U.S. Department\
of Transportation

**Federal Aviation\
Administration**

![](media/image3.png){width="6.759027777777778in"
height="0.13472222222222222in"}

+----+-------------------------------------------+---+----+--------------+
| Su | INFORMATION: Certification of             |   | D  | Original     |
| bj | Strengthened Flightdeck Doors on          |   | at | Release:     |
| ec | Transport Category Airplanes              |   | e: |              |
| t: |                                           |   |    | November 6,  |
|    |                                           |   |    | 2001         |
|    |                                           |   |    |              |
|    |                                           |   |    | Revised:     |
|    |                                           |   |    |              |
|    |                                           |   |    | December 3,  |
|    |                                           |   |    | 2002         |
+----+-------------------------------------------+---+----+--------------+
|    |                                           |   |    |              |
+----+-------------------------------------------+---+----+--------------+
| F  | Manager, Transport Airplane Directorate,  |   | R  | Jeff Gardlin |
| ro | ANM-100                                   |   | ep |              |
| m: |                                           |   | ly |              |
|    |                                           |   | to |              |
|    |                                           |   | A  |              |
|    |                                           |   | tt |              |
|    |                                           |   | n. |              |
|    |                                           |   | o  |              |
|    |                                           |   | f: |              |
+----+-------------------------------------------+---+----+--------------+
|    |                                           |   |    | 01-115-11    |
+----+-------------------------------------------+---+----+--------------+
| T  | See Distribution                          |   |    |              |
| o: |                                           |   |    |              |
+----+-------------------------------------------+---+----+--------------+
|    |                                           |   |    |              |
+----+-------------------------------------------+---+----+--------------+

This memorandum has been revised to include additional information on
§ 25.772(b) and information contained in the airplane flight manual.

The events of September 11, 2001, have highlighted the importance of
expediting the installation of strengthened flightdeck doors to prevent,
or at least delay, entry of unauthorized persons into the flightdeck. To
accomplish this goal in a very short time, the Federal Aviation
Administration (FAA) promulgated Special Federal Aviation Regulation
(SFAR) 92, effective October 9, 2001, and subsequent amendments, SFAR
92-1 through SFAR 92-4, the latest being effective March 19, 2002. While
earlier versions of the SFAR only encouraged entities operating under
part 121 of Title 14 of the Code of Federal Regulations (CFR) to install
internal locking devices on their flightdeck compartment doors to resist
intrusion by unwanted persons, the latest version requires the
installation of these devices. To facilitate rapid improvements to
security, all versions of the SFAR allow installations that do not meet
all of the airworthiness requirements of Title 14 CFR part 25. At this
time, most U.S. operators have installed bars and/or bolts on their
flightdeck doors. These installations have usually resulted in a
non-compliance with one or more of the part 25 requirements, typically,
the decompression requirements of § 25.365, the egress from the
flightdeck requirements of § 25.772, and the entry into the flightdeck
requirements of §§ 25.807 and 25.809.

On November 19, 2001, the United States Congress enacted Public Law
107-71, the Aviation and Transportation Security Act, henceforth
referred to as the Act. Section 104 of the Act required the FAA to issue
requirements to improve flightdeck integrity, specifically the
strengthening of the flightdeck door. On January 15, 2002, the FAA
issued Amendment 25-106 which adds new intrusion resistance and
ballistic penetration requirements to part 25. Concurrently, the FAA
also issued Amendment 121-288 that requires part 121 passenger operators
that are required to have flightdeck doors, and part 121 cargo operators
with flightdeck doors installed on that date, to strengthen these doors.
Flightdeck doors on these airplanes must meet these new requirements of
part 25 by April 9, 2003.

Supplemental Type Certificate (STC) applications involving flightdeck
door modification must address all affected regulatory requirements,
including, but not limited to: §§ 25.301, 25.303, 25.305, 25.307,
25.365, 25.571, 25.601, 25.605, 25.607, 25.609, 25.611, 25.613, 25.619,
25.625, 25.771, 25.772, 25.777, 25.789, 25.803, 25.807, 25.809, 25.831,
23.853, 25.855, 25.857, 25.1301, 25.1309, and 25.1581. Final
determination of the affected regulatory sections is dependent on the
complexity and scope of the modification, and the agreed certification
basis of the design change. As stated earlier, all the applicable
regulatory sections must be addressed and complied with in order for an
applicant to be issued an STC.

