CS 25.1431 Electronic equipment

ED Decision 2003/2/RM

(a) In showing compliance with CS 25.1309(a) and (b) with respect to radio and electronic equipment and their installations, critical environmental conditions must be considered

(b) Radio and electronic equipment must be supplied with power under the requirements of CS 25.1355(c).

(c) Radio and electronic equipment, controls and wiring must be installed so that operation of any one unit or system of units will not adversely affect the simultaneous operation of any other radio or electronic unit, or system of units, required by this CS-25.

(d) Electronic equipment must be designed and installed such that it does not cause essential loads to become inoperative, as a result of electrical power supply transients or transients from other causes.

CS 25.1433 Vacuum systems

ED Decision 2003/2/RM

There must be means, in addition to the normal pressure relief, to automatically relieve the pressure in the discharge lines from the vacuum air pump when the delivery temperature of the air becomes unsafe.

CS 25.1435 Hydraulic Systems

ED Decision 2006/005/R

(See AMC 25.1435)

(a) Element design. Each element of the hydraulic system must be designed to:

(1) Withstand the proof pressure without permanent deformation that would prevent it from performing its intended function, and the ultimate pressure without rupture. The proof and ultimate pressures are defined in terms of the design operating pressure (DOP) as follows:

(2) Withstand, without deformation that would prevent it from performing its intended function, the design operating pressure in combination with limit structural loads that may be imposed;

(3) Withstand, without rupture, the design operating pressure multiplied by a factor of 1.5 in combination with ultimate structural loads that can reasonably occur simultaneously;

(4) Withstand the fatigue effects of all cyclic pressures, including transients, and associated externally induced loads, taking into account the consequences of element failure; and

(5) Perform as intended under all environmental conditions for which the aeroplane is certificated.

(b) System design. Each hydraulic system must:

(1) Have means located at a flight crew member station to indicate appropriate system parameters, if

(i) It performs a function necessary for continued safe flight and landing; or

(ii) In the event of hydraulic system malfunction, corrective action by the crew to ensure continued safe flight and landing is necessary;

(2) Have means to ensure that system pressures, including transient pressures and pressures from fluid volumetric changes in elements that are likely to remain closed long enough for such changes to occur, are within the design capabilities of each element, such that they meet the requirements defined in CS 25.1435(a)(1) through CS 25.1435(a)(5) inclusive;

(3) Have means to minimise the release of harmful or hazardous concentrations of hydraulic fluid or vapours into the crew and passenger compartments during flight;

(4) Meet the applicable requirements of CS 25.863, 25.1183, 25.1185 and 25.1189 if a flammable hydraulic fluid is used; and

(5) Be designed to use any suitable hydraulic fluid specified by the aeroplane manufacturer, which must be identified by appropriate markings as required by CS 25.1541.

(c) Tests. Tests must be conducted on the hydraulic system(s), and/or subsystem(s) and element(s), except that analysis may be used in place of or to supplement testing where the analysis is shown to be reliable and appropriate. All internal and external influences must be taken into account to an extent necessary to evaluate their effects, and to assure reliable system and element functioning and integration. Failure or unacceptable deficiency of an element or system must be corrected and be sufficiently retested, where necessary.

(1) The system(s), subsystem(s), or element(s) must be subjected to performance, fatigue, and endurance tests representative of aeroplane ground and flight operations.

(2) The complete system must be tested to determine proper functional performance and relation to other systems, including simulation of relevant failure conditions, and to support or validate element design.

(3) The complete hydraulic system(s) must be functionally tested on the aeroplane in normal operation over the range of motion of all associated user systems. The test must be conducted at the relief pressure or 1.25 times the DOP if a system pressure relief device is not part of the system design. Clearances between hydraulic system elements and other systems or structural elements must remain adequate and there must be no detrimental effects.

[Amdt 25/2]

AMC 25.1435 Hydraulic Systems - Design, Test, Analysis and Certification

ED Decision 2016/010/R

1. PURPOSE

This AMC (Acceptable Means of Compliance), which is similar to the FAA Advisory Circular AC 25.1435-1, provides advice and guidance on the interpretation of the requirements and on the acceptable means, but not the only means, of demonstrating compliance with the requirements of CS 25.1435. It also identifies other paragraphs of the Certification Specifications (CS) that contain related requirements and other related and complementary documents.

The advice and guidance provided does not in any way constitute additional requirements but reflects what is normally expected by the EASA.

2. RELATED REGULATORY MATERIAL AND COMPLEMENTARY DOCUMENTS

(a) Related Certification Specifications

CS-25 Paragraphs (and their associated AMC material where applicable) that prescribe requirements related to the design substantiation and certification of hydraulic systems and elements include:

Additional CS-25 paragraphs (and their associated AMC material where applicable) that prescribe requirements which can have a significant impact on the overall design and configuration of hydraulic systems are, but are not limited to:

(b) Complementary Documents

Documents, which are considered to provide appropriate standards for the design substantiation and certification of hydraulic systems and system elements may include, but are not limited to:

(i) CS-European Standard Orders (CS-ETSO's)

ETSO-C47 Pressure Instruments - Fuel, Oil and Hydraulic

ETSO-2C75 Hydraulic Hose Assemblies

(ii) Society of Automotive Engineers (SAE) Documents

ARP 4752 Aerospace - Design and Installation of Commercial Transport Aircraft Hydraulic Systems

Note: This document provides a wide range of Civil, Military and Industry document references and standards, which may be appropriate.

(iii) International Organisation for Standardisation (ISO) Documents

ISO 7137 Environmental Conditions and Test Procedures for Airborne Equipment

(iv) US Military Documents

MIL-STD-810 Environmental Test Methods and Engineering Guidelines

(v) European Aviation Safety Agencies Publication

Certification Specification No. 20

AMC 20.6 Temporary Guidance Material for Extended Range Operation with Two-Engine Aeroplanes

ETOPS Certification and Operation

(vi) The European Organisation for Civil Aviation Equipment Documents

ED-14G/RTCA DO-160G Environmental Conditions and Test Procedures for Airborne Equipment

3.  ADVICE AND GUIDANCE

(a) Element Design

(1) Ref. CS 25.1435(a)(1) The design operating pressure (DOP) is the normal maximum steady pressure. Excluded are reasonable tolerances, and transient pressure effects such as may arise from acceptable pump ripple or reactions to system functioning, or demands that may affect fatigue. Fatigue is addressed in sub-paragraph (a)(4) of this paragraph.

The DOP for low-pressure elements (e.g., return, case-drain, suction, reservoirs, etc.) is the maximum pressure expected to occur during normal user system operating modes. Included are transient pressures that may occur during separate or simultaneous operation of user systems such as slats, flaps, landing gears, thrust reverses, flight controls, power transfer units, etc. Short term transient pressures, commonly referred to as pressure spikes, that may occur during the selection and operation of user systems (e.g., those pressure transients due to the opening and closing of selector/control valves, etc.) may be excluded, provided the fatigue effect of such transients is addressed in accordance with sub-paragraph (a)(4) of this paragraph.

In local areas of systems and elements the DOP may be different from the above due to the range of normally anticipated aeroplane operational, dynamic and environmental conditions. Such differences should be taken into account.

At proof pressure, seal leakage not exceeding the allowed maximum in-service leak rate is permitted. Each element should be able to perform its intended functions when the DOP is restored.

For sub-paragraphs (a)(1), (a)(2) and (a)(3) of this paragraph, the pressure and structural loads, as applicable, should be sustained for sufficient time to enable adequate determination that compliance is demonstrated. Typically a time of 2 minutes for proof conditions and 1 minute for ultimate conditions will be considered acceptable.

The term "pressure vessels" is not intended to include small volume elements such as lines, fittings, gauges, etc. It may be necessary to use special factors for elements fabricated from non-metallic/composite materials.

(2) Ref. CS 25.1435(a)(2) Limit structural loads are defined in CS 25.301(a). The loading conditions of CS-25, subpart C to be considered include, but are not limited to, flight and ground manoeuvres, and gust and turbulence conditions. The loads arising in these conditions should be combined with the maximum hydraulic pressures, including transients that could occur simultaneously. Where appropriate, thermal effects should also be accounted for in the strength justification. For hydraulic actuators equipped with hydraulic or mechanical locking features, such as flight control actuators and power steering actuators, the actuators and other loaded elements should be designed for the most severe combination of internal and external loads that may occur in use. For hydraulic actuators that are free to move with external loads, i.e. do not have locking features, the structural loads are the same as the loads produced by the hydraulic actuators. At limit load, seal leakage not exceeding the allowed maximum in-service leak rate is permitted.

(3) Ref. CS 25.1435(a)(3) For compliance, the combined effects of the ultimate structural load(s) as defined in CS 25.301 and 25.303 and the DOP, which can reasonably occur simultaneously, should be taken into account with a factor of 1.5 applied to the DOP. In this case the overall structural integrity of the element should be maintained. However, it may be permissible for this element to suffer leakage, permanent deformation, operational/functional failure or any combination of these conditions. Where appropriate, thermal effects should also be accounted for in the strength justification.

(4) Ref. CS 25.1435(a)(4) Fatigue, the repeated load cycles of an element, is a significant contributor to element failure. Hydraulic elements are mainly subjected to pressure loads, but may also see externally induced load cycles (e.g. structural, thermal, etc.). The applicant should define the load cycles for each element. The number of load cycles should be evaluated to produce equivalent fatigue damage encountered during the life of the aeroplane or to support the assumptions used in demonstrating compliance with CS 25.1309. For example, if the failure analysis of the system allows that an element failure may occur at 25% of aeroplane life, the element fatigue life should at least support this assumption.

(5) Ref. CS 25.1435(a)(5) Aeroplane environmental conditions that an element should be designed for are those under which proper function is required. They may include, but are not limited to temperature, humidity, vibration, acceleration forces, icing, ambient pressure, electromagnetic effects, salt spray, cleaning agents, galvanic, sand, dust and fungus. They may be location specific (e.g., in pressurised cabin vs. in unpressurised area) or general (e.g. attitude). For further guidance on environmental testing, suitable references include, but are not limited to, Military Standard, MIL-STD-810 "Environmental Test Methods and Engineering Guidelines", The European Organisation for Civil Aviation Equipment Document ED-14G "Environmental Conditions and Test Procedures for Airborne Equipment" or International Organisation for Standardisation Document No. ISO 7137 "Environmental Conditions and Test Procedures for Airborne Equipment".

