, the overall frangibility objective is still achieved, e.g. by reaching through a reduced opening to easily move the feature before finishing the actions needed to provide the full opening intended. The frangi bility should be demonstrated by test using a 5th percentile female, and the resulting aperture should be demonstrated to be large enough for a 95th percentile male to escape. The case of probable jamming in a non - fully closed position should be considered ; (d) As an alternative to the above mentioned frangibility feature, it may be demonstrated, for example with double sliding doors, that following any probable failure or jamming of the door, a sufficient opening is still ensured that allows for passing through the doorway; ’sufficient opening’ would mean, in the case of a sliding door, an opening from floor to ceiling consistent with the minimum required width of aisle as prescribed by CS 25.815 for a passenger s eating capacity equal to the maximum expected number of passengers that would need to evacuate through the passenger egress path crossed by the door.

(e) The pre - flight passenger briefing (as mentioned in condition (1)(b)) should contain instructions on how to restore a sufficient opening for evacuation (frangibility feature or alternative means) in case of failure or jamming of the door.

For the definition of ‘probable failure or jamming of the door’, refer to the definition of ‘Probable Failure Conditi ons’ in AMC 25.1309 .

[Amdt 25/19] Powered by EASA eRules Page 1366 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes

AMC to Appendix S, S25.10(b) Interior Doors on Commercially

Operated Aeroplanes

ED Decision 2017/015/R In the case of an aeroplane which is not intended to be limited to non - comm ercial operations, the familiarity of the occupants with the specific cabin features of the aeroplane cannot be credited in the demonstration that, in the case of any probable failure or jamming of the door in a position other than fully open, any occupant is able, from any compartment separated by that door, to restore in an easy and simple manner a sufficient opening to access the compartment on the other side of the door (compliance with the condition S25.10(a)(3) ); this means, for instance, that when the demonstration relies on the frangibility of the door, there should be a placard on each side of the door to indicate the presence a nd functioning of this feature .

The requirement S25.10(b)(2)(ii) states that ‘the demonstration of compliance against the provision S25.10(a)(1) and (2) shall not rely on any passenger action, nor involve any flight crew member leaving their position in the cockpit’. Any of the followi ng solutions may be employed to meet this requirement: (1) An automatic system, for the opening of the door and retention of the door in the open and secured position.

(2) A control in the cockpit, compliant with CS 25.777 , to activate remotely the opening of the door and retention of the door in the open and secured position.

(3) For aeroplanes required to have at least one cabin crew member on board, and the cabin crew is clearly tasked with ensuring that th e door is open before entering any of the taxiing, take - off, and landing phases. Appropriate cabin crew procedures and cabin crew training should be established.

[Amdt 25/19]

AMC to Appendix S, S25.10(c) Isolated Compartments

ED Decision 2017/015/R (1) Cabin Compartments (a) Compartments to be considered as isolated Compartments in an aeroplane with an approved passenger capacity of less than 20 and a cabin length of 18.29 m (60 ft) or less do not need, in any case, to be considered as isolated. AMC 25.854 provides guidance on how to determine the cabin length.

S25.10(c) requires that a compartment in which a fire would not be directly or would not be quickly detected by occupants of another compartment must meet additional criteria in order to provide confidence that a fire will be detected. Such a compartment is described as an isolated compartment.

Any compartment that can be occupied by crew members and/or passengers during flight (other than accessible cargo/baggage compartments) should be considered as isolated for the purposes of showing compliance to S25.10(c) if it cannot be assured that fire/smoke in the compartment will be quickly detected by occupants of other occupied compartments of the aeroplane due to rapid smoke/fumes t ransmission enabled by the design of the aeroplane.

Powered by EASA eRules Page 1367 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes The assurance that fire/smoke will be quickly detected by occupants of other occupied compartments in the aeroplane may be provided by obvious smoke/fumes passage features, e.g. grills/louvres in a door, or via the aeroplane’s environmental control system air recirculation characteristics. Substantiation of the effectiveness of such declared smoke/fumes transmission means, via ground and/or flight tests, may be required. Detection of fire/smoke by occupan ts of another compartment only will provide the required assurance if there is confidence that this other compartment in question will be occupied, and not by sleeping persons (i.e. it is a compartment that meets the conditions set out in paragraph (1)(b)( ii) below). Thus, if smoke/fumes transmission is relied upon for compliance, the occupancy conditions of the aeroplane as a whole need to be taken into account.

(b) Isolated compartments occupied for the majority of the flight time S25.10(c) exempts isolated compartments (as described in paragraph (a) above) that are occupied for the majority of the flight time from being equipped with a smoke/fire detection system, based on the assumption that the occupants will quickly detect the fire.

(i) However, some categories of isolated compartments will by their nature not be eligible for this approach, either because there is a risk that all occupants will be sleeping (sle eping persons will not be able to detect a fire starting in the isolated compartment), or because occupancy for the majority of the flight time cannot be realistically assessed. Examples include, but are not limited to, the following: (A) bedrooms, (i.e. rooms containing any sleeping installations intended to provide a high level of sleeping comfort, such as beds, or berthable divans, even if they also contain seats that can be occupied during taxiing, take - off, and landing; however, passenger seats do no t need to be considered as sleeping installations in this context); (B) specialised rooms for which permanent occupation during the flight is unlikely (examples would include smoking rooms, cinema rooms, etc.); (C) washrooms/bathrooms, although the int ent of S25.10(c) will be met in any case, if they are compliant with CS 25.854; however, a shower cubicle does not need to be considered an isolated compartment; (D) crew rest compartments; and (E) galley compartments.

(ii) On the other hand, an isol ated compartment, unless meeting one of the criteria in (i) above, will be accepted as being occupied for at least the majority of the flight time, thus providing for smoke/fire detection by the occupants, if any of the following conditions are met: (A) it is the flight crew compartment (B) all required cabin crew seats are located in the isolated compartment; (C) the isolated compartment contains a crew station that due to its specialised purpose, is likely to be occupied for the majority of the flig ht time; (D) the number of seats in the isolated compartment (including cabin attendant seats and seats in excess) approved for occupancy during taxiing, take - off, Powered by EASA eRules Page 1368 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes and landing is at least equal to the number indicated in the right hand column of the tabl e below.

Total number of passenger seats installed An isolated compartment is accepted as being on the aeroplane approved for occupancy occupied for the majority of the flight time if it during taxiing, take - off, and landing con tains at least the following number of (including seats in excess) seats approved for occupancy during taxiing, take - off, and landing Up to 19 2 20 – 23 3 24 – 29 4 30 – 36 5 37 – 43 6 44 – 49 7 50 – 56 8 57 – 63 9 64 and above 10 Note: the ‘Up to 19’ figure is included for the case of an aeroplane with a total cabin length in excess of 18.29 m (60 ft).

(iii) In addition, an isolated compartment featuring no seat and no stowage (e.g. a connecting corridor) might be accepted as bei ng an isolated compartment without a smoke/fire detection system, because of the low likelihood of a fire starting in such a compartment.

(c) Minimum requirements for compartments For all compartments, irrespective of whether or not they are required to have a smoke/fire detection system installed: (i) For accessibility and firefighting purposes, sufficient lighting in the compartment should be provided. For compartments that could be dark during flight, a means should be provided to enable a person en tering the compartment to readily gain visibility of the interior. Such means may be: (A) a conveniently located, easy to find and use lighting control for the compartment; (B) a flashlight within close proximity to the entrance of the compartment; or (C) automatic illumination in the event the smoke/fire detection system in the compartment (if installed) triggers.

(ii) At least one readily accessible handheld fire extinguisher should be available for use in each compartment. Fire extinguishers requ ired by CS 25.851(a) may be used for this purpose. On the other hand this may also lead to the need to install more fire extinguishers than the minimum required by CS 25.851(a).

(iii) Portable breathing equipment, required by CS 25.1439(a), should be loc ated close to the handheld fire extinguisher.

Powered by EASA eRules Page 1369 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes (b) Smoke/fire detection in isolated compartments For interiors with more than one isolated compartment, there should be means by which flight or cabin crew can readily identify in which compartment smoke/f ire has been detected.

Depending on the number of isolated compartments and the specific layout, such means might be simply moving through the cabin and checking each compartment (in the case that cabin crew are required to be on board) or might need to be a visual indication outside each compartment, or some form of annunciator panel available to an appropriate crew member.

The objective in any case is that correct identification of the location of the smoke/fire should be possible without unnecessary dela y.

If the isolated compartment incorporates a stowage compartment of a volume greater than 0.7 m3 (25 ft3), this stowage compartment should be itself equipped with a smoke detector, unless it can be demonstrated that smoke from within the stowage compartm ent will be detected by the detector of the isolated compartment in which the stowage compartment is located (e.g.

through grilles in the stowage door), and within the time specified in the requirement S25.10(c).

If the isolated compartment incorporates a galley, or if smoking is to be allowed in the isolated compartment, nuisance triggering of the smoke/fire detection system may be minimised by a design feature that provides for temporary system deactivation by an occupant (passenger or crew member). In that case, full reactivation should be automatic after a time period of no longer than 10 minutes following the last deactivation action.

The effectiveness of the smoke/fire detection system should be demonstrated for all approved operating configurations and conditions. For smoke detection demonstration, FAA AC 25 - 9A, Smoke detection, penetration, and evacuation tests and related flight manual emergency procedures, 6 January 1994 provides acceptable means of compli ance.

During testing, it should be demonstrated that no inadvertent operation of smoke/fire detectors in any compartment would occur as a result of fire starting in any other compartment.

An assessment of the compartment design and observations during smoke/fire detection tests will be expected in order to provide a demonstration of the effectiveness of firefighting procedures. This should also include demonstrating that the compartment is provided with sufficient access in flight to enable a crew member to effectively reach any part with the contents of a handheld fire extinguisher.

[Amdt 25/19] Powered by EASA eRules Page 1370 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes

AMC to Appendix S, S25.10(d) and (e) Deactivation of existing

Emergency Exits

ED Decision 2017/015/R (1) General S25.10(d)(3) requires to ensure that the distance from each passenger seat to at least one non - deactivated emergency exit on each side of the fuselage remains compatible with easy egress from the aeroplane.

For the purpose of this provi sion, a passenger seat distribution will be considered to meet this objective, provided that each passenger seat approved for use during taxiing, take - off, or landing is located such that: (a) It is within 9.14 m (30 ft) from the nearest emergency exit o n one side of the fuselage on the same deck, and within 13.72 m (45 ft) from the nearest emergency exit on the other side of the fuselage on the same deck; and (b) The occupant of that seat has the possibility to move to an emergency exit, on the left sid e, or the right side of the fuselage, whilst at all points along the way remaining within 9.14 m (30 ft) from an emergency exit on one side of the fuselage on the same deck and within 13.72 m (45 ft) from an emergency exit on the other side of the fuselage on the same deck.

When calculating the distance from a passenger seat, or from any point in the egress path of an occupant, to an emergency exit, this distance should be taken as the total longitudinal distance (i.e. as measured parallel to the aeroplane ’s longitudinal axis) that the escapee should cover in order to get to the emergency exit in question (i.e. the distance calculated should take into account all required changes in the direction of movement but measured only longitudinally).

For the distan ce from a passenger seat, as starting point, the front edge of the seat bottom cushion at the seat centreline is to be taken (for forward, angled, side or aft - facing seats), and as end point, the nearest exit edge.

For aeroplanes with an approved passenger seating configuration of 19 or less, only one pair of emergency exits is required. However, such aeroplanes may have additional exits installed, which must then comply with CS 25.807(h) but not with the 18.3 - m (60 - feet) rule of CS 25.807(f)(4). The distance between each passenger seat and the nearest available emergency exit may be determined considering all available emergency exits, including the ones addressed by CS 25.807(h) .

When deact ivation of one or more emergency exits results in an emergency exit arrangement that is asymmetrical relative to the aeroplane centre line, the acceptable seating capacity for each cabin zone should be determined considering the emergency exits remaining a vailable on each side of the fuselage separately, i.e. following a similar methodology as the one used in FAA AC 25.807 - 1, Uniform distribution of exits, 13 August 1990.

(2) Examples The following examples illustrate the analysis method to be followed w hen examining the acceptability of various emergency exit deactivation schemes on an aeroplane that is originally type - certified with two pairs of Type C exits (rated at 55 passengers for each pair) at the forward and aft limits of the cabin, and a single pair of overwing Type III exits (rated at 35 passengers).

In accordance with CS 25.807 , this emergency exit layout will have a possible maximum Powered by EASA eRules Page 1371 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes approved passenger capacity of 145 (55 + 35 + 55). It is assumed that the aeroplane manufacturer has received approval for this number of passengers.

The distance between the nearest exit edges of the two pairs of Type C exits is 20 m (65.7 ft).

The overwing exits pair’s forward edges are 8 m (26.3 ft) from the rear edges o f the forward Type C exit pair.

The figures below provide additional clarification on the methodology to be used and the resultant limitations.

A cabin area that should not include any crew or passenger seats that can be occupied during taxiing, take - off , and landing is referred to as a ‘stay - out zone’, coloured pink in the illustrations below. The hatched/yellow areas in the illustrations below are referred to as ‘additional stay - out zones’ and should also not include any crew or passenger seats that can be occupied during taxiing, take - off, and landing. Seats located within these latter zones do meet the criteria of the above paragraph (1)(a) but do not meet the criteria of the above paragraph (1)(b). In other words, although these zones are located suff iciently close to emergency exits to meet the basic emergency exit egress distance requirements on both sides of the fuselage, an occupant of one of these seats would be forced to traverse a cabin area that does not meet these requirements, i.e. a stay - out zone, in order to egress the aeroplane.

Example 1 In the first example, only the left hand (LH) overwing Type III exit is deactivated.

Identification of stay - out zones No stay - out zone needs to be identified in the cabin, if any possible passenger seat location will be no more than 9.14 m (30 ft) from the nearest exit on one side of thefuselage, and no more than 13.72 m (45 ft) from the nearest exit on the other side of the fuselage, i.e. in compliance with the above paragraph 1.(i).

Calculation of the basic passenger seating configuration limitations set by S25.1(a) .

In the case of non - commercial operations, in accordance with S25.1(a) , the passenger capacity will have an upper possible limit of 73 passengers (1/2 of 145 (55 + 35 + 55) rounded up), i.e.

one half of the maximum passenger seating capacity of the type - certified aeroplane ha ving all exits functional.

In the case of commercial operations, in accordance with S25.1(a) , the passenger capacity will have an upper possible limit of 48 passengers (1/3 of 145 (55 + 35 + 55) rounded down), i.e. one third of the maximum passenger seating capacity of the type - certified aeroplane having all exits functional. Additionally, there will be an upper possible limit of 30 passengers seated forward or aft of the overwing exits (1/3 of 90 (55 + 35)), i.e. one third of the maximum passenger seating capacity for each cabin zone of the type - certified aeroplane having all exits functional.

C alculation of additional passenger seating limitations due to exit deactivation Firstly, a zonal analysis is conducted on the right side of the fuselage in accordance with S25.10(d) . Two zones are represented by t he exits on this side (all original emergency exits remain functional).

The allowable number of seats between the forward Type C exit and the overwing exit is limited to one half of the sum of the ratings of the exits that bound the zone: 1/2 of 90 (55 + 35) = 45.

Powered by EASA eRules Page 1372 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes The same limit is valid also for the zone between the overwing exit and the rearmost Type C exit.

Secondly, a zonal analysis is conducted on the left side of the fuselage in accordance with S25.10(d) . T here is only one zone represented by the remaining functional exits on this side.

The allowable number of passenger seats between the forward and aft Type C exits is again limited to one half of the sum of the exit ratings that bound the zone: 1/2 of 110 ( 55 + 55) = 55.

The passenger seating locations for taxiing, take - off, and landing should simultaneously satisfy all basic limitations set by S25.1(a) and both of the zonal analyses in accordance with S25.10(d).

I n the case of non - commercial operations, this means that the passenger seating configuration is limited to 55 (i.e. in this case, the limitation resulting from the left - side fuselage zonal analysis is most constraining and defines the maximum seating capac ity of the aeroplane) and a maximum of 45 passenger seats located either forward or aft of the remaining functional overwing exit may be occupied for taxiing, take - off, and landing.

However, for commercial operations, an overriding consideration applies d ue to the fact that there is a non - compliance with CS 25.807(f)(4) on the left side of the fuselage, andthe provisions of S25.10(d) only apply to non - commercial operations. The seating capacity of the example aeroplane in commercial operation will thus be limited to 19 seats because CS 25.807(f)(4) only applies to aeroplanes for which more than one exit pair is required. However, the re will be no limitation on the passenger seating location for taxiing, take - off, and landing, as explained in AMC 25.807 .

Example 2 In the second example, both left hand (LH) and right hand (RH) overwing Type III exits are deactivated. The aeroplane has thus only two pairs of remaining functional Type C exits located at either end of the cabin.

Identification of stay - out zones A stay - out zone is identified in the middle of the cabin, where a passenger seat that can be occupied during taxiing, take - off, and landing would not be in compliance with the above paragraph 1.(i), i.e. would be further than 9.14 m (30 ft) from the nearest exit , on both sides of the fuselage. The exact limitation on the seat installation location in order to respect the stay - out zone should be calculated using the longitudinal measurement method as explained in AMC 25.80 7 .

Calculation of the basic passenger seating configuration limitation set by S25.1(a) In the case of non - commercial operations, in accordance with S25.1(a) , the passenge r capacity will have an upper possible limit of 73 passengers (1/2 of 145 (55 + 35 + 55) rounded up), i.e.

one half of the maximum passenger seating capacity of the type - certified aeroplane having all exits functional.

In the case of commercial operations , in accordance with S25.1(a) , the passenger capacity will have an upper possible limit of 48 passengers (1/3 of 145 (55 + 35 + 55) rounded down), i.e. one third of the maximum passenger seating capacity of the typ e - certified aeroplane having all exits functional. Additionally, there will be an upper possible limit of 30 passengers seated forward or aft of the overwing exits (1/3 of 90 (55+35)), i.e. one third of the maximum passenger seating capacity for each cabin zone of the type - certified aeroplane having all exits functional.

Calculation of additional passenger seating limitations due to exit deactivation Powered by EASA eRules Page 1373 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes In this example, the arrangement of the remaining functional exit is symmetrical on either side of the aer oplane centre line, hence, no separate LH and RH zonal analyses are required, and only one cabin zone remains.

The zonal analysis, in accordance with S25.10(d) , results in the number of seats that may be occupied during taxiing, take - off, and landing between the forward and aft Type C exits, limited to one half of the sum of the ratings of the exits that bound the zone: i.e. 1/2 of 110 (55 + 55) = 55.

The passenger seating locations for taxiing, take - off, and land ing should simultaneously satisfy all basic limitations set by S25.1(a) and the zonal analysis in accordance with S25.10(d) .

Therefore, for non - commercial operations, a max imum total of 55 passenger seats may be occupied during taxiing, take - off, and landing, in any combination of individual locations forward or aft of the identified stay - out zone.

For commercial operations, as in Example 1, the seating capacity of the aero plane will be limited to 19, due to non - compliance with CS 25.807(f)(4) , on both sides of the fuselage this time.

However, as also explained in Example 1, the total of 19 passenger seats that can be occupied during taxiing, take - off, and landing may be in any combination of locations forward or aft of the identified stay - out zone.

Example 3 In the third example, the rearmost LH Type C exit is deactivated. The aeroplane has, thus, one pair of functional forward Type C emergency exits and one pair of functional overwing Type III emergency exits, and a functional aft Type C emergency exit on the RH side only.

Identification of stay - out zones No stay - out zone can be identified in the cabin, i.e. any possible passenger seat location will be no more than 9.14 m (30 ft) from the nearest exit on one side of the fuselage, and no more than 13.72 m (45 ft) from the nearest exit on the other side of the fuselage.

Calculation of the basic passenger seating configuration limitations set by S25.1(a) In the case of non - commercial operation, in accordance with S25.1(a) , the passenger capacity will be limited to 73 passengers (1/2 of 145 (55+35+55) rounded up), i.e. one half the maximum passenger seating capacity of the type certified aeroplane with all exits functional.

In the case of commercial operation, in accordance with S25.1(a) , the passenger capacity will have an upper possible limit of 48 passengers (1/3 of 145 ( 55+35+55) rounded down), i.e. one third the maximum passenger seating capacity of the type certified aeroplane with all exits functional. Additionally, there will be an upper possible limit of 30 passengers seated forward or aft of the overwing exits (1/3 of 90 (55+35)), i.e. one third of the maximum passenger seating capacity for each cabin zone of the type certified aeroplane with all exits functional.

Calculation of additional passenger seating limitations due to exit deactivation Firstly, a zonal anal ysis is conducted on the right side of the fuselage, in accordance with S25.10(d) . Two zones are represented by the remaining functional exits on this side (all original emergency exits remain functional).

The all owable number of seats for installation between the forward Type C and the overwing exit is limited to one half of the sum of the ratings of the exits that bound the zone: 1/2 of 90 (55 + 35) = 45.

Powered by EASA eRules Page 1374 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes The same limit is also valid for the zone between the ove rwing emergency exit and the rearmost Type C exit. Secondly, a zonal analysis is conducted on the left side of the fuselage. Again, two zones are represented by the remaining functional emergency exits on this side, but this time, one zone is a so - called d ead end zone.

As for the right side, it is acceptable to install 45 seats between the forward Type C and the overwing exit: 1/2 of 90 (55 + 35) = 45.

In the dead end zone aft of the overwing exit, it is acceptable to install a maximum of 18 seats (1/2 of 35 rounded up).

The passenger seating locations for taxiing, take - off, and landing should simultaneously satisfy all basic limitations set by S25.1(a) and both of the zonal analyses in accordance with S25.10(d) .

Therefore, for non - commercial operations, this results in a maximum total seating capacity of 63 when it simultaneously satisfies the upper limit for each zone, i.e. 45 for the forward zone and 18 for the aft zone .

In case of commercial operations, the total capacity of the aeroplane will be limited to 48 passengers, not exceeding 30 passengers forward of and 18 aft of the overwing exits.

Further examples In addition to Examples 1, 2 and 3 above, further example s of exit deactivation for the same basic aeroplane are illustrated, and the resultant allowable passenger seating restrictions are summarised.

The principles evident from these examples can be used to determine zonal capacities and stay - out zones for any aeroplane.

Powered by EASA eRules Page 1375 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes [Amdt 25/19]

S25.20 Emergency Evacuation

ED Decision 2017/015/R (a) Flammability Requirements (1) Mattresses of permanent bed installations that are located in compartments isolated from the main passenger cabin by doors or equivalent means that would normally be closed during taxiing, take - off, and landing do not need to meet the ‘Oil Burner Test’ requirement of Appendix F, Part II as required by CS 25.853(c) (See AMC to Appendix S, S25.20(a)(1)).

(2) On non - commerc ially operated aeroplanes only, compliance with CS 25.853(d) does not need to be demonstrated if it can be shown by test or a combination of test and analysis Powered by EASA eRules Page 1376 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes under the conditions specified in Appendix J that the maximum time for evacuation of all occupant s does not exceed 45 sec.

(b) Access to Type III and IV Emergency Exits : low - occupancy aeroplanes that have a passenger seating configuration of 19 or less and non - commercially operated aeroplanes may have an item deployable into the region defined by CS 2 5.813 (c)(4)(i) or CS 25.813 (c)(1), (2) or (3) which creates an obstruction and, therefore, leads to non - compliance with one or more of the aforementioned requirements, provided that: (1) it is ensured that the item will be safely stowed before entering a ny of the taxiing, take - off, approach, and landing phases, by means of a position monitoring and alerting system that, in a timely manner, notifies the flight crew and compels the passengers to stow the item if it is in a position that creates an obstructi on (See AMC to Appendix S, S25.20(b)(1)).

It must be substantiated that, with the item in its most adverse position(s), the remaining exit is at least as effective as a Type IV emergency exit, unless it can be shown that following any single failure, an ex it at least as effective as a Type IV emergency exit can be obtained by simple and obvious means; or (2) the approved passenger configuration is such that this number of passengers can be evacuated through the exit in question, with the obstruction in its most adverse position and under the conditions of Appendix J, at least as quickly as the maximum number of passengers allowed by CS 25.807(g) without the obstruction. It must be substantiated that, with the obstruction in place, the remaining exit is at le ast as effective as a Type IV emergency exit; or (3) for aeroplanes required to have at least one cabin crew member on board, the item is intended for use only by a cabin crew member that has direct view of the deployable item and can confirm that it is co rrectly stowed and secured, while they are seated during taxiing, take - off, and landing.

[Amdt 25/19]

AMC to Appendix S, S25.20(a)(1) Flammability of Bed Mattresses

ED Decision 2017/015/R Mattresses of beds that are convertible to/from seats, regardless of their location in the aeroplane, and irrespective of whether or not the seat configuration is approved for occupancy during taxiing, take - off, and landing, should meet the criteria of CS - 25, Appendix F, Part II.

As required by CS - 25, Appendix F, mattress foam shall be tested for 12,7 - mm (1/2 - in.) thickness. If the mattress consists of two or more foams glued together, the foam specimen should consist of two 6.34 - mm (1/4 - in.) (three layers of 4.2 mm (1/6 in.), etc. ) pieces glued together. Three specimens should be made for each combination of foams that are glued together in the production mattress. Any other production mattress components that are glued together should also be tested together.

If such specimens do not meet the test criteria of CS - 25, Appendix F, Part I, it is acceptable to test each production mattress component separately, including a sheet of glue, using the test criteria of Appendix F, Part I.

Additionally, the Bunsen burner is then to be appli ed at three separate corners of the production mattress with all its components. The three - corner test does not need to be conducted if the cushion passes the tests of CS - 25, Appendix F, Part II.

[Amdt 25/19] Powered by EASA eRules Page 1377 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes

AMC to Appendix S, S25.20(b) Exit as effective as a Type IV exit

ED Decision 2017/015/R An acceptable means of compliance with the requirement that the remaining exit resulting from an obstruction shall be as effective as a Type IV emergency exit (S25.20(b)(1) and (b)(2)), is to demonstrate that: (1) the dimensions of the remaining exit opening are equivalent to or greater than those of a Type IV emergency exit; and (2) the obstructing item does not protrude into the horizontally projected opening of the remaining exit.

In the assessment of the eff ectiveness of the remaining exit, the requirements of CS 25.807(a)(4), CS 25.809(b) and CS 25.813(c)(1) should also be considered.

[Amdt 25/19]

AMC to Appendix S, S25.20(b)(1) Ensuring removal of in - flight

obstructions before take - off and landing

ED Decision 2017/015/R This paragraph provides guidelines regarding the criteria under which an item, although constituting an obstruction that does not comply to CS 25.813(c), may be considered acceptable because per design and procedure, there can be high c onfidence that the obstruction will be removed when needed for safety (S25.20(b)(1)).

In addition to the exceptions set in Section 2 — Deployable features of AMC 25.813(c), an item which can be deployed by a crew member or passenger into the region define d by CS 25.813 (c)(4)(i) or into the passageway required by CS 25.813 (c)(1), (2) or (3), but which, when stowed, is no longer in either of these areas, is acceptable if there is enough assurance that the item will be stowed when needed.

Such assurance may be assumed when all following conditions are met: (1) A position monitoring system is installed, which detects that the item is not properly stowed, and triggers both alerts in the passenger cabin and a visual indication to the flight crew if the item i s not properly stowed before entering any of the taxiing, take - off, approach, and landing phases.

(2) The alerts in the cabin, required in paragraph (1), include an aural device which sounds continuously in all areas of the passenger cabin (it should be loud enough to clearly act as an irritant, thus assuring that occupants will stow the obstruction, but not so loud as to distract the flight crew), as well as a conspicuous electrically illuminated sign showing an appropriate text message or pictogram, in the immediate proximity of the relevant emergency exit.

(3) The alerts described in paragraph (2), are triggered without delay if the deployable item is moved away from the safe position during any of the taxiing, take - off, approach, and landing flight p hases, or, if upon entering these phases, the item is not stowed in the safe position. When preparing for landing, the alerts are triggered at a point that allows ample time for a cabin occupant to re - stow the deployable item before landing. It should be c onsidered that the cabin occupant needs to move within the cabin to reach the deployable item, therefore, the alerts should be triggered during descent, allowing enough time prior to entering the approach phase, unless the aeroplane is required to Powered by EASA eRules Page 1378 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes have at least one cabin crew member on board; The aural and visual alerts should both remain on until the obstacle is properly stowed.

(4) The visual indication provided to the flight crew, described in paragraph (1), is triggered without delay if the deployable item is moved away from the safe position during any of the taxiing, take - off, approach, and landing flight phases, or, if upon entering these phases, the deployable item is not stowed in the safe position. When preparing for landing, the visual indicatio n is triggered during the descent phase, early enough to enable the crew to take appropriate action before entering the approach phase.

(5) The failure to alert in the cabin or cockpit that an item is not properly stowed is demonstrated to have an average probability per flight hour of the order of 1 x 10 - 3 or less.

(6) Instructions are given to the passengers and cabin crew (if any), by mea ns of appropriate placards and a pre - flight briefing, that the obstacle should be stowed before entering any of the taxiing, take - off, approach, and landing phases. The pre - flight briefing (which could be part of a regular briefing) should describe the pos ition monitoring and alerting system, as well as the necessary response by the passengers. The requirement for this briefing should be part of the AFM.

(7) A description of the position monitoring and alerting system is made available to the flight crew. The AFM should also include the appropriate normal procedure ensuring that the cabin is ready (i.e. a check that no visual indication, as defined in paragraph (4), being present) prior to landing, and an instruction that the crew takes all necessary actio ns when the visual indication, as defined in paragraph (4), is triggered.

(8) The emergency exit provided when the obstruction in its most adverse position(s) is at least as effective as a Type IV emergency exit, unless it can be shown that following any single failure an exit at least as effective as a Type IV emergency exit can be obtained by simple and obvious means. If the obstructing item is a seat, the normal seat operating controls (e.g. track, swivel, recline etc.) may be considered as means meeti ng the simple and obvious requirement, provided that the controls remain visible to a person approaching the seat and are easily useable without sitting on the seat, when the seat is in any possible obstructing condition. If movement of the obstructing ite m to meet the above requires electrical power, it should be substantiated that the required power source(s) will remain available following an emergency landing.

[Amdt 25/19]

AMC to Appendix S, S25.20(b)(2) Comparative assessment of

evacuation capabilit y

ED Decision 2020/024/R Use of the Latin square method as detailed in Appendix 4 to FAA Advisory Circular (AC) 25 - 17A Change 1 Transport Airplane Cabin Interiors Crashworthiness Handbook , dated 24.5.2016 is accepted by EASA as providing acceptable means of compliance with S25.20(b)(2) .

[Amdt 25/19] [Amdt 25/26] Powered by EASA eRules Page 1379 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes

S25.30 Circulation Inside Cabin During Flight

ED Decision 2017/015/R (a) Width of Aisle: for low - occupancy aeroplanes that have a passenger seating confi guration of 19 or less, and for non - commercially operated aeroplanes, the design must be such that the dimensional requirements of CS 25.815 can be achieved during all flight phases, except that the width of aisle may be reduced to 0 m during in - flight ope rations provided that compliance with the following additional requirements is shown (See AMC to Appendix S, S25.30(a)): (1) all areas of the cabin must be easily accessible by passengers or crew in the event of an emergency situation (e.g. in - flight fire, depressurisation); (2) placard instructions for restoring the aisle to the taxiing, take - off, and landing configuration mu st be provided at the locations where the width of the cabin aisle is reduced; and (3) procedures must be established and documented in the AFM for restoring the aisle width for taxiing, take - off, and landing.

(b) Firm Handholds: in lieu of the require ments of CS 25.785(j), if the seat backs do not provide a firm handhold, there must be an acceptable means to enable persons to steady themselves while using the aisles in moderately rough air (See AMC to Appendix S, S25.30(b)).

[Amdt 25/19]

AMC to Appendi x S, S25.30(a) Width of Aisle

ED Decision 2017/015/R For compliance with the ‘Width of Aisle’ requirement, the following applies: (1) An obstacle in the passageway is considered easily surmountable if the aisle width reduction it creates may be negotiate d by a person anywhere in the size range from 5th percentile female to a 95th percentile male.

(2) Negotiating of an obstacle may require the removal and/or movement of more than one item.

(3) If an obstacle is stepped on, it should be capable of withs tanding without failure a vertical step force of 222 daN (500 lbs) applied at the most adverse stepping location, without failure to the extent that it could unsteady a person trying to surmount that obstacle.

(4) When assessing compliance, the applicant should select the most adverse in - flight configuration(s). The selection should include all possibilities regardless of subjective issues, such as the likelihood that passengers may consider the configuration advantageous. If however, an applicant feels t hat one or more configurations, although p ossible, would only result from severely anomalous behaviour by cabin occupants, it/they may be justified for elimination from the assessment. The configuration(s) should be highlighted and their elimination justif ied in the assessment report, for Agency agreement. The possibility of entrapment (e.g. feet, hands etc.) during negotiating of the obstacle should be included in the assessment and selection of adverse in - flight configurations. Maintaining gaps of less th an 3.5 cm (1.38 in.) is considered acceptable to eliminate the risk of entrapment. Items such as drawers or stowage doors do not need to be considered opened in the aisle. Each interior door may be considered open unless another position of the door might interact with the movement of an obstacle out of the Powered by EASA eRules Page 1380 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes aisle. In that case, all possible interactions between the door and the obstacle should be assessed. In general, items need only be considered in their most adverse detent or locked position.

(5) For t he purpose of showing compliance, the applicant may use tests, analyses supported by test data, or, where appropriate, inspections.

(6) In principle, the total time required for a crew member to travel from the forwardmost point in the cabin to the rearm ost point, with all aisle obstacles in their most adverse positions, should not exceed by more than 30 seconds the time it would take without the obstacles in place. However, the cabin may be divided into zones, provided that each zone includes the quantit y and type of emergency equipment adequate for firefighting, and that it can be substantiated that at least one cabin crew member is likely to occupy that zone during the majority of the flight. It should be shown that the time required for a cabin crew me mber to travel from the forwardmost point to the rearmost point of each zone, with all aisle obstacles in their most adverse positions, will not exceed by more than 30 seconds the time it would take without the obstacles in place.

(7) If an unobstructed passageway exists as an alternative to the obstructed one (e.g.

aeroplanes with two aisles), it may be acceptable for this alternative route to be used when showing compliance. Such acceptability will depend on a case - by - case assessment of the degree to wh ich such an alternative route would be obvious to the crew member.

Note: interior doors are not addressed by the requirements of S25.30(a) but rather by the requirements of S25.10(a) and (b).

[Amdt 25/19]

AMC to Appendix S, S25.30(b) Firm Handholds

ED Decision 2017/015/R Where the cabin layout is similar to a standard airline layout, firm handholds as normally expected for such seating areas should be provided.

Where closely spaced firm handholds cannot be easily provided, the ‘Firm Handhol ds’ requirement can be considered as complied with, provided the following conditions are met: (1) there should be a recommendation to passengers to remain seated with seat belts fastened, which may be a placard or a required (i.e. specified in the AFM) pre - flight briefing; (2) there should be at least one route through each area that provides firm handholds to enable passengers to reach their designated seats; in these areas: (a) firm handholds should be mounted at least 66 cm (26 in.) high; and (b) the distance between fir m handholds should not be greater than 2.15 m (84 in.); (3) wherever aisles are not bordered by seats, it is acceptable that occupants may steady themselves by leaning on sidewalls or other interior components; and (4) in any case, the applicant shall demonstrate that items used as firm handholds are structurally adequate to perform this function.