The regulations that have been most commonly excepted under SFAR 92-4
(§§ 25.365, 25.772, 25.807, 25. 795, and 25.809) will typically pose the
greatest challenge for STC applicants. Additionally, other significant
requirements that must be addressed by an STC applicant include the
ventilation and smoke requirements of § 25.831, § 25.855, § 25.857, and
the flammability requirements of § 25.853. Information about these
requirements and possible acceptable design approaches are discussed in
the following paragraphs.

**[Pressurized Compartment Loads]{.underline}:**

**Background:** Changes in decompression venting integral to the
flightdeck door, and in the surrounding flightdeck barrier, must be
reviewed to ensure compliance with § 25.365. Airplane decompression
requirements include both minimum effective vent areas and maximum
opening times for blowout panels or similar decompression venting
devices. In cases where the entire flightdeck door functions as a large
decompression blowout panel, applicants should consider the impact of
additional door locking features on the release time, the reliability of
the latching system to release under decompression loads, as well as any
increases in opening time due to an increase in door mass, special or
additional door hinges, etc. Some of these same concerns apply to
smaller decompression blowout panels. Applicants must also address
reduced decompression venting area due to the addition of grilles,
louvers, or similar features, as well as the direction of the required
venting (e.g., from the main cabin to the flightdeck or from the
flightdeck to the main cabin).

Failure of a decompression mechanism to function could result in a
catastrophic failure of the flightdeck structure. Therefore, if the
decompression venting relies on an electrically or mechanically actuated
release or opening mechanism, the applicant should conduct qualitative
and/or quantitative assessments in accordance with Figure 2, \"Depth of
Analysis Flowchart,\" in Advisory Circular (AC) 25.1309-1A, \"System
Design and Analysis.\"

**FAQ:**

**Q:** Should the effects of loose articles (e.g., newspapers,
magazines, blankets, etc.) blocking the available flightdeck door flow
area through grilles, louvers, grates, or similar features be
considered?

**A:** The intent of FAR 25.365(e) is to establish a minimum design
level of strength for floors, bulkheads, partitions and other structure
to be able to withstand prescribed decompression scenarios. In
particular, FAR 25.365(e)(2) currently establishes a hole size based on
fuselage cross-sectional area and is intended to cover different
decompression scenarios through one simple and conservative criterion.

Since loose articles are not part of the type design, and their effect
cannot be quantified with any certainty, loose articles such as
newspapers, magazines, or blankets need not be considered in a
decompression analysis. However, if there is something inherent to the
airplane design that would become detached or would otherwise be free to
block a vent (e.g., a curtain or a lavatory door), then this should be
considered in the analysis.

While the intent of the decompression criteria is to establish a simple
and conservative level of strength, certain rational assumptions, such
as the use of a discharge coefficient, have historically been accepted
and will continue to be accepted. Other assumptions may also be
accepted. For example, the flow area restriction formed by the
flightdeck glareshield and overhead panel, as would occur in the event
of a windshield blowout, may be considered, provided that it is shown
that these components will remain intact.

**[Reliability:]{.underline}**

The primary purpose of the door systems is to deter and delay
unauthorized entry into the flightdeck without compromising aircraft
safety. The flightdeck door systems that are developed to comply with
the new § 25.795 requirements must have a reliability level commensurate
with the security function intended to support the operational
strategies for intruder mitigation. Although the conditional probability
of an intruder is not considered extremely high (i.e., this probability
is less than one), there should be reasonable confidence that the door
will deter and delay any intrusion attempt. Systems used to meet
flightdeck intrusion, decompression or other safety related criteria,
must meet the applicable requirements of § 25.1309. Guidance on
compliance to § 25.1309 is provided in AC 25.1309-1A. Reliability
guidance is based on section § 25.1309(b) which states:

*The airplane systems and associated components, considered separately
and in relation to other systems, must be designed so that:*

(1) *The occurrence of any failure condition which would prevent the
    continued safe flight and landing of the airplane is extremely
    improbable, and*

(2) *The occurrence of any other failure condition which would reduce
    the capability of the airplane or the ability of the crew to cope
    with adverse operating conditions is improbable.*

Flightdeck door systems must be shown to comply with §§ 25.1309(b)(1)
and (b)(2). In showing compliance with § 25.1309(b)(1) the applicant
must consider that the failure of the flightdeck door locking system to
unlock during a decompression event may be catastrophic.

If the probability of the decompression event is used then the
probability of occurrence must

be based on statistically valid data or supporting service experience.
Further, the applicant

must show the independence between the decompression event and the
failure of the system

to unlock.

In addition to the decompression scenario, less severe failure
conditions such as the crew "lock out" scenarios discussed elsewhere in
this Memorandum may become a more stringent requirement and should be
assessed when showing compliance to § 25.1309(b)(2).