(b) System Design

Ref. CS 25.1435(b) Design features that should be considered for the elimination of undesirable conditions and effects are:

(a) Design and install hydraulic pumps such that loss of fluid to or from the pump cannot lead to events that create a hazard that might prevent continued safe operation. For example, engine driven pump shaft seal failure or leakage in combination with a blocked fluid drain, resulting in engine gearbox contamination with hydraulic fluid and subsequent engine failure.

(b) Design the system to avoid hazards arising from the effects of abnormally high temperatures, which may occur in the system under fault conditions.

(1) Ref. CS 25.1435(b)(1) Appropriate system parameters may include, but are not limited to, pump or system temperatures and pressures, system fluid quantities, and any other parameters which give the pilot indication of the functional level of the hydraulic systems.

(2) Ref. CS 25.1435(b)(2) Compliance may be shown by designing the systems and elements to sustain the transients without damage or failure, or by providing dampers, pressure relief devices, etc.

(3) Ref. CS 25.1435(b)(3) Harmful or hazardous fluid or vapour concentrations are those that can cause short term incapacitation of the flight crew or long term health effects to the passengers or crew.

Compliance may be shown by taking design precautions, to minimise the likelihood of releases and, in the event of a release, to minimise the concentrations. Suitable precautions, based on good engineering judgement, include separation of air conditioning and hydraulic systems, shut-off capability to hydraulic lines, reducing the number of joints and elements, shrouding, etc. In case of leakage, sufficient drainage should be provided.

(4) Ref. CS 25.1435(b)(4) Unless it has been demonstrated that there are no circumstances which can exist (on the aeroplane) under which the hydraulic fluid can be ignited in any of its physical forms (liquid, atomised, etc.), the hydraulic fluid should be considered to be flammable.

(5) Ref. CS 25.1435(b)(5) If more than one approved fluid is specified, the term “suitable hydraulic fluid” is intended to include acceptable mixtures. Typical nameplate marking locations for hydraulic fluid use, are all hydraulic components having elastomer seals such as cylinders, valves, reservoirs, etc.

(c) Tests

Ref. CS 25.1435(c) Test conditions should be representative of the environment that the element, subsystem or system may be exposed to in the design flight envelope. This may include loads, temperature, altitude effects, humidity, and other influences (electrical, pneumatic, etc.). Testing may be conducted in simulators, or stand-alone rigs, integrated laboratory rigs, or on the aeroplane. The test plan should describe the objectives and test methods. All interfaces between the aeroplane elements and the test facilities should be adequately represented.

(1) Ref. CS 25.1435(c)(1) Testing for performance should demonstrate rates and responses required for proper system operation. Testing for fatigue (the repeated load cycling of an element) and endurance (the ability of parts moving relative to each other to continue to perform their intended function) should be sufficient to show that the assumptions used in demonstrating compliance with CS 25.1309 are correct, but are not necessary to demonstrate aeroplane design life. As part of demonstrating that the element(s), sub-system(s), or system(s) perform their intended functions, the manufacturer (applicant) may select procedures and factors of safety identified in accepted manufacturing, national, military, or industry standards, provided that it can be established that they are suitable for the intended application. Minimum design factors specified in those standards or the requirements may be used unless more conservative factors have been agreed with the Agency.

An acceptable test approach for fatigue or endurance testing is to:

(a) Define the intended element life;

(b) Determine the anticipated element duty cycle;

(c) Conduct testing using the anticipated or an equivalent duty cycle.

(2) Ref. CS 25.1435(c)(2) The tests should include simulation of hydraulic system failure conditions in order to investigate the effect(s) of those failures, and to correlate with the failure conditions considered for demonstrating compliance with CS 25.1309. Relevant failure conditions to be tested are those, which cannot be shown to be extremely improbable, and have effects assessed to be major, hazardous, or have significant system interaction or operational implications.

(3) Ref. CS 25.1435(c)(3) Compliance with CS 25.1435(c)(3) can be accomplished by applying a test pressure to the system using aeroplane pumps or an alternate pressure source (e.g. ground cart). The test pressure to be used should be just below the pressure required to initiate system pressure relief (cracking pressure). Return and suction pressures are allowed to be those, which result from application of the test pressure to the pressure side of the system.

Some parts of the system(s) may need to be separately pressurised to ensure the system is completely tested. Similarly, it may be permissible that certain parts of the system need not be tested if it can be shown that they do not constitute a significant part of the system with respect to the evaluation of adequate clearances or detrimental effects.

[Amdt 25/2]

[Amdt 25/12]

[Amst 25/18]

CS 25.1436 Pneumatic systems – high pressure

ED Decision 2016/010/R

(See AMC 25.1436)

(a) General. Pneumatic systems which are powered by, and/or used for distributing or storing, air or nitrogen, must comply with the requirements of this paragraph.

(1) Compliance with CS 25.1309 for pneumatic systems must be shown by functional tests, endurance tests and analysis. Any part of a pneumatic system which is an engine accessory must comply with the relevant requirements of CS 25.1163.

(2) No element of the pneumatic system which would be liable to cause hazardous effects by exploding, if subject to a fire, may be mounted within an engine bay or other designated fire zone, or in the same compartment as a combustion heater.

(3) When the system is operating no hazardous blockage due to freezing must occur. If such blockage is liable to occur when the aeroplane is stationary on the ground, a pressure relieving device must be installed adjacent to each pressure source.

(b) Design. Each pneumatic system must be designed as follows:

(1) Each element of the pneumatic system must be designed to withstand the loads due to the working pressure, P_w, in the case of elements other than pressure vessels or to the limit pressure, P_L, in the case of pressure vessels, in combination with limit structural loads which may be imposed without deformation that would prevent it from performing its intended function, and to withstand without rupture, the working or limit pressure loads multiplied by a factor of 1·5 in combination with ultimate structural loads that can reasonably occur simultaneously.

(i) P_w. The working pressure is the maximum steady pressure in service acting on the element including the tolerances and possible pressure variations in normal operating modes but excluding transient pressures.

(ii) P_L. The limit pressure is the anticipated maximum pressure in service acting on a pressure vessel, including the tolerances and possible pressure variations in normal operating modes but excluding transient pressures.

(2) A means to indicate system pressure located at a flight-crew member station, must be provided for each pneumatic system that –

(i) Performs a function that is essential for continued safe flight and landing; or

(ii) In the event of pneumatic system malfunction, requires corrective action by the crew to ensure continued safe flight and landing.

(3) There must be means to ensure that system pressures, including transient pressures and pressures from gas volumetric changes in components which are likely to remain closed long enough for such changes to occur –

(i) Will be within 90 to 110% of pump average discharge pressure at each pump outlet or at the outlet of the pump transient pressure dampening device, if provided; and

(ii) Except as provided in sub-paragraph (b)(6) of this paragraph, will not exceed 125% of the design operating pressure, excluding pressure at the outlets specified in sub-paragraph (b)(3)(i) of this paragraph. Design operating pressure is the maximum steady operating pressure.

The means used must be effective in preventing excessive pressures being generated during ground charging of the system. (See AMC 25.1436(b)(3).)

(4) Each pneumatic element must be installed and supported to prevent excessive vibration, abrasion, corrosion, and mechanical damage, and to withstand inertia loads.

(5) Means for providing flexibility must be used to connect points in a pneumatic line between which relative motion or differential vibration exists.

(6) Transient pressure in a part of the system may exceed the limit specified in sub-paragraph (b)(3)(ii) of this paragraph if –

(i) A survey of those transient pressures is conducted to determine their magnitude and frequency; and

(ii) Based on the survey, the fatigue strength of that part of the system is substantiated by analysis or tests, or both.

(7) The elements of the system must be able to withstand the loads due to the pressure given in Appendix L, for the proof condition without leakage or permanent distortion and for the ultimate condition without rupture. Temperature must be those corresponding to normal operating conditions. Where elements are constructed from materials other than aluminium alloy, tungum, or medium-strength steel, the Authority may prescribe or agree other factors. The materials used should in all cases be resistant to deterioration arising from the environmental conditions of the installation, particularly the effects of vibration.

(8) Where any part of the system is subject to fluctuating or repeated external or internal loads, adequate allowance must be made for fatigue.

(c) Tests

(1) A complete pneumatic system must be static tested to show that it can withstand a pressure of 1·5 times the working pressure without a deformation of any part of the system that would prevent it from performing its intended function. Clearance between structural members and pneumatic system elements must be adequate and there must be no permanent detrimental deformation. For the purpose of this test, the pressure relief valve may be made inoperable to permit application of the required pressure.

(2) The entire system or appropriate sub-systems must be tested in an aeroplane or in a mock-up installation to determine proper performance and proper relation to other aeroplane systems. The functional tests must include simulation of pneumatic system failure conditions. The tests must account for flight loads, ground loads, and pneumatic system working, limit and transient pressures expected during normal operation, but need not account for vibration loads or for loads due to temperature effects. Endurance tests must simulate the repeated complete flights that could be expected to occur in service. Elements which fail during the tests must be modified in order to have the design deficiency corrected and, where necessary, must be sufficiently retested. Simulation of operating and environmental conditions must be completed on elements and appropriate portions of the pneumatic system to the extent necessary to evaluate the environmental effects. (See AMC 25.1436(c)(2).)

(3) Parts, the failure of which will significantly lower the airworthiness or safe handling of the aeroplane must be proved by suitable testing, taking into account the most critical combination of pressures and temperatures which are applicable.

[Amdt 25/1]

[Amdt 25/18]

AMC 25.1436(b)(3) Pneumatic Systems

ED Decision 2003/2/RM

1 In systems in which the air pressure of the supply sources is significantly greater than the system operating pressure (e.g. an engine bleed-air tapping) due account should be taken of the consequences of failure of the pressure-regulating device when assessing the strength of the system, downstream of the device relative to the values of P_W, P_L and P_R.

2 Such devices should be protected as necessary against deleterious effects resulting from the presence of oil, water or other impurities, which may exist in the system.

AMC 25.1436(c)(2) Pneumatic Systems

ED Decision 2003/2/RM

The loads due to vibration and the loads due to temperature effects are those loads, which act upon the elements of the system due to environmental conditions.

CS 25.1438 Pressurisation and low pressure pneumatic systems

ED Decision 2016/010/R

(See AMC 25.1438)

Pneumatic systems (ducting and components) served by bleed air, such as engine bleed air, air conditioning, pressurisation, engine starting and hotair ice-protection systems, which are essential for the safe operation of the aeroplane or whose failure may adversely affect any essential or critical part of the aeroplane or the safety of the occupants, must be so designed and installed as to comply the CS 25.1309 In particular account must be taken of bursting or excessive leakage. (See AMC 25.1438 paragraph 1 for strength and AMC 25.1438 paragraph 2 for testing.)