[Amdt 25/19] Powered by EASA eRules Page 1381 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes

S25.40 Markings and Placards

ED Decision 2017/015/R (a) ‘No Smoking’ Placards and Lavatory Ashtrays: if smoking is to be prohibited, in lieu of the requirements of CS 25.791(a) and CS 25.791(d), a reduced number of ‘No smoking’ placards may be provided and lavatory ashtrays do not need to be provided in accordance with the following: (1) a ‘No smoking’ placard must be conspicuously located inside the passenger compartment in the immediate vicinity of each door that can be used as a passenger boarding door.

Each placard must be clearly legible for passengers entering the aeroplane; (2) compliance with CS 25.853(g) is not required; and (3) the indic ation that smoking is prohibited must be the subject of a passenger briefing, and the requirement for this briefing must be part of the AFM.

(b) Briefing Card Placard: for non - commercially operated aeroplanes, the instructions required by CS 25.1541 for p roperly setting the cabin in its configuration approved for taxiing, take - off, and landing may alternatively be provided by a reduced number of placards, each one referring to a briefing card. In that case (See AMC to Appendix S, S25.40(b)): (1) the detail ed minimum instructions to be included in the briefing card must be part of the type design and referred to in the ‘Limitations’ section of the AFM; and (2) the briefing card must be easily accessible from each passenger seat. A dedicated stowage must be p rovided to stow the briefing card within easy reach of each seated passenger with their seat belts fastened.

(c) Seats in Excess (See AMC to Appendix S, S25.40(c)) (1) If the total number of seats that are approved for occupancy during taxiing, take - off, and landing is greater than the approved passenger seating configuration, the difference between these two quantities is deemed to be seats in excess. If seats in excess exist, a placard indicating the approved passenger seating configuration must be insta lled adjacent to each door that can be used as a passenger boarding door. This placard must be clearly legible for passengers entering the aeroplane. Additionally, a note must be included in the ‘Limitations’ section of the AFM stating that there are exces s seats installed, and indicating the maximum number of passengers that may be transported.

(2) For each seating location available for in - flight use only (including in - flight - only seats, beds, berths, and divans), a placard indicating that the location is not to be occupied during taxiing, take - off, and landing must be installed such that the placard is legible to the seated occupant.

[Amdt 25/19]

AMC to Appendix S, S25.40(b) Briefing Card Placard

ED Decision 2017/015/R The instructions that may be reported on the briefing card referred to in S25.40(b) are limited to the instructions necessary to restore the configuration of the passenger cabin to that approved for taxiing, take - off, and landing. All other placards requir ed by CS - 25 are excluded from the provisions of S25.40(b).

Powered by EASA eRules Page 1382 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes For example, and where applicable, a briefing card may be used to deliver information related to setting seats in the upright position, stowing leg rests/armrests, repositioning ‘high – low’ positio n tables, opening/closing doors, installing crash pads, etc.

The content added to the briefing card to cover information conventionally conveyed via placarding, and the means to provide accessibility to this information will need to be approved as part of the type design. However, it may be desired to include additional safety information on the same briefing card.

This may be due to operational requirements for a briefing card, or may be at the applicant’s or customer’s discretion. This is acceptable, and this additional information will not be subject to approval as part of the type design.

However, limitations on the presentation of this additional information on the briefing card (e.g. size, style, relative location) may need to be stated in the type design in order that both sets of information remain appropriately conspicuous to the passengers.

When design solutions are proposed using placards that make reference to a briefing card for further instructions, the following should be considered: ( 1) Individual placards at each seat location may be replaced by a simplified placard referring to the briefing card. For example: ‘Refer to the briefing card to configure cabin/seat/table/leg rest for taxiing, take - off, and landing’.

(2) Alternatively, one single placard stating, for example, ‘Moveable items in this area should be configured in accordance with the briefing card for taxiing, take - off, and landing’, and visible from each seated position of a group of seats, may be used.

(3) The briefing card should be demonstrated to be accessible from each passenger seat. A dedicated stowage (e.g. pocket) easily recognisable by a seated passenger, or when approaching the seat, shall be provided. The briefing card should be within easy reach of each passe nger with their seat belt fastened, except in some cases where this may be impracticable. For instance, it may be acceptable that a passenger occupying the centre place of a three - place divan is not able to reach the briefing card with their seat belt fast ened. In such a case, EASA may accept that either the left hand (LH) or right hand (RH) place of the divan will most likely be occupied, and that this passenger’s access to the briefing card will provide him/her with the required awareness of necessary pre - flight and landing actions.

(4) The briefing card information should be clear and simple. It is expected that the additional space offered by the briefing card, relative to conventional placarding, will allow applicants to provide more easily understood safety instructions. The use of pictograms is encouraged.

[Amdt 25/19]

AMC to Appendix S, S25.40(c) Seats in Excess

ED Decision 2017/015/R S25.40(c) requires the installation of a placard, adjacent to each possible passenger boarding door, on aeroplanes which have a greater number of seats approved for occupancy during taxiing, take - off, and landing than the approved passenger seating configuration. It may be acceptable that the selection of which seats to occupy is at the operator’s/passenger’s discretio n, or constraints may exist for instance due to the zonal limitations set by S25.1(a)(2), or the varying passenger seating configuration and/or direct - view limitations for an aeroplane with different, reconfigurable, cabin designs approved for Powered by EASA eRules Page 1383 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes private vers us commercial transport operations. In such cases, the placard should indicate limitations of the allowable seating occupancy for taxiing, take - off, and landing, as appropriate, for each cabin zone, and not just for the aeroplane as a whole; moreover, diff erent indications should be provided with reference to the different type of operations that may be performed (non - commercial/commercial).

Additionally, if it is decided to help passengers in selecting acceptable seating locations by means of markings on a seat or seats, a local placard (text or symbolic), easily readable by a passenger approaching/seated on each such seat, should be provided. The placard should be of adequate size for easy readability.

[Amdt 25/19]

S25.50 Cabin Attendant Direct View

ED Dec ision 2017/015/R In lieu of the requirements of CS 25.785(h)(2), compliance with the following cabin attendant direct view requirements may be shown: (a) For non - commercially operated aeroplanes, at least half of the installed cabin crew member seats must face the passenger cabin.

(b) For low - occupancy aeroplanes, cabin crew member seats must be, to the extent possible, without compromising proximity to a required floor level emergency exit, located to provide direct view of the cabin area for which the ca bin crew member is responsible (See AMC to Appendix S, S25.50(b)).

[Amdt 25/19]

AMC to Appendix S, S25.50(b) Cabin Attendant Direct View

ED Decision 2017/015/R For commercial operations, compliance with CS 25.785(h)(2) may be shown based on the criteria of FAA AC 25.785 - 1B, Flight attendant seat and torso restraint system installations, 11 May 2010, with the following deviations from Section 10 thereof: (1) Subparagraph 10a(2) is amended to read as follows: ‘(2) Each floor level emergency exit adjacent to a required crew member seat’; (2) Subparagraph 10a(3) is amended to read as follows; ‘(3) At least 50 % of the total number of passenger seats authori sed for occupancy during taxiing, take - off, and landing.’; (3) Subparagraph 10a(4) is amended to read as follows: ‘(4) At least 25 % of the passenger seats in each visually divided zone of four or more passenger seats.’; and (4) Subparagraph 10b(3)(a ) is amended to read as follows: ‘(a) A person seated in the seat is visible when they make any upper - body movement, such as moving their arm over their head or sideways, including leaning, while belted on their seat.’.

[Amdt 25/19] Powered by EASA eRules Page 1384 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes APPENDICES TO CS - 25 (CS - 25) Appendix S – Airworthiness requirements for non - commercially operated aeroplanes an d low - occupancy aeroplanes

S25.60 Security

ED De cision 2018/005/R Non - commercially operated aeroplanes do not need to comply with the security specifications of CS 25.795(b), (c) and (d) .

[Amdt 25/21] Powered by EASA eRules Page 1385 of 1495 | Jan 2023

Next: GENERAL AMCs →

GENERAL AMCs

Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25)

GENERAL AMC S

AMC 25 - 1 On - board weight and balan ce systems

ED Decision 2020/024/R Applicants for the certification of an on - board weight and balance system should take account of EUROCAE Document ED 263, ‘Minimum Operational Performance Standard for Onboard Weight and Balance Systems’, dated June 2019.

ED - 263 defines standards for an advisory OBWBS (i.e. class II) that displays the measured gross weight and calculated centre of gravity for use by the flight crew as an independent means of verifying the conventional weight and balance information pr ovided for the preparation of the dispatch of the aeroplane (e.g. the load sheet). These standards are intended to ensure that the system satisfactorily performs its intended function(s) under all the conditions normally encountered during routine operatio n of the aeroplane.

[Amdt 25/26]

AMC 25 - 11 Electronic Flight Deck Displays

ED Decision 2020/024/R Chapter 1 Background 1. What is the Purpose of this AMC?

2. Who Does this AMC Apply to?

3. [RESERVED] 4. General Table 1 – Topics covered by this AMC Table 2 – Topics outside of this AMC 5. Definitions of Terms Used in this AMC 6. Background 7. – 10. [RESERVED] Chapter 2 Electronic Display System Overview 11. General a. Design Philosophy b. Human Performance Considerations c. Addressing Intended Function in the Certification Programme 12. – 15. [RESERVED] Chapter 3 Electronic Display Hardware 16. Display Hardware Characteristics a. Visual Display Characteristics b. Installation c. Power Bus Transient 17. – 20. [RESERVED] Chapter 4 Safety Aspects of Electronic Display Systems 21. General a. Identification of Failure Conditions b. Effects of Display Failure Conditions c. Mitigation of Failure Conditions d. Validation of the Classification of Failure Conditions and Their Effects Powered by EASA eRules Page 1386 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) e. System Safety Guidelines Table 3 – Example Safety Objectives for Attitude Failure Conditions Table 4 – Example Safety Objectives for Airspeed Failure Conditions Table 5 – Example Safety Objectives for Barometric Altitude Failure Conditions Table 6 – Example Safety Objectives for Heading Failure Conditions Table 7 – Example Safety Objectives for Certain Navigation and Communication Failure Conditions Table 8 – Example Safety Objectives for Failure Conditions of Other Parameters Table 9 – Example Safety Objectives for Engine Failure Conditions Tab le 10 – Failure Conditions for Display Systems Used as Controls 22. – 30. [RESERVED] Chapter 5 Electronic Display Information Elements and Features 31. Display Information Elements and Features a. General b. Consistency c. Display Information Elements (1) Text (2) Labels (3) Symbols (4) Indications (a) Numeric Readouts (b) Scales, Dials, and Tapes (c) Other Graphical Depictions (5) Colour Coding Table 11 – Recommended Colours for Certain Functions Table 12 – Specified Colours for Certain Display Features d. Dynamic (Graphic) Information Elements on a Display e. Sharing Information on a Display (1) Overlays and Combined Information Elements (2) Time Sharing (3) Separating Information Visually (4) Clutter and De - Clutter f. Annunciations and Indications (1) General (2) Location (3) Managing Messages and Prompts (4) Blinking g. Use of Imaging 32. – 35. [RESERVED] Chapter 6 Organising Electronic Display Information Elements 36. Organising Information Elements a. General b. Types and Arrangement of Display Information (1) Placement - General Information (2) Placement - Controls and Indications (3) Arrangement - Basic T Information (4) Arrangement - Powerplant Information (5) Arrangement - Other Information (For Example, Glideslope and Multi - Function Displays) c. Managing Display Information (1) Window (2) Menu (3) Full - Time vs. Part - Time Display of Information Powered by EASA eRules Page 1387 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) d. Managing Display Configuration (1) Normal Conditions (2) System Failure Conditions (Reconfiguration) e. Methods of Reconfiguration (1) Compacted Format (2) Sensor Selection and Annunciation 37. – 40. [RESERVED] Chapter 7 Electronic Display System Control Devices 41. General a. Multi - function Control Labels b. Multi - function Controls (1) “Hard” Controls (2) “Soft” Controls c. Cursor Control Devices d. Cursor Displays 42. – 45. [RESERVED] Chapter 8 Showing Compliance for Approval of Electronic Display Systems 46. Compliance Considerations (Test and Compliance) a. General b. Means of Compliance 47. – 50. [RESERVED] Chapter 9 Continued Airworthiness and Maintenance 51. Continued Airworthiness and Maintenance a. General b. Design for Maintainability c. Maintenance of Display Characteristics 52. – 60. [RESERVED] List of Appendices 1 Primary Flight Information 1.1 Attitude 1.2 Continued Function of Primary Flight Information (Including Standby) in Conditions of Unusual Attitudes or in Rapid Manoeuvres 2.1 Airspeed and Altitude 2.2 Low and High Speed Awareness Cues 3. Vertical Speed 4. Flight Path Vector or Symbol 2 Powerplant Displays 1. General 2. Design Guidelines 3 Definitions Figure A3 - 1 Primary Field of View Figure A3 - 2 Display Format 4 Acronyms Used in This AMC 5 [RESERVED] 6 Head - Up Displays 1.0 Introduction 1.1 Purpose 1.2 Definition of Head - Up Display (HUD) 1.3 Other Resources Powered by EASA eRules Page 1388 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 2.0 Unique Safety Characteristics 2.1 Aircraft and Systems Safety 2.2 Crew Safety 3.0 Design 3.1 Intended Function of HUDs 3.2 HUD Controls 3.3 Visibility and Field - of - View 4.0 HUD Eyebox Criteria 4.1 Design Eye Position 4.2 Design Eyebox 4.3 Conformal Display Accuracy 4.4 Symbol Positioning Alignment 4.5 Overlapping Symbols 4.6 Alignment 4.7 Visual Display Characteristics 5.0 Guidelines for Presenting Information 5.1 HUD and Head - Down Display (HDD) Compatibility 5.2 Indications and Alerts 5.3 Display Clutter 5.4 Display of Information 6.0 Dual HUDs 6.1 Operational Concept for Dual HUDs 6.2 Flight Crew Awareness of Other Instruments and Indications 6.3 Roles and Responsibilities 6.4 Reassessment 7.0 Flight Data Recording 8.0 Continued Airworthiness 7 Weather Displays 1.0 Introduction 1.1 Purpose 1.2 Examples 2.0 Key Characteristics 2.1 Unambiguous Meanings 2.2 Colour 2.3 Multiple Sources of Weather Information 3.0 On - Board Weather Radar Information 3.1 Background 3.2 Minimum Performance Standards 3.3 Hazard Detection 4.0 Predictive Windshear Information 4.1 General 4.2 Presentation Methods 4.3 Pilot Workload 4.4 Windshear Threat Symbol 4.5 Relative Position to the Aeroplane 4.6 Range 5.0 Safety Aspects 5.1 Functional Hazard Assessment (FHA) 5.2 Misleading Information Powered by EASA eRules Page 1389 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) CHAPTER 1 BACKGROUND 1. What is the purpose of this AMC?

This AMC provides an Acceptable Means of Compliance for demonstrating compliance with certain Certification Specifications of CS - 25, as well as general guidance for the design, installation, integra tion, and approval of electronic flight deck displays, components, and systems installed in large aeroplanes.

Appendix 1 to this AMC provides additional guidance for displaying primary flight information (required by CS 25.1303(b) and CS 25.1333(b) ), and Appendix 2 to this AMC provides additional guidance for powerplant displays.

2. Who does this AMC apply to?

a. The acceptable means of compliance and guidance provided in this document is directed to aeroplane and avionics manufacturers, modifiers, a nd operators of large aeroplanes.

b. This material describes acceptable means, but not the only means, for demonstrating compliance with the applicable certification specifications. The Agency will consider other methods of demonstrating compliance that an applicant may elect to present.

While these guidelines are not mandatory, they are derived from extensive Agency and industry experience in determining compliance with the relevant certification specifications. Applicants for a European Technical Standard Order (ETSO) approval should consider following this AMC when the ETSO does not provide adequate or appropriate specifications.

3. [RESERVED] 4. General This AMC applies to the design, integration, installation, and certification approval of electronic flight deck displays, components, and systems for large aeroplanes. As a minimum this includes: — General airworthiness considerations, — Display system and c omponent characteristics, — Safety and criticality aspects, — Functional characteristics, — Display information characteristics, — Guidance to manage display information, — Flight crew interface and interactivity, and — Airworthiness approval (means of complianc e) considerations.

Table 1, below, lists the topics included in this AMC. Table 2, below, lists the topics not included in this AMC.

Table 1: Topics Covered in this AMC Topics Electronic pi lot displays – including single - function and multi - function displays.

Display features and functions that are intended for use by the pilot.

Display functions not intended for use by the pilot if they may interfere with the pilot’s flying duties.

Display aspects of Class III Electr onic Flight Bag (installed equipment).

Powered by EASA eRules Page 1390 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Controls associated with the electronic displays covered in this A M C. These controls include hard controls (physical buttons and knobs) and soft controls (virtual or programmable buttons and knobs, generally control led through a cursor device or line select keys).

Electronic standby displays.

Head - Up Displays (HUD).

Table 2: Topics Outside this AMC Topics Display functions not intended for use by the pilot.

In flight entertainment displays.

Flight attendant displays.

Maintenance terminals, even if they are in the flight deck, but not intended for use by the pilots.

Head mounted displays used by pilo ts.

Displays in the flight crew rest area.

Handheld or laptop items (not installed equipment).

Class I and Class II Electronic Flight Bags.

Electromechanical instruments.

Auditory “displays” (for example, aural alerts), and tactile “displays” (for example, stick shaker).

Flight controls, throttles, and other (hard) controls not directly associated with the electronic displays.

In addition to this AMC, new AMC 25.1302 published in CS - 25 Amendment 3, provides acceptable means of compliance with certification specifications associated with the design of flight crew interfaces such as displa ys, indications, and controls. AMC 25.1322 provides a means of compliance for flight crew alerting systems. The combination of these AMCs is intended to embody a variety of design characteristics and human - centred design techniques that have wide acceptance, are relevant, and can be reasonably applied to large aeroplane certification projects.

Other advisory material is used to establish guidance for specific functionality and characteristics provided by electronic displays. This AMC is not intended to replace or conflict with these existing AMCs but rather provides a top - level view of flight deck displays. Conflicts between this AMC and other advisory material will be resolved on a case - by - case basis in agreement w ith the Agency.

5. Definitions of Terms Used in this AMC a. For the purposes of this AMC, a “display system” includes not only the display hardware and software components but the entire set of avionic devices implemented to display information to the fli ght crew. Hardware and software components of other systems that affect displays, display functions, or display controls should take into account the display aspects of this AMC. For example, this AMC would be applicable to a display used when setting the barometric correction for the altimeter, even though the barometric set function may be part of another system.

b. For the purposes of this AMC, “foreseeable conditions” means the full environment in which the display or the display system is assumed to op erate, given its intended function. This includes operating in normal, non - normal, and emergency conditions.

c. Definitions of technical terms used in this AMC can be found in Appendix 3 of this AMC.

The acronyms u sed throughout this document are included in Appendix 4 of this AMC.

Powered by EASA eRules Page 1391 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 6. Background a. Electronic displays can present unique opportunities and challenges to the design and certification process. In many cases, t he demonstration of compliance with Certification S pecifications related to the latest flight deck display system capabilities has been subject to a great deal of interpretation by applicants and the Agency. At the time the first electronic displays were d eveloped, they were direct replacements for the conventional electromechanical components. The initial relea se of AMC 25 - 11 established an Acceptable Means of C omplia nce for the approval of Cathode Ray Tube (CRT) - based electronic display systems used for g uidance, control, or decision - making by the flight crews of large aeroplanes. This initial release was appropriate for CRTs, but additional specifications were needed to update AMC 25 - 11 to address new technologies.

Additional appendices have been added to address Head - Up Displays (Appendix 6) and Weather Displays ( Appendix 7 ).

b. The FAA and EASA have established a number of specifications intended to improve aviation safety by requiring that the flight deck design have certain capabilities and characteristics. The approval of flight deck displays and display systems has typically been addressed by invoking many specifications that are specific to certain systems, or to specifications with general applicability such as CS 25.1301(a) , CS 25.771(a) , an d CS 25.1523 . Thus, this AMC provides acceptable means of compliance and guidance related to these and other applicable airworthiness specifications.

7. - 10. [RESERVED] CHAPTER 2 ELECTRONIC DISPLAY SYSTEM OVERVI EW 11. General The following paragraphs provide acceptable means of compliance and guidance that applies to the overall electronic display system. This chapter, together with Chapters 3 through 7 of this AMC, provides compliance objectives and design gui dance. Chapter 8 provides general guidance on how to show compliance for approval of electronic display systems. The material in Chapters 2 through 9 and Appendices 1 and 2 of this AMC constitutes an overall method of compliance for the approval of an elec tronic display system.

a. Design Philosophy.

The applicant should establish, document, and follow a design philosophy for the display system that supports the intended functions ( CS 25.1301 ). The documented desig n philosophy may be included as part of a system description, certification programme, or other document that is submitted to the Agency during a certification project. The design philosophy should include a high level description of: (1) General philosop hy of information presentation – for example, is a “quiet, dark” flight deck philosophy used or is some other approach used?

(2) Colour philosophy on the electronic displays – the meaning and intended interpretation of different colours – for example, does magenta always represent a constraint?

(3) Information management philosophy – for example, when should the pilot take an action to retrieve information or is it brought up automatically? What is the intended interpretation of the location of the informat ion?

Powered by EASA eRules Page 1392 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (4) Interactivity philosophy - for example, when and why is pilot confirmation of actions requested? When is feedback provided?

(5) Redundancy management philosophy – for example, how are single and multiple display failures accommodated? How are powe r supply and data bus failures accommodated?

b. Human Performance Considerations.

The applicant should establish and document the following human performance elements when developing a display system: — Flight crew workload during normal and non - normal operations, including emergencies, — Flight crew training time to become sufficiently fa miliar with using the display, and — The potential for flight crew error.

A high workload or excessive training time may indicate a display design that is difficult to use, requires excessive concentration, or may be prone to flight crew errors.

Compliance considerations are included in Chapter 8 of this AMC.

c. Addressing Intended Function in the Certification Programme The certification programme should identify the appropriate CS - 25 certification specifications. An important part of the certification pro gramme will be the system description(s) and all intended functions, including attitude, altitude, airspeed, engine parameters, horizontal situation display, etc. To demonstrate compliance with CS 25.1301(a) , an applicant must show that the design is appropriate for its intended function. The applicant’s description of intended function needs to be sufficiently specific and detailed for the Agency to be able to evaluate that the system is appropriat e to its intended function. ( CS 25.1302 and associated AMC provide additional information on intended function). General and/or ambiguous intended function descriptions are not acceptable (for example, a function d escribed only as “situation awareness”). Some displays may be intended to be used for situation awareness, but that term needs to be clarified or qualified to explain what type of specific situation awareness will be provided.

More detailed descriptions ma y be warranted for designs that are new, novel, highly integrated, or complex. Many modern displays have multiple functions and applicants should describe each intended function. A system description is one place to document the intended function(s).

Displ ay systems and display components that are not intended for use by the flight crew (such as maintenance displays) should not interfere with the flying duties of the flight crew.

12 - 15. [RESERVED] CHAPTER 3 ELECTRONIC DISPLAY HARDWARE 16. Display Hardwa re Characteristics The following paragraphs provide general guidance and a means of compliance for electronic display hardware with respect to its basic visual, installation, and power bus transient handling characteristics. A more detailed set of display hardware characteristics can be found in the following SAE International (formerly the Society of Automotive Engineers) documents: Powered by EASA eRules Page 1393 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) — For electronic displays – SA E Aerospace Standards (AS) 8034B, ''' Minimum Performance Standard for Airborne Mu ltipurpose Elec tronic Displays'''.

— For head up displays - SAE AS8055, “Minimum Performance Standard for Airborne Head Up Display (HUD)”.

— For liquid crystal displays (LCDs) – SAE Aerospace Recommended Practice (ARP) 4256A, “Design Objectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft”.

NOTE 1: For LCDs, the quantitative criterion in SAE ARP 4256A, paragraph 4.2.6., equation 5, is not considered a reliable predictor of acceptable specular reflectivity characteristics.

Accordingly, this aspect of LCD per formance should be specifically assessed via flight crew evaluation to establish that there are not internal or external reflections that can result in flight crew distraction or erroneous interpretation of displayed information.

NOTE 2: With regard to th e criteria for malfunction indication in SAE ARP 4256A, paragraph 3.4, the Agency has determined that showing the fonts and symbols to be tolerant to the loss of a single column, line, or element is an acceptable alternative to providing a malfunction indi cation. Proposed designs that do not use fonts and symbols that are tolerant to these faults are acceptable if they meet the criteria in SAE ARP 4256A.

NOTE 3: The applicant should notify the Agency if any visual display characteristics do not meet the gu idelines in the applicable SAE documents.

NOTE 4: The most recent revision of the referenced SAE documents should be considered. If there is a conflict between the guidance in an SAE document and AMC 25 - 11, follow the guidance in AMC 25 - 11.

a. Visual Di splay Characteristics The visual display characteristics of a flight deck display are directly linked to their optical characteristics. Display defects (for example, element defects or stroke tails) should not impair readability of the display or create er roneous interpretation. In addition to the information elements and features identified in Chapter 5 of this AMC, and the visual characteristic s in SAE ARP 4256A, SAE AS 8034B, and 8055 described above, the display should meet the criteria for the followin g characteristics. These characteristics are independent of the proposed display technology.

(1) Physical Display Size. A display should be large enough to present information in a form that is usable (for example, readable or identifiable) to the flight crew from the flight crew stationin all foreseeable conditions, relative to the operational and lighting environment and in accordance with its intended function(s).

(2) Resolution and Line Width. The resolution and minimum line width should be sufficient to support all the displayed images such that the displayed information is visible and understandable without misinterpretation from the flight crew station in all foreseeable conditions, relative to the operational and lighting environment.

(3) Luminance. Information should be readable over a wide range of ambient illumination under all foreseeable conditions relative to the operating environment, including but not limited to: — Direct sunlight on the display, — Sunlight through a front window illumi nating white shirts (reflections), Powered by EASA eRules Page 1394 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GE NERAL AMCs (CS - 25) — Sun above the forward horizon and above a cloud deck in a flight crew member’s eyes, and — Night and/or dark environment.

(a) For low ambient conditions, the display should be dimmable to levels allowing for the flight crew’s adaptation to the dark, such that outside vision and an acceptable presentation are maintained.

(b) Automatic luminance adjustment systems can be employed to decrease pilot workload and increase display life. Operation of these systems should be satisfactory over a wide range of ambient light conditions, including the extreme cases of a forward low sun and a quartering rearward sun shining directly on the display.

1. Some manual adjustment should be retained to provide for normal and non - norma l operating differences so that the luminance variation is not distracting and does not interfere with the flight crew’s ability to perform their tasks.

2. Displays or layers of displays with uniformly filled areas conveying information such as weather ra dar imagery should be independently adjustable in luminance from overlaid symbology. The range of luminance control should allow detection of colour differences between adjacent small filled areas no larger than 5 milliradians in principal dimension; while at this setting, overlying map symbology, if present, should be discernible.

(c) Display luminance variation within the entire flight deck should be minimised so that displayed symbols, lines, or characters of equal luminance remain uniform under any lum inance setting and under all foreseeable operating conditions.

(4) Contrast Ratio (a) The display’s contrast ratio should be sufficient to ensure that the information is discernable under the whole ambient illumination range from the flight crew station un der all foreseeable conditions relative to the operating environment.

(b) The contrast between all symbols, characters, lines, and their associated backgrounds should be sufficient to preclude confusion or ambiguity of any necessary information.

(5) Chroma ticity (a) The display chromaticity differences, in conjunction with luminance differences, should be sufficient to allow graphic symbols to be discriminated from each other, from their backgrounds (for example, external scene or image background) and back ground shaded areas, from the flight crew station, in all foreseeable conditions relative to the lighting environment. Raster or video fields (for example, non - vector graphics such as weather radar) should allow the image to be discriminated from overlaid symbols, and should allow the desired graphic symbols to be displayed. See SAE AS 8034A, sections 4.3.3 and 4.3.4, for additional guidance.

Powered by EASA eRules Page 1395 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (b) The display should provide chromaticity stability over the foreseeable conditions relative to the range of opera ting temperatures, viewing envelope, image dynamics, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.

(6) Grey Scale (a) The number of shades of gray and the difference between shades of gray th at the display can provide should be adequate for all image content and its use, and should accommodate all viewing conditions.

(b) The display should provide sufficient gray scale stability over the foreseeable range of operating temperatures, viewing env elope, and dimming range, such that the symbology is understandable and is not misleading, distracting, or confusing.

(7) Display Response. The dynamic response of the display should be sufficient to present discernable and readable information that is not misleading, distracting, or confusing. The response time should be sufficient to ensure dynamic stability of colours, line widths, gray scale, and relative positioning of symbols. Undesirable display characteristics, such as smearing of moving images and loss of luminance, should be minimised so that information is still readable and identifiable under all foreseeable conditions, not distracting, and does not lead to misinterpretation of data.

(8) Display Refresh Rate. The display refresh rate should be s ufficient to prevent flicker effects that result in misleading information or difficulty in readi ng or interpreting information. The display refresh rate should be sufficient to preclude the appearance of unacceptable flicker.

(9) [RESERVED] (10) Display D efects. Display defects, such as element defects and stroke tails, resulting from hardware and graphical imaging causes should not impair readability of the displays or induce or cause erroneous interpretation. This is covered in more detail in SA E ARP 425 6A, SAE AS 8034B , and 8055.

(11) [RESERVED] (12) Flight Deck Viewing Envelope. The size of the viewing envelope should provide visibility of the flight deck displays over the flight crew’s normal range of head motion, and support cross - flight deck viewi ng if necessary; for example, when it is required that the captain be able to view and use the first officer’s primary flight information.

b. Installation (1 ) Flight deck display equipment and installation designs should be compatible with the overall flight deck design characteristics (such as flight deck size and shape, flight crew member position, position of windows, external luminance, etc.) as well as the aeroplane environment (such as temperature, altitude, electromagnetic interference, and vibration).

(2) European Organisation for Civil Aviation Electronics (EUROCAE) ED - 14 Environmental Conditions and Test Procedures for Airborne Equipment, at the latest revision, provides information that may be used for an acceptable means of qualifying display equipment for use in the aeroplane environment.

Powered by EASA eRules Page 1396 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (3) [RESERVED] (4) The installation of the display equipment must not adversely affect its readability and the e xternal scene visibility of the flight crew under all foreseeable conditions relative to the operating and lighting environment ( CS 25.1321(a) , CS 25.773(a)(1) ).

(5) The installation of the display equipment must not cause glare or reflection, either on the displays or on the flight deck windows, that could interfere with the normal duties of the minimum flight crew ( CS 25.773( a)(2) ) under all foreseeable conditions.

(6) If the display system design is dependent on cross - flight deck viewing for its use, the installation should take into account the viewing angle limitations of the display units, the size of the displayed inform ation, and the distance of the display from each flight crew member.

(7) When a display is used to align or overlay symbols with real - world external data (for example, HUD symbols), the display should be installed such that the positioning accuracy of the se symbols is maintained during all phases of flight.

Appendix 6 to this AMC and SAE ARP 5288, Transport Category Aeroplane Head Up Display (HUD) Systems, provides additional details regarding the symbol positioning accuracy for conformal symbology on a n H UD.

(8) The display system components should not cause physical harm to the flight crew under foreseeable conditions relative to the operating environment (for example, turbulence or emergency egress , bird strike, hard landing, and emergency landing ).

(9 ) The installed display must not visually obstruct other controls and instruments or prevent those controls and instruments from performing their intended function ( CS 25.1301 ).

(10) The display system must not b e adversely susceptible to electromagnetic interference from other aeroplane systems ( CS 25.1431 ) under all foreseeable conditions.

(11) The display components should be installed in such a way that they retain m echanical integrity (secured in position) for all foreseeable conditions relative to the flight environment.

(12) Liquid spill on or breakage of a display system component in the flight deck should not result in a hazard.

c. Power Bus Transient. EUROCAE document ED - 14, at the latest revision, provides information that may be used for an acceptable means of qualifying display equipment such that the equipment performs its intended function when subjected to anomalous input power. SAE ARP 4256A, Design Obj ectives for Liquid Crystal Displays for Part 25 (Transport) Aircraft, provides additional information for power transient recovery (specifically for the display unit).

(1) Flight deck displays and display systems should be insensitive to power transients caused by normal load switching operation of the aeroplane, in accordance with their intended function.

(2) The electronic attitude display should not be unusable or unstable for more than one second after electrical bus transients due to engine failure. Only displays on one side of the aeroplane should be affected by an engine failure. Recognisably valid pitch and roll data should be available within one second on the affected Powered by EASA eRules Page 1397 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) displays and any effects lasting beyond one second should not interfere with th e ability to obtain quick glance valid attitude. For most aeroplanes an engine failure after take - off will simultaneously create a roll acceleration, new pitch attitude requirements, and an electrical transient. Attitude information is paramount; if there is an engine failure, transfer to standby attitude or transfer of control of the aeroplane to the other pilot cannot be reliably accomplished in a timely enough manner to prevent an unsafe condition. In testing this failure mode, experience has shown that switching the generator off at the control panel may not result in the longest electrical transient. One practical way to simulate this failure is with a fuel cut which will allow the generator output voltage and frequency to decrease until the bus control recognises the failure. Other engine failure conditions may be more critical (such as sub - idle stalls) which cannot be reasonably evaluated during flight test. Analysis should identify these failure modes and show that the preceding criteria are met.

(3) Non - normal bus transients (for example, generator failure) should not initiate a power up initialisation or cold start process.

(4) The display response to a short term power interrupt (<200 milliseconds) should be such that the intended function of the display is not adversely affected.

(5) Following in - flight long term power interrupts (>200 milliseconds), the display system should quickly return to operation in accordance with its intended function, and should continue to permit the safe control of th e aeroplane in attitude, altitude, airspeed, and direction.

(6) The large electrical loads required to restart some engine types should not affect more than one pilot’s display during the start sequence.

17. – 20. [RESERVED] CHAPTER 4 . SAFETY ASPECTS OF ELECTRONIC DISPLAY SYSTEMS 21. General. This chapter provides additional guidance and interpretative material for applying CS 25.1309 and CS 25.1333(b) to the approval of display systems. Using electronic displays and integrated modular avionics allows designers to integrate systems to a much higher degree than was practical with previous flight deck c omponents. Although operating the aeroplane may become easier as a result of the integration, evaluating the conditions in which the display system could fail and determining the severity of the resulting failure effects may become more complex. The evalua tion of the failure conditions should identify the display function and include all causes that could affect that function’s display and display equipment. CS 25.1309 defines the basic safety specifications for the airworthiness approval of aeroplane systems a. Identification of Failure Conditions. One of the initial steps in establishing compliance with CS 25.1309 is identifying the failure conditions that are associated with a display or a display system. The following paragraphs provide material that may be useful in supporting this initial activity. The analysis of the failure condition should identify the impacted functionality, the effect on the aeroplane and/or its o ccupants, any considerations related to phase of flight, and identify any flight deck indication, flight crew action, or other relevant mitigation means.

(1) The type of display system failure conditions will depend, to a large extent, on the architecture (Integrated Modular Avionics, Federated System, Non - Federated Powered by EASA eRules Page 1398 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) System, etc.), design philosophy, and implementation of the system. Types of failure conditions include: — Loss of function (system or display).

— Failure of display controls – loss of function or malfunction such that controls perform in an inappropriate manner, including erroneous display control.

— Malfunction (system or display) that leads to: — Partial loss of data, or — Erroneous display of data t hat is either: — Detected by the system (for example, flagged or comparator alert), and/or easily detectable by the flight crew; or — Difficult to detect by the flight crew or not detectable and assumed to be correct (for example, “Misleading display of ….”) .

