COMPLIANCE WITH CS 25

This paragraph describes specific means of compliance for CS 25.1309. The applicant should obtain early concurrence of the certification authority on the choice of an acceptable means of compliance.

a. Compliance with CS 25.1309(a).

(1) Equipment covered by 25.1309(a)(1) must be shown to function properly when installed. The aeroplane operating and environmental conditions over which proper functioning of the equipment, systems, and installation is required to be considered includes the full normal operating envelope of the aeroplane as defined by the Aeroplane Flight Manual together with any modification to that envelope associated with abnormal or emergency procedures. Other external environmental conditions such as atmospheric turbulence, HIRF, lightning, and precipitation, which the aeroplane is reasonably expected to encounter, should also be considered. The severity of the external environmental conditions which should be considered are limited to those established by certification standards and precedence.

(2) In addition to the external operating and environmental conditions, the effect of the environment within the aeroplane should be considered. These effects should include vibration and acceleration loads, variations in fluid pressure and electrical power, fluid or vapour contamination, due either to the normal environment or accidental leaks or spillage and handling by personnel. Document referenced in paragraph 3b(1) defines a series of standard environmental test conditions and procedures, which may be used to support compliance. Equipment covered by (CS) Technical Standard Orders containing environmental test procedures or equipment qualified to other environmental test standards can be used to support compliance. The conditions under which the installed equipment will be operated should be equal to or less severe than the environment for which the equipment is qualified.

(3) The required substantiation of the proper functioning of equipment, systems, and installations under the operating and environmental conditions approved for the aeroplane may be shown by test and/or analysis or reference to comparable service experience on other aeroplanes. It must be shown that the comparable service experience is valid for the proposed installation. For the equipment systems and installations covered by CS 25.1309(a)(1), the compliance demonstration should also confirm that the normal functioning of such equipment, systems, and installations does not interfere with the proper functioning of other equipment, systems, or installations covered by CS 25.1309(a)(1).

(4) The equipment, systems, and installations covered by CS 25.1309(a)(2) are typically those associated with amenities for passengers such as passenger entertainment systems, in-flight telephones, etc., whose failure or improper functioning in itself should not affect the safety of the aeroplane. Operational and environmental qualification requirements for those equipment, systems, and installations are reduced to the tests that are necessary to show that their normal or abnormal functioning does not adversely affect the proper functioning of the equipment, systems, or installations covered by CS 25.1309(a)(1) and does not otherwise adversely influence the safety of the aeroplane or its occupants. Examples of adverse influences are: fire, explosion, exposing passengers to high voltages, etc.

b. Compliance with CS 25.1309(b).

Paragraph 25.1309(b) requires that the aeroplane systems and associated components, considered separately and in relation to other systems must be designed so that any Catastrophic Failure Condition is Extremely Improbable and does not result from a single failure. It also requires that any Hazardous

CS-25 BOOK 2 2-F-45 Annex to ED Decision 2007/010/R

from damaging or otherwise adversely affecting more than one redundant system channel or more than one system performing operationally similar functions.

(1) General. Compliance with the requirements of CS 25.1309(b) should be shown by analysis and, where necessary, by appropriate ground, flight, or simulator tests. Failure Conditions should be identified and their effects assessed. The maximum allowable probabilityof the occurrence of each Failure Condition is determined from the Failure Condition’s effects, and when assessing the probabilities of Failure Conditions appropriate analysis considerations should be accounted for. Any analysis must consider:

(i) Possible Failure Conditions and their causes, modes of failure, and damage from sources external to the system. (ii) The possibility of multiple failures and undetected failures.

(iii) The possibility of requirement, design and implementation errors.

(iv) The effect of reasonably anticipated crew errors after the occurrence of a failure or Failure Condition. (v) The effect of reasonably anticipated errors when performing maintenance actions.

(vi) The crew alerting cues, corrective action required, and the capability of detecting faults.

(vii) The resulting effects on the aeroplane and occupants, considering the stage of flight and operating and environmental conditions.

(2) Planning. This AMC provides guidance on methods of accomplishing the safety objective. The detailed methodology needed to achieve this safety objective will depend on many factors, in particular the degree of systems complexity and integration. For aeroplanes containing many complex or integrated systems, it is likely that a plan will need to be developed to describe the intended process. This plan should include consideration of the following aspects: (i) Functional and physical interrelationships of systems.

(ii) Determination of detailed means of compliance, which may include the use of Development Assurance techniques. (iii) Means for establishing the accomplishment of the plan.

(3) Availability of Industry Standards and Guidance Materials. There are a variety of acceptable techniques currently being used in industry, which may or may not be reflected in Documents referenced in paragraphs 3b(3) and 3b(4). This AMC is not intended to compel the use of these documents during the definition of the particular method of satisfying the objectives of this AMC. However, these documents do contain material and methods of performing the System Safety Assessment. These methods, when correctly applied, are recognised by the Agency as valid for showing compliance with CS 25.1309(b). In addition, Document referenced in paragraph 3b(4) contains tutorial information on applying specific engineering methods (e.g. Markov Analysis, Fault Tree Analysis) that may be utilised in whole or in part. (4) Acceptable Application of Development Assurance Methods. Paragraph 9b(1)(iii) above requires that any analysis necessary to show compliance with CS 25.1309(b) must consider the possibility of requirement, design, and implementation errors. Errors made during the design and development of systems have traditionally been detected and corrected by exhaustive tests conducted on the system and its components, by direct inspection, and by other direct verification methods capable of completely characterising the performance of the system. These direct techniques may still be appropriate for simple systems which perform a limited number of functions and which are not highly integrated with other aeroplane systems. For more complex or integrated systems, exhaustive testing may either be impossible because all of the system states cannot be determined or impractical because of the number of tests which must be accomplished. For these types of systems, compliance maybe shown by the use of Development Assurance. The level of Development Assurance should be determined by the severity of potential effects on the aeroplane in case of system malfunctions or loss of functions.