[Amdt 25/18]

AMC 25.1438 Pressurisation and low pressure pneumatic systems

ED Decision 2003/2/RM

1 Strength

1.1 Compliance with CS 25.1309(b) in relation to leakage in ducts and components will be achieved if it is shown that no hazardous effect will result from any single burst or excessive leakage.

1.2 Each element (ducting and components) of a system, the failure of which is likely to endanger the aeroplane or its occupants, should satisfy the most critical conditions of Table 1.

TABLE 1

P₁   = the most critical value of pressure encountered during normal functioning.

T₁   = the combination of internal and external temperatures which can be encountered in association with pressure P₁.

P₂   = the most critical value of pressure corresponding to a probability of occurrence ‘reasonably probable’.

T₂   = the combination of internal and external temperatures which can be encountered in association with pressure P₂.

P₃   = the most critical value of pressure corresponding to a probability of occurrence ‘remote’.

T₃   = the combination of internal and external temperatures which can be encountered in association with pressure P₃.

P₄   = the most critical value of pressure corresponding to a probability of occurrence ‘extremely remote’.

T₄   = the combination of internal and external temperatures which can be encountered in association with pressure P₄.

1.3  After being subjected to the conditions given in column 1 of Table 1, and on normal operating conditions being restored, the element should operate normally and there should be no detrimental permanent distortion.

1.4  The element should be capable of withstanding the conditions given in column 2 of Table 1 without bursting or excessive leakage. On normal operating conditions being restored, correct functioning of the element is not required.

1.5  The element should be capable of withstanding, simultaneously with the loads resulting from the temperatures and pressures given in the Table, the loads resulting from –

a. Any distortion between each element of the system and its supporting structures.

b. Environmental conditions such as vibration, acceleration and deformation.

1.6  The system should be designed to have sufficient strength to withstand the handling likely to occur in operation (including maintenance operations).

2 Tests

2.1 Static tests. Each element examined under 1.2 should be static-tested to show that it can withstand the most severe conditions derived from consideration of the temperatures and pressures given in the Table. In addition, when necessary, sub-systems should be tested to the most severe conditions of 1.2 and 1.5. The test facility should be as representative as possible of the aircraft installation in respect of these conditions.

2.2 Endurance tests. When failures can result in hazardous conditions, elements and/or sub-systems should be fatigue-tested under representative operating conditions that simulate complete flights to establish their lives.

CS 25.1439 Protective breathing equipment

ED Decision 2007/020/R

(a) Fixed (stationary, or built in) protective breathing equipment must be installed for the use of the flight crew, and at least one portable protective breathing equipment shall be located at or near the flight deck for use by a flight crew member. In addition, portable protective breathing equipment must be installed for the use of appropriate crew members for fighting fires in compartments accessible in flight other than the flight deck. This includes isolated compartments and upper and lower lobe galleys, in which crew member occupancy is permitted during flight. Equipment must be installed for the maximum number of crew members expected to be in the area during any operation.

(b) For protective breathing equipment required by subparagraph (a) of this paragraph or by the applicable Operating Regulations, the following apply:

(1) The equipment must be designed to protect the appropriate crewmember from smoke, carbon dioxide, and other harmful gases while on flight deck duty or while combating fires.

(2) The equipment must include –

(i) Masks covering the eyes, nose and mouth, or

(ii) Masks covering the nose and mouth, plus accessory equipment to cover the eyes.

(3) Equipment, including portable equipment, while in use must allow communication with other crew members while in use. Equipment available at flight crew assigned duty stations must enable the flight crew to use radio equipment.

(4) The part of the equipment protecting the eyes must not cause any appreciable adverse effect on vision and must allow corrective glasses to be worn.

(5) The equipment must supply protective oxygen of 15 minutes duration per crew member at a pressure altitude of 2438 m (8000 ft) with a respiratory minute volume of 30 litres per minute BTPD. The equipment and system must be designed to prevent any inward leakage to the inside of the device and prevent any outward leakage causing any significant increase in the oxygen content of the local ambient atmosphere. If a demand oxygen system is used, a supply of 300 litres of free oxygen at 21°C (70°F) and 760 mm Hg pressure is considered to be of 15-minute duration at the prescribed altitude and minute volume. If a continuous flow open circuit protective breathing system is used a flow rate of 60 litres per minute at 2438 m (8 000 ft) (45 litres per minute at sea level) and a supply of 600 litres of free oxygen at 21°C (70°F) and 204 kPa (760 mm Hg) pressure is considered to be of 15-minute duration at the prescribed altitude and minute volume. Continuous flow systems must not increase the ambient oxygen content of the local atmosphere above that of demand systems. BTPD refers to body temperature conditions, that is 37°C (99°F), at ambient pressure, dry.

(6) The equipment must meet the requirements of CS 25.1441.

[Amdt 25/4]

CS 25.1441  Oxygen equipment and supply

ED Decision 2019/013/R

(a) If certification with supplemental oxygen equipment is requested, the equipment must meet the requirements of this paragraph and CS 25.1443 through 25.1453.

(b) The oxygen system must be free from hazards in itself, in its method of operation, and in its effect upon other components. (See AMC 25.1441(b))

(c) Except for oxygen chemical generators and for small sealed, one-time use, gaseous oxygen bottles, there must be a means to allow the crew to readily determine, during flight, the quantity of oxygen available in each source of supply.

(d) The oxygen flow rate and the oxygen equipment for aeroplanes for which certification for operation above 12192 m (40 000 ft) is requested must be approved. (See AMC 25.1441(d).)

[Amdt No: 25/18]

[Amdt No: 25/21]

[Amdt No: 25/23]

AMC 25.1441(b) Risk assessment related to oxygen fire hazards in gaseous oxygen systems

ED Decision 2018/005/R

1.  Purpose

This AMC provides guidance material and acceptable means of compliance for demonstrating compliance with CS 25.1441(b), which requires an oxygen system to be free from hazards in itself, in its method of operation, and in its effect upon other components.

This AMC applies to centralised, decentralised or portable oxygen systems. Those systems may be installed in an occupied compartment or in a remote inaccessible area.

2.  Related certification specifications

CS 25.869(c) Fire protection: systems — Oxygen equipment and lines

CS 25.1301 Function and installation

CS 25.1309 Equipment, systems and installations

CS 25.1441(b) Oxygen equipment and supply

CS 25.1453 Protection of oxygen equipment from rupture

3.  Installation

CS 25.869(c) specifies that oxygen system equipment and lines must:

(1)  not be located in any designated fire zone;

(2)  be protected from heat that may be generated in, or may escape from, any designated fire zone; and

(3) be installed so that escaping oxygen cannot cause the ignition of grease, fluid, or vapour accumulations that are present in normal operation or as a result of a failure or malfunction of any system.

In addition, the following analysis and precautions should be considered.

3.1.  External ignition sources

An analysis should be performed to identify all possible external ignition sources and their mechanisms. If an ignition source exists in the vicinity of the oxygen system installation, it should be demonstrated that in normal operation or in conditions that result from a failure or malfunction of any system, the risk of ignition is minimised and that all design precautions have been taken to minimise this risk.

3.2.  Contamination

The compartments in which oxygen system components are installed should provide adequate protection against potential contamination by liquids, lubricants (grease, etc.), dust, etc.

3.3.  Ventilation

The compartments in which oxygen system components are installed should be ventilated in such a way that, if a leak occurred or oxygen was discharged directly into the compartment (not overboard) from any protective device or pressure-limiting device, the likelihood of ignition of the oxygen-enriched environment would be minimised. The applicant should substantiate that the ventilation rate of the compartment is adequate. Analytically determined ventilation rates should be validated by flight test results or their equivalent.

CS 25.1453(f) provides additional specifications related to ventilation.

This paragraph does not apply to portable oxygen systems, such as systems used to provide first-aid oxygen to passengers or supplemental oxygen for cabin crew mobility, usually stowed in overhead bins, provided that it is confirmed that the shut-off means mounted on the oxygen container is always closed when the system is stowed and not used.

3.4.  Routing

The installation of the system should be such that components and pipelines are:

—             adequately separated from electrical and fluid systems;

—             routed so as to minimise joints and sharp bends;

—             clear of moving controls and other mechanisms.

CS 25.1453(b) provides additional specifications related to oxygen pressure sources and the installation of tubing.

4.  Oxygen hazards analysis (OHA)

The applicant should demonstrate that the oxygen systems and their components are designed so that the occurrence of an uncontrolled oxygen fire at the aircraft level is extremely improbable and does not result from a single failure.

To assess the consequences of system/component failures, the applicant should conduct an oxygen hazards analysis (OHA) in either a qualitative or a quantitative manner, and include the conclusions of the OHA in the oxygen systems system safety analysis (SSA).

The applicant should provide an OHA with a detailed assessment of the potential ignition and combustion mechanisms. In the OHA, the applicant should do the following:

4.1.  Equipment failures

The applicant should use a detailed failure modes and effects analysis (FMEA) at the component level as the input for the OHA. The OHA should not include quality/production issues or human errors during assembly in.

The applicant should take into account all single failures, and any failure combinations that are not shown to be extremely improbable.

4.2.  Operating conditions

The applicant should consider the worst-case operating conditions, including any failures determined from paragraph 4.1 that are not shown to be extremely improbable.

4.3.  Components and materials

The analysis should cover all component designations and the materials of construction, including compounds and non-metallic material.

Most materials ignite at lower temperatures in an oxygen-enriched environment than in air. The applicant should therefore establish the auto ignition temperature assuming a 100 % oxygen-enriched environment, and evaluate the materials used to determine whether they are flammable under the conditions specified in paragraph 4.2.

4.4.  Ignition mechanisms

The assessment should address the identification of the possible internal ignition mechanisms. As a minimum, the following mechanisms should be assessed:

—             adiabatic compression (pneumatic impact) (see Note 1 below)

—             frictional heating

—             mechanical impact

—             particle impact

—             fresh metal exposure

—             static discharge

—             electric arc

—             chemical reaction

—             resonance.

The applicant should evaluate each ignition mechanism under the conditions specified in paragraph 4.2 to determine whether it exists in the component and in the system considered.

Note 1: in calculating the temperature elevation due to oxygen compression, the applicant should use the transient peak pressures measured under paragraph 5.2, unless other values are duly demonstrated.