(2) When a flight deck design includes primary and standby displays, consider failure conditions involving the failure of standby displays in combination with the failure of primary displays. The flight crew may use standby instruments in two complement ary roles following the failure of primary displays: (a) Redundant display to cope with failure of main instruments, or (b) Independent third source of information to resolve inconsistencies between primary instruments.

(3) When the display of erroneous information is caused by failure of other systems which interface with the display system, the effects of these failures may not be limited to the display system. Associated failure conditions may be dealt with at the aeroplane level or within the other sy stems’ safety assessment, as appropriate, in order to assess the cumulative effect.

b. Effects of Display Failure Conditions. The effects of display system failure conditions on safe operations are highly dependent on pilot skills, flight deck procedures , phase of flight, type of operations being conducted, and instrument or visual meteorological conditions.

(1) Based on previous aeroplane certification programmes, paragraph 21e of this AMC shows examples of safety objectives for certain failure conditio ns. These safety objectives do not preclude the need for a safety assessment of the actual effects of these failures, which may be more or less severe depending on the design.

Therefore, during the CS 25.1309 safet y assessment process, the Agency will need to agree with the applicant’s hazard classifications for these failure conditions in order for the assessment to be considered valid.

(2) When assessing the effects that result from a display failure, consider th e following, accounting for phases of flight when relevant: — Effects on the flight crew’s ability to control the aeroplane in terms of attitude, speed, accelerations, and flight path, potentially resulting in: — Controlled flight into terrain, — Loss of cont rol of the aeroplane during flight and/or during critical flight phases (approach, take - off, go - around, etc.), Powered by EASA eRules Page 1399 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) — Inadequate performance capability for phase of flight, including: — Loss of obstacle clearance capability, and — Exceeding take - off or landing fie ld length.

— Exceeding the flight envelope, — Exceeding the structural integrity of the aeroplane, and — Causing or contributing to pilot induced oscillations.

— Effects on the flight crew’s ability to control the engines, such as: — Those effects resulting in shutting down a non - failed engine in response to the failure of a different engine, and — Undetected, significant thrust loss.

— Effects on the flight crew’s management of the aeroplane systems.

— Effects on the flight crew’s performance, workload and ability to cope with adverse operating conditions.

— Effects on situation awareness; for example, the specific effects must be identified, such as situation awareness related to navigation or system sta tus.

— Effects on automation if the display is used as a controlling device.

(3) When the display system is used as a control device for other aeroplane systems, consider the cumulative effect of a display system failure on all of the controlled systems.

c. Mitigation of Failure Conditions (1) When determining mitigation means for a failure condition consider the following: — Protection against common mode failures.

— Fault isolation and reconfiguration.

— Redundancy (for example, heading information may be pr ovided by an independent integrated standby and/or a magnetic direction indicator).

— Availability of, level of, timeliness of, and type of, alert provided to the flight crew.

— The flight phase and the aircraft configuration.

— The duration of the condition.

— The aircraft motion cues that may be used by the flight crew for recognition.

— Expected flight crew corrective action on detection of the failure, and/or operational procedures.

— In some flight phases, ability of the flight crew to control the aeroplane after a loss of primary attitude display on one side.

— The flight crew’s ability to turn off a display (for example, full bright display at night).

Powered by EASA eRules Page 1400 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) — Protections provided by other systems (for example, flight envelope protection or augmentation systems).

( 2) The mitigation means should be described in the safety analysis/assessment document or by reference to another document (for example, a system description document). The continued performance of the mitigation means, in the presence of the failure condi tions, should also be identified and assured.

(3) The safety assessment should include the rationale and coverage of any display system protection and monitoring philosophies used in the design. The safety assessment should also include an evaluation of e ach of the identified display system failure conditions and an analysis of the exposure to common mode/cause or cascade failures in accordance with AMC 25.1309 . Additionally, the safety assessment should justify an d describe any functional partitioning schemes employed to reduce the effect of integrated component failures or functional failures.

d. Validation of the Classification of Failure Conditions and Their Effects.

There may be situations where the severity of the effect of the failure condition identified in the safety analysis needs to be confirmed. Laboratory, simulator, or flight test may be appropriate to accomplish the confirmation. The method of validating the failure condition classification will depe nd on the effect of the condition, assumptions made, and any associated risk. If flight crew action is expected to cope with the effect of a failure condition, the information available to the flight crew should be useable for detection of the failure cond ition and to initiate corrective action.

e. System Safety Guidelines (1) Experience from previous certification programmes has shown that a single failure due to a loss or malfunction of the display system, a sensor, or some other dependent system, which causes the misleading display of primary flight information, may have negative safety effects. It is recommended that the display system design and architecture implement monitoring of the primary flight information to reduce the probability of displaying misleading information.

(2) Experience from previous certification programmes has shown that the combined failure of both primary displays with the loss of the standby system can result in failure conditions with catastrophic effects.

(3) When an integra ted standby display is used to provide a backup means of primary flight information, the safety analysis should substantiate that common cause failures have been adequately addressed in the design, including the design of software and complex hardware. In particular, the safety analysis should show that the independence between the primary instruments and the integrated standby instruments is not violated becausethe integrated standby display may interface with a large number of aeroplane components, includ ing power supplies, pitot static ports, and other sensors.

(4) There should be a means to detect the loss of or erroneous display of primary flight information, either as a result of a display system failure or the failure of an associated sensor. When lo ss or malfunction of primary flight information is detected, the means used to indicate the lost or erroneous information should ensure that the erroneous information will not be used by the flight crew (for Powered by EASA eRules Page 1401 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) example, removal of the information from the dis play or placement of an “X” through the failed display).

(5) The means used to indicate the lost or erroneous information, when it is detected, should be independent of the failure mechanism. For example, the processor that originates the erroneous parame ter should not be the same processor that annunciates or removes the erroneous parameter from the display. Common mode failures of identical processor types should be considered (for example, common mode failures may exist in a processor used to compute th e display parameters and an identical processor used for monitoring and annunciating failures.)

(6) A catastrophic failure condition should not result from the failure of a single component, part, or element of a system. Failure containment should be provided by the system design to limit the propagation of the effects of any single failure and preclude catastrophic failure conditions. In addition, there should not be a common cause failure that could affect both the single component, part, or element and its failure containment provisions.

(7) For safety - critical display parameters, there should be a me ans to verify the correctness of sensor input data. Range, staleness, and validity checks should be used where possible.

(8) The latency period induced by the display system, particularly for alerts, should not be excessive and should take into account th e criticality of the alert and the required crew response time to minimise propagation of the failure condition.

(9) For those systems that integrate windowing architecture into the display system, a means should be provided to control the information show n on the displays, such that the integrity of the display system as a whole will not be adversely impacted by anomalies in the functions being integrated. This means of controlling the display of information, called window manager in this AMC, should be de veloped to the software assurance level at least as high as the highest integrity function of any window. For example, a window manager should be level “A” if the information displayed in any window is level “A” (see AMC 20 - 115 Software Considerations for Airborne Systems and Equipment Certification ). SAE ARP 4754A/EUROCAE ED - 79A, Guidelines for development of civil aircraft and systems, provides a recommended practice for system development assurance.

(10) System Safety Assessment Guidelines.The complete set of failure conditions to be considered in the display system safety analysis and the associated safety objective are established during the system safety assessment, and agreed upon by the applicant and the approving civil airworthiness agency. The sa fety assessment should consider the full set of display system intended functions as well as display system architecture and design philosophy (for example, failure modes, failure detection and annunciation, redundancy management, system and component inde pendence and isolation). The system safety analysis is required by CS 25.1309 , and indirectly by other specifications, including CS 25.901 , CS 25.903 , and CS 25.1333 .

The following tables provide examples of failure conditions and associated safety objectives common to numerous display systems that are already c ertified. These tables are provided to identify a set of failure conditions that need to be considered; however, these are only examples. These examples do not replace the need for a system safety Powered by EASA eRules Page 1402 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) assessment and are not an exhaustive list of failure condit ions. For these example failure conditions, additional functional capabilities or less operational mitigation may result in higher safety objectives, while reduced functional capability or increase operational mitigation may result in lower safety objectiv es.

1 Attitude (Pitch and Roll). The following table lists examples of safety objectives for attitude related failure conditions.

Table 3 Example Safety Objectives for Attitude Failure Conditions Failure Condition Safety Objective Loss of all attitud e displays, including standby display Extremely Improbable Loss of all primary attitude displays Remote - Extremely Remote Display of misleading attitude information on both primary displays Extremely Improbable Display of misleading attitude information on one primary display Extremely Remote Display of misleading attitude information on the standby display Remote Display of misleading attitude information on one primary display Extremely Improbable combined with a standby fail ure (loss of attitude or incorrect attitude) Notes (1) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reductio n in safety margins to warrant a hazardous classification.

(2) Consistent with the “Loss of all attitude display, including standby display” safety objective, since the flight crew may not be able to identify the correct display. Consideration will be giv en to the ability of the flight crew to control the aeroplane after a loss of attitude primary display on one side in some flight phases (for example, during take - off).

2 Airspeed. The following table lists examples of safety objectives for airspeed rel ated failure conditions.

Table 4 Example Safety Objectives for Airspeed Failure Conditions Failure Condition Safety Objective Loss of all airspeed displays, including standby display Extremely Improbable Loss of all primary airspeed displays Remote - Extremely Remote Display of misleading airspeed information on both primary displays, Extremely Improbable coupled with loss of stall warning or loss of over - speed warning Display of misleading airspeed i nformation of the standby display Remote (primary airspeed still available) Display of misleading airspeed information on one primary display Extremely Improbable combined with a standby failure (loss of airspeed or incorrect airspeed) Notes (1) Syst em architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2) Consistent with the “Loss of all airspeed display, including standby display” safety objective, since the flight crew may not be able to separate out the correct display.

3 Barometric Altitude. The following table lists examples of safety objectives for barometric altitude related failure conditions.

Powered by EASA eRules Page 1403 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Table 5 Example Safety Objectives for Barometric Altitude Failure Conditions Failure Condition Safety Objective Loss of all barometric altitude displays, including standby display Extremely Improbable Loss of all barometric altitude primary displays Remote - Extremely Remote Display of misleading barometric altitude information on both primary Extremely Improbab le displays Display of misleading barometric altitude information on the standby Remote display (primary barometric altitude still available) Display of misleading barometric altitude information on one primary Extremely Improbable display combined with a standby failure (loss of altitude or incorrect altitude) Notes (1) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classification.

(2) Consistent with the “Loss of all barometric altitude display, including standby display” safety objective since the flight crew may not be able to separate out the correct display.

Consideration should be given that barometric setting function design is co mmensurate with the safety objectives identified for barometric altitude.

4 Heading. The following table lists examples of safety objectives for heading related failure conditions.

(aa) The standby heading may be provided by an independent integrated s tandby or the magnetic direction indicator.

(bb) The safety objectives listed below can be alleviated if it can be demonstrated that track information is available and correct.

Table 6 Example Safety Objectives for Heading Failure Conditions Failure Cond ition Safety Objective Loss of heading on the flight deck on both pilots' primary displays Remote Loss of all heading displays on the flight deck Extremely Improbable Display of misleading heading information on both pilots' primary Remote - Extremely Remote2) displays Display of misleading heading information on one primary display Remote – Extre mely Remote2) combined with a standby failure (loss of heading or incorrect heading) Notes (1) System architecture and functional integration should be considered in determining the classification within this range. This failure may result in a sufficiently large reduction in safety margins to warrant a hazardous classificat ion.

(2) This assumes the availability o f an independent, heading required by CS 25.1303(a)(3) .

5 Navigation and Communication (Excluding Heading, Airspeed, and Clock Data). The following table lists examples o f safety objectives for navigation and communication related failure conditions.

Powered by EASA eRules Page 1404 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Table 7 Example Safety Objectives for Certain Navigation and Communication Failure Conditions Failure Condition Safety Objective Loss of display of all navigation information Remote Non - restorable loss of display of all navigation information coupled with Extremely Improbable a total loss of communication functions Display of misleading navigation information simultaneously to both Remote – Extremely Remote pilots Loss of all co mmunication functions Remote Note (1) “All” means loss of all navigation information, excluding heading, airspeed, and clock data. If any or all of the latter information is also lost then a higher classification may be warranted.

6 Other Parameters (Typically Shown on Electronic Display Systems). The following table lists examples of safety objectives for failure conditions related to other parameters typically shown on electronic display systems.

Table 8 Example Safety Objectives for Failure Conditi ons of Other Parameters Failure Condition Safety Objective Display of misleading flight path vector information to one pilot Remote Loss of all vertical speed displays Remote Display of misleading vertical speed information to both pilots Remote Loss of all slip/skid indication displays Remote Display of misleading slip/skid indication to both pilots Remote Display of misleading weather radar information Remote Total loss of flight crew alerting displays Remote Display of misleading flight crew alerting information Remote Display of misleading flight crew procedures Remote – Extremely Improbable Loss of the standby displays Remote Notes (1) The safety objective may be more stringent depending on the use and on the phase of flight (2) Applicable to the display part of the system only.

(3) See also AMC 25.1322 .

(4) To be evaluated depending on the particula r proced ures and associated situations.

7 Engine. Table 9, below, lists examples of generally accepted safety objectives for engine related failure conditions. Appendix 2 of this AMC provides additional guidance for powerplant displays.

(aa) The term “required engine indications” refers specifically to the engine thrust/power setting parameter (for example, engine pressure ratio, fan speed, or torque) and any other engine indications that may be required by the flight crew to maintain the engine within safe operating limits (for example, rotor speeds or exhaust gas temperature).

(bb) The information in Table 9 is based on the premise that the display failure occurs while operating in an autonomous engine control mode.

Autonomous engine control modes, such as those provided by full authority Powered by EASA eRules Page 1405 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) digital engine controls, protect continued sa fe operation of the engine at any thrust lever setting. Hence, the flight deck indications and associated flight crew actions are not the primary means of protecting safe engine operation.

(cc) Where the indications serve as the primary means of assuring continued safe engine operation, the hazard classification may be more severe. For example, under the table entry “Loss of one or more required engine indications on more than one engine,” the hazard classification would change to “Catastrophic” and the p robability would change to “Extremely Improbable.” (dd) Each of the general failure condition descriptions provided in Table 9 represents a set of more specific failure conditions. The hazard classifications and probabilities provided in Table 9 represent the most severe outcome typically associated with any failure condition within the set. If considered separately, some of the specific failure conditions within each set would likely have less severe hazard classifications and probabilities.

Table 9 Exam ple Safety Objectives for Engine Failure Conditions Failure Condition Safety Objective Loss of one or more required engine indications for a single engine Remote Misleading display of one or more required engine indications for a Remote single engine Loss of one or more required engine indications for more than one Remote - Extremely Remote engine Misleading display of any required engine indications for more than one Extremely Remote - Extremely engine Improbable Notes (1) The worst anticipated outcomes associated with this class of failure may often be driven by consideration of the simultaneous loss of all required engine indications. In any case, those outcomes will typically include both a high speed take - off abort and l oss of the backup means to assure safe engine operations. High speed aborts have typically been classified as “hazardous” by the Agency due to the associated impacts on both flight crew workload and safety margins. Since any number of single failures or er rors can defeat the protections of a typical autonomous engine control, losing the ability to backup the control is considered a sufficiently large reduction in the safety margins to also warrant a “hazardous” classification.

Hence the “Extremely Remote” d esign guideline was chosen.

(2) If the power setting parameter is indicating higher than actual during take - off, this can lead directly to a catastrophe, either due to a high speed runway overrun or impacting an obstacle after take - off. This classificatio n has been debated and sustained by the Agency numerous times in the past. Hence the “Extremely Improbable” probability is listed.

8 Use of Display Systems as Controls. Hazard classifications and safety objectives are not provided for display systems use d as controls because the failure conditions are dependant on the functions and systems being controlled or on alternative means of control. The use of display systems as controls is described in Chapter 7 of this AMC. The following table lists the failure conditions when display systems are used as controls.

Table 10 Failure Conditions for Display Systems Used as Controls Powered by EASA eRules Page 1406 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Failure Condition Safety Objective Total loss of capability to use the display system as a control Depends on system being control led.

Undetected erroneous input from the display system as a control Depends on system being controlled.

22. – 30. [RESERVED] CHAPTER 5 ELECTRONIC DISPLAY INFORMATION ELEMENTS AND FEATURES 31. Display Information Elements and Features. This chapter provides guidance for the display of information elements including text, labels, symbols, graphics, and other depictions (such as schematics) in isolation and in combination. It covers the design and format of these information elements within a given display area. Chapter 6 of this AMC covers the integration of information across several display areas in the flight deck, including guidance on flight deck information location, display arrangement, win dowing, redundancy management, and failure management.

a. General (1) The following list provides objectives for each display information element, in accordance with its intended function: — Each flight, navigation, and powerplant instrument for use by any pilot must be plainly visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path ( CS 25.1321(a) ).

— The displa yed information should be easily and clearly discernable, and have enough visual contrast for the pilot to see and interpret it. Overall, the display should allow the pilot to identify and discriminate the information without eyestrain. Refer to paragraph 16a(4) of this AMC for additional guidance regarding contrast ratio.

— For all display configurations, all foreseeable conditions relative to lighting should be considered. Foreseeable lighting considerations should include failure modes such as lighting and power system failure, the full range of flight deck lighting and display system lighting options, and the operational environment (for example, day and night operations). If a visual indicator is provided to indicate a malfunction of an instru ment, it must be effective under all foreseeable lighting conditions ( CS 25.1321(e) ).

— Information elements (text, symbol, etc.) should be large enough for the pilot to see and interpret in all foreseeable conditio ns relative to the operating environment and from the flight crew station. If two or more pilots need to view the information, the information elements should also be discernable and interpretable over these viewing distances.

— The pilots should have a cle ar, unobstructed, and undistorted view of the displayed information.

— Information elements should be distinct and permit the pilots to immediately recognise the source of the information elements when there are multiple sources of the same kind of informat ion. For example, if there are multiple sources for vertical guidance information, then each informational element should be distinct so the flight crew can immediately recognise the source of the vertical guidance.

Powered by EASA eRules Page 1407 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (2) Factors to consider when designing and evaluating the viewability and readability of the displayed information include: — Position of displayed information: Distance from the design eye position (DEP) is generally used. If cross - flight deck viewing of the information is needed, distance from the offside DEP, accounting for normal head movement, should be used. For displays not mounted on the front panel, the distance determination should include any expected movement away from the DEP by the flight crew.

— Vibrations: Readability should be main tained in adverse conditions, such as vibration. One possible cause of vibration is sustained engine imbalance.

AMC 25 - 24 , Sustained Engine Imbalance, provides readability guidance for that condition.

— Visual Angle s: Account for both the position of the displayed information as well as font height. SAE ARP 4102/7, Electronic Displays, provides additional information on this subject.

— Readability of Display Information: The Illuminating Engineering Society classifies three main parameters that affect readability: luminance, size, and contrast. Size is the combination of font size and distance from the display.

b. Consistency. Display information should be presented so it is consistent with the flight deck design phil osophy in terms of symbology, location, control, behaviour, size, shape, colour, labels, dynamics and alerts. Consistency also applies to the representation of information on multiple displays on the same flight deck. Display information representing the s ame thing on more than one display on the same flight deck should be consistent. Acronyms and labels should be used consistently, and messages/annunciations should contain text in a consistent way. Inconsistencies should be evaluated to ensure that they ar e not susceptible to confusion or errors, and do not adversely impact the intended function of the system(s) involved.

c. Display Information Elements (1) Text.Text should be shown to be distinct and meaningful for the information presented. Messages shou ld convey the meaning intended. Abbreviations and acronyms should be clear and consistent with established standards. For example, International Civil Aviation Organization (ICAO) document 8400, Procedures for Air Navigation Services ICAO Abbreviations and Codes, provides internationally recognised standard abbreviations and airport identifiers.

(a) Regardless of the font type, size, colour, and background, text should be readable in all foreseeable lighting and operating conditions from the flight crew st ation ( CS 25.1321(a) ). General guidelines for text are as follows: — Standard grammatical use of upper and lower case letters is recommended for lengthy documentation and lengthy messages.

Using this format is also helpful when the structure of the text is in sentence form.

— The use of only upper case letters for text labels is acceptable.

— Break lines of text only at spaces or other natural delimiters.

— Avoid abbreviations and acronyms where practical.

Powered by EASA eRules Page 1408 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) — SAE ARP 4102 /7, Electronic Displays, provides guidelines on font sizes that are generally acceptable.

(b) The choice of font also affects readability. The following guidelines apply: — To facilitate readability, the font chosen should be compatible with the display technology. For example, serif fonts may become distorted on some low pixel resolution displays. However, on displays where serif fonts have been found acceptable, they have b een found to be useful for depicting full sentences or larger text strings.

— Sans serif fonts (for example, Futura or Helvetica) are recommended for displays viewed under extreme lighting conditions.

(2) Labels. Labels may be text or icons. The following paragraphs provide guidance on labelling items such as knobs, buttons, symbols, and menus. This guidance applies to labels that are on a display, label a display, or label a display control.

CS 25.1555(a) requires that each flight deck control, other than controls whose function is obvious, must be plainly marked as to its function and method of operation. Controls whose functions are not obvious should be marked or identified so that a flight crew member with littl e or no familiarity with the aeroplane is able to rapidly, accurately, and consistently identify their functions.

(a) Text and icons should be shown to be distinct and meaningful for the function(s) they label. Standard or non - ambiguous symbols, abbreviat ions, and nomenclature should be used; for example, in order to be distinct from barometric altitude, any displayed altitude that is geometrically derived should be labelled “GSL.” (b) If a control performs more than one function the labels should include all intended functions, unless the function of the control is obvious. Labels of graphical controls accessed via a cursor control device should be included on the graphical display.

(c) The following are guidelines and recommendations for labels: — Data fi elds should be uniquely identified either with the unit of measurement or a descriptive label. However, some basic “T” instruments have been found to be acceptable without units of measurement.

— Labels should be consistent with related labels located elsew here in the flight deck.

— When a control or indication occurs in multiple places (for example, a “Return” control on multiple pages of a flight management function), the label should be consistent across all occurrences.

(d) Labels should be placed such that: — The spatial relationships between labels and the objects they reference are clear.

— Labels for display controls are on or adjacent to the controls they identify.

— Labels for display controls are not obstructed by the asso ciated controls.

Powered by EASA eRules Page 1409 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) — Labels are oriented to facilitate readability. For example, the labels continuously maintain an upright orientation or align with an associated symbol such as a runway or airway.

— On multi - function displays, a label should be used to indic ate the active function(s), unless its function is obvious. When the function is no longer active or being displayed, the label should be removed unless another means of showing availability of that function is used.

For example, greying out an inactive me nu button.

(e) When using icons instead of text labels, only brief exposure to the icon should be needed in order for the flight crew to determine the function and method of operation of a control. The use of icons should not cause flight crew confusion.

(3) Symbols (a) Electronic display symbol appearance and dynamics should be designed to enhance flight crew comprehension and retention, and minimise flight crew workload and errors in accordance with the intended function. The following list provides gui dance for symbol appearance and dynamics: — Symbols should be positioned with sufficient accuracy to avoid interpretation errors or significantly increase interpretation time.

— Each symbol used should be identifiable and distinguishable from other related s ymbols.

— The shape, dynamics, and other symbol characteristics representing the same function on more than one display on the same flight deck should be consistent.

— Symbol modifiers used to convey multiple levels of information should follow depiction rul es clearly stated by the applicant. Symbol modifiers are changes to easily recognised baseline symbols such as colours, fill, and borders.

— Symbols that represent physical objects (for example, navigational aids and traffic) should not be misleading as to the object’s physical characteristics (including position, size, envelope, and orientation).

(b) Within the flight deck, avoid using the same symbol for different purposes, unless it can be shown that there is no potential for misinterpretation errors or i ncreases in flight crew training times.

(c) It is recommended that standardised symbols be used. The symbols in the following SAE documents have been found to be acceptable for compliance with the regulations: — SAE ARP 4102/7, Electronic Displays, Appendi ces A through C (for primary flight, navigation, and powerplant displays); — SAE ARP 5289 A , Electronic Aeronautical Symbols, (for depiction of navigation symbology); and — SAE ARP 5288, Transport Category Aeroplane Head Up DisplayD) Systems, (for HUD symbology).

Powered by EASA eRules Page 1410 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (4) Indications.The following paragraphs provide guidanceon numeric readouts, gauges, scales, tapes and graphical depictions such as schematics. Graphics related to interactivity are discussed in paragraph 31e of this chapter and Chapter 7 of this AMC. Graphics and display indications should: — Be readily understood and compatible with other graphics and indications in the flight deck.

— Be identifiable and readily dis tinguishable.

— Follow the guidance for viewability presented in paragraphs 31a, 31b, 31c(1), and 31c(2) of this chapter.

(a) Numeric Readouts. Numeric readouts include displays that emulate rotating drum readouts where the numbers scroll, as well as displ ays where the digit locations stay fixed.

1 Data accuracy of the numeric readout should be sufficient for the intended function and to avoid inappropriate flight crew response.

The number of significant digits should be appropriate to the data accuracy. Leading zeroes should not be displayed unless convention dictates otherwise (for example, heading and track). As the digits change or scroll, there should not be any confusing motion effects such that the apparent motion does not match the actual trend.

2 When a numeric readout is not associated with any scale, tape, or pointer, it may be difficult for pilots to determine the margin relative to targets or limits, or compare between numeric parameters. A scale, dial, or tape may be needed to accomplish the intended flight crew task.

3 For North, numeric readouts of heading should indicate 360, as opposed to 000.

(b) Scales, Dials, and Tapes. Scales, dials, and tapes with fixed and/or moving pointers have been shown to effectively improve flight crew inte rpretation of numeric data.

1 The displayed range should be sufficient to perform the intended function. If the entire operational range is not shown at any given time, the transition to the other portions of the range should not be distracting or confus ing.

2 Scale resolution should be sufficient to perform the intended task.

Scales may be used without an associated numeric readout if alone they provide sufficient accuracy for the intended function. When numeric readouts are used in conjunction with sc ales, they should be located close enough to the scale to ensure proper association, yet not detract from the interpretation of the graphic or the readout.

3 Delimiters, such as tick marks, should allow rapid interpretation without adding unnecessary clu tter. Markings and labels should be positioned such that their meaning is clear yet they do not hinder interpretation. Pointers and indexes should not obscure the scales or delimiters such that they can no longer be interpreted. Pointers and indexes should be positioned with sufficient accuracy for their Powered by EASA eRules Page 1411 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) intended function. Accuracy includes effects due to data resolution, latency, graphical positioning, etc.

(c) Other Graphical Depictions. Depictions include schematics, synoptics, and other graphics such a s attitude indications, moving maps, and vertical situation displays.

1 To avoid visual clutter, graphic elements should be included only if they add useful information content, reduce flight crew access or interpretation time, or decrease the probabilit y of interpretation error.

2 To the extent it is practical and necessary, the graphic orientation and the flight crew’s frame of reference should be correlated. For example, left indications should be on the left side of the graphic and higher altitudes should be shown above lower altitudes.

3 If there are multiple depictions, such as “thumbnail” or overlaid depictions, the orientation (for example, heading up, track up, North up, etc.) should be the same for each depiction. This does not apply to other systems where the captain and first officer may select different presentations of the same information and are used exclusively by that flight crew member.

4 Graphics that include 3 - Dimensional effects, such as raised buttons or the aeroplane flight pat h in a perspective view, should ensure that the symbol elements used to achieve these effects will not be incorrectly interpreted.

(5) Colour Coding (a) If colour is used for coding at least one other distinctive coding parameter should be used (for example, size, shape, location, etc.). Normal aging of the eye can reduce the ability to sharply focus on red objects, or discriminate blue from green. For pil ots with such a deficiency, display interpretation workload may be unacceptably increased unless symbology is coded in more dimensions than colour alone. However, the use of colour alone for coding information has been shown to be acceptable in some cases, such as weather radar and terrain depiction on the lateral view of the navigation display.

(b) To ensure correct information transfer, the consistent use and standardisation of colour is highly desirable. In order to avoid confusion or interpretation err or, there should not be a change in how the colour is perceived over all foreseeable conditions. Colours used for one purpose in one information set should not be used for an incompatible purpose that could create a misunderstanding within another informat ion set. In particular, consistent use and standardisation for red and amber or yellow, per CS 25.1322 , is required to retain the effectiveness of flight crew alerts. A common application is the progression from gr een to amber to red, representing increasing degrees of threat, potential hazard, safety criticality, or need for flight crew awareness or response. Inconsistencies in the use of colour should be evaluated to ensure that they are not susceptible to confusi on or errors, and do not adversely impact the intended function of the system(s) involved.

Powered by EASA eRules Page 1412 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (c) If colour is used for coding it is considered good practice to use six colours or less for coding parameters. Each coded colour should have sufficient chrominan ce separation so it is identifiable and distinguishable in all foreseeable lighting and operating conditions and when used with other colours. Colours should be identifiable and distinguishable across the range of information element size, shape, and movem ent. The colours available for coding from an electronic display system should be carefully selected to maximise their chrominance separation. Colour combinations that are similar in luminance should be avoided (for example, Navy blue on black or yellow on white).

(d) Other graphic depictions such as terrain maps and synthetic vision presentations may use more than six colours and use colour blending techniques to represent colours in the outside world or to emphasize terrain features. These displays are o ften presented as background imagery and the colours used in the displays should not interfere with the flight crew interpretation of overlaid information parameters as addressed in paragraph 31c(5)(e)1 of this chapter.

(e) The following table depicts pre viously accepted colour coding and the functional meaning associated with each colour. The use of these colours is recommended for electronic display systems with colour displays. (Note: Some of these colours may be mandatory under CS - 25).

Table 11 Recomm ended Colours for Certain Features Feature Colour Warnings Red Flight envelope and system limits, exceedances Red or Yellow/Amber as appropriate (see above) Cautions, non - normal sources Yellow/Amber Scales, dials, tapes, and associated information elements White Earth Tan/Brown Sky Blue/Cyan Engaged Modes/Normal Conditions Green Instrument landing system deviation pointer Magenta Divisor lines, units and labels for inactive soft buttons Light Gray Note (1) Use of the colour green for tape elements (for example airspeed and altitude) has also been found acceptable if the colour green does not adversely affect flight crew alerting.

(f) The following table depicts display features that should be allocated a c olour from either Colour Set 1 or Colour Set 2.

Table 12 Recommended Colour Sets for Certain Display Features Display Feature Colour Set 1 Colour Set 2 Fixed reference symbols White Yellow Current data, values White Green Armed modes White Cyan Selected data, values Green Cyan Selected heading Magenta Cyan Powered by EASA eRules Page 1413 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Active route/flight plan Magenta White Notes (1) Use of the colour yellow for functions other than flight crew alerting should be limited and should not adversely affect flight crew alerting.

(2) In Colour Set 1, magenta is intended to be associated with those analogue parameters that constitute “fly to ” or “keep centred” type information.

(g) Colour Pairs.For further information on this subject , see the FAA report No DOT/FAA/CT - 03/05 HF - STD - 001, Human Factors Design Standard (HFDS): For Acquisition of Commercial Off - the - Shelf Subsystems, Non - Developme ntal Items, and Developmental Systems.

(h) When background colour is used (for example, grey), it should not impair the use of the overlaid information elements. Labels, display - based controls, menus, symbols, and graphics should all remain identifiable an d distinguishable. The use of background colour should conform to the overall flight deck philosophies for colour usage and information management. If texturing is used to create a background, it should not result in loss of readability of the symbols over laid on it, nor should it increase visual clutter or pilot information access time. Transparency is a means of seeing a background information element through a foreground one – the use of transparency should be minimised because it may increase pilot inte rpretation time or errors.

(i) Requiring the flight crew to discriminate between shades of the same colour for distinct meaning is not recommended. The use of pure blue should not be used for important information because it has low luminance on many disp lay technologies (for example, CRT and LCD).

(j) Any foreseeable change in symbol size should ensure correct colour interpretation; for example, the symbol needs to be sufficiently large so the pilot can interpret the correct colour.

d. Dynamic (Graphic) Information Elements on a Display (1) General. The following paragraphs cover the motion of graphic information elements on a display, such as the indices on a tape display.Graphic objects that translate or rotate should do so smoothly without di stracting or objectionable jitter, jerkiness, or ratcheting effects. Data update rates for information elements used in direct aeroplane or powerplant manual control tasks (such as attitude, engine parameters, etc.) equal to or greater than 15 Hertz have b een found to be acceptable. Any lag introduced by the display system should be consistent with the aeroplane control task associated with that parameter. In particular, display system lag (including the sensor) for attitude which does not exceed a first or der equivalent time constant of 100 milliseconds for aeroplanes with conventional control system response is generally acceptable.

(2) Movement of display information elements should not blur, shimmer, or produce unintended dynamic effects such that the i mage becomes distracting or difficult to interpret. Filtering or coasting of data intended to smooth the motion of display elements should not introduce significant positioning errors or create system lag that makes it difficult to perform the intended tas k.

Powered by EASA eRules Page 1414 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (3) When a symbol reaches the limit of its allowed range of motion, the symbol should either slide from view, change visual characteristics, or be self - evident that further deflection is impossible.

(4) Dynamic information should not appreciably chang e shape or colour as it moves.

Objects that change sizes (for example, as the map range changes) should not cause confusion as to their meaning and should remain consistent throughout their size range. At all sizes the objects should meet the guidance of t his chapter as applicable (that is, the objects should be discernable, legible, identifiable, placed accurately, not distracting, etc.).

e. Sharing Information on a Display. There are three primary methods of sharing information on a given display. First, the information may be overlaid or combined, such as when traffic alert and collision avoidance system (TCAS) information is overlaid on a map display. Second, the information can be time shared so that the pilot toggles between functions, one at a time. Third, the information may be displayed in separate physical areas or windows that are concurrently displayed. Regardless of the method of information sharing, care should be taken to ensure that information that is out prioritised, but is needed, can be r ecovered, and that it will not be needed more quickly than it can be recovered.

(1) Overlays and Combined Information Elements. The following guidelines apply: — When information is graphically overlaid over other information (for example, an aeroplane symbol over a waypoint symbol) in the same location on a display, the loss of information availability, information access times, and potential for confusion should be minimised.

— When information obscures other information it should be shown that the obscured information is either not needed when it is obscured or can be rapidly recovered. Needed information should not be obscured. This may be accomplished by protect ing certain areas of the display.

— If information is integrated with other information on a display, the projection, the placement accuracy, the directional orientation and the display data ranges should all be consistent (for example, when traffic or weat her is integrated with navigation information). When information elements temporarily obscure other information (for example, pop - up menus or windows), the resultant loss of information should not cause a hazard in accordance with the obscured information’ s intended function.

(2) Time Sharing.The following guidelines apply: — Guidance on Full - time vs. Part - time Displays (see paragraph 36c(3) of this AMC).

— Any information that should or must be continuously monitored by the flight crew should be displayed a t all times (for example, attitude).

— Whether or not information may be time shared depends on how easily it can be retrieved in normal, non - normal, and emergency operations.

Information for a given performance monitoring task may be time shared if the met hod of switching back and forth does not jeopardise the performance monitoring task.

Powered by EASA eRules Page 1415 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AM Cs (CS - 25) — Generally, system information, planning, and other information not necessary for the pilot tasks can be time shared.

(3) Separating Information Visually.When different i nformation elements are adjacent to each other on a display, the elements should be separated visually so the pilots can easily distinguish between them. Visual separation can be achieved with, for example, spacing, delimiters, or shading in accordance wit h the overall flight deck information management philosophy. Required information presented in reversionary or compacted display modes following a display failure should still be uncluttered and still allow acceptable information access time.

(4) Clutter a nd De - Clutter (a) A cluttered display presents an excessive number or variety of symbols, colours, and/or other unnecessary information and, depending on the situation, may interfere with the flight task or operation. A cluttered display causes increased f light crew processing time for display interpretation, and may detract from the interpretation of information necessary to navigate and fly the aeroplane. Information should be displayed so that clutter is minimised.