It is assumed that a failure of the system to lock the door will be
detected within one flight. Therefore, the period of latency in this
case is reasonable for the failure of the door to unlock. The applicant
should provide substantiation that the failure mode is not intermittent.
In this

case the latency period could be much greater and should factor into the
method for showing compliance to § 25.1309(c). Failures of the system to
lock the door should be indicated and only be evident to the cockpit
crew.

Based on the above rationale, the FAA considers a suitable reliability
level to be on the order of 10^-5^ failure per flight-hour for both lock
and unlock operations. Applicants should provide specific rationale if a
lower reliability target is requested. This should be accomplished via
the issue paper process.

**FAQ:**

**Q:** Some designs use decompression panels for venting instead of the
opening of the door. Does the above guidance apply to these designs?

**A:** The reliability target of 10^-5^ for the door lock and unlock
functions is also applicable to the decompression detection and venting
functions.

**Q:** How do you show that a decompression event, a catastrophic event,
to be extremely improbably using the 10^-5^ reliability target?

**A:** There is no agreed probability of occurrence for a decompression
event. However, the FAA considers the probability of a decompression
event to occur during flight to be much less than 10^-4^. Using a
decompression venting system that is on the order of 10^-5^ failure per
flight-hour, the probability of a catastrophic event becomes extremely
improbable (10^-9^).

**[Intrusion Protection]{.underline}:**

**Background:** Section 25.795 (a)(1) requires that the flightdeck door
installation be designed to resist intrusion by any person who attempts
to enter the flightdeck by physically forcing his or her way through the
door. The door installation includes the door, its means of attachment
to the surrounding structure, and the attachment structure to the
bulkhead itself. Of concern are the integrity of the
locking/latching/hinge mechanism, any decompression venting panels
included as part of the door panel, the door panel itself, and the
attachment of the door to the surrounding structure.

It is important to understand that the intent of this regulation is not
to make the flightdeck door impenetrable, rather to deter attempts at
entry and delay any attempts until other actions can be taken to prevent
entry.

Advisory Circular 25.795-1 includes test methods and procedures that
result in acceptable methods for demonstrating compliance. Other
methods, or deviations from methods described in the AC, may be
acceptable to demonstrate compliance. Alternative compliance methods
should be coordinated with the Transport Directorate Staff and
documented in an issue paper.

**FAQ:**

**Q:** How much of the structure surrounding the door must be
representative for the test set-up, and how representative must it be?
For example, doors may be installed in airplanes with interior
configurations that result in the door being installed on various types
of bulkheads from multiple suppliers, with different strength and
stiffness characteristics. In some cases, the original mounting
structure is no longer available.

**A:** Section 25.795(a)(1) identifies intrusion requirements for the
door installation. The preamble to this amendment states, "the door
installation includes the door, its means of attachment to the
surrounding structure, and the attachment structure on the bulkhead
itself." Therefore, the test article should be representative of that
installation. If the structure to which the door frame attaches is not
available, it may be possible to test with the extreme conditions of
stiffness (i.e., soft and firm). Conversely, an installation that does
not rely on the existing monuments for structural capabilities (strength
and stiffness) would avoid this issue.

**Q:** Do interface loads (static and dynamic) between the door/surround
structure need to be collected during the testing? If required, how are
these loads applied?

**A:** As discussed above, the relevant structure should be included in
the test. If the door, the door frame, and the surround structure to
which the door frame is attached is represented in the test, collection
of interface loads during testing should not be necessary. Testing that
is proposed to be conducted with non-representative structure should be
coordinated in advance with the appropriate Aircraft Certification
Office. In this case, interface loads may be required to substantiate
the installation of the door system.

**[Ballistic Penetration]{.underline}:**

**Background:** Section 25.795 (a)(2) requires design precautions be
taken to minimize the penetration of shrapnel from a fragmentation
device and small arms fire which might be fired through the flightdeck
doors from occupied compartments. The intent of the ballistic
requirements is twofold: (1) to ensure that the integrity of the
flightdeck door is not compromised from a ballistic threat that could
enable an intruder to gain access to the flightdeck, and (2) to protect
the pilot and critical flight instruments from projectiles penetrating
into the flightdeck. Again, the intent is not to make the flightdeck
"impenetrable," but to provide a high level of protection.

Advisory Circular 25.795-2 includes test methods and procedures that
result in acceptable methods for demonstrating compliance. Other
methods, or deviations from methods described in the AC, may be
acceptable to demonstrate compliance. Alternative compliance methods
should be coordinated with the Transport Directorate Staff and
documented in an issue paper.