4.5.  Kindling chain

The applicant should evaluate the ability of a fire to propagate and burn through a component, i.e. the kindling chain. The ignition and burning of a single component may produce sufficient heat to ignite the surrounding materials, leading to a burn-through of the component.

Therefore, if any of the ignition mechanisms assessed under paragraph 4.4 exists, the applicant should conduct an analysis to assess the kindling chain, based on the ability of the materials of construction to contain a fire.

5.  Design considerations

5.1.  High-pressure shut-off

As required by CS 25.1453(c), the applicant must keep to a minimum the parts of the system that are subjected to high-pressure oxygen, and must locate those parts so they are remote from occupied compartments to the extent that is practicable.

High-pressure shut-off valves should be designed to open and close slowly enough so as to avoid the possible risk of fire or explosion.

5.2.  Pressure-limiting devices (e.g. relief valves)

As required by CS 25.1453(e), the applicant must design the pressure-limiting devices (e.g. relief valves), which protect parts of the system from excessive pressure, so that in the event of a malfunction of the normal pressure-controlling means (e.g. a pressure reducing valve), they prevent the pressure from exceeding the applicable maximum working pressure multiplied by 1.33.

In addition, the performance of pressure-limiting devices should be tested on a complete system under the conditions specified in paragraph 4.2, but limited to failures that are not shown to be extremely improbable.

For testing purposes, oxygen can be replaced by an inert gas (e.g. nitrogen). However, the relationship between the pressure and the temperature would not be simulated by the inert gas and should be analysed separately. The transient pressure level (TPL) should be measured at various locations, and each component of the oxygen system exposed to the TPL should be demonstrated to sustain the pressure level.

The analysis detailed in paragraph 4.1 may identify single failures that affect the pressure regulation device. These failures could include poppet/shaft/diaphragm blockages or ruptures, seal leakages, etc. of a pressure reducer. If the applicant excludes any of these single failures from the TPL assessment due to

—             design considerations, such as a safety factor on the yield strength, the size of damage, etc. or

—             a low estimated probability of the failure occurring,

they should provide a detailed rationale for this in the certification documents and agree it with EASA.

CS 25.1453(d) provides additional specifications related to the protection of oxygen pressure sources (e.g. tanks or cylinders) against overpressure.

5.3.  Isolation

When the system includes multiple bottles as oxygen sources, each source should be protected from reverse flow or reverse pressure if a failure occurs on one source. Such isolation can be achieved by installing check valves or an equivalent means in an appropriate manner.

5.4.  Non-metallic hoses

Except for flexible lines from oxygen outlets to the dispensing units, or where shown to be otherwise suitable for the installation, non-metallic hoses should not be used for any oxygen line that is normally pressurised during flight.

If non-metallic hoses with anti-collapse springs are used due to installation constraints, it should be ensured that inadvertent electrical current cannot reach the spring, as this could cause the hose to melt or burn, leading to an oxygen-fed fire. As an example, correctly grounded metallic braid may be considered to prevent inadvertent electrical current from reaching the spring.

In addition, non-metallic oxygen distribution lines should not be routed where they may be subjected to elevated temperatures, electric arcing, or released flammable fluids that might result from normal operation, or from a failure or malfunction of any system.

5.5. Grounding

All the oxygen lines and hoses should be grounded as appropriate.

5.6.  Joints

Joints should, as far as possible, be assembled dry. However, where compounds are used for sealing, they should be approved for that purpose.

5.7.  Recharging systems

Recharging systems, if installed, should be provided with means to prevent excessive rates of charging, which could result in dangerously high temperatures within the system. The recharging system should also provide protection from contamination.

Where in situ recharging facilities are provided, the compartments in which they are located should be accessible from outside the aircraft and be as remote as possible from other service points and equipment. Placards should be provided, located adjacent to the servicing point, with adequate instructions covering the precautions to be observed when the system is being charged.

[Amdt 25/21]

AMC 25.1441(c)  Oxygen chemical generators and small sealed, one-time use gaseous oxygen bottles

ED Decision 2019/013/R9/013/R

For chemical generators and for small, sealed, one-time use, gaseous oxygen bottles distributed throughout the cabin for passenger use, the following precautions should be considered in order to ensure that oxygen is actually available:

1. The oxygen supply source should be designed and tested to ensure that it will retain the required quantity of oxygen or chemicals throughout its expected life under the foreseeable operating conditions;

2. A means should be provided for maintenance personnel to readily determine when oxygen is no longer available in the supply source due to inadvertent activation;

3. The life limit of the oxygen supply source should be established by test and analysis;

4. Each oxygen supply source should be labelled such that the expiration date can be easily checked by maintenance; and

5. Instructions for continued airworthiness should be provided to ensure that the oxygen supply sources:

a. are removed from the aeroplane and replaced whenever they have been used, and before they reach their expiration dates; and

b. are not installed on the aeroplane beyond their expiration dates.

[Amdt No: 25/23]

AMC 25.1441(d) Oxygen equipment and supply

ED Decision 2003/2/RM

In assessing the required oxygen flow rates and equipment performance standards, consideration should be given to the most critical cabin altitude/time-history following any failure, not shown to be Extremely Improbable, which will result in the loss of cabin pressure taking into account the associated emergency procedures.

CS 25.1443 Minimum mass flow of supplemental oxygen

ED Decision 2003/2/RM

(a) If continuous flow equipment is installed for use by flight-crew members, the minimum mass flow of supplemental oxygen required for each crew member may not be less than the flow required to maintain, during inspiration, a mean tracheal oxygen partial pressure of 149 mmHg when breathing 15 litres per minute, BTPS, and with a maximum tidal volume of 700 cm³ with a constant time interval between respirations.

(b) If demand equipment is installed for use by flight-crew members, the minimum mass flow of supplemental oxygen required for each crew member may not be less than the flow required to maintain, during inspiration, a mean tracheal oxygen partial pressure of 122 mmHg, up to and including a cabin pressure altitude of 10668 m (35 000 ft), and 95% oxygen between cabin pressure altitudes of 10668 m (35 000) and 12192 m (40 000 ft), when breathing 20 litres per minute BTPS. In addition, there must be means to allow the crew to use undiluted oxygen at their discretion.

(c) For passengers and cabin crew members, the minimum mass flow of supplemental oxygen required for each person at various cabin pressure altitudes may not be less than the flow required to maintain, during inspiration and while using the oxygen equipment (including masks) provided, the following mean tracheal oxygen partial pressures:

(1) At cabin pressure altitudes above 3048 m (10 000 ft) up to and including 5639 m (18,500 ft), a mean tracheal oxygen partial pressure of 100 mmHg when breathing 15 litres per minute, BTPS, and with a tidal volume of 700 cm³ with a constant time interval between respirations.

(2) At cabin pressure altitudes above 5639 m (18 500 ft) up to and including 12192 m (40,000 ft), a mean tracheal oxygen partial pressure of 83·8 mmHg when breathing 30 litres per minute, BTPS, and with a tidal volume of 1100 cm³ with a constant time interval between respirations.

(d) If first-aid oxygen equipment is installed, the minimum mass flow of oxygen to each user may not be less than 4 litres per minute, STPD. However, there may be a means to decrease this flow to not less than 2 litres per minute, STPD, at any cabin altitude. The quantity of oxygen required is based upon an average flow rate of 3 litres per minute per person for whom first-aid oxygen is required.

(e) If portable oxygen equipment is installed for use by crew members, the minimum mass flow of supplemental oxygen is the same as specified in sub-paragraph (a) or (b) of this paragraph, whichever is applicable.

CS 25.1445 Equipment standards for the oxygen distributing system

ED Decision 2012/008/R

(a) When oxygen is supplied to both crew and passengers, the distribution system must be designed for either –

(1) A source of supply for the flight crew on duty and a separate source for the passengers and other crew members; or

(2) A common source of supply with means to separately reserve the minimum supply required by the flight crew on duty.

(b) Portable walk-around oxygen units of the continuous flow, diluter demand, and straight demand kinds may be used to meet the crew or passenger breathing requirements.

[Amdt 25/12]

CS 25.1447 Equipment standards for oxygen dispensing units

ED Decision 2017/015/R

(See AMC 25.1447)

If oxygen-dispensing units are installed, the following apply:

(a) There must be an individual dispensing unit for each occupant for whom supplemental oxygen is to be supplied. Units must be designed to cover the nose and mouth and must be equipped with a suitable means to retain the unit in position on the face. Flight crew masks for supplemental oxygen must have provisions for the use of communication equipment.

(b) If certification for operation up to and including 7620 m (25 000 ft) is requested, an oxygen supply terminal and unit of oxygen dispensing equipment for the immediate use of oxygen by each crew member must be within easy reach of that crew member. For any other occupants the supply terminals and dispensing equipment must be located to allow use of oxygen as required by the operating rules.

(c) If certification for operation above 7620 m (25 000 ft) is requested, there must be oxygen dispensing equipment meeting the following requirements (See AMC 25.1447(c)):

(1) There must be an oxygen-dispensing unit connected to oxygen supply terminals immediately available to each occupant, wherever seated. If certification for operation above 9144 m (30 000 ft) is requested, the dispensing units providing the required oxygen flow must be automatically presented to the occupants before the cabin pressure altitude exceeds 4572 m (15 000 ft) and the crew must be provided with a manual means to make the dispensing units immediately available in the event of failure of the automatic system. The total number of dispensing units and outlets must exceed the number of seats by at least 10%. The extra units must be as uniformly distributed throughout the cabin as practicable. (See AMC 25.1447(c)(1).)

(2) Each flight-crew member on flight deck duty must be provided with demand equipment. In addition, each flight-crew member must be provided with a quick-donning type of oxygen dispensing unit, connected to an oxygen supply terminal, that is immediately available to him when seated at his station, and this is designed and installed so that it (see AMC 25.1447(c)(2)) –

(i) Can be placed on the face from its ready position, properly secured, sealed, and supplying oxygen upon demand, with one hand within 5 seconds and without disturbing eyeglasses or causing delay in proceeding with emergency duties; and

(ii) Allows, while in place, the performance of normal communication functions.

(3) There must be sufficient outlets and units of dispensing equipment of a type similar to that required by sub-paragraph (c)(1) of this paragraph in all other areas that may be occupied by passengers or crew members during flight. (See AMC 25.1447 (c)(3))

(4) Portable oxygen equipment must be immediately available for each cabin crew member. The portable oxygen equipment must have the oxygen dispensing unit connected to the portable oxygen supply. (See AMC 25.1447(c)(4).)