(b) To enhance pilot performance a mean s should be considered to de - clutter the display. For example, an attitude indicator may automatically de - clutter when the aeroplane is at an unusual attitude to aid the pilot in recovery from the unusual attitude by removing unnecessary information and re taining information required for the flight crew to recover the aeroplane. Failure messages, flags, or comparative monitoring alerts related to the information required to be indicated by CS 25.1303 should not be r emoved from the main primary flight display by decluttering the display, as long as the associated indication is maintained on the primary flight display.

f. Annunciations and Indications (1) General. Annunciations and indications include annunciator switc hes, messages, prompts, flags, and status or mode indications which are either on the flight deck display itself or control a flight deck display. Reference: CS 25.1322 and the associated AMC for information regard ing specific annunciations and indications such as warning, caution, and advisory level alerts.

(a) Annunciations and indications should be operationally relevant and limited to minimise the adverse effects on flight crew workload.

(b) Annunciations an d indications should be clear, unambiguous, timely, and consistent with the flight deck design philosophy. When an annunciation is provided for the status or mode of a system, it is recommended that the annunciation indicate the actual state of the system and not just the position or selection of a switch. Annunciations should only be indicated while the condition exists.

(2) Location.Annunciations and indications should be consistently located in a specific area of the electronic display. Annunciations th at may require immediate flight crew awareness should be located in the flight crew’s forward/primary field of view.

Powered by EASA eRules Page 1416 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (3) Managing Messages and Prompts (a) The following general guidance applies to all messages and prompts: — When messages are currently being displayed and there are additional messages in the queue that are not currently displayed, there should be an indication that the additional messages exi st.

— Within levels of urgency, messages should be displayed in logical order. In many cases the order of occurrence of events has been found to be the most logical way to place the messages in order.

— See CS 25.132 2 and AMC 25.1322 for information on warning, caution, and advisory alerts.

(4) Blinking. Blinking information elements such as readouts or pointers are effective methods of annunciation. However, the use of blin king should be limited because it can be distracting and excessive use reduces the attention getting effectiveness.

Blinking rates between 0.8 and 4.0 Hertz should be used, depending on the display technology and the compromise between urgency and distract ion. If blinking of an information element can occur for more than approximately 10 seconds, a means to cancel the blinking should be provided.

g. Use of Imaging. This paragraph provides guidance on the use of images which depict a specific portion of th e aeroplane environment. These images may be static or continuously updated. Imaging includes weather radar returns, terrain depictions, forecast weather maps, video, enhanced vision displays, and synthetic vision displays.

Images may be generated from dat abases or by sensors.

(1) Images should be of sufficient size and include sufficient detail to meet the intended function. The pilots should be able to readily distinguish the features depicted. Images should be oriented in such a way that their presentation is easily interpreted. All images, but especially dynamic images, should be located or controllable so they do not distract the pilots from required tasks. The source and intended function of the image and the level of operational approval for using the image should be provided to the pilots. This can be accomplished using the aeroplane flight manual, image location, adequate labelling, distinct texturing, or other means.

(2) Image distortion should not compromise image interpretation. Images meant to provide information about d epth (for example, 3 - Dimensional type perspective displays) should provide adequate depth information to meet the intended function.

(3) Dynamic images should meet the guidance in paragraph 31d of this chapter, above.

The overall system lag time of a dyna mic image relative to real time should not cause flight crew misinterpretation or lead to a potentially hazardous condition.

Image failure, freezing, coasting or colour changes should not be misleading and should be considered during the safety analysis.

(4) When overlaying coded information elements over images, the information elements should be readily identifiable and distinguishable for all foreseeable conditions of the underlying image and range of motion. The information elements should not obscure necessary information contained in the image. The information should be depicted with the appropriate size, shape, and placement accuracy to Powered by EASA eRules Page 1417 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) avoid being misleading. They should retain and maintain their shape, size, and colour for all foreseeable condition s of the underlying image and range of motion.

(5) When fusing or overlaying multiple images, the resultant combined image should meet its intended function despite any differences in image quality, projection, data update rates, sensitivity to sunlight, data latency, or sensor alignment algorithms. When conforming an image to the outside world, such as on a HUD, the image should not obscure or significantly hinder the flight crew’s ability to detect real world objects. An independent brightness control of the image may help satisfy this guideline. Image elements that correlate or highlight real world objects should be sufficiently coincident to avoid interpretation error or significantly increase interpretation time.

32. – 35. [RESERVED] CHAPTER 6 ORGAN ISING ELECTRONIC DISPLAY INFORMATION ELEMENTS 36. Organising Information Elements a. General. This chapter provides guidance for integrating information into the flight deck related to managing the location of information, arranging the display, windowi ng, configuring and reconfiguring the display, and selecting the sensors across the flight deck displays. The following paragraphs include guidance for various flight deck configurations from dedicated electronic displays for the attitude director indicato r and the horizontal situation indicator to larger display sizes which use windowing techniques to display various functionalities on one display area. In some flight decks the primary flight information and the navigation display are examples of informati on that is displayed using windowing techniques. Chapter 5 of this AMC provides guidance for information elements including: text, labels, symbols, graphics, and other depictions (such as video) in isolation and combination.

b. Types and Arrangement of D isplay Information. This paragraph provides guidance for the arrangement and location of categories of information. The categories of information include: — Primary flight information including attitude, airspeed, altitude, and heading.

— Powerplant informat ion which covers functions relating to propulsion.

— Other information.

(1) Placement - General Information. The position of a message or symbol within a display conveys meaning to the pilot. Without the consistent or repeatable location of a symbol in a s pecific area of the electronic display interpretation error and response times may increase. The following information should be placed in a consistent location under normal conditions: — Primary flight information (see paragraph 36b(3) in this chapter and Appendix 1 of this AMC).

— Powerplant information (see paragraph 36b(4) in this chapter and Appendix 2 o f this AMC).

— Flight crew alerts – each flight crew alert should be displayed in a specific location or a central flight crew alert area.

— Autopilot and flight director modes of operation.

Powered by EASA eRules Page 1418 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) — Lateral and vertical path deviation indicators.

— Radio altitude in dications.

— Failure flags should be presented in the location of the information they reference or replace.

— Data labels for navigation, traffic, aeroplane system, and other information should be placed in a consistent position relative to the information they are labelling.

— Supporting data for other information, such as bugs and limit markings, should be consistently positioned relative to the information they support.

— Features on electronic moving map displays (for example, VORs, waypoints, etc.) relati ve to the current aeroplane position. In addition, the features should be placed on a constant scale for each range selected.

— Segment of flight information relative to similar information or other segments.

(2) Placement - Controls and Indications. When a control or indication occurs in multiple places (for example a “Return” control on multiple pages of a flight management func tion), the control or indication should be located consistently for all occurrences.

(3) Arrangement - Basic T Information (a) CS 25.1321(b) includes specifications for the “Basic T” arrangement of certain informa tion required by CS 25.1303(b) .

(b) The following paragraphs provide guidance for the Basic T arrangement. This guidance applies to single and multiple display surfaces.

1 The Basic T information should be displ ayed continuously, directly in front of each flight crew member under normal (that is, no display system failure) conditions. CS 25.1321(b) requires that flight instruments required by CS 25.1303 must be grouped on the instrument panel and centred as nearly as practicable about the vertical plane of the pilot's forward vision.

2 The Basic T arrangement applies to the primary display of attitude, airspeed, altitude, and dir ection of flight. Depending on the flight deck design, there may be more than one indication of the Basic T information elements in front of a pilot. For example, heading information may appear on back - up displays, HUDs, and moving map displays. The primar y airspeed, altitude, and direction indications are the respective display indications closest to the primary attitude indication.

3 The primary attitude indication should be centred about the plane of the flight crew’s forward vision. This should be mea sured from the DEP at the flight crew station. If located on the main instrument panel, the primary attitude indication must be in the top centre position ( CS 25.1321(b) ). The attitude indication should be placed so that the display is unobstructed under all flight conditions. Refer to SAE ARP 4102/7 for additional information.

Powered by EASA eRules Page 1419 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 4 The primary airspeed, altitude, and direction of flight indications should be located adjac ent to the primary attitude indication.

Information elements placed within, overlaid, or between these indications, such as lateral and vertical deviation, are acceptable when they are relevant to respective airspeed, altitude, or directional indications u sed for accomplishing the basic flying task, and are shown to not disrupt the normal crosscheck or decrease manual flying performance.

5 The instrument that most effectively indicates airspeed must be adjacent to and directly to the left of the primary a ttitude indication ( CS 25.1321(b) ). The centre of the airspeed indication should be aligned with the centre of the attitude indication. For airspeed indications, vertical deviations have been found acceptable up to 15 degrees below to 10 degrees above when measured from the direct horizontal position of the aeroplane waterline reference symbol. For tape type airspeed indications, the centre of the indication is defined as the centre of the current airspeed status re ference.

6 Parameters related to the primary airspeed indication, such as reference speeds or a mach indication, should be displayed to the left of the primary attitude indication.

7 The instrument that most effectively indicates altitude must be locat ed adjacent to and directly to the right of the primary attitude indication ( CS 25.1321(b) ). The centre of the altitude indication should be aligned with the centre of the attitude indication. For altitude indicati ons, vertical deviations have been found acceptable up to 15 degrees below to 10 degrees above when measured from the direct horizontal position of the aeroplane waterline reference symbol. For tape type altitude indications, the centre of the indication i s defined as the centre of the current altitude status reference.

8 Parameters related to the primary altitude indication, such as the barometric setting or the primary vertical speed indication, should be displayed to the right of the primary altitude i ndication.

9 The instrument that most effectively indicates direction of flight must be located adjacent to and directly below the primary attitude indication ( CS 25.1321(b) ). The centre of the direction of fligh t indication should be aligned with the centre of the attitude indication.

The centre of the direction of flight indication is defined as the centre of the current direction of flight status reference.

10 Parameters related to the primary direction of fli ght indication, such as the reference (that is, magnetic or true) or the localiser deviation should be displayed below the primary attitude indication.

11 If applicants seek approval of alternative instrument arrangements by equivalent safety under Part 21A.21(c)2, the Agency will normally require well - founded research, or relevant service experience from military, foreign, or other sources to substantiate the applicants’ proposed compensating factors.

Powered by EASA eRules Page 1420 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (4) Arrangement - Powerplant Information (a) Requir ed engine indications necessary to set and monitor engine thrust or power should be continuously displayed in the flight crew’s primary field of view, unless the applicant can demonstrate that this is not necessary (see the guidance in paragraph 36c(3) of this chapter and Appendix 2 of this AMC). The automatically selected display of powerplant information should not suppress other information that requires flight crew awareness.

(b) Powerplant information must be closely grouped (in accordance with § 25.1 321) in an easily identifiable and logical arrangement which allows the flight crew to clearly and quickly identify the displayed information and associate it with the corresponding engine. Typically, it is considered to be acceptable to arrange parameters related to one powerplant in a vertical manner and, according to powerplant position, next to the parameters related to another powerplant in such a way that identical powerplant parameters are horizontally aligned. Generally, place parameter indications in order of importance with the most important one at the top. Typically, the top indication is the primary thrust setting parameter.

(5) Arrangement - Other Information (For Example, Glideslope and Multi - Function Displays) (a) Glideslope or glidepath dev iation scales should be located to the right side of the primary attitude indication. If glideslope deviation data is presented on both an electronic horizontal situation indicator and an electronic attitude direction indicator, the information should appe ar in the same relative location on each indicator.

(b) When the glideslope pointer is being driven by a RNAV (area navigation) system with VNAV (vertical navigation) or ILS (instrument landing system) look - alike functionality, the pointer should not be m arked “GS” or “glideslope.” (c) Navigation, weather, and vertical situation display informationis often displayed on multi - function displays. This information may be displayed on one or more physical electronic displays, or on several areas of one larger display. When this information is not required to be displayed continuously, it can be displayed part - time, but the displayed information should be easily recoverable to the flight crew when needed. For guidance on part - time displays see paragraph 36c(3) o f this chapter.

(d) Other information should not be located where the primary flight information or required powerplant information is normally presented. See paragraphs 36b(1) and 36b(3) of this chapter for primary flight information guidance. See paragr aphs 21e(10) and 36b(4) of this AMC for powerplant information guidance.

c. Managing Display Information. The following paragraphs address managing and integrating the display of information throughout the flight deck. This includes the use of windows to present information and the use of menus to manage the display of information .

(1) Window. A window is a defined area which can be present on one or more physical displays. A window that contains a set of related information is commonly referred Powered by EASA eRules Page 1421 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) to as a format. Multiple windows may be presented on one physical display surface and may have different sizes. Guidelines for sharing information on a display, using separate windows, are as follows: — The window(s) should have fixed size(s) and location(s).

— Separation between information elements within and across windows should be suffic ient to allow the flight crew to readily distinguish separate functions or functional groups (for example, powerplant indication) and avoid any distractions or unintended interaction.

— Display of selectable information, such as a window on a display area, should not interfere with or affect the use of primary flight information.

— For additional information regarding the display of data on a given location, data blending, and data over - writing (see Aeronautical Radio, Inc ( ARINC ) Standard 661 - 5, Cockpit Disp lay System Interfaces to User Systems ).

(2) Menu (a) A menu is a displayed list of items from which the flight crew can choose.

Menus include drop - down and scrolling menus, line select keys on a multi - function display, and flight management system menu trees. An option is one of the selectable items in a men u. Selection is the action a user makes in choosing a menu option, and may be done by pointing (with a cursor control device or other mechanism), entering an associated option code, or activating a function key.

(b) The hierarchical structure and organisa tion of the menus should be designed to allow the flight crew to sequentially step through the available menus or options in a logical way that supports their tasks. The options provided on any particular menu should be logically related to each other. Men us should be displayed in consistent locations, either a fixed location or a consistent relative location, so that the flight crew knows where to find them. At all times the system should indicate the current position within the menu and menu hierarchy.

(c ) The number of sub - menus should be designed to assure timely access to the desired option without over - reliance on memorisation of the menu structure. The presentation of items on the menu should allow clear distinction between items that select other men us and items that are the final selection.

(d) The number of steps required to choose the desired option should be consistent with the frequency, importance, and urgency of the flight crew’s task.

(e) Whena menu is displayed it should not obscure require d information.

(3) Full - time vs. Part - time Display of Information.Some aeroplane parameters or status indications are required to be displayed by the specifications (for example, powerplant information required by CS 25.1305 ), yet they may only be necessary or required in certain phases of flight. If it is desired to inhibit some parameters from full - time display, a usability level and functionality equivalent to a full - time display should be demonstrated.

Powered by EASA eRules Page 1422 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (a) When determining if information on a display can be part - time, consider the following criteria: — Continuous display of the parameter is not required for safety of flight in all normal flight phases.

— The parameter is automatically displayed in flight phases wh ere it is required, when its value indicates an abnormal condition, or when it would be relevant information during a failure condition.

— Display of the inhibited parameter can be manually selected by the flight crew without interfering with the display of other required information.

— If the parameter fails to be displayed when required, the failure effect and compounding effects must meet the specifications of all applicable specifications (for example, CS 25.1309 ) .

— The automatic or requested display of the inhibited parameter should not create unacceptable clutter on the display. Also, simultaneous multiple "pop - ups" should not create unacceptable clutter on the display.

— If the presence of a new parameter is not sufficiently self - evident, suitable alerting or other annunciations should accompany the automatic presentation of the parameter.

(b) Pop - up Display of Information 1 Certain types of information, such as terrain and TCAS, are required by operating rules to be displayed, yet they are only necessary or required in certain phases of flight (similar to the part - time display of required aeroplane parameters, (see paragraph 36b(3) of this chapter)) or under specific conditions. One method commonly employed to d isplay this information is called “automatic pop - up.” Automatic pop - ups may be in the form of an overlay, such as a TCAS overlay on the moving map, or in a separate window as a part of a display format. Pop - up window locations should not obscure required i nformation.

2 Consider the following criteria for displaying automatic pop - up information: — Information is automatically displayed when its value indicates a predetermined condition, or when the associated parameter reaches a predetermined value.

— Pop - up information should appropriately attract the flight crew’s attention while minimising task disruption.

— If the flight crew deselects the display of the automatic pop - up information, then another automatic pop - up should not occur until a new condition/event causes it.

— If an automatic pop - up condition is activated and the system is in the wrong configuration or mode to display the information, and the system configuration cannot be automatically changed, Powered by EASA eRules Page 1423 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) then an annunciation should be displayed in the colour associated with the nature of the alert, prompting the flight crew to make the necessary changes for th e display of the information. This guidance differs from the part - time display of information required by CS - 25 because the required information should be displayed regardless of the configuration.

— If a pop - up(s) or simultaneous multiple pop - ups occur and obscure information, it should be shown that the obscured information is not relevant or necessary for the current flight crew task. Additionally, the pop - ups should not cause a misleading presentation.

— If more than one automatic pop - up occurs simultaneo usly on one display area, for example a terrain and TCAS pop - up, then the system should prioritise the pop - up events based on their criticality. Pop - up display orientation should be in track - up or heading - up.

— Any information to a given system that is not continuously displayed, but the safety assessment determines it is necessary to be presented to the flight crew, should automatically pop - up or otherwise indicate that its display is required.

d. Managing Display Configuration. The following paragraphs a ddress managing the information presented by an electronic display system and its response to failure conditions and flight crew selections. The following paragraphs also provide guidance on the acceptability of display formats and their required physical location on the flight deck, both during normal flight and in failure modes. Manual and automatic system reconfiguration and source switching are also addressed.

(1) Normal Conditions. In normal conditions (that is, non - failure conditions) there may be a number of possible display configurations that may be selected manually or automatically. All possible display configurations available to the flight crew should be designed and evaluated for arrangement, visibility, and interference.

(2) System Failure C onditions (Reconfiguration). The following paragraphs provide guidance on manual and automatic display system reconfiguration in response to display system failures. Arrangement and visibility specifications also apply in failure conditions. Alternative di splay locations used in non - normal conditions should be evaluated by the Agency to determine if the alternative locations meet the criteria for acceptability.

(a) Moving display formats to different display locations on the flight deck or using redundant display paths to drive display information is acceptable to meet availability and integrity specifications.

(b) In an instrument panel configuration with a display unit for primary flight information positioned above a display unit for navigation informat ion, it is acceptable to move the primary flight information to the lower display unit if the upper display unit fails.

(c) In an instrument panel configuration with a display unit for primary flight information positioned next to a display unit for navig ation information, it is Powered by EASA eRules Page 1424 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) acceptable to move the primary flight information to the display unit directly adjacent to it if the preferred display unit fails. It is also acceptable to switch the navigation information to a centrally located auxiliary display (multi - function display).

(d) If several possibilities exist for relocating the failed display, a recommended flight crew procedure should be considered and documented in the aeroplane flight manual.

(e) It is acceptable to have manual or automatic switch ing capability (automatic switching is preferred) in case of system failure; however, CS 25.1333(b) requires that the equipment, systems, and installations must be designed so that sufficient information is available to assure control of the aeroplane’s airspeed, altitude, heading, and attitude by one of the pilots without additional flight crew action, after any single failure or combination of failures that is not assessed to be extremely improbable.

(f) The following means to reconfigure the displayed information are acceptable: — Display unit reconfiguration. Moving a display format to a different lo cation (for example, moving the primary flight information to the adjacent display unit) or the use of a compacted format may be acceptable.

— Source/graphic generator reconfiguration. The reconfiguration of graphic generator sources either manually or auto matically to accommodate a failure may be acceptable. In the case where both the captain and first officer’s displays are driven by a single graphic generator source, there should be clear, cautionary alerting to the flight crew that the displayed informat ion is from a single graphic generator source.

— In certain flight phases, manual reconfiguration may not satisfy the need for the pilot controlling the aeroplane to recover primary flight information without delay. Automatic reconfiguration might be necessa ry to ensure the timely availability of information that requires immediate flight crew member action.

— When automatic reconfiguration occurs (for example, display transfer), it should not adversely affect the performance of the flight crew and should not result in any trajectory deviation.

— When the display reconfiguration results in the switching of sources or display paths that is not annunciated and is not obvious to the flight crew, care should be taken that the flight crew is aware of the actual stat us of the systems when necessary, depending on flight deck philosophy.

Powered by EASA eRules Page 1425 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) e. Methods of Reconfiguration (1) Compacted Format (a) The term "compacted format," as used in this AMC, refers to a reversionary display mode where selected display components of a multi - display configuration are combined in a single display format to provide higher priority information following a display failure. The “compacted format” may be automatically selected in case of a primary display failure, or it may be manually (autom atic selection preferred) selected by the flight crew. Except for training purposes, the “compacted format” should not be selectable unless there is a display failure. The concepts and specifications of CS 25.1321 , as discussed in paragraph 36(b)(3) of this chapter, still apply.

(b) The compacted display format should maintain the same display attributes (colour, symbol location, etc.) and include the same required information, as the primary formats it is replacing. The compacted format should ensure the proper operation of all the d isplay functions it presents, including annunciation of navigation and guidance modes, if present. However, due to size constraints and to avoid clutter, it may be necessary to reduce the amount of display functions on the compacted format. For example, in some cases, the use of numeric readouts in place of graphical scales has been found to be acceptable. Failure flags and mode annunciations should, wherever possible, be displayed in a location common with the normal format.

(2) Sensor Selection and Annun ciation (a) Automatic switching of sensor data to the display system should be considered, especially with highly integrated display systems to address those cases where multiple failure conditions may occur at the same time and require immediate flight cr ew action. Manual switching may be acceptable.

( b) Independent attitude, direction, and air data sources are required for the captain and first officer’s displays of primary flight information (see CS 25.1333 ). If sources can be switched such that the captain and first officer are provided with single sensor information, each of them should receive a clear annunciation indicating the vulnerability to misleading information.

(c) If sensor information sources cannot be switched, then no annunciation is required.

(d) There should be a means of determining the source of the displayed navigation information and the active navigation mode. For approach operations the source of the displayed navigation information and th e active navigation mode should be available on the primary flight display or immediately adjacent to the primary flight display.

(e) The selected source should be annunciated if multiple or different types of navigation sources (flight management system, instrument landing system, GNSS (global navigation satellite system) landing system, etc.) can be selected (manually or automatically).

Powered by EASA eRules Page 1426 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GE NERAL AMCs (CS - 25) (f) An alert should be given when the information presented to the flight crew is no longer meeting the required integ rity level, in particular when there is a single sensor or loss of independence.

37. – 40. [RESERVED] CHAPTER 7 ELECTRONIC DISPLAY SYSTEM CONTROL DEVICES 41. General. Each electronic display system control device has characteristics unique to its operation that need to be considered when designing the functions the display system controls, and the redundancy provided during failure modes. Despite the amount of redundancy that may be available to achieve a given task, the flight deck should still present a consistent user interface scheme for the primary displays and a compatible, if not consistent, user interface scheme for auxiliary displays throughout the flig ht deck.

a. Multi - function Control Labels. Multi - function controls should be labelled such that the pilot is able to: — Rapidly, accurately, and consistently identify and select all functions of the control device.

— Quickly and reliably identify what item on the display is “active” as a result of cursor positioning, as well as what function will be performed if the item is selected using the selector buttons and/or changed using the multi - function control.

— Determine quickly and accurately the function of t he control without extensive training or experience.

b. Multi - function Controls. The installation guidelines below apply to control input devices that are dedicated to operating a specific function (for example, control knobs and wheels), as well as new control features (for example, a cursor control device (CCD)).

(1) “Hard” Controls (a) Mechanical controlsused to set numeric data on a display should have adequate friction or tactile detents to allow a flight crew without extensive training or experienc e to set values (for example, setting an out - of - view heading bug to a displayed number) to a required level of accuracy within a time appropriate to the task.

(b) The input for display response gain to control should be optimised for gross motion as well as fine positioning tasks without overshoots. In accordance with CS 25.777(b) , the direction of movement of the cockpit controls must meet the specifications of CS 25.779 . Wherever practicable, the sense of motion involved in the operation of other controls must correspond to the sense of the effect of the operation on the aeroplane or on the part operated. Controls of a variable nature using a rotary motion must move clockw ise from the off position, through an increasing range, to the full on position.

(2) “Soft” Controls (a) There are two interactive types of soft control displays, one type affects aeroplane systems and the other type does not. Displays that utilize a grap hical user interface (GUI) permit information within different display areas to be directly manipulated by the flight crew (for example, changing Powered by EASA eRules Page 1427 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) range, scrolling crew alert messages or electronic checklists, configuring windows, or layering information.) This level of display interaction affects only the presentation of display information and has a minimal effect on flight deck operations. The other level of display interaction provides a GUI to control aeroplane system operations (for example, utility co ntrols on displays traditionally found in overhead panel functions, FMS operations, and graphical flight planning).

(b) The design of display systems that will be used as soft controls is dependent on the functions they control. Consider the following gui delines when designing these display systems: 1 The GUI and control device should be compatible with the aeroplane system they will control. The hardware and software design assurance levels and tests for the GUI and control device should be commensurate with the level of criticality of the aeroplane system they will control.

2 Redundant methods of controlling the system may lessen the criticality required of the display control. Particular attention should be paid to the interdependence of display contr ols (that is, vulnerability to common mode failures), and to the combined effects of the loss of control of multiple systems and functions.

3 The applicant should demonstrate that the failure of any display control does not unacceptably disrupt operation of the aeroplane (that is the allocation of flight crew member tasks) in normal, non - normal, and emergency conditions.

4 To show compliance w ith CS 25.777(a) and CS 25.1523 , the applicant should show that the flight crew can conveniently access required and backup control functions in all expected flight scenari os, without impairing aeroplane control, flight crew task performance, and flight crew resource management.

5 Control system latency and gains can be important in the acceptability of a display control. Usability testing should therefore accurately repli cate the latency and control gains that will be present in the actual aeroplane.

6 The final display response to control input should be fast enough to prevent undue concentration being required when the flight crew sets values or display parameters CS 25.771(a) ). The initial indication of a response to a soft control input should take no longer than 250 milliseconds. If the initial response to a control input is not the same as the final expected response, a mean s of indicating the status of the pilot input should be made available to the flight crew.

7 To show compliance with CS 25.771(e) the applicant should show by test and/or demonstration in representative motion en vironment(s) (for example, turbulence) that the display control is acceptable for controlling all functions that the flight crew may access during these conditions.

Powered by EASA eRules Page 1428 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) c. Cursor Control Devices When the input device controls cursor activity on a display, it is called a cursor control device (CCD). The CCDs are used to position display cursors on selectable areas of the displays. These selectable areas are “soft controls” intended to perform the s ame functions as mechanical switches or other controls on conventional control panels.

Typically, CCDs control several functions and are the means for directly selecting display elements. When designing CCDs, in addition to the guidance provided in paragra phs 41a, 41b, and 41d of this chapter, consider the guidance in the following paragraphs, which address design considerations unique to CCDs.

(1) The CCD design and installation should enable the flight crew to operate the CCD without exceptional skill du ring foreseeable flight conditions, both normal and adverse (for example, turbulence and vibrations). Certain selection techniques, such as double or triple clicks, should be avoided.

(2) The safety assessment should address reversion to alternate means o f control following loss of the CCD. This includes an assessment on the impact of the failure on flight crew workload.

(3 ) The functionality of the CCD should be demonstrated with respect to the flight crew interface considerations outlined below: (a) Th e ability of the flight crew to share tasks, following CCD failure, with appropriate workload and efficiency.

(b) The ability of the flight crew to use the CCD with accuracy and speed of selection required of the related tasks, under foreseeable operating conditions (for example, turbulence, engine imbalance, and vibration).

(c) Satisfactory flight crew task performance and CCD functionality, whether the CCD is operated with a dominant or non - dominant hand.

(d) Hand stability support position (for exampl e, wrist rest).

(e) Ease of recovery from incorrect use.

d. Cursor Displays (1) The cursor symbol should be restricted from areas of primary flight information or where occlusion of display information by a cursor could result in misinterpretation by t he flight crew. If a cursor symbol is allowed to enter a critical display information field, it should be demonstrated that the cursor symbol’s presence will not cause interference during any phase of flight or failure condition.

(2) Because the cursor is a directly controllable element on the display it has unique characteristics. Consider the following when designing a cursor display: (a) Presentation of the cursor should be clear, unambiguous, and easily detectable in all foreseeable operating conditio ns.

(b) The failure mode of an uncontrollable and distracting display of the cursor should be evaluated.

(c) Because in most applications more than one flight crew member will be using one cursor, the applicant should establish an acceptable method for h andling “duelling cursors” that is compatible with the overall flight deck philosophy (for example, “last person on display wins”). Acceptable methods Powered by EASA eRules Page 1429 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) should also be established for handling other possible scenarios, including the use of two cursors by two pilots.

(d) If more than one cursor is used on a display system, a means should be provided to distinguish between the cursors.

(e) If a cursor is allowed to fade from a display, some means should be employed for the flight crew to quickly locate it on the display system. Common examples of this are “blooming” or “growing” the cursor to attract the flight crew’s attention.

42. – 45. [RESERVED] CHAPTER 8 SHOWING COMPLIANCE FOR APPROVAL OF ELECTRONIC DISPLAY SYSTEMS 46. Compliance Considerations (Test and Compliance) a. General. This chapter provides guidance for demonstrating compliance to the specifications for the approval of electronic flight deck displays. Since so much of display system compliance is dependent on subjective e valuations, this chapter focuses on providing specific guidance that facilitates these types of evaluations.

b. Means of Compliance (1) The acceptable means of compliance for a display system depends on many factors and is determined on a case - by - case ba sis. For example, when the proposed display system technology is mature and well understood, means such as analogical reasoning documented as a Statement of Similarity may be sufficient.

However, more rigorous and structured methods, such as analysis and f light test, are appropriate if the proposed display system design is deemed novel, complex, or highly integrated.

(2) The acceptable means of compliance depends on other factors as well. These include the subjectivity of the acceptance criteria and the e valuation facilities of the applicant (for example, high - fidelity flight simulators) and the manner in which these facilities are used (for example, data collection).

(3) When subjective criteria are used to satisfy a means of compliance, the subjective d ata should be collected from multiple people (including pilots, engineers, and human factor specialists.)

(4) The following guidance describes means of compliance for electronic displays: (a) System Descriptions 1 System descriptions may include system architecture, description of the layout and general arrangement of the flight deck, description of the intended function, flight crew interfaces, system interfaces, functionality, operational modes, mode transitions, and characteristics (for example dynami cs of the display system), and applicable specifications addressed by this description. Layout drawings and/or engineering drawings may show the geometric arrangement of hardware or display graphics. Drawings typically are used in cases where showing compl iance to the specifications can easily be reduced to simple geometry, arrangement, or the presence of a given feature on the drawing.

Powered by EASA eRules Page 1430 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 2 The following questions may be used to evaluate whether the description of intended function is sufficiently specific and detailed: — Does each system, feature, and function have a stated intended function?

— What assessments, decisions, or actions are the flight crew members intended to make based on the display system?

— What other information is assumed to be used in comb ination with the display system?

— What is the assumed operational environment in which the equipment will be used? For example, the pilots’ tasks and operations within the flight deck, phase of flight, and flight procedures.

(b) Statement of Similarity. This is a substantiation to demonstrate compliance by a comparison to a previously approved display (system or function). The comparison details the physical, logical, and functional and operational similarities of the two systems. Substantiation data from previous installations should be provided for the comparison. This method of compliance should be used with care because the flight deck should be evaluated as a whole, rather than merely as a set of individual functions or system s. For example, display functions that have been previously approved on different programmes may be incompatible when applied to another flight deck. Also, changing one feature in a flight deck may necessitate corresponding changes in other features, in or der to maintain consistency and prevent confusion (for example, use of colour).

(c) Calculation & Engineering Analyses. These include assumptions of relevant parameters and contexts, such as the operational environment, pilot population, and pilot trainin g. Examples of calculations and engineering analyses include human performance modelling of optical detections, task times, and control forces. For analyses that are not based on advisory material or accepted industry standards, validation of calculations and engineering analyses using direct participant interaction with the display should be considered.

(d) Evaluation. This is an assessment of the design conducted by the applicant, who then provides a report of the results to the Agency. Evaluations typic ally use a display design model that is more representative of an actual system than drawings. Evaluations have two defining characteristics that distinguish them from tests: (1) the representation of the display design does not necessarily conform to the final documentation, and (2) the Agency may or may not be present. Evaluations may contribute to a finding of compliance, but they generally do not constitute a finding of compliance by themselves.

1 Evaluations may begin early in the certification progr amme. They may involve static assessments of the basic design and layout of the display, part - task evaluations and/or, full task evaluations in an operationally representative environment (environment may be simulated). A wide variety of development tools may be used for evaluations, from mock - ups to full installation representations of the actual product or flight deck.

Powered by EASA eRules Page 1431 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 2 In cases where human subjects (typically pilots) are used to gather data (subjective or objective), the applicant should fully documen t the process used to select subjects, the subjects’ experience, the type of data collected, and the method(s) used to collect the data. The resulting information should be provide to the Agency as early as possible to obtain agreement between the applican t and the Agency on the extent to which the evaluations are valid and relevant for certification credit. Additionally, credit will depend on the extent to which the equipment and facilities actually represent the flight deck configuration and realism of th e flight crew tasks.

(e) Test. This means of compliance is conducted in a manner very similar to evaluations (see above), but is performed on conformed systems (or conformed items relevant to the test), in accordance with an approved test plan, and may be witnessed by the Agency. A test can be conducted on a test bench, in a simulator, and/or on the actual aeroplane, and is often more formal, structured, and rigorous than an evaluation.

1 Bench or simulator tests that are conducted to show compliance sho uld be performed in an environment that adequately represents the aeroplane environment, for the purpose of those tests.

2 Flight tests should be used to validate and verify data collected from other means of compliance such as analyses, evaluations, and simulations. Per CS 25.1523 , during the certification process, the flight crew workload assessments and failure classification validations should be addressed in a flight simulator or an actual aeroplane, although the assessments may be supported by appropriate analyses (see CS - 25 Appendix D , for a description of the types of analyses).

47. – 50. [RESERVED] CHAPTER 9 CONTINUED AIRWORTHINESS AND MAINTENANCE 51. Continued Airworthiness and Maintenance. The following paragraphs provide guidance for preparing instructions for the continued airworthiness of the display system and its components to show complianc e with CS 25.1309 and CS 25.1529 (including Appendix H), which require preparing Instructions for Continued Airworthiness. The following guidance is not a definitive list, and other maintenance tasks may be developed as a result of the safety assessment, design reviews, manufacturer’s recommendations, and Maintenance Steering Group (MSG) - 3 analyses that are conducted.

a. General. Information on preparing the Instructions f or Continued Airworthiness can be found in CS - 25 Appendix H . In addition to those instructions, maintenance procedures should be considered for: (1) Reversionary switches not used in normal operation. These switch es should be checked during routine maintenance because, if a switch failure is not identified until the aeroplane is in flight, the switching or back up display/sensor may not be available when required. These failures may be addressed by a System Safety Assessment and should be addressed in the aeroplane’s maintenance programme (for example, MSG - 3).

(2) Display cooling fans and filters integral with cooling ducting.

Powered by EASA eRules Page 1432 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) b. Design for Maintainability. The display system should be designed to minimise mainte nance error and maximise maintainability.

(1) The display mounting, connectors, and labelling, should allow quick, easy, safe, and correct access for identification, removal and replacement. Means should be provided (for example, using physically coded co nnectors) to prevent inappropriate connections of system elements.

(2) If the system has the capability of providing information on system faults (for example diagnostics) to maintenance personnel, it should be displayed in text instead of coded informati on.