QUESTIONS

1. What is the purpose of the wing main spar? a. To withstand bending and torsional loads. b. To withstand compressive and torsional loads. c. To withstand compressive and shear loads. d. To withstand bending and shear loads. 2. What is the purpose of wing ribs?

a. To withstand the fatigue stresses. b. To shape the wing and support the skin. c. To house the fuel and the landing gear. d. To provide local support for the skin. 3. What is the purpose of stringers?

a. To absorb the torsional and compressive stresses. b. To produce stress risers and support the fatigue metres.

c. To prevent buckling and bending by supporting and stiffening the skin. d. To support the primary control surfaces.

4. The airframe structure must remain substantially intact after experiencing: a. the design ultimate load times a 1.5 safety factor.

b. the design limit load plus the design ultimate load. c. three times the safety factor.

d. the design limit load times a 1.5 factor of safety.

5. In the construction of airframes the primary purpose of frames or formers is to: a. provide a means of attaching the stringers and skin panels.

b. oppose hoop stresses and provide shape and form to the fuselage. c. form the entrance door posts.

d. support the wings.

6. How can wing bending moments be reduced in flight?

a. By using aileron ‘up-float’ and keeping the centre section fuel tanks full for as long as possible.

b. By using aileron ‘up-float’ and using the fuel in the wings last. c. By having tail-mounted engines and using aileron ‘down-float’. d. By having wing-mounted engines and using the wing fuel first.

7. Regarding a safe life structure:

1. will only fail after a known number of operations or hours of use.

2. should not fail until a predicted number of fatigue cycles has been achieved. 3. has a programmed inspection cycle to detect and rectify faults.

4. is changed before its predicted life is reached. a. 1 and 2 apply.

b. 1 and 3 apply. c. 2, 3 and 4 apply. d. all of the above apply. 8. A fail safe structure:

1. has a programmed inspection cycle to detect and rectify faults. 2. is changed before its predicted life is reached.

3. has redundant strength which will tolerate a certain amount of structural damage. 4. is secondary structure of no structural significance.

a. 1 and 2 apply. b. 1 and 3 apply. c. 3 and 4 apply.

d. all of the above apply.

9. The skin of a modern pressurised aircraft:

a. is made up of light alloy steel sheets built on the monocoque principle. b. houses the crew and the payload.

c. provides aerodynamic lift and prevents corrosion by keeping out adverse weather. d. is primary load bearing structure carrying much of the structural loads.

10. The primary purpose of the fuselage is to: a. support the wings.

b. house the crew and payload. c. keep out adverse weather. d. provide access to the cockpit.

11. Station numbers (Stn) and water lines (WL) are:

a. a means of locating airframe structure and components. b. passenger seat locations.

c. runway markings for guiding the aircraft to the terminal. d. compass alignment markings.

12. Flight deck windows are constructed from:

a. an amalgam of strengthened glass and vinyl with rubber pressure seals.

13. A cantilever wing:

a. is externally braced with either struts and/or bracing wires. b. is supported at one end only with no external bracing. c. has both an upper an lower airfoil section.

d. folds at the root section to ease storage in confined spaces. 14. A torsion box:

a. is a structure within the fuselage to withstand compression, bending and twisting loads.

b. is a structure formed between the wing spars, skin and ribs to resist bending and twisting loads.

c. is a structure within the wing for housing the fuel tanks, flight controls and landing gear.

d. is a structure designed to reduce the weight. 15. A lightening hole in a rib:

a. prevents lightning strikes damaging the fuselage.

b. provides a means of passing cables and controls through a pressure bulkhead. c. collects and disposes of electrical charges.

d. lightens and stiffens the structure. 16. Control surface flutter:

a. provides additional lift for take off and landing in the event of engine failure. b. occurs at high angles of attack.

c. is a destructive vibration that must be damped out within the flight envelope. d. is a means of predicting the critical safe life of the wing.

17. Control surface flutter is minimised by:

a. reducing the moment of the critical engine. b. aerodynamic balance of the control cables.

c. changing the wings before they reach their critical life. d. mass balance of the control surface.

18. A damage tolerant structure:

a. has degree of structural strength redundancy spread over a large area.

b. is light, non load bearing structure, damage to which will not adversely affect the aircraft.

c. is replaced when it reaches its predicted life.

19. Aircraft structures consists mainly of:

a. light alloy steel sheets with copper rivets and titanium or steel materials at points requiring high strength.

b. magnesium alloy sheets with aluminium rivets and titanium or steel at points requiring high strength.

c. aluminium alloy sheets and rivets with titanium or steel materials at points requiring high strength.

d. aluminium sheets and rivets with titanium or steel materials at points requiring high strength.

20. The Maximum Zero Fuel Mass (MZFM) of an aircraft is: a. the maximum permissible take off mass of the aircraft.

b. the maximum permissible mass of an aircraft with no useable fuel. c. the maximum permissible mass of an aircraft with zero payload. d. the maximum permissible landing mass.

ANSWERS 1. A 2. B 3. C 4. D 5. B 6. B 7. C 8. B 9. D 10. B 11. A 12. B 13. B 14. B 15. C 16. D 17. D 18. A 19. C 20. B

CHAPTER TWO