[Amdt 25/12]

[Amdt 25/13]

[Amdt 25/18]

[Amdt 25/19]

AMC 25.1447(c) Equipment standards for oxygen dispensing units

ED Decision 2003/2/RM

Where Operational Regulations do not require all passengers to be provided with oxygen, (c)(3) and (c)(4) may not apply.

AMC 25.1447(c)(1) Equipment standards for oxygen-dispensing units

ED Decision 2017/015/R

1 When oxygen masks are presented, oxygen should be supplied to the mask but without flow.

2 Oxygen flow from the mask should be initiated automatically on pulling the mask to the face.

3 Facilities for manual presentation by a crewmember should be provided on each dispensing unit.

4 Indication of the operation of the automatic presentation system should be provided at the appropriate flight-crew station.

5 The design of the automatic presentation system should take into account that when the landing field altitude is less than 610 m (2000 feet) below the normal preset automatic presentation altitude, the automatic presentation altitude may be reset to landing field altitude plus 610 m (2000 feet).

6  A supplemental oxygen supply should be provided for each passenger lying on a bed or a seat that can be converted into a bed. Except for cases where the occupant’s head location during sleeping is obvious, a placard indicating the correct sleeping position should be installed, unless the passenger oxygen system is designed to account for any sleeping position.

7  Sufficient illumination should be provided at all times or automatically when necessary (i.e. without the need of a crew action and without delay) at each location where supplemental oxygen is provided so that in the event of oxygen mask presentation, the user has sufficient visibility to enable quick donning.

[Amdt 25/19]

AMC 25.1447(c)(2) Equipment standards for oxygen dispensing units

ED Decision 2003/2/RM

Unless it is required that the pilot at the control is wearing his mask and breathing oxygen while the altitude exceeds 7620 m (25 000 feet), the design of the flight-crew masks and their stowages should be such that each mask can be placed in position and put into operation in not more than five seconds, one hand only being used, and will thereafter remain in position, both hands being free.

AMC 25.1447(c)(3) Equipment standards for oxygen-dispensing units

ED Decision 2017/015/R

It is acceptable that oxygen outlets/units of dispensing equipment are not provided within an area where people are likely to congregate (for instance a waiting area for lavatory facilities, a bar/lounge area etc.), provided the applicant demonstrates that sufficient oxygen-dispensing outlets are within five feet or five seconds reach of the area and that no visual obstruction exists between the potential oxygen users and the outlets, such as curtains or partitions, unless another method of indication (e.g. an ‘oxygen in use’ light) is provided in the area.

There should be at least two outlets and units of dispensing equipment in toilets, washrooms, galley work areas etc. In such areas where occupancy of more than two persons can be expected, the number of outlets (within the area or within five feet or five seconds reach) should be consistent with the expected maximum occupancy.

In the case of a shower, there should be an oxygen outlet and unit of dispensing equipment immediately available to each shower occupant without stepping outside the shower. Reaching through an opened shower cubicle door is acceptable, in which case the door should be sufficiently transparent so that the location of the mask and the required actions to access it are immediately obvious.

[Amdt 25/13]

[Amdt 25/15]

[Amdt 25/19]

AMC 25.1447(c)(4) Equipment standards for oxygen dispensing units

ED Decision 2003/2/RM

1 The equipment should be so located as to be within reach of the cabin crewmembers while seated and restrained at their seat stations.

2 The mask/hose assembly should be already connected to the supply source, and oxygen should be delivered with no action being required except turning it on and donning the mask.

3 Where a cabin crewmember’s work area is not within easy reach of the equipment provided at his seat station, an additional unit should be provided at the work area.

CS 25.1449 Means for determining use of oxygen

ED Decision 2003/2/RM

There must be a means to allow the crew to determine whether oxygen is being delivered to the dispensing equipment.

CS 25.1450 Chemical oxygen generators

ED Decision 2015/019/R

(a) For the purpose of this paragraph, a chemical oxygen generator is defined as a device, which produces oxygen, by chemical reaction.

(b) Each chemical oxygen generator must be designed and installed in accordance with the following requirements:

(1) Surface temperature developed by the generator during operation may not create a hazard to the aeroplane or to its occupants.

(2) Means must be provided to relieve any internal pressure that may be hazardous.

(3)  Comply with CS 25.795(d).

(c) In addition to meeting the requirements in sub-paragraph (b) of this paragraph, each portable chemical oxygen generator that is capable of sustained operation by successive replacement of a generator element must be placarded to show –

(1) The rate of oxygen flow, in litres per minute;

(2) The duration of oxygen flow, in minutes, for the replaceable generator element; and

(3) A warning that the replaceable generator element may be hot, unless the element construction is such that the surface temperature cannot exceed 37.8°C (100°F).

[Amdt 25/17]

CS 25.1453 Protection of oxygen equipment from rupture

ED Decision 2007/020/R

(a) Each element of the system, excluding chemical oxygen generators, must have sufficient strength to withstand the maximum working pressures and temperatures in combination with any externally applied load, arising from consideration of limit structural loads that may be acting on that part of the system in service.

(1) The maximum working pressure must include the maximum normal operating pressure, the transient and surge pressures, tolerances of any pressure limiting means and possible pressure variations in the normal operating modes. Transient or surge pressures need not be considered except where these exceed the maximum normal operating pressure multiplied by 1·10.

(2) Account must be taken of the effects of temperature up to the maximum anticipated temperature to which the system may be subjected.

(3) Strength demonstration using proof pressure and burst pressure coefficients specified in Table 1 is acceptable, unless higher stresses result when elements are subjected to combined pressure, temperature and structural loads.

(i) The proof and burst factors in Table 1 must be applied to maximum working pressure obtained from sub-paragraph (a)(1) with consideration given to the temperature of sub-paragraph (a)(2).

(ii) Proof pressure must be held for a minimum of 2 minutes and must not cause any leakage or permanent distortion.

(iii) Burst pressure must be held for a minimum of 1 minute and must not cause rupture but some distortion is allowed.

TABLE 1

(b) Oxygen pressure sources and tubing lines between the sources and shut-off means must be –

(1) Protected from unsafe temperatures; and

(2) Located where the probability and hazard of rupture in a crash landing are minimised.

(c) Parts of the system subjected to high oxygen pressure must be kept to a minimum and must be remote from occupied compartments to the extent practicable. Where such parts are installed within occupied compartments they must be protected from accidental damage.

(d) Each pressure source (e.g. tanks or cylinders) must be provided with a protective device (e.g. rupture disc). Such devices must prevent the pressure from exceeding the maximum working pressure multiplied by 1·5.

(e) Pressure limiting devices (e.g. relief valves), provided to protect parts of the system from excessive pressure, must prevent the pressures from exceeding the applicable maximum working pressure multiplied by 1·33 in the event of malfunction of the normal pressure controlling means (e.g. pressure reducing valve).

(f) The discharge from each protective device and pressure limiting device must be vented overboard in such a manner as to preclude blockage by ice or contamination, unless it can be shown that no hazard exists by its discharge within the compartment in which it is installed. In assessing whether such hazard exists consideration must be given to the quantity and discharge rate of the oxygen released, the volume of the compartment into which it is discharging, the rate of ventilation within the compartment and the fire risk due to the installation of any potentially flammable fluid systems within the compartment.

[Amdt 25/4]

CS 25.1455 Draining of fluids subject to freezing

ED Decision 2003/2/RM

If fluids subject to freezing may be drained overboard in flight or during ground operation, the drains must be designed and located to prevent the formation of hazardous quantities of ice on the aeroplane as a result of the drainage.

CS 25.1457 Cockpit voice recorders

ED Decision 2020/024/R

(See AMC 25.1457)

(a) Each cockpit voice recorder required by the operating rules must be approved and must be installed so that it will record the following:

(1) Voice communications transmitted from or received in the aeroplane by radio.

(2) Voice communications of flight-crew members on the flight deck.

(3) Voice communications of flight-crew members on the flight deck, using the aeroplane’s interphone system.

(4) Voice or audio signals identifying navigation or approach aids introduced into a headset or speaker.

(5) Voice communications of flight-crew members using the passenger loudspeaker system, if there is such a system and if the fourth channel is available in accordance with the requirements of sub-paragraph (c)(4)(ii) of this paragraph.

(b) The recording requirements of sub-paragraph (a)(2) of this paragraph must be met by installing a cockpit-mounted area microphone, located in the best position for recording voice communications originating at the first and second pilot stations and voice communications of other crew members on the flight deck when directed to those stations. The microphone must be so located and, if necessary, the pre-amplifiers and filters of the recorder must be so adjusted or supplemented, that the intelligibility of the recorded communications is as high as practicable when recorded under flight cockpit noise conditions and played back. Repeated aural or visual playback of the record may be used in evaluating intelligibility.

(c) Each cockpit voice recorder must be installed so that the part of the communication or audio signals specified in subparagraph (a) of this paragraph obtained from the following sources is recorded on at least four separate channels:

(1) From each boom, mask, or hand-held microphone, headset, or speaker used at the first pilot station.

(2) From each boom, mask, or hand-held microphone, headset, or speaker used at the second pilot station.

(3) From the cockpit-mounted area microphone.

(4) From:

(i) each boom, mask, or handheld microphone, headset or speaker used at the stations for the third and fourth crew members; or

(ii) if the stations specified in subparagraph (c)(4)(i) of this paragraph are not required or if the signal at such a station is picked up by another channel, each microphone on the flight deck that is used with the passenger loudspeaker system if its signals are not picked up by another channel.

No channel shall record communication or audio signals from more than one of the following sources: the first pilot station, second pilot station, cockpit-mounted area microphone, or additional crew member stations.

As far as is practicable, all the sounds received by the microphones listed in subparagraphs (c)(1), (2) and (4) of this paragraph must be recorded without interruption irrespective of the position of the interphone-transmitter key switch. The design must ensure that sidetone for the flight crew is produced only when the interphone, public address system or radio transmitters are in use.