(3) If the flight crew needs to provide information to the maintenance personnel (for example overheat warning), problems associated with the display system should be communicated to the maintenance personnel as appropriate, relative to the task and c riticality of the information displayed.

(4) The display components should be designed so they can withstand cleaning without internal damage, scratching and/or crazing (cracking).

c. Maintenance of Display Characteristics.

(1) Maintenance procedures m ay be used to ensure that the display characteristics remain within the levels presented and accepted at certification.

(2) Experience has shown that display quality may degrade with time and become difficult to use. Examples include lower brightness/contrast; distortion or discolouration of the screen (blooming effects); and areas of the screen that may not display information properly.

(3) Test methods and criteria may be established to determine if the display system remains within acceptable minimum levels. Display system manufacturers may alternatively provide “end of life” specifications for the displays which could be ad opted by the aeroplane manufacturer.

52. – 60. [RESERVED] [Amdt 25/11] [Amdt 25/12] [Amdt 25/17] [Amdt 25/21] [Amdt 25/26] Powered by EASA eRules Page 1433 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25)

Appendix 1 – Primary Flight Information

ED Decision 2015/019/R This appendix provides additional guidance for displaying primary flight information. Displaying primary flight information is required by CS 25.1303(b) and CS 25.1333(b) . The specifications for arranging primary flight information are specified in CS 25.1321(b) .

1.1 Attitude Pitch attitude display scaling should be such that during normal manoeuvres (for example, approach or clim b at high thrust - to - weight ratios) the horizon remains visible in the display with at least 5 degrees pitch margin available.

An accurate, easy, quick - glance interpretation of attitude should be possible for all unusual attitude situations and other “non - normal” manoeuvres sufficient to permit the pilot to recognise the unusual attitude and initiate an appropriate recovery within one second.

Information to perform effective manual recovery from unusual attitudes using chevrons, pointers, and/or permanent ground - sky horizon on all attitude indications is recommended.

Both fixed aeroplane reference and fixed earth reference bank po inters (“ground and/or sky” pointers) are acceptable as a reference point for primary attitude information. A mix of these types in the same flight deck is not recommended.

There should be a means to determine the margin to stall and to display that infor mation when necessary. For example, a pitch limit indication is acceptable.

There should be a means to identify an excessive bank angle condition prior to stall buffet.

Sideslip should be clearly indicated to the flight crew (for example, a split trapezo id on the attitude indicator) and an indication of excessive sideslip should be provided.

1.2 Continued Function of Primary Flight Information (Including Standby) in Conditions of Unusual Attitudes or in Rapid Manoeuvres Primary flight information must c ontinue to be displayed in conditions of unusual attitudes or in rapid manoeuvres ( CS 25.1301 ). The pilot must also be able to rely on primary or standby instrument informa tion for recovery in all attitudes and at the highest pitch, roll, and yaw rates that may be encountered ( CS 25.1301 ).

In showing compliance with the specifications of CS 25.1301( a ) , CS 25.1309(a) , CS 25.1309(b) , and CS 25.1309(c) , the analysis and test programme must consider the following conditions that might occur due to pilot action, system failures, or external events: — Abnormal attitude (including the aeroplane becoming inverted); — Excursion of any other flight parameter out side protected flight boundaries; or — Flight conditions that may result in higher than normal pitch, roll, or yaw rates.

For each of the conditions identified above, primary flight displays and standby indicators must continue to provide useable attitude, altitude, airspeed and heading information and any other information that the pilot may require to recognise and execute recovery from the unusual attitude and/or arrest the higher than normal pitch, roll, or yaw rates ( CS 25.1301 ).

Powered by EASA eRules Page 1434 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 2.1 Airspeed and Altitude Airspeed and altitude displays should be able to convey to the flight crew a quick - glance sense of the present speed or altitude. Conventional round - dial moving pointer displays inherently give some of this sense that may be difficult to duplicate on moving scales. Scale length is one attribute related to this quick - glance capability. The minimum visible airspeed scale length found acceptable for moving scales has been 80 knots; since this minimum is depende nt on other scale attributes and aeroplane operational speed range, variations from this should be verified for acceptability. A displayed altitude that is geometrically d erived should be easily discerni ble from the primary altitude information, which is b arometrically derived altitude. To ensure the pilot can easily discern the two, the label '''GSL''' should be used to label geometric height above mean sea level. See Section 5.4.4 of Appendix 6 for HUD - specific airspeed considerations.

Airspeed reference marks (bugs) on conventional airspeed indicators perform a useful function by providing a visual reminder of important airspeed parameters. Including bugs on electronic airspeed displays is encouraged. Computed airspeed/angle - of - attack bugs such as Vstall warning, V1, VR, V2, flap limit speeds, etc., displayed on the airspeed scale should be evaluated for accuracy. The design of an airspeed indicator should include the capability to incorporate a reference mark that will reflect the current target airspeed of the flight guidance system. This has been required in the past for some systems that have complex speed selection algorithms, in order to give the flight crew adequate information for system monitoring as required by CS 25.1309(c) .

Scale units marking for air data displays incorporated into primary flight displays are not required (“knots,” “airspeed” for airspeed, “feet,” “altitude” for altimeters) as long as the content of the readout remains clear. For altimeters with the capabili ty to display both English and Metric units, the scale and primary present value readout should remain scaled in English units with no units marking required; the Metric display should consist of a separate present value readout that does include units mar king.

Airspeed scale markings such as stall warning, maximum operation speed/maximum operating mach number, or flap limits, should be displayed to provide the flight crew a quick - glance sense of speed relative to key targets or limits. The markings should be predominant enough to confer the quick - glance sense information, but not so predominant as to be distracting when operating normally near those speeds (for example, stabilised approach operating between stall warning and flap limit speeds).

If airspee d trend or acceleration cues are associated with the speed scale, vertically oriented moving scale airspeed indications should have higher numbers at the top so that increasing energy or speed results in upward motion of the cue. Speed, altitude, or vertic al rate trend indicators should have appropriate hysteresis and damping to be useful and non - distracting, however, damping may result in erroneous airspeed when accelerating. In this case, it may be necessary to use acceleration data in the algorithms to c ompensate for the error. The evaluation should include turbulence expected in service.

For acceptable means of compliance and guidance material on instrument graduations and markings, refer to the latest ETSOs and list of approved deviations on the Agency ’s webse (www.easa.europa.eu).

Altimeters present special design problems in that: (1) the ratio of total usable range to required resolution is a factor of 10 greater than for airspeed or attitude, and (2) the consequences of losing sense of context of al titude can be detrimental. The combination of altimeter scale length and markings, therefore, should be adequate to allow sufficient resolution for precise manual Powered by EASA eRules Page 1435 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) altitude tracking in level flight, as well as enough scale length and markings to reinforce t he flight crew's sense of altitude and to allow sufficient look - ahead room to adequately predict and accomplish level - off. When providing low altitude awareness, it may be helpful to include radio altimeter information on the scale so that it is visually r elated to the ground position.

2.2 Low and High Speed Awareness Cues CS 25.1541(a)(2) states: ''' The aeroplane must contain – Any additional information, instrument markings, and placards required for the safe op eration if there are unusual design, operatin g, or handling characteristics.''' The CS - 25 certification specifications related to instrument systems and their markings were not developed with modern day electronic displays in mind; consequently, these elec tronic displays are considered an “unusual design characteristic” per CS 25.1541(a)(2) , and may require additional marking to warrant safe operation. In particular, it is considered necessary to incorporate additio nal markings on electronic airspeed displays in the form of low and high speed awareness cues to provide pilots the same type of “quick glance” airspeed awareness that was an intrinsic feature of round dial instruments.

Low speed awareness cues should pro vide adequate visual cues to the pilot that the airspeed is below the reference operating speed for the aeroplane configuration (that is, weight, flap setting, landing gear position, etc.); similarly, high speed awareness cues should provide adequate visua l cues to the pilot that the airspeed is approaching an established upper limit that may result in a hazardous operating condition. Consider the following guidance when developing airspeed awareness cues: — Take into account all independent parameters that may affect the speed against which protection is being provided. This is most important in the low speed regime where all large aeroplanes have a wide range of stall speeds due to multiple flap/slat configurations and potentially large variations in gross weight.

— The cues should be readily distinguishable from other markings such as V - speeds and speed targets (bugs). The cues should indicate not only the boundary value of the speed limit, but must clearly distinguish between the normal speed range and the unsafe speed range beyond those limiting values ( CS 25.1545 ). Since the moving scale display does not provide any inherent visual cue of the relationship of present airspeed to low or high airspeed limits, many ele ctronic displays utilize an amber and red bar adjacent to the airspeed tape to provide this quick - glance low/high speed awareness. The preferred colours to be used are amber or yellow to indicate that the airspeed has decreased below a reference speed that provides adequate manoeuvre margin, changing to red at the stall warning speed. The speeds at which the low speed awareness bands start should be chosen as appropriate to the aeroplane configuration and operational flight regime. For example, low speed aw areness cues for approach and landing should be shown starting at VREF with a tolerance of +0 and – 5 knots. Some Agency approved systems use a pilot selectable operating speed “bug” at VREF supplemented by system - computed low speed cues that vary in colour as airspeed decreases below certain multiples of the appropriate stall speed (for example, white below 1.3VS, amber below 1.2 VS, and red below 1.1 VS).

Consider the specific operating needs of other flight regimes when developing the criteria for the ass ociated visual cue.

— Low speed awareness displays should be sensitive to load factor (g - sensitive) to enable the pilot to maintain adequate manoeuvre margins above stall warning in all phases of flight. The accuracy of this g - sensitivity function should be verified by flight t ests. Flight tests should also be conducted in manoeuvring flight and expected levels of turbulence to evaluate proper functioning of any damping routines incorporated into the low speed Powered by EASA eRules Page 1436 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) awareness software; the level of damping should preclude nuisance/err atic movement of the low speed cues during operation in turbulence but not be so high that it inhibits adequate response to accurately reflect changes in margins to stall warning and stall during manoeuvring flight.

— High speed awareness should be provided to prevent inadvertent excursions beyond limit speeds. Symbology should be provided to permit easy identification of flap and landing gear speed limits. A visual cue should be incorporated to provide adequate awareness of proximity to VMO; this awareness has been provided by amber bands, similar to the previously discussed low speed cues, and instantaneous airspeed displays that turn amber (or flash amber digits) as the closure rate to VMO increases beyond a value that sill provides adequate time for pilot corrective action to be taken without exceeding the limit speed.

— The display requirements for airspeed awareness cues are in addition to other alerts associated with exceeding high and low speed limits, such as the stick shaker and aural overspeed warnin g.

3. Vertical Speed The display range of vertical speed (or rate of climb) indications should be consistent with the climb/descent performance capabilities of the aeroplane. If the resolution advisory (RA) is integrated with the primary vertical speed i ndication, the range of vertical speed indication should be sufficient to display the red and green bands for all TCAS RA information.

4. Flight Path Vector or Symbol The display of Flight Path Vector (FPV or velocity vector) or Flight Path Angle (FPA) c ues on the primary flight display is not required, but may be included in many designs.

The FPV symbol can be especially useful on HUD applications. See Section 5.4.5 of Appendix 6 for HUD - specific FPV considerations. .

The FPV or FPA indication may als o be displayed on the HDD. In some HDD and most HUD applications, the FPV or FPA is the primary control and tracking cue for controlling the aeroplane during most phases of flight. Even though an FPV or FPA indication may be used as a primary flight contro l parameter, the attitude pitch and roll symbols (that is, waterline or boresight and pitch scale) which are still required primary indications by § 25.1303 must still be prominently displayed. In dynamic situation s, such as during recovery from an unusual attitude, constant availability of attitude indications is required.

If the FPV/FPA is used as the primary means to control the aeroplane in pitch and roll, the FPV/FPA system design should allow pilots to control and manoeuvre the aeroplane with a level of safety that is at least equal to traditional designs based on attitude ( CS 25.1333(b) ).

There may be existing aeroplane designs where the HUD provides a FPV pres entation and the HDD provides a FPA presentation. However, mixture of the two different presentations is not recommended due to possible misinterpretation by the flight crew. The designs that were accepted were found to have the following characteristics: correlation between the HUD FPV display and the primary flight display FPA display; consistent vertical axis presentation of FPV/FPA; and pilots’ ability to interpret and respond to the FPV and FPA similarly.

It should be easy and intuitive for the pilot to switch between FPV/FPA and attitude when necessary. The primary flight display of FPV/FPA symbology must not interfere with the display of attitude and there must always be attitude symbology at the top centre of the pilot's primary field of view, as re quired by CS 25.1321 .

Powered by EASA eRules Page 1437 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Aeroplane designs which display flight path symbology on the HUD and the HDD should use consistent symbol shapes (that is, the HUD FPV symbol looks like the HDD FPV).

In existing cases where an FPV is displayed head up and an FPA head down on an aeroplane, the symbols for each should not have the same shape. When different types of flight path indications may be displayed as head up and/or head down, the symbols should be easily distinguished to avoid any misinterpretation by the flight crew. A mixture of the two types of flight path indications is not recommended due to possible misinterpretation by the flight crew.

The normal FPV, the field - of - view limited FPV, and the caged FPV should each have a distinct appearance, so that the pilot is aware of the restricted motion or non - conformality.

Implementation of air mass - based FPV/FPA presentations should account for inherent limitations of air mass flight path computations.

Flight directors sh ould provide some lateral movement to the lateral flight director guidance cue during bank commands.

To show compliance with CS 25.1301(a) , CS 25.1303(b)(5) , and CS 25.143(b) , the FPV/FPA FD design must: 1. Not have any characteristics that may lead to oscillatory control inputs; 2. Provide sufficiently effective and salient cues to support all expected manoeuvres in longitudinal , lateral, and directional axes, including recovery from unusual attitudes; and 3. Not have any inconsistencies between cues provided on the HUD and HDD displays that may lead to pilot confusion or have adverse affects on pilot performance.

Performance and system safety requirements for flight guidance systems are found in the following document s: Document Number Title AMC N°1 to CS 25.1329 Flight Guidance Systems AC 120 - 28D Criteria for Approval of Category III Weather Minima for Take - off, Landing, and Rollout AC 120 - 29A Criteria for Approval of Category I and Category II Weather Minima for Approach [Amdt No: 25/11] [Amdt No: 25/12] [Amdt No: 25/17] Powered by EASA eRules Page 1438 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25)

Appendix 2 – Powerplant Displays

ED Decision 2011/004/R 1. General At the time CS 25.1305 was adopted, flight deck powerplant displays were primarily a collection of dedicated, independent, full - time analogue “r ound dial” type instruments. Typically, there was one display for each required indication. Today, flight deck powerplant displays are primarily electronic displays integrated with other flight deck displays on a few relatively large electronic display spa ces. Throughout this technological evolution, the Agency has used certification review items (CRIs) to assure that this new technology, with its increased potential for common faults and the challenges of effectively sharing display space, did not adversel y impact the timely availability and independence of the powerplant information required to meet the intent of CS 25.1305 . This AMC provides some of that guidance material.

To comply with one of the provisions of CS 25.1305 , a display should provide all the instrument functionality of a full - time, dedicated analogue type instrument as intended when the specification was adopted (see AC 20 - 88A, Guidelines on the Marking of Ai rcraft). The design flexibility and conditional adaptability of modern displays were not envisioned when CS 25.1305 and CS 25.1549 were initially adopted. In addition, the capabilities of modern control systems to automate and complement flight crew functions were not envisioned. In some cases these system capabilities obviate the need for a dedicated full - time analogue type instrume nt.

When making a compliance finding, all uses of the affected displays should be taken into consideration, including: (1) Flight deck indications to support the approved operating procedures ( CS 25.1585 ), (2) Indications as required by the powerplant system safety assessments ( CS 2 5.1309 ), and (3) Indications required in support of the instructions for continued airworthiness 25.1529).

For example: Compliance with CS 25.1305 (c)(3) for the engine N2 rotor was originally achieved by means of a dedicated, full time analogue instrument. This provided the continuous monitoring capability required to: — Support engine starting (for example, typically used to identify fuel on point); — Support power setting (for example, sometimes used as primary or back up parameter); — “Give reasonable assurance that those engine operating limitations that adversely affect turbine rotor structural integrity will not be exceeded in service” as required by CS 25.903(d)(2 ); — Pro vide the indication of normal, precautionary, and limit operating values required by CS 25.1549 ; as well as — Support detection of unacceptable deterioration in the margin to operating limits and other abnormal engi ne operating conditions as required to comply with CS 25.901 , CS 25.1309 , etc.

As technology evolved full authority digital engin e controls (FADECs) were introduced. The FADECs were designed with the ability to monitor and control engine N2 rotor speed as required to comply with CS 25.903(d)(2) . Additionally, engine condition monitoring programmes were introduced and used to detect unacceptable engine deterioration. Flight deck technology Powered by EASA eRules Page 1439 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) evolved such that indications could be displayed automatically to cover abnormal engine operating conditions . The combination of these developments obviated the need for a full time analogue N2 rotor speed indication, in accordance with the guidance found in Chapter 6, paragraph 36c(3) of this AMC.

2. Design Guidelines Safety - related engine limit exceedances s hould be indicated in a clear and unambiguous manner. Flight crew alerting is addressed in CS 25.1322 .

If an indication of significant thrust loss is provided it should be presented in a clear and unambiguous manner.

In addition to the failure conditions listed in Chapter 4 of this AMC, the following design guidelines should be considered: 1. For single failures leading to the non - recoverable loss of any indications on an engine, sufficient indications should remain to allow continued safe operation of the engine. (See CS 25.901(b)(2) , CS 25.901(c) , and CS 25.903(d)(2) ).

2. No single failure could prevent the continued safe operation of more than one engine or require immediate action by any flight crew member for continued safe operation. (See CS 25.901(c) , CS 25.903(b) , and CS 25.1309(b) ).

3. Engine indications needed during engine re - start should be readily available after an engine out event. (See CS 25.901(b)(2) , CS 25.901(c) , CS 25.903(d)(2) , CS 25.903(e) , CS 25.1301 , CS 25.1305 , CS 25.1309 , and Chapter 6, paragraph 36c(3) of this AMC).

[Amdt 25/11] Powered by EASA eRules Page 1440 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25)

Appendix 3 – Definition s

ED Decision 2011/004/R Air Mass System - An air mass - based system that provides a heading/airspeed/vertical velocity derived flight path presentation. It depicts the flight path through an air mass, will not account for air mass disturbances such as win d drift and windshear and, therefore, cannot be relied on to show the flight path relative to the earth’s surface.

Alert – A generic term used to describe a flight deck indication meant to attract the attention of and identify to the flight crew a non - nor mal operational or aeroplane system condition. Warnings, Cautions, and Advisories are considered to be alerts.

Annunciation - A visual, auditory, or tactile stimulus used to attract a flight crew member’s attention.

Architecture - The manner in which the components of a display or display system are organised and integrated.

Basic T - The arrangement of primary flight information as required by CS 25.1321(b) ; including attitude, airspeed, altitude, and dir ection information.

Brightness - The perceived or subjective luminance. This should not be confused with luminance.

Bugs - A symbol used to mark or reference other information such as heading, altitude, etc.

Catastrophic - Failure conditions that result in multiple fatalities, usually with the loss of the aeroplane.

( Note: In previous versions of CS 25.1309 and the associated advisory material a “catastrophic failure condition” was defined as a failure condition t hat would prevent continued safe flight and landing. ) Chrominance - The quality of a display image that includes both luminance and chromaticity and is a perceptual construct subjectively assessed by the human observer.

Chromaticity - Colourcharacteristic of a symbol or an image defined by its u’, v’ coordinates (See Commissions Internationale de L’Eclairage publication number 15.3, Colorimetry, 2004).

Clutter - Excessive number and/or variety of symbols, colours, or other information on a display that ma y reduce flight crew access or interpretation time, or decrease the probability of interpretation error.

Coasting Data - Data that is not updated for a defined period of time.

Coding - The use of assigning special meanings to some design element or charac teristic (such as numbers, letters, symbols, auditory signals, colours, brightness, or variations in size) to represent information in a shorter or more convenient form.

Coding Characteristics - Readily identifiable attributes commonly associated with a d esign element that provide special meaning and differentiate the design elements from each other; for example size, shape, colour, motion, location, etc.

Colour Coding - The structured use of colour to convey specific information, call attention to informa tion, or impose an organisational scheme on displayed information.

Command Information - Displayed information directing a control action.

Compact Mode - In display use, this most frequently refers to a single, condensed display presented in numeric format that is used during reversionary or failure conditions.

Conformal - Refers to displayed graphic information that is aligned and scaled with the outside view.

Powered by EASA eRules Page 1441 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Contrast Ratio - For HUD - Ratio of the luminance over the background scene (see SAE AS 8055) .

For HDD - Ratio of the total foreground luminance to the total background luminance.

Criticality - Indication of the hazard level associated with a function, hardware, software, etc., considering abnormal behaviour (of this function, hardware, software ) alone, in combination, or in combination with external events.

Design Eye Position - The position at each pilot's station from which a seated pilot achieves the required combination of outside visibility and instrument scan. The design eye position (DEP) is a single point selected by the applicant that meets the specifications of CS 25.773(d) , CS 25.777(c) , and CS 25.1321 for each pilot station. It is normally a point fixed in relation to the aircraft structure (n eutral seat reference point) at which the midpoint of the pilot’s eyes should be located when seated at the normal position. The DEP is the principal dimensional reference point for the location of flight deck panels, controls, displays, and external visio n.

Display Element – A basic component of a display, such as a circle, line, or dot.

Display Refresh Rate - The rate at which a display completely refreshes its image.

Display Resolution - Size of the minimum element that can be displayed, expressed by t he total number of pixels or dots per inch (or millimetre) of the display surface.

Display Response Time - The time needed to change the information from one level of luminance to a different level of luminance. Display response time related to the intrin sic response me linked to the electro - optic effect used for the display and the way to address it).

Display Surface/Screen - The area of the display unit that provides an image.

Display System - The entire set of avionic devices implemented to display inf ormation to the flight crew. This is also known as an electronic display system.

Display Unit - Equipment that is located in the flight deck, in view of the flight crew, that is used to provide visual information. Examples include a colour head down display and a head up display projector and combiner.

Earth Referenced System - An inertial - based s ystem which provides a display of flight path through space. In a descent, an earth - referenced system indicates the relationship between the flight path and the terrain and/or the artificial horizon.

Enhanced Flight Vision System (EFVS) - An electronic mea ns to provide a display of the forward external scene topography (the natural or manmade features of a place or region, especially in a way to show their relative positions and elevation) through the use of imaging sensors such as millimetre wave radiometr y, millimetre wave radar, and low light level image intensifying.

Enhanced Vision System (EVS) - An electronic means to provide a display of the forward external scene topography through the use of imaging sensors, such as forward looking infrared, millim etre wave radiometry, millimetre wave radar, and low light level image intensifying.

NOTE: An EFVS is an EVS that is intended to be used for instrument approaches under the provisions of 14 CFR 91.175 (l) and 91.175 (m), and must display the imagery with instrument flight information on a HUD.

Extremely Improbable - An extremely improbablefailure condition is so unlikely that it is not anticipated to occur during the entire operational life of all aeroplanes of one type.

Powered by EASA eRules Page 1442 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Extremely Remote - An extremely re mote failure condition is not anticipated to occur to each aeroplane during its total life, but may occur a few times when considering the total operational life of all aeroplanes of that type.

Eye Reference Position (ERP) - A single spatial position loca ted at or near the centre of the HUD Eye Box. The HUD ERP is the primary geometrical reference point for the HUD.

Failure - An occurrence which affects the operation of a component, part, or element, such that it can no longer function as intended (this i ncludes both loss of function and malfunction). NOTE: Errors may cause failures but are not considered to be failures.

Failure Condition - A condition having an effect on the aeroplane and/or its occupants, either direct or consequential, which is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events.

Field of View - The angular extent of the display that can be seen by either pilot with the pil ot seated at either pilots station.

Flicker - An undesired, rapid temporal variation in the display luminance of a symbol, group of symbols, or a luminous field. It can cause discomfort for the viewer (such as headaches and irritation).

Flight Deck Design Philosophy - A high level description of the design principles that guide the designer and ensure a consistent and coherent interface is presented to the flight crew.

Flight Path Angle (FPA) so known as a Flight Path Symbol, Climb, Dive Angle, or “caged” (on the attitude indicator centreline) Flight Path Vector) - A dynamic symbol displayed on an attitude display that depicts the vertical angle relative to the artificial horizon, in the pitch axis, that the aeroplane is moving. A flight p ath angle is the vector resultant of the forward velocity and the vertical velocity. For most designs, the FPA is earth referenced, though some use air mass vectors. Motion of the FPA on the attitude display is in the vertical (pitch) axis only with no lat eral motion.

Flight Path Vector (FPV) so known as Velocity Vector or Flight Path Marker) - A dynamic symbol displayed on an attitude display that depicts the vector resultant of real - time flight path angle (vertical axis) and lateral angle relative to aero plane heading created by wind drift and slip/skid. For most designs, the FPV is earth referenced, though some use air mass vectors which cannot account for wind effects Foreseeable Conditions - The full environment that the display or the display system is assumed to operate within, given its intended function. This includes operating in normal, non - normal, and emergency conditions.

Format (See Figure A3 - 2) - An image rendered on the whole display unit surface. A format is constructed from one or more wind ows (see ARINC Specification 661).

FPV/FPA - referenced Flight Director (FD) - A HUD or HDD flight director cue in which the pilot “flies” the FPV/FPA cue to the FD command in order to comply with flight guidance commands. This is different from attitude FD guidance where the pilot “flies” the aeroplane (that is, pitch, boresight) symbol to follow pitch and roll commands.

Full - time Display - A dedicated continuous information display.

Functional Hazard Assessment - A systematic, comprehensive examination of aeroplane and system function to identify potential Minor, Major, Hazardous, and Catastrophic failure conditions that may arise as a result of malfunctions or failures to function.

Grey Scale - The number of incremental luminance levels between full dark and full bright.

Powered by EASA eRules Page 1443 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Hazard - Any condition that compromises the overall safety of the aeroplane or that significantly reduces the ability of the flight crew to cope with adverse operating conditions.

Hazardous – A hazardous failure condition reduces the ope ration of the aeroplane or the ability of the flight crew to operate in adverse conditions to the extent that there would be: — A large reduction in safety margins or functional capabilities; — Physical distress or excessive workload such that the flight cre w cannot be relied upon to perform their tasks accurately or completely; or — Serious or fatal injury to a relatively small number of the occupants other than the flight crew.

Head Down Display (HDD) - A primary flight display located on the aeroplane’s ma in instrument panel directly in front of the pilot in the pilot’s primary field of view. The HDD is located below the windscreen and requires the flight crew to look below the glareshield in order to use the HDD to fly the aeroplane.

Head Mounted Display (HMD) – A special case of HUD mounted on the pilot’s head. Currently, there are not any HMDs used in CS - 25 installations, but guidance will be provided in the future, as needed.

Head Up Display (HUD) - A display system that projects primary flight information (for example, attitude, air data, guidance, etc.) on a transparent screen (combiner) in the pilot’s forward field of view, between the pilot and the windshield. This allows the pilot to simultaneous ly use the flight information while looking along the forward path out the windshield, without scanning the head down displays. The flight information symbols should be presented as a virtual image focused at optical infinity. Attitude and flight path symb ology needs to be conformal (that is, aligned and scaled) with the outside view.

HUD Design Eye Box - The three - dimensional area surrounding the design eye position, which defines the area, from which the HUD symbology and/or imagery are viewable.

Icon - A single, graphical symbol that represents a function or event.

Image Size - The viewing area (field) of the display surface.

— Direct View Display: The useful (or active) area of the display (for example, units cm x cm).

— Head Up Display: The total field of view (units usually in degrees x degrees).

(Total field of view defines the maximum angular extent of the display that can be seen by either eye allowing head motion within the eyebox (see 8055).

Indication - Any visual information representing the sta tus of graphical gauges, other graphical representations, numeric data messages, lights, symbols, synoptics, etc. to the flight crew.

Information Update Rate - The rate at which new data is displayed or updated .

Interaction - The ability to directly affect a display by utilizing a graphical user interface (GUI) that consists of a control device (for example, a trackball), cursor, and “soft” display control that is the cursor target.

Latency - Thetime taken by the display system to react to a triggered even t coming from an input/output device, the symbol generator, the graphic processor, or the information source.

Layer - A layer is the highest level entity of the Display System that is known by a User Application.

Luminance - Visible light that is emitted from the display. Commonly - used units: foot - lamberts, cd/m2.

Powered by EASA eRules Page 1444 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Major - A majorfailure condition reduces the operation of the aeroplane or the ability of the flight crew to operate in adverse conditions to the extent that there would be, for example: — A significant reduction in safety margins or functional capabilities; — Physical discomfort or a significant increase in flight crew workload — Physical distress to passengers or cabin crew, possibly including injuries.

Menu - A list of display options avai lable for selection.

Message - Acommunication that conveys an intended meaning such as an alerting or data link message.

Minor - A minor failure condition would not significantly reduce aeroplane safety and would involve crew actions well within their ca pabilities. Minor failure conditions may include: — A slight reduction in safety margins or functional capabilities; — A slight increase in crew workload (such as routine flight plan changes); or — Some physical discomfort to passengers or cabin crew.

Mislea ding Information - Incorrect information that is not detected by the flight crew because it appears as correct and credible information under the given circumstances.

When incorrect information is automatically detected by a monitor resulting in an indica tion to the flight crew, or when the information is obviously incorrect, it is no longer considered misleading. The consequence of misleading information will depend on the nature of the information, and the given circumstances.

Mode - The functional stat e of a display and/or control system(s). A mode can be manually or automatically selected.

MSG - 3 - Maintenance Steering Group 3. A steering group sponsored by the Airline Transportation Association whose membership includes representatives from the aviatio n industry and aviation regulatory authorities.

Occlusion - Visual blocking of one symbol by another, sometimes called occulting.

Partitioning - A technique for providing isolation between functionally independent software components to contain and/or isolate faults and potentially reduce the effort of the software verification process.

Pixel - A display picture element which usually consists of th ree (red, green, blue) sub - pixels (also called dots on a cathode ray tube).

Pixel Defect - A pixel that appears to be in a permanently on or off - state.

Primary Flight Displays - The displays used to present primary flight information.

Primary Field of Vi ew (FOV) (See Figure A3 - 1) - Primary Field - of - View is based on the optimum vertical and horizontal visual fields from the design eye reference point that can be viewed with eye rotation only using foveal or central vision. The description below provides an example of how this may apply to head - down displays.

With the normal line - of - sight established at 15 degrees below the horizontal plane, the values for the vertical (relative to normal line - of - sight forward of the aircraft) are +/ - 15 degrees optimum, wi th +40 degrees up and - 20 degrees down maximum.

Powered by EASA eRules Page 1445 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Figure A3 - 1 Primary Field of View Primary Flight Information - The information whose presentation is required by CS 25.1303(b) and CS 25.1333(b) , and arranged by CS 25.1321(b) .

Primary Flight Instrument - Any display or instrument that serves as the flight crew’s primary reference of a specific paramete r of primary flight information. For example, a centrally located attitude director indicator is a primary flight instrument because it is the flight crew’s primary reference for pitch, bank, and command steering information.

Prompt - A method of cueing th e flight crew that some input or action is required.

Required Engine Indications - The information whose presentation is required by CS 25.1305 .

Reversionary - The automatic or flight crew initiated (manual) reloc ation of display formats or windows following a display failure.

Shading - Shading is used as: — A coding method for separating information, change in state, give emphasis, and depth information.

— A blending method between graphic elements (map displays, s ynthetic vision system).

Soft Control - Display element used to manipulate, select, or de - select information (for example, menus and soft keys).

Standby Display - A backup display that is used if a primary display malfunctions.

Status information - Informa tion about the current condition of an aeroplane system and its surroundings.

Powered by EASA eRules Page 1446 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Symbol - A symbol is a geometric form or alpha - numeric information used to represent the state of a parameter on a display. The symbol may be further defined by its location and motion on a display.

Synthetic Vision – A computer generated image of the external topography from the perspective of the flight deck. The image is derived from aircraft attitude, high - precision navigation solution, and terrain database terrain, obstacle s, and relevant cultural features.

Synthetic Vision System – An electronic means to display a synthetic vision image of the external scene topography to the flight crew.

Texturing - A graphic, pictorial effect used to give a displayed object or graphic a specific “look” (metallic, grassy, cloudy, etc.). Texture is used: — As a coding method for separating information, change in state, give emphasis, and depth information.

— As a blending method between graphic elements (map displays, synthetic vision system).

— To enhance similarity between a synthetic image and the real world image.

Time Sharing – Showing different information in the same display area at different times.

Tr ansparency - A means of seeing a background information element through a foreground information element. Transparency can alter the colour perception of both the “front” element and the “back” element.

Viewing Angle – The angle between the normal line of sight (looking straight ahead) and the line from the eye to the object being viewed. The angle can be horizontal, vertical, or a composite of those two angles.

Window (See Figure A3 - 2) - A rectangular physical area of the display surface. A window consists of one or more layers (see ARINC Specification 661).

Figure A3 - 2 – Display Format Windowing - The technique to create windows. Segmenting a single display area into two or more in dependent display areas or inserting a new display area onto an existing display.

[Amdt 25/11] Powered by EASA eRules Page 1447 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AM Cs (CS - 25)

Appendix 4 – Acronyms Used in this AMC

ED Decision 201 5 /0 19 /R AC (FAA) Advisory Circular AMC Acceptable Means of Compliance ARAC Aviation Rulemaking Advisory Committee ARP Aerospace Recommended Practices AS Aerospace Standard CCD Curs or Control Device CFR Code of Federal Regulations CRT Cathode Ray Tube CS - AWO EASA Certification Specifications for All Weather Operations DEP Design Eye Position EASA European Aviation Safety Agency EFVS Enhanced Flight Vision System ERP Eye Reference Position ETSO European Technical Standard Order EUROCAE European Organisation for Civil Aviation Equipment EVS Enhanced Vision System FAA Federal Aviation Administration FADEC Full Authority Digital Engine Controls FD Flight Director FHA Functional Hazard Assessment FMS Flight Management System FOV Field - of - View FPA Flight Path Angle FPV Flight Path Vector GNSS Global Navigation Satellite System GUI Graphical User Interface HDD Head - Down Display HMD Head - Mounted Display HUD Head - Up Display ILS Instrument Landing System I CAO International Civil Aviation Organization JAA Joint Aviation Authorities LCD Liquid Crystal Display MSG - 3 Maintenance Steering Group 3 PF Pilot Flying PNF Pilot Not Flying RA Resolution Advisory RNAV Area Navigation SAE SAE International (formerly Society of Automotive Engineers) SVS Synthetic Vision System TAWS Terrain Awareness and Warning System TCAS Traffic Alert and Collision Avoidance System VFR Visual Flight Rules Powered by EASA eRules Page 1448 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) VNAV Vertical Navigation VOR Very High Frequency Omnirange Stations [Amdt 25/11] [Amdt 25/17] Powered by EASA eRules Page 1449 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25)

Appendix 6 – Head - Up Display

ED Decision 2015/019/R Contents No table of contents entries found.

1.0 Introduction 1.1 Purpose This Appendix provides additional guidance related to the unique aspects, characteristics, and functions of Head - Up Displays (HUDs) for transport category aeroplanes. This Appendix also addresses issues related to the design, analysis, and testing of HUDs. It addresses HUDs that are designed for a variety of different operational concepts and functions. This gui dance applies to HUDs that are intended to be used as a supplemental display in which the HUD contains the minimum information immediately required for the operational task associated with the intended function. It also applies to HUDs that are intended to be used effectively as primary flight displays. This Appendix addresses both the installation of a single HUD, typically used by the left - side pilot, as well as special considerations related to dual HUDs, one for each pilot. This Appendix does not provid e the guidance for display of vision system (e.g. Enhanced Flight Vision Systems (EFVS) and Synthetic Vision Systems (SVS)) video on the HUD. The airworthiness requirements and means - of - compliance criteria for display of video on the HUD may be found in th e Certification Review Items (CRIs) issued by the Agency until new CSs and AMCs are issued.