(d) Each cockpit voice recorder must be installed so that –

(1) (i) It receives its electrical power from the bus that provides the maximum reliability for operation of the cockpit voice recorder without jeopardising service to essential or emergency loads; and

(ii) It remains powered for as long as possible without jeopardising emergency operation of the aeroplane;

(2) If the recorder has a recording duration of less than 25 hours, there is an automatic means to stop the recording within 10 minutes after crash impact;

(3) There is an aural or visual means for pre-flight checking of the recorder for proper operation;

(4) Any single electrical failure that is external to the recorder does not disable both the cockpit voice recorder function and the flight data recorder function;

(5) There is a means for the flight crew to stop the cockpit voice recorder function upon completion of the flight in a way such that re-enabling the cockpit voice recorder function is only possible by dedicated manual action;

(6) It has an alternate power source:

—             that provides at least 10 minutes of electrical power to operate both the recorder and the cockpit-mounted area microphone; and

—             to which the recorder and the cockpit-mounted area microphone are switched automatically in the event that all other power to the recorder is interrupted either by a normal shutdown or by any other loss of power; and

(7) If the recorder is deployable:

(i) It has an automatic deployment capability that is engaged no later than when the aeroplane is airborne and that remains engaged as long as the aeroplane is airborne;

(ii) The automatic deployment capability and the emergency locator transmitter integrated in the deployable recorder cannot be manually disengaged from the cockpit when the aeroplane is capable of moving under its own power;

(iii) The deployment occurs upon the detection of severe structural damage that causes the immediate break-up of the aeroplane;

(iv) The deployment occurs upon the immersion of the aeroplane in water;

(v) An assessment of the effects of unintended deployment is made in accordance with the specifications of CS 25.1309;

(vi) Effects on persons other than aeroplane occupants and on search-and-rescue services are taken into account when assessing the unintended deployment failure condition;

(vii) There is no means to manually deploy the recorder while the aeroplane is capable of moving under its own power; and

(viii) An alert is provided to the flight crew when the flight recorder is no longer attached to the aeroplane.

(e) If the recorder is not deployable, the container of the recording medium must be located and mounted so as to minimise the probability of the container rupturing, the recording medium being destroyed, or the underwater locating device failing as a result of any possible combinations of:

(1) impact with the Earth’s surface;

(2) the heat damage caused by a post-impact fire; and

(3) immersion in water.

If the recorder is deployable, the deployed part must be designed and installed so as to minimise the probability of the recording medium being destroyed or the emergency locator transmitter failing to transmit (after damage or immersion in water) as a result of any possible combinations of:

(1) the deployment of the recorder;

(2) impact with the Earth’s surface;

(3) the heat damage caused by a post-impact fire; and

(4) immersion in water.

(f) If the cockpit voice recorder has an erasure device or function, the installation must be designed to minimise the probability of inadvertent operation and actuation of the erasure device or function during crash impact.

(g) The container of the cockpit voice recorder must –

(1) Be bright orange; however, if the recorder is deployable, the surface that is visible from outside the aeroplane, when the recorder is installed, may be of another colour;

(2) Have reflective tape affixed to its external surface to facilitate locating it;

(3) Have, if the recorder is not deployable, an underwater locating device on or adjacent to the container which is secured in such a manner that they are not likely to be separated during crash impact;

(4) Have, if the recorder is deployable, an integrated emergency locator transmitter that automatically starts emitting upon deployment; and

(5) Be, if the recorder is deployable, able to float on water and self-oriented so that the transmission of the emergency signal is not impeded.

[Amdt 25/23]

[Amdt 25/26]

AMC 25.1457 Cockpit voice recorders

ED Decision 2020/024/R

1. General

The installation of a recorder with an ETSO authorisation against ETSO-C123c (or equivalent standard accepted by EASA) satisfies the approval requirement in CS 25.1457(a).

In showing compliance with CS 25.1457, the applicant should take account of EUROCAE Document No ED-112A ‘MOPS for Crash Protected Airborne Recorder Systems’ or a later revision.

‘Deployable recorder’ designates a flight recorder installed on the aeroplane which is capable of automatically deploying from the aeroplane.

‘CVR system’ designates the cockpit voice recorder (CVR) and its dedicated equipment (e.g. dedicated sensors or transducers, amplifiers, dedicated data busses, dedicated power source).

2. Combination recorders

a. If the recorder performs several recording functions (i.e. it is a combination recorder), the means for pre-flight checking the recorder for proper operation should indicate which recording functions (e.g. FDR, CVR, data-link recording, etc.) have failed.

b. When two flight data and cockpit voice combination recorders are installed, either because they are required or because they are an acceptable alternative to a flight data recorder and a cockpit voice recorder, then these two fight data and cockpit voice combination recorders should be connected to separate power buses.

3. Automatic means to stop the recording after a crash impact

The automatic means to stop the recording (which is required if the recorder has a recording duration of less than 25 hours) should operate even if a power supply is still available.

The automatic means to stop the recording within 10 minutes after a crash impact may rely on:

a. dedicated crash impact detection sensors. In that case, negative acceleration sensors (also called ‘g-switches’) should not be used as the sole means of detecting a crash impact; or

b. the recording start-and-stop logic, provided that this start-and-stop logic stops the recording 10 minutes after power is lost on all engines (and, when applicable, the APU) when the aeroplane is on the ground.

4. Means for pre-flight checking of the recorder

The means for pre-flight checking of the recorder should be able to detect and indicate the following:

a. A loss of electrical power to the flight recorder system;

b. A failure of the data acquisition and processing stages;

c. A failure of the recording medium and/or drive mechanism; and

d. A failure of the recorder to store the data in the recording medium as shown by checks of the recorded data including, as far as is reasonably practicable for the storage medium concerned, its correct correspondence with the input data.

5. Means for the flight crew to stop the cockpit voice recorder function

The means required for the flight crew to stop the cockpit voice recorder function after the completion of the flight is needed in order to preserve the recording for the purpose of investigating accidents and serious incidents. In fulfilling this requirement, it is acceptable to use circuit breakers to remove the power to the equipment. Such a means to stop the cockpit voice recorder function is not in contradiction with CS 25.1357(f), because it would not be used under normal operating conditions, but after an accident or a serious incident has occurred.

6. Power sources

a. An alternate power source is a power source that is different from the source(s) that normally provides (provide) power to the cockpit voice recorder function.

In CS 25.1457(d)(6), a ‘normal shutdown’ of power to the cockpit voice recorder means a commanded interruption of the power supply from the normal cockpit voice recorder power bus; for example, after the termination of a normal flight. ‘All other power’ means the electrical power source(s) used for normal operation of the cockpit voice recorder function. The following applies to the installation of an alternate power source:

i. A tolerance of 1 minute on the 10 minutes minimum power requirement of CS 25.1457(d)(6) is acceptable;

ii. The use of aeroplane batteries or other power sources is acceptable, provided that electrical power to the essential and critical loads is not compromised;

iii. If the alternate power source relies on dedicated stand-alone batteries (such as a recorder independent power supply), then these batteries should be located as close as practicable to the recorder;

iv. The means for performing a pre-flight check of the recorder for proper operation should include a check of the availability of the alternate power source;

v. If the cockpit voice recorder function is combined with other recording functions within the same unit, the alternate power source may also power the other recording functions; and

vi. If two flight data and cockpit voice combination recorders are installed, either because they are required, or because they are an acceptable alternative to single-function recorders, then only one recorder needs to have an alternate power source for the cockpit voice recorder function. This should be the combination recorder that is located closer to the cockpit area.

b. If the cockpit voice recorder function has a recording duration of less than 25 hours, the electrical power to this function should not be supplied for more than 10 minutes after power is lost on all engines (and, when applicable, the APU) when the aeroplane is on the ground.

7. Recorder container

The attachment of the recorder container should comply with the specifications given in EUROCAE Document No ED-112A.

The container of a non-deployable recorder should be installed in the rear section of the aeroplane and in an area that increases the chances of the equipment surviving crash impact forces and the heat damage caused by a fire. However, it should not be installed where aft-mounted engines may crush the container during impact.

If two combination flight data and cockpit voice recorders (non-deployable) are installed, then the container of the recorder that is dedicated to the cockpit voice recorder function may be located near the flight crew compartment if at least one recorder is installed in the rear section.

8. Deployable recorder

If the recorder is deployable:

a. The automatic deployment capability should be available as long as the aeroplane is airborne; this should include cases in which electrical power is lost from the engines and APU.

In the event of a landing on water, the deployment should occur upon the immersion of the aeroplane in water; this means that the automatic deployment capability should remain available after contact with the water for a certain period in order to allow automatic deployment upon immersion;

b. The assessment of the effects of unintended deployment of the recorder in flight should include:

i. The effects on the continued safe flight and landing of the aeroplane. This assessment should cover the normal flight envelope of the aeroplane and include the following aspects:

—             Potential impact on aeroplane structure, including flight control surfaces, and on systems; and

—             Aerodynamic effects caused by the cavity created in the structure after deployment.

In order to address the effects of the impact on the aeroplane after deployment, the applicant should:

—             either demonstrate that impact with the aeroplane is extremely improbable;

—             or demonstrate continued safe flight and landing after impact damage, considering all flight phases. The demonstration should include the effect of the damage to the structure and systems on residual strength, stability, control and aeroelasticity:

—             Residual strength should be demonstrated in accordance with AMC 25.571, Section 10.(c); and

—             Freedom from aeroelastic instability should be demonstrated within the aeroelastic stability envelope as defined by CS 25.629(b)(2); and

ii. The effects on persons other than aeroplane occupants due to unintended deployment while the aeroplane is airborne, in particular the risk of serious or fatal injuries for persons being hit by the deployed part.

Several methods can be adopted in order to quantify the probability of causing serious or fatal injuries to the persons on the ground associated with unintended deployment of a recorder. However, the following variables should be used:

—             The density of population, with reasonable correction factors related to time exposure and shielding such as being indoors and shielded by, for example, buildings, or being in a means of transportation; and

—             The size and weight of the deployed part.

The probability of causing a serious or fatal injury is expressed as the combination of:

—             the probability of an unintended deployment;

—             the probability of a person being hit by the deployed part; and

—             the probability that, if hit by the deployed part, a person will suffer serious or fatal injuries. This probability may be set to 1, as a conservative assumption; otherwise, the applicant may propose another value to EASA for approval.

c. The assessment of the effects of unintended deployment of the recorder on ground should include:

i. The risk of injuries caused to persons. This should include those who are involved in aeroplane maintenance, ground handling, taxiing, rescue operations, or emergency evacuation; and

ii. The effects on other aircraft and facilities.