1.2 Definition of Head - Up Display (HUD) An HUD is a display system that projects primary flight information (for example, attitude, air data, and guidance) on a tr ansparent screen (combiner) in the pilot’s forward Field - of - View (FOV), between the pilot and the windshield. This allows the pilot to simultaneously use the flight information while looking along the forward path out of the windshield, without scanning th e Head - Down Displays (HDDs). The flight information symbols should be presented as a virtual image focussed at optical infinity. Attitude and flight path symbology needs to be conformal (that is, aligned and scaled) with the outside view.

1.3 Other resourc es For guidance associated with specific operations using HUDs, such as low - visibility approach and landing operations, see the relevant requirements and guidance material (e.g. EASA Certifications Specifications for All Weather Operations (CS - AWO), and FAA Advisory Circular (AC) 120 - 28D, Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout). In addition, Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 5288, Transport Category Aero plane Head Up Display (HUD) Systems; SAE Aerospace Standard (AS) 8055, Minimum Performance Standard for Airborne Head Up Display (HUD); and SAE ARP5287, Optical Measurement Procedures for Airborne Head Up Display; provide guidance for designing and evaluat ing HUDs.

Powered by EASA eRules Page 1450 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 2.0 Unique safety considerations 2.1 Aeroplane and systems safety 2.1.1 Systems Installing HUD systems in flight decks may introduce complex functional interrelationships among the flight crew members and other display and control systems. Cons equently, a functional hazard assessment which requires a top - down approach from an aeroplane - level perspective should be developed in accordance with CS 25.1309 . Developing a functional hazard assessment for a particular installation requires careful consideration of the role that the HUD plays within the flight deck in terms of integrity and availability of function, as well as the operational concept of the installation to be certified (e.g. dual - HUD versus si ngle - HUD installation, and the type and amount of information displayed). Chapter 4 of this AMC provides material that may be useful in preparing the functional hazard assessment.

2.1.2 Aeroplane Flight Manual (AFM) procedures All alleviating flight crew a ctions that are considered in the HUD safety analysis need to be validated for incorporation into the AFM procedures section or for inclusion in type - specific training.

2.1.3 Availability of primary flight information Requirements for the availability of p rimary flight information are provided in CS 25.1333 .

2.2 Crew safety 2.2.1 Prevention of head injury HUD equipment introduces potential hazards that are not traditionally associated with head - down electronic fligh t deck displays. The HUD system must be designed and installed to prevent the possibility of pilot injury in the event of an accident or any other foreseeable circumstance such as turbulence, hard landing, or bird strike.

An HUD combiner with a swing - arm d eployment mechanism should be designed to avoid false detents and false latch indications between the fully stowed and deployed positions. A misstowed combiner could swing inadvertently into the path of the pilot’s head and cause injury. Additionally, the HUD installation, including the overhead unit and combiner, must comply with the occupant injury requirements of CS 25.785(d) and (k) and the retention requirements of CS 2 5.789(a) .

2.2.2 Special considerations for dual - HUD installations For dual - HUD installations, the applicant should address single events that could simultaneously incapacitate both pilots and, therefore, become safety - of - flight issues. Examples of such sin gle events are flight or gust loads, a hard landing, or an emergency landing. The Agency may need to issue a Certification Review Item providing project - specific means of compliance if the installation geometry indicates that such events may produce occupa nt contact with the HUD installation.

Powered by EASA eRules Page 1451 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 2.2.3 Non - interference with emergency equipment CS 25.803 , CS 25.1411 , and CS 25.1447 requ ire that the HUD installation must not interfere with, or restrict the use of, other installed equipment such as emergency oxygen masks, headsets, or microphones. The installation of the HUD should not adversely affect the emergency egress provisions for t he flight crew, or significantly interfere with flight crew access. The system should not hinder the flight crew’s movement while conducting any flight procedures.

3.0 Design 3.1 Intended function of HUDs The applicant is responsible for identifying the intended function of the HUD. The description of the intended function should include the operational phases of flight and the concept of operation, including how, when, and for what purpose(s) the HUD is to be used. For example, the HUD ma y display situational information and/or guidance information, be a supplemental display of primary flight information in all phases of flight, display command guidance for manually flown approaches and/or for monitoring autopilot - coupled instrument approa ches, display guidance for low - visibility take - off, and/or display enhanced vision imagery and synthetic vision video. See paragraph 11.c of this AMC for additional guidance.

3.1.1 General In most applications, HUDs provide an indication of primary flight references, which allow the pilot to rapidly evaluate the aircraft attitude, energy status, and position during the phases of flight for which the HUD is designed. HUDs are usually designed to present information to enhance pilot performance in such phases of flight as during the transition between instrument and visual flight conditions with variable outside visibility conditions. While HUDs may be designed to display enhanced and synthetic visual imagery, particular means - of - compliance guidance for this p urpose is not found in this Appendix but will be addressed by associated CRIs until new CSs and AMCs are issued.

3.1.2 Display of primary flight information 3.1.2.1 HUD as de facto primary flight display If an HUD displays primary flight information, it is considered a de facto primary flight display while the pilot is using it, even if it is not the pilot’s sole display of this information. The pilot should be able to easily recognise the primary flight i nformation — it should not be ambiguous or confusing when taking into account information displayed on other flight deck displays.

3.1.2.2 Applicable instrument requirements for HUD Primary flight information displayed on the HUD should comply with all th e requirements associated with such information in CS - 25 (e.g. CS 25.1303(b) for flight and navigation instruments that must be visible from each pilot station, and CS 25.1 333(b) for the operational requirements of those systems). CS 25.1321(b) specifies the requirements for arranging primary flight information. For specific guidance regarding the display of primary flight informatio n, see the main body and Appendix 1 of this AMC.

Powered by EASA eRules Page 1452 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 3.1.3 Display of other flight information Additional information may be related to the display of command guidance or specific flight parameter information needed for operating the aeroplane by reference to the HUD.

3.1.3.1 Command guidance When the HUD is used to monitor the autopilot, it should display the following information: — situation information based on independent raw data; — autopilot operating mode; — autopi lot engage status; and — autopilot disconnect warning (visual).

3.1.3.2 Flight parameter information The HUD should also display additional flight parameter information, if required, to enable the pilot to operate the aeroplane during phases of flight for which the HUD is approved. This additional information may include: — flight path indication; — target airspeed references and speed limit indications; — target altitude references and altitude awareness (e.g. decision height and minimum descent altitude) in dications; or — heading or course references.

3.2 HUD controls 3.2.1 Control placement For compliance with CS 25.777 , the flight crew must be able to see, identify, and reach the means of controlling the HUD, includi ng its configuration and display modes, from the normal seated position. To comply with CS 25.777 and CS 25.1301 , the position and movement of the HUD controls must not lea d to inadvertent operation.

3.2.2 Control illumination To comply with CS 25.1381 , the HUD controls must be adequately illuminated for all normal ambient lighting conditions and must not create any objectionable ref lections on the HUD or other flight instruments. Unless a fixed level of illumination is satisfactory under all lighting conditions, there should be a means to control its intensity.

3.2.3 Control integration To the greatest extent practicable, HUD control s should be integrated with other associated flight deck controls to minimise the flight crew workload and error associated with HUD operation and to enhance flight crew awareness of HUD modes.

Powered by EASA eRules Page 1453 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 3.2.4 Ease of use HUD controls, including the controls to change or select HUD modes, should be implemented to minimise flight crew workload for data selection or data entry, and allow the pilot to easily view and perform all mode control selections from the seated position.

3.3 Visibility and Field - o f - View (FOV) 3.3.1 Field - of - View The design of the HUD installation should provide adequate display FOV in order for the HUD to function as intended in all anticipated flight attitudes, aircraft configurations, and environmental conditions, such as crossw inds, for which it is approved. The AFM should specify all airworthiness and operational limitations related to these factors.

3.3.2 Impact on pilot compartment view 3.3.2.1 Interior view Whether or not the combiner is deployed and the HUD is in use, it must not create additional significant obstructions to either pilot’s compartment view as required by CS 25.773 . The HUD must also not restrict the view of any flight deck controls, indicators, or other flight instruments as required by CS 25.777 and CS 25.1321 .

3.3.2.2 External view The HUD should not significantly ob scure the necessary pilot compartment view of the outside world for normal, non - normal, or emergency flight manoeuvres during any phase of flight for a pilot seated at the Design Eye Position (DEP). The HUD should not significantly affect the ability of an y flight crew member to spot traffic, distinctly see approach lights, runways, signs, markings, or other aspects of the external visual scene. The combination of the windshield and the HUD must meet the requirements of CS 25.773(a)(1) .

3.3.2.3 HUD optical performance As far as practicable, the optical performance of the HUD should not cause distortions that degrade or detract from the flight crew’s view of external references or of other aircraft. The optical perfor mance should not degrade or detract from the flight crew’s ability to safely perform any manoeuvres within the operating limits of the aeroplane, as required by CS 25.773 .

Where the windshield optically modifies th e pilot’s view of the outside world, the motions and positions of conformal HUD symbols should be optically consistent (i.e. aligned and scaled) with the perceived outside view.

To avoid distortions, the optical qualities of the HUD should be uniform acros s the entire FOV. When the pilot views the HUD with both eyes from any off - centre position within the design eyebox, optical non - uniformities should not produce perceivable differences in the binocular view. SAE ARP 5288, Transport Category Aeroplane Head Up Display (HUD) Systems, provides additional guidance.

Powered by EASA eRules Page 1454 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 3.3.3 Conformal symbols with limited HUD Field - of - View The range of motion of conformal symbology can present certain challenges in rapidly changing and high - crosswind conditions. In certain cases, the motion of the guidance and the primary reference cue may be limited by the FOV. It should be shown that, in such cases, the guidance remains usable and that there is a positive indication that it is no longer conformal with the outside scene. It should also be shown that there is no interference between the indications of primary flight information and the flight guidance cues.

4.0 HUD design eyebox criteria 4.1 Design eye position The FAA AC 25.773 - 1, Pilot Compartment View Design Considerations, defin es DEP as a single point that meets the requirements of CS 25.773 and CS 25.777 . For certification purposes, the DEP is the pilot’s normal seated position. Fixed markers or some other means should be provided at each pilot station to enable the pilots to position themselves in their seats at the DEP for an optimum combination of outs ide visibility and instrument scan. The HUD installation must comply with CS 25.773 and CS 25.1321 . The HUD should be able to accommodate pilots, from 1 575 to 1 905 mm (5 ft 2 in to 6 ft 3 in) tall, while they are seated at the DEP with their shoulder harnesses and seat belts fastened, to comply with CS 25.777 . The DEP should be centred within the minimum design eyebox dimensions fo und in paragraph 4.2.3 of this Appendix. Actual HUD eyeboxes are larger than these minimum dimensions and, if not centred around the DEP, they need only be large enough so that this minimum sub - volume is centred around the DEP.

4.2 Design eyebox 4.2.1 Disp lay visibility requirements The fundamental requirements for instrument arrangement and visibility in CS 25.773 , CS 25.777 , CS 25. 1301 , and CS 25.1321 apply to HUDs. Each flight instrument, including the flight information displayed on the HUD, must be plainly visible to the pilot at that pilot’s station with minimum practicable deviation fro m the normal position and forward line of vision. While seated at the DEP, the pilot must be able to see the flight information displayed on the HUD. The optical characteristics of the HUD, particularly the limits of its design eyebox, cause the pilot’s ab ility to fully view essential flight information to be more sensitive to the pilot’s eye position, as compared to HDDs. The HUD design eyebox is a three - dimensional volume, specified by the manufacturer, within which display visibility requirements are met . Thus, whenever the pilot’s eyes are within the design eyebox, the required flight information must be visible on the HUD. The size of the design eyebox and the layout of flight information on the HUD should be designed so that visibility of the displayed symbols is not unduly sensitive to pilot head movements in all expected flight conditions. In the event that the pilot’s view of displayed information is totally lost as a result of a head movement, the pilot should be able to regain the view of the displ ay rapidly and without difficulty. The minimum monocular FOV required to display this required flight information should include the centre of the FOV and should be specified by the manufacturer.

The HUD FOV should be designed by considering the intended o perational environment and potential aeroplane configurations.

Powered by EASA eRules Page 1455 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 4.2.2 Design eyebox position The HUD design eyebox should be laterally and vertically positioned around the respective pilot’s DEP. It should be large enough so that the required flight information is visible to the pilot at the minimum displacements from the DEP specified in paragraph 4.2.3 of this Appendix. The symbols should be laid out and positioned such that excessive eye movements are not required to scan elements of the display. T he displayed symbols which are necessary to perform the required tasks should be visible to the pilot from the DEP. The DEP used for the evaluation of the eyebox location should be the same as that used for the basic flight deck in accordance with the FAA AC 25.773 - 1.

4.2.3 Design eyebox dimensions The lateral and vertical dimensions of the design eyebox represent the total movement of a monocular viewing instrument with a 6.35 mm (0.25 in) entrance aperture (pupil). The longitudinal dimension of the design eyebox represents the total fore – aft movement over which the requirement of this specification is met (refer to SAE AS 8055). When the HUD is a primary flight display, when airworthiness approval is predicated on the use of the HUD, or when the pilo t can be reasonably expected to operate primarily by reference to the HUD, dimensions larger than the minimums shown below may be necessary.

4.2.3.1 Lateral: 38.1 mm (1.5 in) left and right from the DEP (76.2 mm (3.0 in) wide).

4.2.3.2 Vertical: 25.4 mm (1 .0 in) up and down from the DEP (50.8 mm (2.0 in) high).

4.2.3.3 Longitudinal: 50.8 mm (2.0 in) fore and aft from the DEP (101.6 mm (4.0 in) deep).

4.3 Conformal display accuracy 4.3.1 Symbol positioning The accuracy of symbol positioning relative to the e xternal references, or display accuracy, is a measure of the relative conformality of the HUD display with respect to the pilot’s view of the real world through the combiner and windshield from any eye position within the HUD design eyebox. The display acc uracy is a monocular measurement. For a fixed field point, the display accuracy is numerically equal to the angular difference between the position of a real - world feature (as seen through the combiner and windshield) and the HUD projected symbology.

4.3.2 Error budget The total error budget for the display accuracy of the HUD system (excluding sensor and windshield errors) includes installation errors, digitisation errors, electronic gain and offset errors, optical errors, combiner positioning errors, erro rs associated with the CRT and yoke (if applicable), misalignment errors, environmental conditions (e.g. temperature and vibration), and component variations.

4.3.2.1 Error sources Optical errors are dependent upon both the head position and the field ang le. Optical errors comprise three sources: uncompensated pupil and field Powered by EASA eRules Page 1456 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) errors originating in the optical system aberrations, image distortion errors, and manufacturing variations. Optical errors are statistically determined by sampling the HUD FOV and th e design eyebox (see 4.2.10 of SAE AS8055 for a discussion of FOV and design eyebox sampling).

4.3.2.2 Total accuracy The optical errors should represent at least 95.4 % (2 sigma) of all sampled points. The display accuracy errors are characterised in both the horizontal and vertical planes. The total display accuracy should be characterised as the root - sum square errors of these two component errors.

4.3.2.3 Allowable margin for display errors All display errors should be minimised across the display FOV c onsistent with the intended function of the HUD. Table A6 - 1 shows the allowable display accuracy errors for a conformal HUD as measured from the HUD eye reference point: Table A6 - 1 — Allowable display accuracy errors Location on the HUD combiner Error tole rance in milliradians (mrad) At HUD bore sight ≤ 5.0 mrad ≤ 10° diameter ≤ 7.5 mrad (2 sigma) ≤ 30° diameter ≤ 10.0 mrad (2 sigma) > 30° diameter < 10 mrad + kr [(FOV)(in degrees) – 30)] (2 sigma) where kr = 0.2 mrad of error per degree of FOV 4.3.2.4 Maximum error The HUD manufacturer should specify the maximum allowable installation error. In no case should the display accuracy error tolerances cause hazardously misleading data to be presented to the pilot viewing the HUD.

4.4 Symbol positioni ng alignment The symbols intended for use in combination with other symbols and scales to convey meaning should be aligned and positioned precisely enough not to be misleading to the pilot.

4.5 Overlapping symbols Symbols that share space with other symbol s should not partially obscure or interfere with the appearance of other symbols in a way that misleads the pilot.

4.6 Alignment 4.6.1 Outside view The HUD combiner should be properly aligned so that display elements such as attitude scales and flight path vector symbology are conformal (i.e. the position and motion are aligned and scaled). Proper combiner alignment is needed to match conformal display parameters as close as possible to the outside real world, depending on the intended function o f those parameters.

4.6.2 Combiner If the HUD combiner is stowable, means should be provided to ensure that it is in its fully deployed and aligned position before using the symbology for aircraft Powered by EASA eRules Page 1457 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) control. The HUD should alert the pilot if the position of the combiner causes normally conformal data to become misaligned in a manner that may result in the display of misleading information.

4.7 Visual display characteristics The following paragraphs highlight some areas related to performance aspects that are specific to the HUD. SAE ARP5288, Transport Category Aeroplane Head Up Display (HUD) Systems and SAE AS8055, Minimum Performance Standard for Airborne Head Up Display (HUD), provide performance guidelines for an HUD. As stated in Chapter 3 of this AMC, the applicant should notify the Agency if any visual display characteristics do not meet the guidelines in SAE ARP5288 and AS8055.

4.7.1 Luminance 4.7.1.1 Background light conditions The display luminance (brightness) should be satisfactory in the presence of dynamically changing background (ambient) lighting conditions (5 to 10 000 foot - Lambert (fL), as specified in SAE AS8055), so that the HUD data are visible.

4.7.1.2 Luminance control The HUD should have adequate means to control luminance so that displaye d data is always visible to the pilot. The HUD may have both manual and automatic luminance control capabilities. It is recommended that automatic control is provided in addition to the manual control. Manual control of the HUD brightness level should be a vailable to the flight crew to set a reference level for automatic brightness control. If the HUD does not provide automatic control, a single manual setting should be satisfactory for the range of lighting conditions encountered during all foreseeable ope rational conditions and against expected external scenes. Readability of the displays should be satisfactory in all foreseeable operating and ambient lighting conditions. SAE ARP5288 and SAE AS8055 provide guidelines for contrast and luminance control.

4.7 .2 Reflections The HUD must be free of glare and reflections that could interfere with the normal duties of the minimum flight crew, as required by CS 25.773 and CS 25.1523 .

4.7.3 Ghost images A ghost image is an undesired image appearing at the image plane of an optical system. Reflected light may form an image near the plane of the primary image.

This reflection may result in a false image of the object or an out - of - focus image of a bright source of light in the field of the optical system. The visibility of ghost images within the HUD of external surfaces should be minimised so as not to impair the flight crews ability to use the display.

4.7.4 Accuracy and stability 4.7. 4.1 Sensitivity to aircraft manoeuvring The system operation should not be adversely affected by aircraft manoeuvring or changes in attitude encountered in normal service.

Powered by EASA eRules Page 1458 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GE NERAL AMCs (CS - 25) 4.7.4.2 Motion of symbols The accuracy of positioning of symbols should be commensurate with their intended use. Motion of non - conformal symbols should be smooth, not sluggish or jerky, and consistent with aircraft control response. Symbols should be stable with no discernible flicker or jitter.

5.0 Guidelines for presenting info rmation 5.1 HUD and HDD compatibility 5.1.1 General If the content, arrangement, or format of the HUD is dissimilar to the HDD, it can lead to flight crew confusion, misinterpretation, and excessive cognitive workload.

During transitions between the HUD an d HDDs (whether required by navigation duties, failure conditions, unusual aeroplane attitudes, or other reasons), dissimilarities could make it more difficult for the flight crew to manually control the aeroplane or to monitor the automatic flight control system. Dissimilarities could also delay the accomplishment of time - critical tasks. Some differences may be unavoidable, such as the use of colour on the HDD and a single colour (i.e.

monochrome) on the HUD. The guidelines listed below are intended to min imise the potential for confusion, undue workload, and delays in flight crew task performance.

5.1.2 Exceptions Deviation from the guidelines below may be unavoidable due to conflict with other information display characteristics or requirements unique to HUDs. These deviations may relate to the minimisation of display clutter, minimisation of excessive symbol flashing, and the presentation of certain information conformal to the outside scene. Deviations from these guidelines require additional pilot evaluation.

5.1.3 Guidelines for HUD – HDD compatibility 5.1.3.1 Consistent displays and format The content, arrangement, symbology, and format of the information on the HUD should be sufficiently compatible with the HDDs to preclude pilot confusion, misinterpretation, increased cognitive workload, or flight crew error (see paragraphs 31.b and 31.c(3) of this AMC). The layout and arrangement of HUD and HDD formats of the same information need to convey the same intended meanings (see paragra ph 36.b of this AMC). For example, the relative locations of barometric altitude, airspeed, and attitude should be similar. Likewise, the acronyms and relative locations of flight guidance mode annunciations for thrust and lateral and vertical flight path should be similar.

Powered by EASA eRules Page 1459 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 5.1.3.2 Symbols Table A6 - 2 provides the guidelines for symbols.

Table A6 - 2 — Symbol guidelines for HUD – HDD compatibility Symbol Guidelines characteristics Shape and HUD symbols that have similar shape and appearance as HDD appearance symbols should have the same meaning. It is not acceptable to use similar symbols for different meanings. Symbols that have the same meaning should have the same shape and appearance on the HUD and HDDs.

Special symbolic Special display features or changes may be used to convey features particular conditions, such as an overlaid ‘X’ to mean failure of a parameter, a box around a parameter to convey that its value changed, a solid line/shape changing to a dashed line/shape to convey that its motion is limited, and so on. To the extent that it is practical and meaningful, the same display features should be used on the HUD as on the HDDs.

Relative location Information that relates to the symbols should appear in the same general location relative to other information.

5.1.3.3 Alphanumeric information Alphanumeric (i.e. textual) information should have the same resolution, units, and labelling. For example, the command reference indication for vertical speed should be displayed in the same foot - per - minute increments and labelled with the same characters as on the HDDs. Likewise, the same terminology should be used for labels, modes, and alert messages on the HUD as on the HDDs. If the design has exceptions to this principle, then they should be justified by necessity or impracticality, and shown not to increase workload or the potential for flight crew confusion or flight crew error.

5.1.3.4 Analog scales or dials Analog scales or dials should have the same range and dynamic operation.

For ex ample, a glideslope deviation scale displayed head - up should have the same displayed range as when it is displayed head - down, and the direction of movement should be consistent.

5.1.3.5 Flight guidance systems Modes of flight guidance systems (e.g. autopil ot, flight director, and autothrust) and state transitions (e.g. land 2 to land 3) should be displayed on the HUD. Except for the use of colour, the modes should be displayed using consistent methods (e.g. the method used head - down to indicate a flight dir ector mode transitioning from armed to captured should also be used head - up).

5.1.3.6 Command information When command information (e.g. flight director commands) is displayed on the HUD in addition to the HDDs, the HUD guidance cue and path deviation scal ing (i.e. dots of lateral and vertical deviation) need to be consistent with that used on the HDDs. There may be cases when the other pilot is using the HDD of guidance and path deviations to monitor the flying pilot’s Powered by EASA eRules Page 1460 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) performance. Therefore, the HDD must have path deviation scaling that is sufficiently consistent with the HUD so as not to mislead the monitoring pilot.

5.1.3.7 Sensor sources Sensor system sources for instrument flight information (e.g. attitude, direction, altitude, and airspeed) should be consistent between the HUD and the HDDs used by the same pilot.

5.1.4 Head - up to head - down transition 5.1.4.1 Transition scenarios The applicant should identify conditions for which the pilot transitions between the HUD and the HDD and develop scenarios fo r evaluation (e.g.

simulation or flight test). These scenarios should include systems’ failures and events leading to unusual attitudes. Transition capability should be shown for all foreseeable modes of upset.

5.1.4.2 Unambiguous information While the HUD and HDD may display information (e.g. flight path, path deviation, or aircraft performance information) in a different manner, the meaning should be the same and any differences should not create confusion, misinterpr etation, unacceptable delay, or otherwise hinder the pilot’s transition between the two displays. The pilot should be able to easily recognise and interpret information on the HUD. The information should not be ambiguous with similar information on other a ircraft flight deck displays.

5.2 Indications and alerts 5.2.1 Monochrome attention - getting properties To comply with CS 25.1322 , and considering that most HUDs are predominantly monochrome devices, the HUD should emphasise the display of caution and warning information with the appropriate use of attention - getting properties such as flashing, outline boxes, brightness, size, and/or location to compensate for the lack of colour coding. For additional alerting guidan ce, see AMC 25.1322 ‘Flight Crew Alerting’. The applicant should develop and apply a consistent documented philosophy for each alert level. These attention - getting properties should be consistent with those used on the HDDs. For example, flashing icons on the HUD should indicate situations with the same level of urgency as flashing icons on the HDDs.

5.2.2 Time - critical alerts on the HUD For some phases of flight, airworthiness approval may be predicated on the use of the HUD. In these phases of flight, it can be reasonably expected that the pilot operates primarily by using the HUD, so the objective is to not redirect attention of the Pilot Flying (PF) to another display when an immediate manoeuvre is required (e.g . resolution advisory or windshear). The applicant should provide in the HUD the guidance, warnings, and annunciations of certain systems, if installed, such as a Terrain Awareness and Warning System (TAWS), or a Traffic Alert and Collision Avoidance Syste m (TCAS) and a windshear detection system. If the provision of TCAS or windshear guidance is not practical on the HUD, the applicant should provide compensating design features and pilot procedures (e.g. a Powered by EASA eRules Page 1461 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) combination of means such as control system protec tions and an unambiguous reversion message on the HUD) to ensure that the pilot has equivalent and effective visual information for immediate awareness and response to the respective alerts.

5.2.3 Additional resources Additional guidance on indications and alerts is contained in AMC No 1 to CS 25.1329 , Flight Guidance System, in AMC No 2 to CS 25.1329 , Flight Testing of Flight Guidance Systems, in AMC 25.1322 , Flight Crew Alerting, and in the associated rules.

5.3 Display clutter This AMC addresses display clutter for traditional displays on the instrument pane l.

However, because the pilot must see through the HUD, special attention is needed to avoid display clutter that would otherwise unduly obscure the outside view.

5.4 Display of information 5.4.1 General The HUD information display requirements depend on t he intended function of the HUD. Specific guidance for displayed information is contained within the main body and Appendix 1 of this AMC. In addition, the following sections provide guidance related to unique char acteristics of the HUD. As in the case of other flight deck displays, new and novel display formats may be subject to human factors evaluation of the pilot interface by an airworthiness authority.

5.4.2 Alternate formats for primary flight information 5.4. 2.1 Phase of flight There may be certain operations and phases of flight during which certain primary flight reference indications on the HUD do not need to have the analog cues for trend, deviation, and quick glance awareness that would normally be necess ary. For example, during the precision approach phase, HUD formats have been accepted that provide a digital - only display of airspeed and altitude. Acceptance of these displays has been predicated on the availability of compensating features that provide c lear and distinct warning to the flight crew when these and certain other parameters exceed well - defined tolerances around the nominal approach state (e.g. approach warning). These warnings have associated procedures that require a missed approach.

5.4.2.2 Digital displays Formats with digital - only display of primary flight information (e.g. airspeed, altitude, attitude, and heading) should be demonstrated to provide at least one of the following: — a satisfactory level of task performance; — a satisfactory awa reness of proximity to limit values like V , V , and S MO V ; and FE — a satisfactory means to avoid violating such limits.

Powered by EASA eRules Page 1462 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 5.4.2.3 Go - around and missed approach If a different display format is used for go - around than that used for the approach, the format transition should occur automatically as a result of the normal go - around or missed approach procedure.

5.4.2.4 Minimise format changes Changes in the display format and primary flight data arrangement should be minimised to prevent confusion and to enhance the flight crew’s ability to interpret vital data.

5.4.3 Aircraft control considerations For those phases of flight where airworthiness approval is predicated on the use of the HUD, or when it can be reasonably expected that the fl ight crew will operate primarily by reference to the HUD, the HUD should adequately provide the following information and cues.

5.4.3.1 Flight state and position The HUD should provide information to permit the pilot to instantly evaluate the aeroplane’s f light state and position. This information should be adequate for manually controlling the aeroplane and for monitoring the performance of the automatic flight control system. Using the HUD for manual control of the aeroplane and for monitoring the automat ic flight control system should not require exceptional pilot skill, excessive workload, or excessive reference to other flight displays.

5.4.3.2 Attitude cues Attitude cues should enable the pilot to instantly recognise unusual attitudes. Attitude cues sh ould not hinder unusual attitude recovery. If the HUD is designed to provide guidance or information for recovery from upsets or unusual attitudes, recovery steering guidance commands should be distinct from, and not confused with, orientation symbology su ch as horizon pointers. This capability should be shown for all foreseeable modes of upset, including crew mishandling, autopilot failure (including ‘slow - overs’), and turbulence/gust encounters.

5.4.4 Airspeed considerations 5.4.4.1 Airspeed scale range A s with other electronic flight displays, the HUD airspeed indications may not typically show the entire range of airspeed. CS 25.1541(a)(2) states that ‘The aeroplane must contain - Any additional information, instr ument markings, and placards required for the safe operation if there are unusual design, operating, or handling characteristics.’.

5.4.4.2 Low - and high - speed awareness cues Low - speed awareness cues on the HUD should provide adequate visual cues to the pi lot that the airspeed is below the reference operating speed for the aeroplane configuration (e.g. weight, flap setting, and landing gear position).

Similarly, high - speed awareness cues should provide adequate visual cues to the pilot that the airspeed is approaching an established upper limit that may result in a hazardous operating condition.

Powered by EASA eRules Page 1463 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 5.4.4.3 Format of low - and high - speed awareness cues The low - and high - speed awareness cues should be readily distinguishable from other markings such as V - speeds an d speed targets (e.g. bugs). The cues should indicate the boundary value of speed limit, and they should also clearly distinguish between the normal speed range and the unsafe speed range beyond those limiting values. Cross - hatching or other similar coding techniques may be acceptable to delineate zones of different meaning.

5.4.5 Flight path considerations 5.4.5.1 General The type of flight path information displayed (e.g. earth - referenced or air mass) may be dependent on the operational characteristics of a particular aeroplane and the phase of flight during which the flight path is to be displayed.

5.4.5.2 Velocity/flight path vector An indication of the aeroplane’s velocity vector, or flight path vector, is considered essential to most HUD applications. Earth - referenced flight path display information provides an instantaneous indication of where the aeroplane is actually going. During an approach, this information can be used to indicate the aeroplane’s impact or touchdown point on the runway.

The earth - referenced flight path shows the effects of wind on the motion of the aeroplane. The flight path vector can be used by the pilot to set a precise climb or dive angle relative to the conformal outside scene or relative to the HUD’s flight path (pitch) refer ence scale and horizon displays. In the lateral axis, the flight path symbols should indicate the aeroplane’s track relative to the bore sight.

5.4.5.3 Air - mass - derived flight path Air - mass - derived flight path may be displayed as an alternative, but it do es not show the effects of wind on the motion of the aeroplane. In this case, the lateral orientation of the flight path display represents the aeroplane’s sideslip, while the vertical position relative to the reference symbol represents the aeroplane’s an gle of attack.

5.4.6 Attitude considerations 5.4.6.1 General For all unusual attitude situations and command guidance display configurations, the displayed attitude information should enable the pilot to make accurate, easy, quick glance interpretation of the attitude situation.

5.4.6.2 Pitch The pitch attitude display should be such that, during all manoeuvres, a horizon reference remains visible with enough margin to allow the pilot to recognise pitch and roll orientation. For HUDs that are capable of displaying the horizon conformally, the display of a non - conformal horizon reference should appear distinctly different than the display of a conformal horizon reference.

Powered by EASA eRules Page 1464 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 5.4.6.3 Display of unusual attitude conditions Extreme attitude symbology and automatically decluttering the HUD at extreme attitudes has been found acceptable (i.e. extreme attitude symbology should not be visible during normal manoeuvring).

5.4.6.4 Unusual attitude recovery When the HUD is not designed to be used for recovery from unusual attitude, the applicant should provide a satisfactory demonstration of the following.

5.4.6.4.1 Compensating features (e.g. characteristics of the aeroplane and the HUD system).

5.4.6.4.2 Immediate annunciation on the HUD to direct the pilot to us e the head - down primary flight display for recovery.

5.4.6.4.3 Satisfactory demonstration of timely recognition and correct recovery manoeuvres.

5.4.6.5 Flight crew awareness of HUD modes The same information concerning current HUD system mode, reference d ata, status state transitions, and alert information that is displayed to the pilot using the HUD should also be displayed to the other pilot. The display of this information for the other pilot should use consistent nomenclature to ensure unmistakable awa reness of the HUD operation.

6.0 Dual HUDs 6.1 Operational concept for dual HUDs The applicant should define the operational concept using dual HUDs. The operational concept should detail the tasks and responsibilities of both PF and Pilot Not Flying (PNF) with regard to using and monitoring HDDs and HUDs during all phases of flight. It should specifically address the simultaneous use of the HUD by both pilots during each phase of flight, as well as cross - flight - deck transfer of control.

6.2 Flight crew awa reness of other instruments and indications With single - HUD installations, the PF likely uses the HUD as a primary flight reference and the PNF monitors the head - down instruments and alerting systems for failures of systems, modes, and functions that are n ot displayed on the primary flight displays or on the HUD. However, in the case where both flight crew members simultaneously use HUDs, they should be able to maintain an equivalent level of awareness of key information that is not displayed on the HUD (e. g. powerplant indications, alerting messages, and aircraft configuration indications).

6.3 Roles and responsibilities The applicant should define the operational concept to account for the expected roles and responsibilities of the PF and the PNF. The conc ept should also take into account the following considerations.

6.3.1 Impact on head - down vigilance When both pilots of the flight crew use an HUD as the primary flight display, the visual head - down indications may not receive the same level of vigilance ( as compared to a pilot using the head - down primary flight display).

Powered by EASA eRules Page 1465 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 6.3.2 Assurance of head - down scan The applicant should explain how the scan of the head - down instruments is ensured during all phases of flight and, if not, what compensating design featur es help the flight crew maintain awareness of key information that is only displayed on the HDDs (e.g. powerplant indications, alerting messages, and aircraft configuration indication). The applicant should describe which pilot scans the head - down instrume nt indications and how often. For any case in which at least one pilot is not scanning the head - down instruments full - time, the design should have compensating design features that ensure an equivalent level of timeliness and awareness of the information p rovided by the head - down visual indications.

6.3.3 Alerts The design should effectively compensate for any cautions and warnings that do not have visual indications on the HUD that are equivalent to the head - down primary flight display. The purpose of the compensating design features is to make the pilot using the HUD aware of the alerts so there are no additional delays in awareness and response time. The flight crew should be able to respond to alerts without any reduction in task performance or degra ded safety.

6.4 Reassessment The applicant should globally reassess the alerting functions to ensure that the flight crew is aware of alerts and responds to them in a timely manner. The reassessment should review the design and techniques, the alerting att ention - getting properties (e.g. visual master warning, master caution, and aural alerts), and other alerts in the flight deck. The flight crew’s awareness of alerts might differ between single - and dual - HUD installations.

With a dual - HUD installation, ther e may be periods when neither pilot is scanning the instrument panel. With a single - HUD configuration, the PNF refers only to the head - down instrument panel and may have responsibility for monitoring indications on that panel.

With dual - HUD configurations, both pilots’ attention may be turned to their HUDs, and they might miss an alert that would otherwise be plainly visible to a pilot not using an HUD.

7.0 Flight data recording Flight data recorders must record the minimum data parameters required by the applicable operational regulations. In addition, flight data recorders should also record other parameters regarding unique operating characteristics of HUDs in compliance with CS 25.1459(e) . For example, they may include information such as the mode in which the HUD was operating, the status (e.g. in use or inoperative), and if the display declutter mode was operating.

8.0 Continued airworthiness CS 25.1309 , CS 25.1529 and Appendix H to CS - 25 require instructions for the continued airworthiness of a display system and its comp onents. The content of the instructions depends on the type of operation and the intended function of the HUD.

[Amdt 25/17] Powered by EASA eRules Page 1466 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25)

Appendix 7 – Weather Displays

ED Decision 2015/019/R 1. Introduction 1.1 Purpose This Appendix provides additional gui dance for displaying weather information in the flight deck. Weather displays provide flight crew with additional tools to help make decisions based on weather information.

1.2 Examples Sources of weather information may include but are not limited to on - b oard weather sensors, data - linked weather information, and pilot/air traffic reports. The information from these sources can be displayed in a variety of graphical or text formats. Because many sources of weather information exist, it is important that the applicant identify the source of the information, assess its intended function, and apply the guidance contained within this AMC.

2.0 Key characteristics In addition to the general guidelines provided in the body of this AMC, the following guidelines should be considered when establishing the intended functions of weather displays.

2.1 Unambiguous meanings The meaning of the presentations (e.g. display format, colours, labels, data formats, and interaction with other display parameters) shou ld be clear and unambiguous. The flight crew should not misunderstand or misinterpret the weather information.

2.2 Colour 2.2.1 The use of colour should be appropriate to its task and use.

2.2.2 The use of colour must not adversely affect or degrade the at tention - getting qualities of the information as required by CS 25.1322(f) .

2.2.3 Colour conventions should be followed (such as the conventions established in ARINC 708A - 3, Airborne Weather Radar with Forward Looking Windshield Detection Capability, and the FAA AC 20 - 149A, Installation Guidance for Domestic Flight Information Services - Broadcast).

2.2.4 The use of red and yellow must be in compliance with CS 25.1 322(e) for flight crew alerts, or with CS 25.1322(f) for information other than flight crew alerts.

Compliance can be demonstrated by using the guidance in AMC 25.1322 , Fli ght Crew Alerting, and this AMC.

Note 1: The FAA AC 20 - 149A indicates an exclusion to the acceptability of RTCA/DO - 267A, Minimum Aviation System Performance Standards (MASPS) for Flight Information Services - Broadcast (FIS - B) Data Link, Sections 2.0 and 3.0 , for Part 25/CS - 25 aeroplanes.

Note 2: Refer to paragraph 31.c(5) in Chapter 5 of this AMC for information on guidelines on colour progression.

Powered by EASA eRules Page 1467 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 2.3 Multiple sources of weather information 2.3.1 The weather display should enable the flight crew to quickly, accurately, and consistently differentiate among sources of the displayed weather information.

Time - critical information should be immediately distinguishable from dated, non - time - critical information.

2.3.2 If more than one source of weather info rmation is available, the source of the weather information should be indicated on the selector and the resulting display.

2.3.3 When simultaneously displaying information from multiple weather sources (e.g.

weather radar and data link weather), the displa y should clearly and unambiguously indicate the source of that information. In other words, the flight crew should know the source of the symbol and whether it is coming from data - linked weather or real - time weather sources. These guidelines also apply to symbols (e.g. winds aloft and lightning) that have the same meaning but originate from different weather information sources.

2.3.4 If weather information is overlaid on an existing display, it should be easily distinguished from the existing display. It a lso should be consistent with the information it overlays in terms of position, orientation, range, and altitude.

2.3.5 When fusing or overlaying multiple weather sources, the resulting combined image should convey its intended meaning and meet its intende d function, regardless of any differences in the sources in terms of image quality, projection, data update rates, data latency, or sensor alignment algorithms, for example.

2.3.6 If weather information is displayed on an HUD, the guidance of this AMC incl uding its Appendix 6 should be followed.

2.3.7 When the source of the weather information source is not the on - board sensors, some means to identify its relevance (e.g. a time stamp or the age of the product) should be provided. Presenting the product age is particularly important when combining information from multiple weather products. In addition, the effective time of forecast weather should also be provided.

2.3.8 If a weather - looping (animation) display feature is provided, the system should provide the means to readily identify the total elapsed time of the image compilation so that the flight crew does not misinterpret the movement of the weather cells.

2.3.9 For products that have the ability to present weather for varying altitudes (e.g.

potenti al or reported icing, radar, and lightning strikes), information should be presented that allows the flight crew to distinguish or identify which altitude range applies to each feature.

2.3.10 Weather information may include a number of graphical and text information features or sets of information (e.g. text and graphical Aviation Routine Weather Reports (METARs) and winds aloft). The display should provide a means to identify the meaning of each feature to ensure that the information is correctly used.

2.3.11 If the flight crew or system has the ability to turn a weather information source on or off, the flight crew should be able to easily determine if the source is on or off.

2.3.12 When weather information is presented on a vertical situation displa y, the lateral width of the weather swath (like that of the terrain swath) should be carefully considered to ensure that weather information that is relevant to the current Powered by EASA eRules Page 1468 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) phase of flight or flight path is displayed. An unsuitable lateral swath width coul d either mislead the flight crew to abort an operation for weather that poses no hazard, or fail to abort an operation when the weather does pose a hazard. If swath dimensions are automatically controlled, then careful consideration should be given to incl ude only the area that would be relevant to the operation. Means may be provided for the flight crew to select the swath widths that they consider suitable for the phase of flight and prevailing weather conditions. The lateral width of the weather swath (l ike that of the terrain swath) should be made readily apparent to the flight crew (e.g. use the same swath as is used for the terrain, or display its boundaries on the plan view weather display). Generally, if the vertical situation displays terrain and we ather at the same time, the choice of flight - path - centred or track/heading - centred swath should be consistent. If the weather overlay is designed to show a smaller vertical swath than is represented by the altitude scale, then the boundaries of this swath should be clearly depicted on the display.

2.3.12.1 Weather information displayed on a vertical situation display should be accurately depicted with respect to the scale factors of the display (i.e.

vertical and horizontal).

2.3.12.2 Consideration should b e given to making the width of the information on the weather display consistent with the width used by other systems, including the Terrain Awareness and Warning System (TAWS), if displayed.

This should not be interpreted as a restriction precluding other means of presentation that can be demonstrated to be superior.

3.0 On - board weather radar information 3.1 Background On - board weather radar provides forward - looking weather detection, including in some cases windshear and turbulence detection.

3.2 Minimu m performance standards The display of on - board weather radar information should be in accordance with the applicable portions of RTCA/DO - 220, Minimum Operational Performance Standards for Airborne Weather Radar with Forward - Looking Windshear Capability. TSO - C63d allows exceptions to the minimum performance standards of RTCA/DO - 220 for Class A and B radar equipment.

3.3 Hazard detection The weather display echoes from precipitation and ground returns should be clear, automatic, timely, concise, and distinct so that the flight crew can easily interpret, analyse, and avoid hazards. The radar range, elevation, and azimuth indications should provide sufficient information for flight crews to safely avoid the hazard.

4.0 Predictive windshear information 4 .1 General If provided, windshear information should be clear, automatic, timely, concise, and distinct so that the flight crew can easily interpret, detect, and minimise the threat of windshear activity.

Powered by EASA eRules Page 1469 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 4.2 Presentation methods When a windshear threat is detected, the corresponding display may be automatically presented or selected by the flight crew at an appropriate range to identify the windshear activity and minimise the windshear threat to the aeroplan e.

4.3 Pilot workload Pilot workload necessary for the presentation of windshear information should be minimised. When the flight deck is configured for normal operating procedures, it should not take more than one action to display the windshear informati on.

4.4 Windshear threat symbol The size and location of the windshear threat symbol should allow the flight crew to recognise the dimension of the windshear and its position. The symbol should be presented in accordance with RTCA/DO - 220.

4.5 Relative posi tion to the aeroplane The relative position and azimuth of the windshear threat with respect to the nose of the aeroplane should be displayed in an unambiguous manner.

4.6 Range The range selected by the flight crew for the windshear display should allow t he flight crew to distinguish the windshear event from other information. Amber radial lines may be used to extend from the left and right radial boundaries of the icon extending to the upper edge of the display.

5.0 Safety aspects 5.1 Functional Hazard As sessment (FHA) Both the loss of weather information and the display of misleading weather information should be addressed in the FHA. In particular, the FHA should address failures of the display system that could result in the loss of the display and fai lures that could result in the presentation of misleading weather information.

5.2 Misleading information The FHA should address the effects of displaying misleading information. In accordance with Chapter 4 of this AMC, the display of misleading weather radar includes information that would lead the flight crew to make a bad decision or introduce a potential hazard.

Examples include but are not limited to storm cells displayed in the incorrect position, at the wrong intensity, or misregistered in the case of a combined (e.g. fused) image.

[Amdt 25/17] Powered by EASA eRules Page 1470 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25)

AMC 25 - 13 Reduced a nd d erated t ake - o ff t hrust ( p ower)

p rocedures

ED Decision 2021/015/R 1 Purpose This acceptable means of compliance (AMC) provides guidance for the certification and use of reduced thrust (power) for take - off and derated take - off thrust (power) on turbine powered transport category aeroplanes. It consolidates CS guidance concerning this subject and serves as a ready reference for those involved with aeroplane certification an d operation. These procedures should be considered during aeroplane type certification and supplemental type certification activities when less than engine rated take - off thrust (power) is used for take - off.

2 Related Certification Specifications (CS) The applicable regulations are CS 25.101 , 25.1521 and 25.1581 .

3 Background Take - off operations conducted at thrust (power) settings less than the maximum take - off thrust (power) available may provide substantial benefits in terms of engine reliability, maintenance, and operating costs. These take - off operations generally fall into two categories; those with a specific derated thrust (p ower) level, and those using the reduced thrust (power) concept, which provides a lower thrust (power) level that may vary for different take - off operations. Both methods can be approved for use, provided certain limitations are observed. The subjects disc ussed herein do not pertain to in - flight thrust cutback procedures that may be employed for noise abatement purposes.

4 Definitions Customarily, the terms ‘thrust’ and ‘power’ are used, respectively, in reference to turbojet and turboprop installations. Fo r simplicity, only the term ‘thrust’ is used throughout this AMC. For turboprop installations, the term ‘power’ should be substituted. For purposes of this AMC the following definitions apply: a. Take - off Thrust (1) Rated take - off thrust, for a turbojet en gine, is the approved engine thrust, within the operating limits, including associated time limits, established by the engine type certificate for use during take - off operations.

(2) Take - off thrust, for an aeroplane, is normally the engine rated take - off thrust, corrected for any installation losses and effects that is established for the aeroplane under CS - 25. Some aeroplanes use a take - off thrust setting that is defined at a level that is less than that based on the engine rated take - off thrust.

CS 25.1521 requires that the take - off thrust rating established for the aeroplane must not exceed the take - off thrust rating limits established for the engine under the engine type certificate. The value of the take - off th rust setting parameter is presented in the Aeroplane Flight Manual (AFM) and is considered a normal take - off operating limit.

b. Derated take - off thrust, for an aeroplane, is a take - off thrust less than the maximum take - off thrust, for which exists in the AFM a set of separate and independent, or clearly distinguishable, take - off limitations and performance data that complies with all the take - off requirements of CS - 25. When operating with a derated take - off thrust, the value of Powered by EASA eRules Page 1471 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) the thrust setting parameter , which establishes thrust for take - off, is presented in the AFM and is considered a normal take - off operating limit.

c. Reduced take - off thrust, for an aeroplane, is a take - off thrust less than the take - off (or derated take - off) thrust. The aeroplane take - off performance and thrust setting are established by approved simple methods, such as adjustments, or by corrections to the take - off or derated take - off thrust setting and performance. When operating with a reduced take - off thrust, the thrust setting par ameter, which establishes thrust for take - off, is not considered a take - off operating limit.

d. A ‘ wet runway ’ is one whose surface is covered by any visible dampness or water up to, and including, 3 mm deep within the intended area of use .

e. A ‘ contaminated runway ’ is a runway where a significant portion of the runway surface area (whether in isolated areas or not) within the length and width being used is covered by one or more of the following substances: — compacted snow, — dry snow more than 3 mm deep, — heavy frost, — ice, — slush more than 3 mm deep, — standing water more than 3 mm deep, and — wet snow more than 3 mm deep.

For the definitions of the contaminants, refer to Section 4 of AMC 25.1591 .

f. A ‘slippery w et runway’ is a wet runway where the surface friction characteristics on a significant portion of the runway have been determined to be degraded.

5 Reduced Thrust : (Acceptable Means o f Compliance) Under CS 25.101(c) , 25.101(f) , and 25.101(h) , it is acceptable to establish and use a take - off thrust setting that is less than the take - o ff or derated take - off thrust if – a. The reduced take - off thrust setting – (1) Does not result in loss of systems or functions that are normally operative for take - off such as automatic spoilers, engine failure warning, configuration warning, systems de pendent on engine bleed air, or any other required safety related system.

(2) Is based on an approved take - off thrust rating or derating for which complete aeroplane performance data is provided.

(3) Enables compliance with the applicable engine operating and aeroplane controllability requirements in the event that take - off thrust, or derated take - off thrust (if such is the performance basis), is applied at any point in the take - off path.

(4) Is at least 60 % of the maximum take - off thrust (no derate) for th e existing ambient conditions, wi th no further reduction below 60 % resulting from Automatic Take - off Thrust Control System (ATTCS) credit. Consequently the amount of reduced thrust permitted is reduced when combined with the use of derated thrust so that the overall thrust reduction remains at least 60 % of the maximum take - off thrust.

For reduced thrust operations, compliance with the applicable performance and Powered by EASA eRules Page 1472 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) handling requirements should be demonstrated as thoroughly as for an approved take - off rating.

(5) For turboprop installations, is predicated on an appropriate analysis of propel ler efficiency variation at all applicable conditions and is limited to at least 75% take - off thrust.

(6) Enables compliance with CS - 25 Appendix I in the event of an engine failure during take - off, for aeroplanes equipped with an ATTCS .

b. Relevant speeds (V , V , V , and V ) used for reduced thrust take - offs are not less than EF MC R 2 those which will comply with the required airworthiness controllability criteria when using the take - off thrust (or derated take - off thrust, if such is the performance basis) for th e ambient conditions, including the ef fects of an ATTCS . It should be noted, as stated in paragraph c. below, that in determining the take - off weight limits, credit can be given for an operable ATTCS .

c. The aeroplane complies with all applicable performa nce requirements, including the criteria in paragraphs a. and b. above, within the range of approved take - off weights, with the operating engines at the thrust available for the reduced thrust setting selected for take - off. However, the thrust settings use d to show compliance with the take - off flight path requirements of CS 25.115 and the final take - off climb performance requirements of CS 25.121(c) should not be greater tha n that established by the initial thrust setting. In determining the take - off weight limits, credit can be given for an operable A TTCS .

d. Appropriate limitations, procedures, and performance information are established and are included in the AFM. The re duced thrust procedures must ensure that there is no significant increase in cockpit workload, and no significant change to take - off procedures.

e. A periodic take - off demonstration is conducted using the aeroplane’s tak e - off thrust setting without ATTCS , if fitted, and the event is logged in the aeroplane’s permanent records. An approved engine maintenance procedure or an approved engine condition - monitoring programme may be used to extend the time interval between take - off demonstrations.

f. The AFM sta tes, as a limitation, that take - offs utilising reduced take - off thrust settings : (1) Are not authorised on runways contaminated with standing water, snow, slush, or ice, and are not authorised on wet runways , including slippery wet runways, unless suitable performance accountability is made for the increased stopping distance on the wet surface.

(2) Are not authorised where items affecting performance cause significant increase in crew workload.

Examples of these are – Inoperative Equipment: Inoperative eng ine gauges, reversers, anti - skid systems or engine systems resulting in the need for additional performance corrections.

Engine Intermix: Mixed engine configurations resulting in an increase in the normal number of power setting values.

Non - standard oper ations: Any situation requiring a non - standard take - off technique.

Powered by EASA eRules Page 1473 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) (3) Are not authorised unless the operator establishes a means to verify the availability of take - off or derated take - off thrust to ensure that engine deterioration does not exceed authori sed limits.

(4) Are authorised fo r aeroplanes equipped with an ATTCS , whether operating or not.

g. The AFM states that – (1) Application of reduced take - off thrust in service is always at the discretion of the pilot.

(2) When conducting a take - off using reduced take - off thrust, take - off thrust or derated take - off thrust if such is the performance basis may be selected at any time during the take - off operation.

h. Procedures for reliably determining and applying the value of the reduced take - off thru st setting and determining the associated required aeroplane performance are simple (such as the assumed temperature method). Additionally, the pilot is provided with information to enable him to obtain both the reduced take - off thrust and take - off thrust, or derated take - off thrust if such is the performance basis, for each ambient condition.

i. Training procedures are developed by the operator for the use of reduced take - off thrust.

6 Derated Thrust (Acceptable Means Of Compliance) For approval of derated take - off thrust provisions, the limitations, procedures, and other information prescribed by CS 25.1581 , as applicable for approval of a change in thrust, should be included as a separate Appendix in the AFM. The AFM limitations section should indicate that when operating with derated thrust, the thrust setting parameter should be considered a take - off operating limit. However, in - flight take - off thrust (bas ed on the maximum take - off thrust specified in the basic AFM) may be used in showing compliance with the landing and approach climb requirements of CS 25.119 and 25.121(d) , provided that the availability of take - off thrust upon demand is confirmed by using the thrust - verification checks specified in paragraph 5.e. above.

[Amdt No: 25/2] [Amdt No: 25/13] [Amdt No: 25/27]

AMC 25 - 19 Certification Maintenance Requirements

ED De cision 2018 / 005 /R 1 P URPOSE This Acceptable Means of Compliance (AMC) provides guidance on the selection, documentation and control of Certification Maintenance Requirements (CMRs). This AMC also provides a rational basis for coordinating the CMR selection process and the Maintenance Review Board (MRB) process if the latter is used. The applicant should ensure that the maintenance tasks and intervals identified in the system safety analyses to support compliance with CS 25.1309 and other syste m safety requirements (such as CS 25.671 , CS 25.783 , CS 25.901 , and CS 25.933 ) are prote cted in service. For those aeroplanes whose initial maintenance programme is developed under a different process than the MRB process, the coordination and document aspects have to be adapted to the particular case. This AMC describes an acceptable means, but not the only means, for selecting, documenting and managing CMRs. Terms such as ‘shall’ and ‘must’ are used only in the sense of ensuring applicability of this acceptable means of compliance.

Powered by EASA eRules Page 1474 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 2 RELATED CERTIFICATION SPECIFICATIONS a. CS 25.671 Control Systems — General b. CS 25.783 Fuselage Doors c. CS 25.901 Powerplant — Installation d. CS 25.933 Reversing systems e. CS 25.1309 Equipment, systems and installations f. CS 25.1529 Instructions for Continued Airworth iness 3 RELATED DOCUMENTS a. Airlines for America (A4A), MSG – 3, Operator/Manufacturer Scheduled Maintenance Development Document.

b. International Maintenance Review Board/Maintenance Type Board Process Standard (IMPS) 4 NOT USED 5 CERTIFICATION MAINTENANCE REQUIREMENTS ( CMR ) DEFINITION A CMR is a required scheduled maintenance task, established during the design certification of the aeroplane systems as an airworthiness limitation of the type certificate (TC) or supplemental type c ertificate (STC). The CMRs are a subset of the Instructions for Continued Airworthiness (ICA) identified during the certification process. A CMR usually result from a formal, numerical analysis conducted to show compliance with the requirements applicable to catastrophic and hazardous failure conditions as defined in paragraph 6e, below. A CMR may also result from a qualitative, engineering judgment - based analysis.

a. The CMRs are required tasks, and associated intervals, developed to achieve compliance wit h CS 25.1309 and other requirements requiring safety analyses (such as CS 25.671 , 25.783 , 25.901 , and 25.933 ). A CMR is usually intended to detect latent failures that would, in combination with one or more other specific failures or events, result in a Hazardous or Catastrophic Failure Condition. A C MR can also be used to establish a required task to detect an impending wear out of an item whose failure is associated with a hazardous or catastrophic failure condition. A CMR may also be used to detect a latent failure that would, in combination with on e specific failure or event, result in a major failure condition, where the SSA identifies the need for a scheduled maintenance task.

b. CMRs are derived from a fundamentally different analysis process than the maintenance tasks and intervals that result f rom MSG – 3 analysis associated with MRB activities (if the MRB process is used). Although both types of analysis may produce equivalent maintenance tasks and intervals, it is not always appropriate to address a Candidate Certification Maintenance Requiremen t (CCMR) with a Maintenance Review Board Report (MRBR) task.

c. CMRs verify that a certain failure has or has not occurred, indicate that corrective maintenance or repair is necessary if the item has failed, or identify the need to inspect for impending failures (e.g. wear out or leakage). Because the exposure time to a latent failure is a key element in the calculations used in a safety analysis, limiting the exposure time will have a significant effect on the resultant overall failure probabil ity of the system.

The intervals for CMR tasks interval should be designated in terms of flight hours, cycles, or calendar time, as appropriate.

Powered by EASA eRules Page 1475 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) d. The type certification process assumes that the aeroplane will be maintained in a condition or airworthiness equal to its certified condition. The process described in this AMC is not intended to establish routine maintenance tasks (e.g. greasing, fluid - level checks, etc.) that should be defined through the MSG – 3 analysis process. Also, this process is not inten ded to establish CMRs for the purpose of providing supplemental margins of safety for concerns arising late in the type design approval process. Such concerns should be resolved by appropriate means, which are unlikely to include CMRs not established via n ormal safety analyses.

e. CMRs should not be confused with required structur al inspection programmes, that are de veloped by the TC applicant to meet the inspection requirements for damage tolerance, as required by CS 25.571 or CS 25.1529 , and Appendix H25.4 (Airworthiness Limitations S ection). CMRs ar e to be developed and manag ed separately from any structural inspection program s.

6 OTHER DEFINITIONS The following terms apply to the system design and analysis requirements of CS 25.1309(b) and (c), and to the guidance material provided in this AMC. (for a complete definition of these terms, refer t o the applicable specifications and acceptable means of compliance, (e.g. CS and AMC 25.1309 )).

a. Catastrophic. Refer to AMC 25.1309 .

b. Compatible MRBR task. An MRBR tas k whose intent addresses the CCMR task intent and whose interval is equal to or lower than the interval that would otherwise be required by a CMR.

c. Crew. The cabin crew, or flight crew, as applicable.

d. Failure. Refer to AMC 25.1309 .

e. Failure Condition. Refer to AMC 25.1309 .

f. Failure Effect Category 5 task (FEC5). Refer to MSG - 3, Operator/Manufacturer Scheduled Maintenance Development.

g. Failure Effect Category 8 task (FEC8). Refer to MSG - 3, Operator/Manufacturer Scheduled Maintenance Development.

h. Hazardous. Refer to AMC 25.1309 .

i. Latent Failure. Refer to AMC 25.13 09 .

j. Major. Refer to AMC 25.1309 .

k. Qualitative. Refer to AMC 25.1309 .

l. Quantitative. Refer to AMC 25.1309 .

m. Significan t Latent Failure. A latent failure that would, in combination with one or more other specific failures or events, result in a hazardous or catastrophic failure condition.

n. Task. Short description (e.g. descriptive title) of what is to be accomplished by a procedure. Example: ‘Operational check of the static inverter’.

o. Wear out. A condition where a component is worn beyond a predetermined limit.

7 SYSTEM SAFETY ASSESSMENTS (SSA) Powered by EASA eRules Page 1476 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) a. CS 25.1309(b) specifies re quired safety levels in qualitative terms, and a safety assessment must be conducted to show compliance. Various assessment techniques have been developed to help applicants and EASA in determining that a logical and acceptable inverse relationship exists between the probability and the severity of each Failure Condition. These techniques include the use of service experience data of similar, previously approved systems, and thorough qualitative and quantitative analyses.

b. In addition, difficulties have b een experienced in assessing the acceptability of some designs, especially those of systems, or parts of systems, that are complex, that have a high degree of integration, that use new technology, or that perform safety - critical functions. These difficulti es led to the selective use of rational analyses to estimate quantitative probabilities, and the development of related criteria based on historical data of accidents and hazardous incidents caused or contributed to by failures. These criteria, expressed a s numerical probability ranges associated with the terms used in CS 25.1309(b), became commonly accepted for evaluating the quantitative analyses that are often used in such cases to support experienced engineering and operational judgement and to suppleme nt qualitative analyses and tests.

NOTE: See AMC 25.1309 for a complete description of the inverse relationship between the probability and severity of Failure Conditions, and the various methods of showing compliance with CS 25.1309.

8 DESIGN CONSIDERATIONS RELATED TO SIGNIFICANT LATENT FAILURES a. The applicant should implement practical and reliable failure monitoring and flight crew indication systems to detect failures that would otherwise be significant latent failures. A reliable failure monitoring and flight crew indication system should utilise current state - of - the - art technology to minimise the probability of falsely detecting and indicating non - existent failures. Experience and judgement should be applied when determining wheth er or not a failure monitoring and flight crew indication system would be practical and reliable. Comparison with similar, previously approved systems is sometimes helpful.

b. Supplemental design considerations are provided in Appendix 1 to this AMC.

9 OVERVIEW OF THE CERTIFICATION MAINTENANCE REQUIREMENTS DEVELOPMENT PROCESS a. Figure 1 shows the development process of CMRs. The details of the process to be followed in defining, documenting, and handling CMRs are given in paragraphs 10 through 13.

Powered by EASA eRules Page 1477 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Fi gure 1 — CMR development process Certification Process TC application Design Note 1: As part of the SSA acceptance, the CCMRs should be agreed by EASA System Safety Analyses Note 2: The disposition activity (25.1309, 25.671, 25.783, involves the TC/STC holder, EASA, and 25.901, 25.933, etc.)

an optional Advisory Committee (e.g.

(Paragraph 10) CMCC). The disposition of each CCMR and the means in place to ensure that Note 1 SSA assumptions are protected in service should be accepted by EASA.

Significant Disposition of Latent Failures CCMRs not requiring scheduled maintenance CCMRs tasks identified for major failure conditions (Paragraph 11) Disposition of each CCMR Note 3 ISC/MRB Note 4 (Paragraph 11) Note 2 Note 3: Discussion and feedback with CCMRs Adequate ISC in order to revise, if justified, the accomodated scheduled MSG-3 analyses and the associated CMRs by compatible maintenance MRBR tasks intents/intervals.

MRBR tasks tasks Note 4: Where the SSA identifies the need for a scheduled maintenance Certification task, the CMR designation may also be Authority used to detect a latent failure that approval would, in combination with one specified failure or event, lead to a major failure condition. This CMR CMR designation may be necessary if an documentation adequate scheduled maintenance task (ALS) has not been identified in other ALS: Airworthiness Limitations Section Instructions for Continued CMR: Certification Maintenance Airworthiness.

Requirement Reference CCMR: Candidate Certification Maintenance Requirement ISC: Industry Steering Committee TCDS MRB: Maintenance Review Board MRBR: MRB Report TC: Type Certificate Certification Process TCDS: Type Certificate Data Sheet 10 IDENTIFICATION OF CANDIDATE CMRs (CCMRs) a. The SSA should address all significant latent failures.

b. Credit may be taken for correct flight crew performance of the periodic checks requi red to demonstrate compliance with CS 25.1309(b) . Unless these flight crew actions are accepted as normal airmanship, they should be included in the approved Aeroplane Flight Powered by EASA eRules Page 1478 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) Manual procedures. Similarly, credit may be taken from self - initiated checks (e.g. power - up built - in tests). In both cases, these significant latent failures do not need a CCMR.

c. Tasks that are candidates for selection as CMRs come from safety analyses (e.g. SSAs), which establish w hether there is a need for tasks to be carried out periodically to comply with CS 25.1309, and other requirements (such as CS 25.671 , CS 25.783 , CS 25.901 , and CS 25.933 ) requiring this type of analysis. The SSA should identify as CCMRs the maintenance tasks intended to detect significant latent failures. Tasks may also be selected from those intended to inspect for impending failures due to wear out.

d. As the safety analysis may be qualitative or quantitative, some task intervals may be derived in a qualitative manner (e.g. engineering judgment and service experience). As per AMC 25.1309 , numerical analysis supplements, but does not replace, qualitative engineering and operational judgment. Therefore, other tasks that are not derived from numerical analysis of significant latent failures, but are bas ed on properly justified engineering judgment, can also be candidates for CMRs. The justification should include the logic leading to identification of CCMRs, and the data and experience base supporting the logic.

e. In some situations, a Catastrophic or Hazardous Failure Condition might meet the quantitative probability objective, yet it might contain one or more components that, as per the quantitative analysis, do not require a periodic maintenance task to meet that objective (i.e. could be failed laten t for the life of the aeroplane). In such cases, the SSA should include a qualitative assessment to determine whether a periodic maintenance task is needed.

Unless otherwise substantiated, a CCMR should be identified to: — reduce exposure to a single failur e or event that would cause the failure condition, — ensure the availability of backup or emergency systems, and — ensure the availability of equipment/systems required to be installed as per CS - 25.

f. For failure conditions involving multiple significant lat ent failures, the SSA should identify a CCMR for each significant latent failure unless otherwise justified (e.g. one CCMR may cover multiple significant latent failures, or the significant latent failure could exist for the life of the aeroplane without c ompromising compliance with the safety objectives and paragraph 10.e considerations).

g. For each identified CCMR, the applicant should indicate: — the failure mode to be detected, — the failure condition of concern, — the intended maintenance task, and — the tas k interval (the allowable value coming from the SSA or other relevant analysis).

11 SELECTION OF CMRs a. Each CCMR should be reviewed and a determination made as to whether or not it should be a CMR.

Criteria and guidance are provided below for CMR selection or non - selection. The applicant may seek additional input from an advisory committee, as described in Appendix 2, before proposing CMRs to EASA for final review and approval.

Powered by EASA eRules Page 1479 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AM Cs (CS - 25) b. The applicant should provide sufficient information to enable a n understanding of the Failure Conditions and the failure or event combinations that result in the CCMRs. CCMRs are evaluated in the context of the Failure Conditions in which they are involved, e.g.

whether the significant latent failure is part of a dual failure, a triple failure, or more.

c. The CMR designation should be applied in the case of catastrophic dual failures where one failure is latent. The CMR designation should also be applied to tasks that address wear out of a component involved in a Cat astrophic Failure Condition that results from two failures.

d. In all other cases, the CMR designation may not be necessary if there is a compatible MRBR task to accommodate the CCMR, provided that the applicant has the means in place to ensure that the C CMRs are protected in service. Appendix 3 provides examples of acceptable means of protection. Any means should be presented to EASA for acceptance.

These means of protection should address future evolutions of the compatible MRBR task proposed by the appl icant or by the operator. In this respect, these means should ensure that in service: — the compatible MRBR task would not be changed to the extent that the CCMR task intent is adversely affected, and — the compatible MRBR task would not be escalated beyond the interval that would otherwise be required by a CMR.

The TC applicant should adequately describe the selected means of protection in the associated technical publication in order for the operator t o be aware of the process to be followed if there are modifications to any compatible MRBR tasks that are included in the operator’s aeroplane maintenance program (AMP).

e. The rationale for the disposition of each CCMR should be presented to EASA for acc eptance.

f. Since the MSG - 3 logic may not consider a Failure Condition containing three or more failures, it is possible that a CCMR might not have any identified MRBR tasks. In this case, a CMR will be required.

g. Where the SSA identifies the need for a scheduled maintenance task, the CMR designation may also be used to detect a latent failure that would, in combination with one specified failure or event, lead to a Major Failure Condition. This CMR designation may be necessary if no adequate scheduled maintenance task has been identified in any other Instructions for Continued Airworthiness.

h . If the SSA does not specify an interval shorter than the life of the aeroplane, an interval may be established by considering the factors that influence the out come of the Failure Condition, such as the nature of the fault, the system(s) affected, field experience, or task characteristics .

12 DOCUMENTATION AND HANDLING OF CMRs a. CMRs are considered functionally equal to airworthiness limitations, therefore th ey should be included in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness.

b. The CMR data location should be referenced in the type certificate data sheet (TCDS). The latest version of the applicant’s CMR documentatio n should be controlled by a log of Powered by EASA eRules Page 1480 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) pages approved by EASA. In this way, changes to CMRs following certification will not require an amendment to the TCDS.

c. Since CMRs are based on statistical averages and reliability rates, an ‘exceptional short - term ex tension’ for CMR intervals may be made on one aeroplane for a specific period of time without jeopardising safety. Any exceptional short - term extensions to CMR intervals must be defined and fully explained in the applicant’s CMR documentation. The competen t authority must concur with any exceptional short - term extension allowed by the applicant’s CMR documentation before it takes place, using procedures established with the competent authority in the operators’ manuals. The exceptional short - term extension process is applicable to CMR intervals. It should not be confused with the operator’s ‘short - term escalation’ program for normal maintenance tasks described in the operators’ manuals.

(1) The term ‘exceptional short - term extension’ is defined as an increas e in a CMR interval that may be needed to cover an uncontrollable or unexpected situation.

Any allowable increase must be defined either as a percent of the normal interval, or a stated number of flight hours, flight cycles, or calendar days. If no excepti onal short - term extension is to be allowed for a given CMR, this restriction should be stated in the applicant’s CMR documentation.

(2) Repeated use of exceptional short - term extensions, either on the same aeroplane or on similar aeroplanes in an operator’ s fleet, should not be used as a substitute for good management practices. Exceptional short - term extensions must not be used for the systematic escalation of CMR intervals.

(3) The applicant’s CMR documentation should state that the competent authority mu st approve, prior to its use, any desired exceptional short - term extension not explicitly listed in the CMR document.

13 POST - CERTIFICATION CHANGES TO CMRs (New, revised or deleted) a. The introduction of a new CMR or any change to an existing CMR should be reviewed by the same entities that were involved in the process of CCMR/CMR determination (refer to paragraphs 10 and 11 of this AMC) at the time of initial certification. To allow operators to manage their own maintenance programs, it is important that they be afforded the same opportunity for participation that they were afforded during the initial certification of the aeroplane.

b. Any post - certification changes to CMRs must be approved by EASA which approved the type design.

c. Since the purpose of a CMR is to limit the time of exposure to a given significant latent failure, or a given wear out, as part of an engineering analysis of the overall system safety, instances of a CMR task repeatedly finding that no failure has occurred may not be sufficient justification for deleting the task or increasing the time between repetitive performances of the CMR task. In general, a CMR task change or interval escalation should only be made if experience with the aeroplane fleet in service worldwide indicates that certain assumptions regarding component failure rates made early during the engineering analysis were too conservative, and a re - calculation of the system’s reliability with revised failure rates of certain components reveals that the task or interval may be changed.

Powered by EASA eRules Page 1481 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) d. If later data provides a sufficient basis for the relaxation of a CMR (less restrictive actions to be performed), the change may be documented by a revision to the applicant’s CMR documentation and approved by EASA.

e. To address an unsafe condition, EASA may determine that the requirements of an existing CMR must be modified (more restrictive actions to be required) or a new CMR must be created. These modified requirements will be mandated by an Airworthiness Directive (AD) and the applican t’s CMR documentation will be revised to include the change.

f. New CMRs that are unrelated to in - service occurrences may be created and they should be documented and approved by EASA. New CMRs can arise in situations such as: (1) the certification of design changes, or (2) updates of the applicant’s certification c ompliance documentation. These may result from regulatory changes, actions required by an AD on similar systems or aeroplanes, awareness of additional Hazardous or Catastrophic Failure Conditions, revised failure rates, consideration of extended service go als, etc.