In particular:

—             A conspicuous placard or label that is visible from the outside of the aeroplane should be placed adjacent to the recorder deployment point;

—             ICA and/or operational procedures should be provided to prevent injuries during maintenance and ground handling;

—             Operational procedures should define the first actions to be taken by the flight crew when the recorder is no longer attached to the aeroplane, in order to address any risk to continued safe flight and landing and the possible effects on other aircraft and facilities;

—             Procedures should address the precautions that should be taken to avoid injuries which could be caused by an unintended deployment during emergency evacuation;

—             Information that addresses the precautions to be taken by search-and-rescue services after an accident should be publicly available; and

—             The deployment mechanism should only release the recorder in one piece.

d. There may be a means to manually disengage the deployment capability when the aeroplane is not capable of moving under its own power; however, in this case, an alert should be provided to the flight crew during the pre-flight checks if the deployment capability is disengaged;

e. The deployable recorder installation should be such as to guarantee the highest probability of the deployment of the recorder in the event of an explosion or a collision. In particular, the installation and the performance of the deployment capability should be such that, in most cases of collision, the deployment of the recorder can take place before the deployment mechanism is damaged. However, the installation should be such that, to the extent possible, the recorder does not deploy in a non-catastrophic occurrence such as a hard landing or a tail strike.

f. The demonstration of compliance with CS 25.1457(e) should cover the whole flight envelope of the aeroplane, and additional trajectories that might be expected during the initial stages of an accident sequence.

The applicant may use the following Table 1 parameter ranges that have been observed during occurrences of loss of control of large aeroplanes:

Table 1: Parameter ranges

g. The alert that the recorder is no longer attached to the aeroplane should be provided as early as permitted by the principles of AMC 25.1322.

h. The deployment capability should function under all the environmental conditions for which the aeroplane is certificated.

i. The effect of exposure to environmental conditions (such as temperature, rain, lightning strikes, etc.) on the serviceability of the flight recorder and of its deployment capability should be addressed by design features and/or by ICA. ICA or operational procedures or both should also be provided such as to prevent maintenance and operational actions on the external surfaces of the aeroplane (such as painting, cleaning, application of de-/anti-icing fluids, etc.) from adversely affecting the serviceability of the flight recorder and its deployment capability.

j. In order to limit the effects on search-and-rescue services of an unintended activation of the emergency locator transmitter (ELT) that is integrated in the recorder:

—             unintended deployment of the recorder should be classified at least as a major failure condition; and

—             operational procedures should define the flight crew actions to be taken after they realise that an unintended recorder deployment has taken place, including actions to prevent an unnecessary search-and-rescue response.

Furthermore, in order to identify the conditions which triggered an unintended deployment of the recorder (including the ensuing activation of the ELT) or an activation of the ELT without deployment of the recorder, appropriate data should be recorded on board or transmitted to the ground to support the post-flight analysis.

9. Evaluation of the CVR recording

The following acceptable means of compliance with CS 25.1457(b) is provided to demonstrate that the performance of a new or modified CVR system is acceptable and that the quality of the CVR recording is acceptable. Inspections of the CVR recording that are part of the Instructions for Continued Airworthiness are not in the scope of this paragraph.

a. The CVR system should be installed in accordance with the recommendations made in EUROCAE Document ED-112A, in particular:

—             Chapter 2-5, Equipment installation and installed performance, and

—             Part I, Cockpit Voice Recorder System, Chapter I-6.1.1 Interface design, I‑6.1.2 Recorder Operation and I-6.1.3 Bulk Erasure Interlocks.

Particular attention should be given to the location of the cockpit area microphone (CAM). ED‑112A, Chapter I-6.2., Equipment location, provides guidance on this topic.

It should be noted that the CVR may record on more than four channels, and that this may help to avoid superimposition between signal sources recorded on the same CVR channel.

b. To ensure that the CVR system is properly installed, and to verify that the quality of the audio signals recorded on all the channels is acceptable, the applicant should conduct a flight test. The recording obtained should be evaluated to confirm that the quality is acceptable during all the normal phases of flight (including taxi-out, take-off, climb, cruise, descent, approach, landing, and taxi-in). ED‑112A provides guidance for testing a new CVR installation. (Refer to Chapter I-6.3).

c. The evaluation of the CVR recording should include:

i. the tasks described in ED-112A, Annex I-A, Chapter I-A.3;

ii. checking that the vocal signal sources are intelligible and that non-vocal alerts on headsets or speakers can be identified;

iii. checking that the levels of sidetone signals (e.g. radio) and public address are adjusted so that these signals are audible and do not mask the signals from the flight crew microphones (refer to ED-112A, Part I, Chapter I-6.1.1);

iv. checking the start-and-stop function of the CVR system. The CVR should begin to operate no later than when power from sources other than from the alternate power source is available and the pre-flight checklist is started. The CVR should continue to operate until either the completion of the final post-flight checklist or until 10 minutes after power is lost on all engines (and, when applicable the APU) and the aeroplane is on the ground.; and

v. checking for the presence of any fault in the memory of the built-in-test feature of the CVR, if applicable.

d. The evaluation of the CVR recording should fulfil all of the conditions below:

i. The equipment used for the CVR recording replay should meet the specifications of Chapter I-A.2 of Annex I-A of ED-112A or a higher standard;

ii. The replay and evaluation of CVR recordings should be performed by personnel who have adequate knowledge of CVR systems and aircraft operations, and who have appropriate experience of the techniques used to evaluate recordings;

iii. The observations from the evaluation should be documented in an evaluation report. An example of an evaluation report is provided in ED-112A, Annex I-A; and

iv. The evaluation report should indicate the quality of each audio signal required to be recorded by CS 25.1457(c) according to defined criteria. For example, the following audio quality rating scale may be used:

GOOD:

1. When considering a vocal signal source (crew voice, radio reception, radio sidetone, interphone, public address, synthetic voice in callouts, warnings and alerts) recorded on a channel other than the CAM channel, the signal is intelligible without using any signal post-processing techniques, and no significant issue (e.g. saturation, noise, interference, or inadequate signal level of a source) affects the quality of this signal;

2. When considering non-vocal alerts recorded on a channel other than the CAM channel, the sounds are accurately identifiable in the recording without using any signal post-processing techniques, and no significant issue affects the quality of the sound recording;

3. When considering the CAM, the recording is representative of the actual ambient sound, conversations and alerts as if an observer was listening in the cockpit, and no significant issue affects the quality of the signal; and

4. No ‘medium’ or ‘major’ issue is identified on any channel (see Table 1 below for examples).

FAIR: a significant issue affects the signal source being considered. However, the related signal can still be analysed without signal post-processing, or by using signal post‑processing techniques provided by standard audio analysis tools (e.g. audio level adjustment, notch filters, etc.). The severity of the identified issues is not rated higher than ‘medium’ (see Table 1 below for examples).

POOR: the signal source being considered is not intelligible or not identifiable, and this cannot be corrected even with the use of signal post-processing techniques. The severity of the identified issues is not necessarily rated as ‘major’, it may also be rated as ‘medium’, depending on the consequences for the required signal sources (see Table 1 below for examples); and

v. the audio quality rating of a CVR channel required by CS 25.1457(c) should be the same as the worst audio quality rating among the signal sources to be recorded on this channel.

e. The performance of the CVR system should be considered acceptable by the applicant only if, for none of the signal sources required by CS 25.1457(c) or by the applicable operating rules, the quality of the audio recording was rated as ‘poor’. In addition, if the CVR system is part of a new aeroplane type, the performance of the CVR system should be considered acceptable by the applicant only if, for all of the signal sources required by CS 25.1457(c) and by the applicable operating rules, the quality of the audio recording was rated as ‘good’.

Table 1: Examples of issues affecting a signal source and of the associated severity.

*CAM line: microphone+control or preamplifier unit+wiring to the CVR

10. Instructions for Continued Airworthiness (ICA)

When developing the ICA for the CVR system, required by CS 25.1529 and Appendix H, the applicant should address all the failures that may affect the correct functioning of the CVR system or the quality of the recorded audio signals.

Examples of failures (indicative and non-exhaustive list):

—             Loss of the recording function or of the acquisition function of the CVR;

—             Any communication or audio signal (required by CS 25.1457(c) or by the applicable air operations regulations) is missing, or is recorded with an audio quality that is rated ‘poor’ (refer to the example of audio quality rating provided in Section 9 of this AMC);

—             Failure of a sensor, transducer or amplifier dedicated to the CVR system (e.g. failure of the cockpit area microphone);

—             Failure of a means to facilitate the finding of the CVR recording medium after an accident (e.g. an underwater locating device or an emergency locator transmitter attached to the recorder);

—             Failure of any power source dedicated to the CVR (e.g. dedicated battery);

—             Failure of the start-and-stop function;

—             Failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpose of deploying the recorder if it is deployable).

[Amdt 25/2]

[Amdt 25/23]

[Amdt 25/26]

CS 25.1459 Flight data recorders

ED Decision 2020/024/R

(See AMC 25.1459)

(a) Each flight data recorder required by the operating rules must be approved and must be installed so that –

(1) It is supplied with airspeed, altitude, and directional data obtained from sources that meet the accuracy requirements of CS 25.1323, 25.1325 and 25.1327, as appropriate;

(2) The vertical acceleration sensor is rigidly attached, and located longitudinally either within the approved centre of gravity limits of the aeroplane, or at a distance forward or aft of these limits that does not exceed 25% of the aeroplanes mean aerodynamic chord;

(3) (i) It receives its electrical power from the bus that provides the maximum reliability for operation of the recorder without jeopardising service to essential or emergency loads; and

(ii) It remains powered for as long as possible without jeopardising the emergency operation of the aeroplane;

(4) There is an aural or visual means for pre-flight checking of the recorder for proper recording of data in the storage medium;

(5) If the recorder has a recording duration of less than 25 hours, there is an automatic means to stop the recording within 10 minutes after crash impact. This requirement does not apply to recorders that are powered solely by the engine-driven electrical generator system;

(6) There is a means to record data from which the time of each radio transmission either to or from ATC can be determined;

(7) If another recorder is installed to perform the cockpit voice recorder function, any single electrical failure that is external to the recorder dedicated to the flight data recorder function does not disable both the recorders; and

(8) If the recorder is deployable, it complies with CS 25.1457(d)(7).

(b) If the recorder is not deployable, the container of the recording medium must be located and mounted so as to minimise the probability of the container rupturing, the recording medium being destroyed, or the underwater locating device failing as a result of any possible combinations of:

(1) impact with the Earth’s surface;

(2) the heat damage caused by a post-impact fire; and

(3) immersion in water.

If the recorder is deployable, the deployed part must be designed and installed so as to minimise the probability of the recording medium being destroyed or the emergency locator transmitter failing to transmit (after damage or immersion in water) as a result of any possible combinations of:

(1) the deployment of the recorder;

(2) impact with the Earth’s surface;

(3) the heat damage caused by a post-impact fire; and

(4) immersion in water.