APPENDIX 1 SUPPLEMENTAL GUIDANCE FOR THE USE OF CMRs 1. The TC/STC applicant should choose a system design that minimises the number of significant latent failures, with the ultimate goal that no such failures should exist, if this is practical . A practical and reliable failure monitoring and flight crew indication system should be considered as the first means to detect a significant latent failure. If the cost of adding practical and reliable failure monitoring and flight crew indication syste m is high, and the added maintenance cost of a CMR is low, the addition of a CMR may be the solution of choice for both the type certificate applicant and the operator, provided all applicable regulations are met. Substituting a CMR with an MRBR task does not necessarily reduce maintenance costs.

2. The decision to create a CMR may include a trade - off of the cost, weight, or complexity of providing mechanism or device that will expose the latent failure, versus the requirement for the operator to conduct a maintenance or inspection task at fixed intervals.

3. The following points should be considered in any decision to create a CMR in lieu of a design change.

a. What is the magnitude of the changes to the system and/or aeroplane needed to add a reliable failure monitoring and flight crew indication system that would expose the latent failure? What is the cost in added system complexity?

b. Is it possible to introduce a self - test on power - up?

c. Is the monitoring and flight crew indication system reliable? False warnings must be considered, as well as a lack of warnings.

d. Does the failure monitoring or flight crew indication system itself need a CMR due to its latent failure potential?

e. Is the CMR task reasonable, considering all aspects of the failure condition that the task is intended to address?

f. How long (or short) is the CMR task interval?

g. Is the proposed CMR task labour intensive or time consuming? Can it be done without having to ‘gain access’ and/or without workstands? Without test equipment? Can the Powered by EASA eRules Page 1482 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) CMR task be done without removing equipment from the aeroplane? Without having to re - adjust equipment? Without leak checks and/or engine runs?

h. Can a simple visual inspection be used instead of a complex one? Can a simple operational check suffice in lieu of a formal functional check against measured requirements?

i. Is there ‘added value’ to the proposed task (i.e. will the proposed task do more harm than good if the aeroplane must be continually inspected)?

j. Have all alternatives b een evaluated?

APPENDIX 2 ROLE OF THE CERTIFICATION MAINTENANCE COORDINATION COMMITTEE (CMCC) 1. The CMCC functions as an advisory committee for the applicant and proposes the disposition of each presented CCMR. EASA is the authority that ultimately app roves CMRs as airworthiness limitations of the type certificate as per Part - 21.

2. In order to grant aeroplane operators the opportunity to participate in the selection of CMRs, and to assess the CCMRs and the proposed MRBR tasks and intervals in an integr ated process, the applicant should convene a CMCC as early as possible in the design phase of the aeroplane program, and at intervals as necessary. This CMCC should comprise TC/STC holder representatives (typically maintenance, design, and safety engineeri ng personnel), operator representatives designated by the Industry Steering Committee (ISC) chairperson, EASA certification specialist(s), and the MRB chairperson(s). EASA certification specialist participation in the CMCC is necessary to provide regulator y guidance on the disposition of CCMRs.

3. The CMCC should review CCMRs and their purposes, the Failure Conditions and their classifications, the intended tasks and their intervals, and other relevant factors. In addition, where multiple tasks result from a quantitative analysis, it may be possible to extend a given interval at the expense of one or more other intervals, in order to optimise the required maintenance activity. However, once a decision is made to create a CMR, then the CMR interval should be based solely on the results of the SSA or other relevant analysis. If the SSA does not specify an interval shorter than the life of the aeroplane, then the CMR interval may be proposed by the CMCC considering factors that influence the outcome of the fail ure condition, such as the failure mode(s) to be detected, the system(s) affected, field experience, or task characteristics.

4. The CMCC should address all CCMRs. Alternatively, the applicant may coordinate with EASA to define a subset of CCMRs to be pre sented to the CMCC.

5. The CMCC discusses compatible tasks (if any) that the MRB generates. The CMCC may select an MRBR task in lieu of a CMR in accordance with paragraph 11 of this AMC.

6. The CMCC may request the ISC to review selected CMCC results (e. g. proposed revised MRBR tasks and/or intervals). Upon ISC review, the proposed revised MRBR tasks and/or intervals accepted by the ISC are reflected in the MRBR proposal, and the proposed revised MRBR tasks and/or intervals rejected by the ISC result in C MRs. Following consideration by the ISC, the applicant submits the CMRs to EASA for final review and approval.

APPENDIX 3 MEANS OF PROTECTION PROPOSED BY THE DESIGN APPROVAL HOLDER (DAH) AGAINST FUTURE EVOLUTIONS OF THE COMPATIBLE MRBR TASKS AND DERIVED TASKS OF THE OPERATOR’S AEROPLANE MAINTENANCE PROGRAM — EXAMPLES Powered by EASA eRules Page 1483 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 1. With reference to paragraph 11.c of this AMC, this Appendix provides examples to facilitate the implementation of the means to ensure that the CCMRs are protected in service.

2. These examples describe acceptable means, but not the only means. Any means should be presented to EASA for acceptance.

EXAMPLE 1 — Traceability of CCMRs and MRBR tasks in the Airworthiness Limitations Section a. The CMR designation may not be necessary i f there is a compatible MRBR task to accommodate the CCMR, provided that the design approval holder (DAH) shows direct traceability between the MRBR task and the accommodated CCMR in the airworthiness limitations section (ALS).

b. The compatible MRBR task and its interval are not airworthiness limitations. The status of the compatible MRBR task with regard to the MRB process remains unchanged.

c. Traceability between the CCMR and the compatible MRBR task should be provided in the ALS of the instructions f or continued airworthiness to ensure that the CCMR is respected during in - service operation of the aeroplane and any future evolution of the maintenance program.

Table 1 illustrates one possible means for traceability.

CCMR task reference CCMR interval Com patible MRBR task reference CCMR task #NN 60 months MRBR task #XX CCMR task #MM 10 000 flight hours MRBR task #YY … … … Appendix 3 — Table 1 d. If the DAH changes the compatible MRBR task to the extent that the intent of the corresponding CCMR task is adversely affected, this corresponding CCMR task is no longer accommodated. Therefore, the DAH could either propose a new compatible MRBR task , if o ne exists, or create a new CMR in line with the intent of the previously referenced CCMR limitation. These changes to the ALS require EASA approval.

e. If the DAH escalates the interval of the compatible MRBR task beyond the corresponding CCMR limitation, this corresponding CCMR is no longer accommodated and the DAH needs to create a CMR in order to satisfy the corresponding CCMR limitation.

Alternatively, the DAH could assess the feasibility of escalating the interval of the corresponding CCMR by re - evalu ating the system safety assumptions that lead to the CCMR at the time of initial certification. These changes to the ALS require EASA approval.

f. Furthermore, the DAH shall describe in the ALS what the operator needs to observe when changing the operator ’s aeroplane maintenance program (AMP). For tasks included in an AMP, which are based on compatible MRBR tasks, the following applies: i. Should the operator propose to change the intent of a task, the operator should ask for the DAH’s confirmation that th is change does not adversely affect the intent of the corresponding CCMR task. If the corresponding CCMR task is no longer accommodated, the operator needs to propose to include a mandatory task in the AMP in order to satisfy the intent of the referenced C CMR limitation. These changes to the AMP require the approval of the competent authority responsible for the oversight of the operator.

ii. If the operator proposes to escalate the interv al of a task, the corresponding CCMR limitation must not be exceeded .

Powered by EASA eRules Page 1484 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) EXAMPLE 2 — Uniquely identifying the compatible MRBR tasks a. The CMR designation may not be necessary if there is a compatible MRBR task to accommodate the CCMR, provided that the DAH uniquely identified each compatible MRBR task in the existing MRBR t ask listing. Table 2 illustrates one possible means for marking.

Failure effect MRBR task reference MRBR task description Interval Tracking category (FEC) MRBR task #XX Functional check of […] FEC 8 60 months MRBR task #YY Detailed inspection of - 72 months EWIS […] MRBR task #ZZ Operational check of FEC 8 10 000 flight CCMR […] hours … … … … … Appendix 3 — Table 2 b. The purpose of the marking and the policies to be observed for appropriate change control of the marked MRBR tasks should be stated in the MRB report.

c. The status of the compatible MRBR task with regard to the MRB process remains unchanged.

d. If the DAH changes the marked MRBR task to the extent that the intent of the corresponding CCMR task is adversely affected, the DAH n eeds to create a CMR to satisfy the intent of the initial CCMR task. This change to the ALS requires EASA approval.

e. For future escalations of MRBR tasks, the DAH should have procedures in place to ensure that these escalations do not increase the inter val of the marked MRBR task beyond the corresponding CCMR interval.

f. However, should the DAH escalate the marked MRBR task beyond the CCMR interval, the DAH needs to create a CMR in order to satisfy the corresponding CCMR. This change to the ALS require s EASA approval. Alternatively, the DAH could assess the feasibility of escalation of the interval of the corresponding CCMR by re - evaluating the system safety assumptions that lead to the CCMR at the time of initial certification. This change to the CCMR interval requires EASA involvement in accordance with the process described in paragraph 11 of this AMC.

g. Furthermore, the DAH shall describe in the MRBR what the operator needs to observe when changing the operator’s aeroplane maintenance program (AMP) . For tasks included in the AMP, which are based on marked MRBR tasks, the following applies: i. If the operator proposes to change the intent of a task, the operator should ask for the DAH’s confirmation that this change does not adversely affect the int ent of the corresponding CCMR task.

ii. If the operator proposes to escalate the interval of a task, the operator should ask for the DAH’s confirmation that this escalation does not increase the interval beyond the corresponding CCMR interval. These chan ges to the AMP require the approval of the competent authority responsible for the oversight of the operator.

[Amdt 25/20] [Amdt 25/21] Powered by EASA eRules Page 1485 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25)

AMC 25 - 24 Sustained Engine Imbalance

ED Decision 2009/017/R 1. PURPOSE This AMC sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of CS - 25 related to the aircraft design for sustained engine rotor imbalance conditions.

2. RELATED CS PARAGRAPHS a. CS - 25: CS 25.302 “Intera ction of systems and structures” CS 25.571 “Damage tolerance and fatigue evaluation of structure” CS 25.629 “Aeroelastic stability requirements” CS 25.901 “Installation” CS 25.903 “Engines” b. CS - E: CS - E 520 “Strength” CS - E 525 “Continued Rotation” CS - E 810 “Compressor and Turbine Blade Failure” CS - E 850 “Compressor, Fan and Turbine Shafts” 3. DEFINITIONS. Some new terms have been defined for the imbalance condition in order to present criteria in a precise and consistent manner. In addition, some terms are employed from other fields and may not be in general use as defined be low. The following definitions apply in this AMC: a. Airborne Vibration Monitor (AVM). A device used for monitoring the operational engine vibration levels that are unrelated to the failure conditions considered by this AMC.

b. Design Service Goal (DSG). The design service goal is a period of time (in flight cycles/hours) established by the applicant at the time of design and/or certification and used in showing compliance with CS 25.571 .

c. Diversion Fligh t. The segment of the flight between the point where deviation from the planned route is initiated in order to land at an en route alternate airport and the point of such landing.

d. Ground Vibration Test (GVT). Ground resonance tests of the aeroplane nor mally conducted in compliance with CS 25.629 .

e. Imbalance Design Fraction (IDF). The ratio of the design imbalance to the imbalance (including all collateral damage) resulting from release of a single turbine, c ompressor, or fan blade at the maximum rotational speed to be approved, in accordance with CS - E 810.

f. Low Pressure (LP) Rotor. The rotating system, which includes the low pressure turbine and compressor components and a connecting shaft.

g. Well Phas e. The flight hours accumulated on an aeroplane or component before the failure event.

Powered by EASA eRules Page 1486 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 4. BACKGROUND a. Requirements. CS 25.901(c) requires the powerplant installation to comply with CS 25.1309 . In addition, CS 25.903(c) requires means of stopping the rotation of an engine where continued rotation could jeopardise the safety of the aeroplane, and CS 25.903(d) requires that design precautions be taken to minimise the hazards to the aeroplane in the event of an engine rotor failure. CS - E 520(c)(2) requires that data shall be established and provided for the purpose of enabling each aircraft co nstructor to ascertain the forces that could be imposed on the aircraft structure and systems as a consequence of out - of - balance running and during any continued rotation with rotor unbalance after shutdown of the engine following the occurrence of blade f ailure, as demonstrated in compliance with CS - E 810, or a shaft, bearing or bearing support, if this results in higher loads.

b. Blade Failure. The failure of a fan blade and the subsequent damage to other rotating parts of the fan and engine may induce s ignificant structural loads and vibration throughout the airframe that may damage the nacelles, equipment necessary for continued safe flight and landing, engine mounts, and airframe primary structure. Also, the effect of flight deck vibration on displays and equipment is of significance to the crew’s ability to make critical decisions regarding the shut down of the damaged engine and their ability to carry out other operations during the remainder of the flight. The vibratory loads resulting from the failu re of a fan blade have traditionally been regarded as insignificant relative to other portions of the design load spectrum for the aeroplane.

However, the progression to larger fan diameters and fewer blades with larger chords has changed the significance of engine structural failures that result in an imbalanced rotating assembly. This condition is further exacerbated by the fact that fans will continue to windmill in the imbalance condition following engine shut down.

c. Bearing/Bearing Support Failure. Service experience has shown that failures of bearings/bearing supports have also resulted in sustained high vibratory loads.

d. Imbalance Conditions. There are two sustained imbalance conditio ns that may affect safe flight: the windmilling condition and a separate high power condition.

(1) Windmilling Condition. The windmilling condition results after the engine is shut down but continues to rotate under aerodynamic forces. The windmilling imbalance condition results from bearing/bearing support failure or loss of a fan blad e along with collateral damage. This co ndition may last until the aeroplane completes its diversion flight, which could be several hours.

(2) High Power Condition. The high power imbalance condition occurs immediately after blade failure but before the engine is shut down or otherwise spools do wn.

This condition addresses losing less than a full fan blade which may not be sufficient to cause the engine to spool down on its own. This condition may last from several seconds to a few minutes. In some cases it has hampered the crew's ability to rea d instruments that may have aided in determi ning which engine was damaged.

e. The information provided in this AMC is derived from the recommendations in the report “Engine Windmilling Imbalance Loads - Final Report,” dated July 1, 1997, which is appended to this NPA for information.

f. The criteria presented in this AMC are based on a statistical analysis of 25 years of service history of high by - pass ratio engines with fan diameters of 1.52 metres (60 inches) or greater. Although the study was limited t o these larger engines, the criteria and methodology are also acceptab le for use on smaller engines.

Powered by EASA eRules Page 1487 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 5. EVALUATION OF THE WINDMILLING IMBALANCE CONDITIONS a. Objective. It should be shown by a combination of tests and analyses that after: i) partial or complete loss of an engine fan blade, or ii) after bearing/bearing support failure, or iii) any other failure condition that could result in higher induced vibrations including collateral damage, the aeroplane is capable of continued safe flight and landing .

b. Evaluation. The evaluation should show that during continued operation at windmilling engine rotational speeds, the induced vibrations will not cause damage that would jeopardise continued safe flight and landing. The degree of fli ght deck vibration should not prevent the flight crew from operating the aeroplane in a safe manner. This includes the ability to read and accomplish checklist procedures.

This evaluation should consider: (1) The damage to airframe primary structure incl uding, but not limited to, engine mounts and flight control surfaces, (2) The damage to nacelle components, and (3) The effects on equipment necessary for continued safe flight and landing (including connectors) mounted on the engine or airframe.

c. Blade Loss Imbalance Conditions (1) Windmilling Blade Loss Conditions. The duration of the windmilling event should cover the expected diversion time of the aeroplane. An evaluation of service experience indicates that the probability of the combination of a 1.0 IDF and a 60 minute diversion is on the order of 10 - 7 to 10 - 8 while the probability of the combination of a 1.0 IDF and a 180 minute diversion is 10 - 9 or less. Therefore, with an IDF of 1.0, it would not be necessary to consider diversion times great er than 180 minutes. In addition, the 180 minute diversion should be evaluated using nominal and realistic flight conditions and parameters. The following two separate conditions with an IDF of 1.0 are prescribed for application of the subsequent criteria which are developed consistent with the probability of occurrence: (a) A 60 minute diversion flight.

(b) If the maximum diversion time established for the aeroplane exceeds 60 minutes, a diversion flight of a duration equal to the maximum diversion time, but not exceeding 180 minutes.

(2) Aeroplane Flight Loads and Phases (a) Loads on the aeroplane components should be determined by dynamic analysis. At the start of the windmill event, the aeroplane is assumed to be in level flight with a typical pay load and realistic fuel loading. The speeds, altitudes, and flap configurations considered may be established according to the Aeroplane Flight Manual (AFM) procedures. The analysis should take into account unsteady aerodynamic characteristics and all sign ificant An acceptable level of cockpit vibration in terms of vibration frequency, acceleration magnitude, exposure time and direction may be found in ISO 2631/1 “International Standard, Evaluation of Human Exposure to Whole - Body Vibration, Part I: General Requirements”, 1985.

Powered by EASA eRules Page 1488 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) structural degrees of freedom including rigid body modes. The vibration loads should be determined for the significant phases of the diversion profiles described in paragraphs 5c(1)(a) and (b) above.

(b) The significant phases are: 1 The init ial phase during which the pilot establishes a cruise condition; 2 The cruise phase; 3 The descent phase; and 4 The approach to landing phase.

(c) The flight phases may be further divided to account for variation in aerodynamic and other parameters . The calculated loads parameters should include the accelerations needed to define the vibration environment for the systems and flight deck evaluations. A range of windmilling frequencies to account for variation in engine damage and ambient temperature should be considered.

(3) Strength Criteria (a) The primary airframe structure should be designed to withstand the flight and windmilling vibration load combinations defined in paragraphs 1, 2, and 3 below.

1 The peak vibration loads for the flight pha ses in paragraphs 5c(2)(b)1 and 3 above, combined with appropriate 1g flight loads. These loads should be considered limit loads, and a factor of safety of 1.375 should be applied to obtain ultimate load.

2 The peak vibration loads for the approach to landing phase in paragraph 5c(2)(b)4 above, combined with appropriate loads resulting from a positive symmetrical balanced manoeuvring load factor of 1.15g. These loads should be considered as limit loads, and a factor of safety of 1.375 should be applied to obtain ultimate load.

3 The vibration loads for the cruise phase in paragraph 5c(2)(b)2 above, combined with appropriate 1g flight loads and 70 percent of the flight manoeuvre loads up to the maximum likely operational speed of the aeropla ne. These loads are considered to be ultimate loads.

4 The vibration loads for the cruise phase in paragraph 5c(2)(b)2 above, combined with appropriate 1g flight loads and 40 percent of the limit gust velocity of CS 25.341 as specified at VC (design cruising speed) up to the maximum likely operational speed of the aeroplane. These loads are considered to be ultimate loads.

(b) In selecting material strength properties for the static strength analyses, the requirements of CS 25 .613 apply.

(4) Assessment of Structural Endurance (a) Criteria for fatigue and damage tolerance evaluations of primary structure are summarised in Table 1 below. Both of the conditions described in paragraphs 5c(1)(a) and (b) above should be evaluated . Different levels of structural endurance capability are provided for these conditions. The criteria for the condition in paragraph 5c(1)(b) are set to ensure at least a 50 percent probability of preventing a structural component failure. The criteria for the condition in paragraph 5c(1)(a) Powered by EASA eRules Page 1489 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) are set to ensure at least a 95 percent probability of preventing a structural component failure. These criteria are consistent with the probability of occurrences for these events discussed in paragraph 5(c)(1) above.

(b) For multiple load path and crack arrest “fail - safe” structure, either a fatigue analysis per paragraph 1 below, or damage tolerance analysis per paragraph 2 below, may be performed to demonstrate structural endurance capability. For all other structu re, the structural endurance capability should be demonstrated using only the damage tolerance approach of paragraph 2 below. The definitions of multiple load path and crack arrest "fail - safe" structure are the same as defined for use in showing compliance with CS 25.571 , "Damage tolerance and fatigue evaluation of structure."

1 Fatigue Analysis. Where a fatigue analysis is used for substantiation of multiple load path “fail - safe” structure, the total fatigue dama ge accrued during the well phase and the windmilling phase should be considered. The analysis should be conducted considering the following: (aa) For the well phase, the fatigue damage should be calculated using an approved load spectrum (such as used in satisfying the requirements of CS 25.571 ) for the durations specified in Table 1. Average material properties may be used.

(bb) For the windmilling phase, fatigue damage should be calculated for the diversion pr ofiles using a diversion profile consistent with the AFM recommended operations, accounting for transient exposure to peak vibrations, as well as the more sustained exposures to vibrations.

Average material properties may be used.

(cc) For each component , the accumulated fatigue damage specified in Table 1 should be shown to be less than or equal to the fatigue damage to failure of the component.

2 Damage Tolerance Analysis. Where a damage tolerance approach is used to establish the structural endurance , the aeroplane should be shown to have adequate residual strength during the specified diversion time. The extent of damage for residual strength should be established, considering growth from an initial flaw assumed present since the aeroplane was manufa ctured.

Total flaw growth will be that occurring during the well phase, followed by growth during the windmilling phase. The analysis should be conducted considering the following: (aa) The size of the initial flaw should be equivalent to a manufacturing quality flaw associated with a 95 percent probability of existence with 95 percent confidence (95/95).

(bb) For the well phase, crack growth should be calculated starting from the initial flaw defined in paragraph 5c(4)(b)2(aa) above, using an approved load spectrum (such as used in satisfying the requirements of CS 25.571 ) for the duration specified in Table 1. Average material properties may be used.

(cc) For the windmilling phase, crack growth should be calculated for the diversion profile starting from the crack length calculated in paragraph 5c(4)(b)2(bb) above. The diversion profile should be Powered by EASA eRules Page 1490 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GE NERAL AMCs (CS - 25) consistent with the AFM recommended operation accounting for transient exposure to peak vibrations as well as the more sustained exposures to vibrations. Average material properties may be used.

(dd) The residual strength for the structure with damage equal to the crack length calculated in paragraph 5c(4)(b)2(cc ) above should be shown capable of sustaining the combined loading conditions defined in paragraph 5c(3)(a) above with a factor of safety of 1.0.

TABLE 1 - Fatigue and Damage Tolerance Condition Paragraph 5c(1)(a) Paragraph 5c(1)(b) Imbalance Design 1.0 1.0 Fraction (IDF) Diversion time A 60 - minute diversion The maximum expected diversion Well phase Damage for 1 DSG Damage for 1 DSG 1,2 Fatigue Analysis Windmilling Damage due to 60 minute Damage due to the maximum (average material phase diversion under a 1.0 IDF expected diversion time under properties) imbalance condition. a 1.0 IDF imbalance condition 7 7 Criteria Demonstrate no failure Demonstrate no failure under under twice the total damage the total damage (unfactored) due to the well phase and the due to the well phase and the windmilling phase. windmilling phase.

5 5 Well phase Manufacturing quality flaw Manufacturing quality flaw (MQF) grown for 1 DSG (MQF) grown for 1/2 DSG 1,2 Damage Tolerance Windmilling Additional crack growth for Additional crack growth for the 3,4 (average ma terial phase 60 minute diversion with an maximum diversion6 with an properties) IDF = 1.0 IDF = 1.0 Criteria Positive margin of safety with Positive margin of safety with residual strength loads residual strength loads specified in 5c(3)(a) for the specified in 5c(3)(a) for the final final crack length crack length Notes: 1 The analysis method that may be used is described in paragraph 5 (Evaluation of the Windmilli ng Imbalance Conditions) of this AMC.

2 Load spectrum to be used for the analysis is the same load spectrum qualified for use in showing compliance with CS 25.571 , augmented with windmilling loads as appropriate.

3 Windmilling phase is to be demonstrated following application of the well phase spectrum loads.

4 The initial flaw for damage tolerance analysis of the windmilling phase need not be greater than the flaw size determined as the detectable flaw size plus gr owth under well phase spectrum loads for one inspection period for mandated inspections.

5 MQF is the manufacturing quality flaw associated with 9 5/95 probability of existence. (Reference - ‘Verification of Methods For Damage Tolerance Evaluation of Aircra ft Structures to FAA Requirements’, Tom Swift FAA, 12th International Committee on Aeronautical Fatigue, 25 May 1983, Figures 42, and 43.)

6 Maximum diversion time for condition 5c(1)(b) is the maximum diversion time established for the aeroplane, but need not exceed 180 minutes. This condition should only be investigated if the diversion time established for the aeroplane exceeds 60 minutes.

Powered by EASA eRules Page 1491 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) 7 The allowable cycles to failure may be used in the damage calculations.

(5) Systems Integrity (a) It should be shown that systems required for continued safe flight and landing after a blade - out event will withstand the vibratory environment defined for the windmilling conditions and diversion times described above. For this evaluation, the aeroplane is a ssumed to be dispatched in its normal configuration and condition. Additional conditions associated with the Master Minimum Equipment List (MMEL) need not be considered in combination with the blade - out event.

(b) The initial flight environmental conditi ons are assumed to be night, instrument meteorological conditions (IMC) en route to nearest alternate airport, and approach landing minimum of 300 feet and 3/4 mile or runway visual range (RVR) 4000m or better.

(6) Flight crew Response. For the windmilli ng condition described above, the degree of flight deck vibration shall not inhibit the flight crew’s ability to continue to operate the aeroplane in a safe manner during all phases of flight .

d. Bearing/Bearing Support Failure. To evaluate these conditio ns, the low pressure (LP) rotor system should be analysed with each bearing removed, one at a time, with the initial imbalance consistent with the airborne vibration monitor (AVM) advisory level. The analysis should include the maximum operating LP rotor s peed (assumed bearing failure speed), spool down, and windmilling speed regions. The effect of gravity, inlet steady air load, and significant rotor to stator rubs and gaps should be included. If the analysis or experience indicates that secondary damage s uch as additional mass loss, secondary bearing overload, permanent shaft deformation, or other structural changes affecting the system dynamics occur during the event, the model should be revised to account for these additional effects. The objective of th e analyses is to show that the loads and vibrations produced by the bearing/bearing support failure event are less than those produced by the blade loss event across the same frequency range.

An alternative means of compliance is to conduct an assessment o f the design by analogy with previous engines to demonstrate this type of failure is unlikely to occur. Previous engines should be of similar design and have accumulated a significant amount of flight hours with n o adverse service experience.

e. Other fail ure conditions. If any other engine structural failure conditions applicable to the specific engine design, e.g. failure of a shaft, could result in more severe induced vibrations than the blade loss or bearing/bearing support failure condition, they shoul d be evaluated.

6. ANALYSIS METHODOLOGY a. Objective of the Methodology. The aeroplane response analysis for engine windmilling imbalance is a structural dynamic problem. The objective of the methodology is to develop acceptable analytical tools for cond ucting dynamic investigations of imbalance events. The goal of the windmilling analyses is to produce loads and accelerations suitable for structural, systems, and flight deck evaluations.

b. Scope of the Analysis. The analysis of the aeroplane and engine configuration should be sufficiently detailed to determine the windmilling loads and accelerations on the Powered by EASA eRules Page 1492 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) aeroplane. For aeroplane configurations where the windmilling loads and accelerations are shown not to be significant, the extent and depth of the ana lysis may be reduced accordingly.

c. Results of the Analysis. The windmilling analyses should provide loads and accelerations for all parts of the primary structure. The evaluation of equipment and human factors may require additional analyses or tests. F or example, the analysis may need to produce floor vibration levels, and the human factors evaluation may require a test (or analysis) to subject the seat and the human subject to floor vibration.

7. MATHEMATICAL MODELLING a. Components of the Integrated Dynamic Model. Aeroplane dynamic responses should be calculated with a complete integrated airframe and propulsion analytical model. The model should provide representative connections at the engine - to - pylon interfaces, as well as all interfaces between c omponents (e.g., inlet - to - engine and engine - to - thrust reverser). The model should be to a similar level of detail to that used for certification flutter and dynamic gust analyses, except that it should also be capable of rep resenting asymmetric responses. The model should be representative of the aeroplane to the highest windmilling frequency expected. The model consists of the following components: (1) Airframe structural model, (2) Propulsion structural model (including the engine model representing t he engine type - design), (3) Control system model, (4) Aerodynamic model, and (5) Forcing function and gyroscopic effects The airframe and engine manufacturers should mutually agree upon the definition of the integrated structural model, based on test and experience.

b. Airframe Structural Model. An airframe structural model is necessary in order to calculate the response at any point on the airframe due to the rotating imbalance of a windmilling engine. The airframe structural model should include the mass, stiffness, and damping of the complete airframe. A lumped mass and finite element beam representation is considered ade quate to model the airframe. This type of modelling represents each airframe component, such as fuselage, empennage, and wings, as distributed lumped masses rigidly connected to weightless beams that incorporate the stiffness properties of the component. A full aeroplane model capable of representing asymmetric responses is necessary for the windmilling imbalance analyses. Appropriate detail should be included to ensure fidelity of the model at windmilling frequencies. A more detailed finite element model o f the airframe may also be acceptable. Structural damping used in the windmilling analysis may be based on Ground Vibration Test (GVT) measured damping.

c. Propulsion Structural Model (1) Engine manufacturers construct various types of dynamic models to determine loads and to perform dynamic analyses on the engine rotating components, its static structures and mounts. Dynamic engine models can range from a centreline two - dimensional (2D) mo del, to a centreline model with appropriate three - dimensional (3D) features such as mount and pylon, up to a full 3D finite element Powered by EASA eRules Page 1493 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) model (3D FEM). Any of these models can be run for either transient or steady state conditions.

(2) Propulsion structural models typically include the engine and all major components of the propulsion system, such as the nacelle intake, fan cowl doors, thrust reverser, common nozzle assembly, all structural casings, frames, bearing housings, rotors, and a representative pylon . Gyroscopic effects are included. The models provide for representative connections at the engine - to - pylon interfaces as well as all interfaces between components (e.g., inlet - to - engine and engine - to - thrust reverser). The engine that is generating the imb alance forces should be modelled in this level of detail, while the undamaged engines that are operating normally need only to be modelled to represent their sympathetic response to the aeroplane windmilling condition.

(3) Features modelled specifically for blade loss windmilling analysis typically include fan imbalance, component failure and wear, rubs (blade to casing, and intershaft), and resulting stiffness changes. Manufacturers whose engines fail the rotor support structure by design during the blad e loss event should also evaluate the effect of the loss of support on engine structural response during windmilling.

(4) Features that should be modelled specifically for bearing/bearing support failure windmilling events include the effects of gravit y, inlet steady air loads, rotor to stator structure friction and gaps, and rotor eccentricity. Secondary damage should be accounted for, such as additional mass loss, overload of other bearings, permanent shaft deformation, or other structural changes aff ecting the system dynamics, occurring during rundown from maximum LP rotor speed and subsequent windmilling.

d. Control System Model. The automatic flight control system should be included in the analysis unless it can be shown to have an insignificant eff ect on the aeroplane response due to engine imbalance.

e. Aerodynamic Model. The aerodynamic forces can have a significant effect on the structural response characteristics of the airframe. While analysis with no aerodynamic forces may be conservative at m ost frequencies, this is not always the case. Therefore, a validated aerodynamic model should be used. The use of unsteady three - dimensional panel theory methods for incompressible or compressible flow, as appropriate, is recommended for modelling of the w indmilling event. Interaction between aerodynamic surfaces and main surface aerodynamic loading due to control surface deflection should be considered where significant. The level of detail of the aerodynamic model should be supported by tests or previous experience with applications to similar configurations.

Main and control surface aerodynamic derivatives should be adjusted by weighting factors in the a eroelastic response solutions. The weighting factors for steady flow (k=0) are usually obtained by comp aring wind tunnel test results with theoretical data.

f. Forcing Function and Gyroscopic Forces. Engine gyroscopic forces and imbalance forcing functio n inputs should be considered. The imbalance forcing function should be calibrated to the results of the test performed under CS - E 810.

8. VALIDATION.

a. Range of Validation. The analytical model should be valid to the highest windmilling frequency expected.

Powered by EASA eRules Page 1494 of 1495 | Jan 2023 Easy Access Rules for Large Aeroplanes GENERAL AMCs (CS - 25) b. Aeroplane Structural Dynamic Model. The measured ground vibration tests (GVT) normally conducted for compliance with CS 25.629 may be used to validate the analytical model throughout the windmilling range. These tests consist of a complete airframe and propulsion configuration subjected to vibratory forces im parted by electro - dynamic shakers.

(1) Although the forces applied in the ground vibration test are small compared to the windmilling forces, these tests yield reliable linear dynamic characteristics (structural modes) of the airframe and propulsion sy stem combination.

Furthermore, the windmilling forces are far less than would be required to induce non - linear behaviour of the structural material (i.e. yielding). Therefore, a structural dynamic model that is validated by ground vibration test is consid ered appropriate for the windmilling analysis.

(2) The ground vibration test of the aeroplane may not necessarily provide sufficient information to assure that the transfer of the windmilling imbalance loads from the engine is accounted for correctly. Th e load transfer characteristics of the engine to airframe interface via the pylon should be validated by test and analysis correlation. In particular, the effect of the point of application of the load on the dynamic characteristics of the integrated model should be investigated in the ground vibration test by using multiple shaker locations.

(3) Structural damping values obtained in the ground vibration tests are considered conservative for application to windmilling dynamic response analysis. Applicatio n of higher values of damping consistent with the larger amplitudes associated with windmilling analysis should be justified.

c. Aerodynamic Model. The dynamic behaviour of the whole aeroplane in air at the structural frequency range associated with win dmilling is normally validated by the flight flutter tests performed under CS 25.629 .

d. Engine Model. The engine model covering the engine type - design will normally be validated by the Engine manufacturer under CS - E 520(c)(2) by correlation against blade - off test data obtained in showing compliance with CS - E 810. This is aimed at ensuring that the model accurately predicts initial blade release event loads, any rundown resonant response behaviour, frequencies, po tential structural failure sequences, and general engine movements and displacements. In addition, if the Failure of a shaft, bearing or bearing support, results in higher forces being developed, such Failures and their resulting consequences should also b e accurately represented.

9. H IGH POWER IMBALANCE CONDITION.

An imbalance condition equivalent to 50 percent of one blade at cruise rotor speed considered to last for 20 seconds may be assumed unless it is shown that the engine will respond automatically and spool down in a shorter period. It should be shown that attitude, airspeed, and altimeter indications will withstand the vibratory environment of the high power condition and operate accurately in that environment. Adequate cues should be available to determine which engine is damaged. Strength and structural endurance need not be considered for this condition.

[Amdt 25/8] Powered by EASA eRules Page 1495 of 1495 | Jan 2023

Source & rights

Source: easa.europa.eu. © EASA. Reproduction is authorised provided the source is acknowledged.

© European Union / EASA. Reproduced with acknowledgement of the source per the EASA copyright notice.

This re-publication is not the authentic official text — only the version published in the Official Journal of the European Union is authentic.

View the official PDF at easa.europa.euLicense termsDownload PDF

Permanent URL — we don’t break links.

Report a problem or request removal

Document details

Doc number
CS-25 Amendment 27
Publisher
EASA
Year
2025
Pages
1,495
File size
25 MB
Chapters
16
All Easy Access Rules
What to do next
Browse EASA documents
All EASA handbooks, rules & guides
All regulations & handbooks
Every authority, chaptered and searchable
Identify an aircraft
Look up a tail number or match a type
Aircraft for sale
Browse the marketplace