(c) A correlation must be established between the flight data recorder readings of airspeed, altitude, and heading and the corresponding readings (taking into account correction factors) of the first pilot’s instruments. The correlation must cover the airspeed range over which the aeroplane is to be operated, the range of altitude to which the aeroplane is limited, and 360° of heading. Correlation may be established on the ground as appropriate.

(d) The container of the flight data recorder must comply with the specifications in CS 25.1457(g) that are applicable to the container of the cockpit voice recorder.

(e) Any novel or unique design or operational characteristics of the aeroplane must be evaluated to determine if any dedicated parameters must be recorded on the flight data recorder in addition to, or in place of, the parameters that are required by the existing requirements.

[Amdt 25/11]

[Amdt 25/18]

[Amdt 25/23]

[Amdt 25/26]

AMC 25.1459 Flight data recorders

ED Decision 2020/024/R

1. General

The installation of a recorder with an ETSO authorisation against ETSO-C124c (or equivalent standard accepted by EASA) satisfies the approval requirement in CS 25.1459(a).

In showing compliance with CS 25.1459, the applicant should take into account EUROCAE Document No ED-112A ‘MOPS for Crash Protected Airborne Recorder Systems’ or a later revision.

‘FDR system’ designates the flight data recorder (FDR) and its dedicated equipment. It may include the following items as appropriate to the aircraft:

a. The equipment necessary to:

i. acquire and process analogue and digital sensor signals;

ii. store the recorded data in a crash-survivable recording medium; and

iii. when necessary, support dedicated sensors.

b. Digital data busses and/or networks providing communications between elements of the system.

‘Deployable recorder’ designates a flight recorder that is installed on the aeroplane, and which is capable of automatically deploying from the aeroplane.

2. Automatic means to stop the recording after a crash impact

Refer to the Section of AMC 25.1457 titled ‘Automatic means to stop the recording after a crash impact’.

3. Means for pre-flight checking of the recorder

The means for pre-flight checking of the recorder should be able to detect and indicate the following:

a. a loss of electrical power to the flight recorder system;

b. a failure of the data acquisition and processing stages;

c. a failure of the recording medium and/or drive mechanism; and

d. a failure of the recorder to store the data in the recording medium as shown by checks of the recorded data including, as far as is reasonably practicable for the storage medium concerned, its correct correspondence with the input data.

4. Recorder container

Refer to the Section of AMC 25.1457 titled ‘Recorder container’.

5. Combination recorder

Refer to the Section of AMC 25.1457 titled ‘Combination recorder’.

6. Deployable recorder

Refer to the Section of AMC 25.1457 titled ‘Deployable recorder’

7. Instructions for Continued Airworthiness (ICA)

When developing the ICA for the FDR system, required by CS 25.1529 and Appendix H, the applicant should address all the failures that may affect the correct functioning of the FDR system or the quality of the recorded data.

Examples of failures (indicative and non-exhaustive list):

—             Loss of the recording function or of the acquisition function of the FDR;

—             Any parameter (required by CS 25.1459(a)(1) or by the applicable air operations regulations) is missing, or is not correctly recorded;

—             Failure of a sensor dedicated to the FDR system;

—             Failure of a means to facilitate the finding of the FDR recording medium after an accident (e.g. an underwater locating device or an emergency locator transmitter attached to the recorder);

—             Failure of the start-and-stop function;

—             Failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpose of deploying the recorder if it is deployable).

In addition, the ICA should include the following items, unless the applicant shows that this is not applicable:

—             Calibration checks of parameters from sensors dedicated to the flight data recorder to verify the accuracy of these parameters; and

—             FDR decoding documentation.

i. Definitions

FDR decoding documentation: a document that presents the information necessary to retrieve the raw binary data of an FDR data file and convert it into engineering units and textual interpretations.

Fixed-frame recording format: a recording format organised in frames and subframes of a fixed length and that are recorded chronologically. ARINC Specifications 573 and 717 provide an example of a fixed-frame recording format.

Variable-frame recording format: a recording format based on recording frames which are individually identified and time stamped, so that their order in the recording file is not important. ARINC Specification 767 provides an example of a variable-frame recording format.

ii. Content of the FDR decoding documentation

The FDR decoding documentation should at least contain information on:

—             the aircraft make and model;

—             the date and time when the document was modified; and

—             in the case of a fixed-frame recording format:

—             the sync pattern sequence;

—             the number of bits per word, of words per subframe, and of subframes per frame; and

—             the time duration of a subframe;

—             In the case of a variable-frame recording format, the list of frames, and for each frame:

—             its identification;

—             information on whether the frame is scheduled or event-triggered;

—             the recording rate (for a scheduled frame);

—             the frame event condition (for an event-triggered frame); and

—             the list of parameters, by order of recording;

—             For every parameter:

—             its identification: name (and mnemonic code or other identification if applicable);

—             the sign convention and the units of converted values (if applicable);

—             the location of each component of a parameter in the data frame;

—             instructions and equations to assemble the components of each parameter and convert the raw binary values into engineering units (if applicable); and

—             the conversion to text or the discrete decipher logic (if applicable).

iii. Format of the FDR decoding documentation

The FDR decoding documentation should:

—             be provided in an electronic format;

—             contain all the information described in paragraph f.ii. above; and

—             comply with the standard of ARINC Specification 647A or a later equivalent industry standard.

[Amdt 25/23]

[Amdt 25/26]

CS 25.1460 Data link recorders

ED Decision 2020/024/R

(See AMC 25.1460)

(a) Each recorder performing the data link recording function required by the operating rules must be approved and must be installed so that it will record data link communication messages related to air traffic services (ATS) communications to and from the aeroplane.

(b) Each data link recorder must be installed so that:

(1) (i) it receives its electrical power from the bus that provides the maximum reliability for the operation of the recorder without jeopardising service to essential or emergency loads; and

(ii) it remains powered for as long as possible without jeopardising the emergency operation of the aeroplane;

(2) there is an aural or visual means for pre-flight checking of the recorder for the proper recording of data in the storage medium; and

(3) if the recorder is deployable, it complies with CS 25.1457(d)(7).

(c) If the recorder is not deployable, the container of the recording medium must be located and mounted so as to minimise the probability of the container rupturing, the recording medium being destroyed, or the underwater locating device failing as a result of any possible combinations of:

(1) impact with the Earth’s surface;

(2) the heat damage caused by a post-impact fire; and

(3) immersion in water.

If the recorder is deployable, the deployed part must be designed and installed so as to minimise the probability of the recording medium being destroyed or the emergency locator transmitter failing to transmit (after damage or immersion in water) as a result of any possible combinations of:

(1) the deployment of the recorder;

(2) impact with the Earth’s surface;

(3) the heat damage caused by a post-impact fire; and

(4) immersion in water.

(d) The container of the data link recorder must comply with the specifications applicable to the container of the cockpit voice recorder in CS 25.1457(g).

[Amdt 25/26]

AMC 25.1460 Data link recorders

ED Decision 2020/024/R

1. General

The installation of a recorder with an ETSO authorisation against ETSO-C177a (or an equivalent standard accepted by EASA) satisfies the approval requirement in CS 25.1460(a).

In showing compliance with CS 25.1460, the applicant should take into account EUROCAE Document ED-112A, ‘Minimum operational performance specification for crash protected airborne recorder systems’, dated September 2013, or a later revision.

‘DLR system’ designates the data link recorder (DLR) and its dedicated equipment. It may include the following items as appropriate to the aircraft:

a. A crash-protected recorder.

b. Digital interface equipment suitable for converting a data link communication message into a format which is to be recorded.

c. Digital data busses and/or networks providing communications between elements of the system.

The data link recording function may be performed by:

a. a cockpit voice recorder;

b. a flight data recorder;

c. a flight data and cockpit voice combination recorder; or

d. a dedicated data link recorder.

2. Combination recorders

Refer to the Section of AMC 25.1457 titled ‘Combination recorder’.

3. Recorded data

The recorded data should be sufficient to allow investigators, in the framework of an accident or incident investigation, to accurately reconstruct the sequence of data link communications between the aircraft and air traffic service units, other aircraft and other entities. For this purpose, the data link recording should comply with:

a. EUROCAE Document ED-93 (dated November 1998), ‘Minimum aviation system performance specification for CNS/ATM message recording systems’, Section 2.3.1, Choice of recording points, and Section 2.3.2, Choice of data to be recorded on board the aircraft; and

b. EUROCAE Document ED-112A (dated September 2013), ‘Minimum operational specification for crash protected airborne recorder systems’, Part IV, Chapter IV-2, Section IV-2.1.6, Data to be recorded.

4. Instructions for Continued Airworthiness (ICA)

When developing the ICA for the DLR system, as required by CS 25.1529 and Appendix H, the applicant should address all the failures that may affect the correct functioning of the DLR system or the integrity of the recorded information.

Examples of failures (indicative and non-exhaustive list):

—             Loss of the recording function or of the acquisition function of the DLR;

—             Part of the data link communication (required by CS 25.1460(a) or by the applicable air operations regulations) is missing or corrupted;

—             Failure of a means to facilitate the finding of the DLR recording medium after an accident (e.g. an underwater locating device or an emergency locator transmitter attached to the recorder);

—             Failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpose of deploying the recorder if it is deployable).

In addition, the ICA should include the following item, unless the applicant shows that this is not applicable:

Documentation to perform the following:

i. Convert the recorded data back to the original format of the data link communication messages,

ii. Retrieve the time and the priority of each recorded message, and

iii. Correlate the recorded messages with the FDR and CVR recordings.

[Amdt 25/26]

CS 25.1461 Equipment containing high-energy rotors

ED Decision 2003/2/RM

(a) Equipment containing high energy rotors must meet sub-paragraph (b), (c) or (d) of this paragraph.

(b) High energy rotors contained in equipment must be able to withstand damage caused by malfunctions, vibration, abnormal speeds, and abnormal temperatures. In addition –

(1) Auxiliary rotor cases must be able to contain damage caused by the failure of high energy rotor blades; and

(2) Equipment control devices, systems, and instrumentation must reasonably ensure that no operating limitations affecting the integrity of high-energy rotors will be exceeded in service.

(c) It must be shown by test that equipment containing high-energy rotors can contain any failure of a high-energy rotor that occurs at the highest speed obtainable with the normal speed control devices inoperative.

(d) Equipment containing high energy rotors must be located where rotor failure will neither endanger the occupants nor adversely affect continued safe flight.