**FAQ:**

**Q:** How will certification of ballistics labs be handled?

**A:** There are two ballistics test facilities, U.S. Test Laboratories
and H.P. White, that have been accepted by the National Institute of
Justice (NIJ) as being capable of conducting tests in accordance with
NIJ 0101.04. The FAA has discussed these laboratories qualifications
with the NIJ. Based on their qualifications, the FAA will accept either
of these laboratories for testing. Conformity inspections would still be
required using the normal processes. Other test facilities may be
acceptable; however, additional FAA review and oversight will be
required. Note, test witnessing may be delegated to the above two
laboratories, however, the pass/fail determination will be made by the
FAA or an authorized designated engineering representative (DER).

**Q:** If the door contains decompression panels as part of the design,
does the door need to pass the ballistic penetration tests with the
panels deployed?

**A:** The door is not required to provide ballistic penetration
protection after a decompression event.

**Q:** Some designs may contain louvers or openings in panels that are
installed at angles greater or less than the 0-30 degree angle required
in AC 25.795-2. Since the bullet would be deflected by these
louvers/openings and not allow penetration into the flightdeck at the
test angles required by the test, would additional testing be required
at other angles that may allow the bullet to enter the flightdeck?

**A:** The 0-30 degree test described in AC 25.795-2 is basically a
material test. The two test conditions are used to evaluate the
penetration resistance of the material and to verify that there is no
significant difference in performance based on angle of incidence. With
regard to the door design, a shotline that originates in the passenger
cabin, and enters the flightdeck, should be evaluated to determine if it
constitutes a hazardous trajectory. If it's determined that no hazardous
trajectory can result, additional protection may not be required.

**Q:** Advisory Circular 25.795-2 addresses projectiles targeted at the
edge of the door. Our understanding is that the intent was to arrest an
errant projectile not an intentionally aimed projectile. Based on the
above, would we be expected to aim a shot at the door knob/lock
mechanism, the hinges, the gaps or other such door features for
ballistic testing?

**A:** The preamble to Amendment 25-106 states, "any compromise to the
integrity of the flightdeck door from a ballistic threat could enable an
intruder to gain access to the flightdeck. It would be impracticable to
protect the door without including a ballistic protection component."
Thus, the features mentioned above would require substantiation if their
failure compromises the penetration resistance of the door, or would
allow the door to open. For example, if a penetration failure results in
a hazardous trajectory or enables an intruder to gain access to the
flightdeck, these results would be unacceptable. For a feature with one
of these potential types of failures, the feature should be tested, or
shown to meet the requirement through some other means.

**Q:** What is the FAA\'s position on the ballistic testing of gaps?

**A:** Based upon AC 25.795-2, if the gap is protected with an
equivalent amount of material that passed the material ballistic tests,
testing of the gap is generally not necessary. Surfaces of protective
material that are butted flush against each other may also be acceptable
without testing, if it is clear that penetration is not an issue. If
it's determined that a gap needs to be tested, however, the same
pass/fail criteria for the material ballistic test would apply.

**Q:** Is it necessary to test at angles other than 0 and 30 degrees for
features where other angles might be critical?

**A**: The intent of the requirement is to provide a ballistic
penetration barrier across the door, that will prevent compromise to the
flightdeck, either by the ballistic threat itself, or by an intruder. To
the extent that this barrier contains features and details that are not
homogeneous, they may behave differently with shots at different angles
of incidence. Based on experience gathered to date, assuming that there
are no discontinuities in the barrier, (see figure), it is sufficient to
address these features with shots at 0 and 30 degrees only. It is not
necessary to try and define some other angle. Where there are
discontinuities, this effectively results in no protective barrier for
the part of the door where the discontinuity exists, which is contrary
to the intent of the requirement.

**Q:** Since the revised NIJ standard calls for semi-jacketed bullets,
can these types of bullets be used in lieu of jacketed hollow point
bullets specified in AC 25.795-2?

**A:** AC 25.795-2 was based on the National Institute of Justice
Ballistic Resistance of Personal Body Armor, NIJ Standard 0101.04, dated
September 2000. This standard called out a jacketed hollow point bullet.
The standard was later revised in June 2001 to call out a semi-jacketed
bullet. To promote standardization, the NIJ requires a specific bullet,
the Remington R44MG3 semi-jacketed bullet, to be used when testing to
the standard. The FAA considers this same bullet as acceptable for
testing in accordance with AC 25.795-2. Otherwise, a jacketed bullet
should be used as per the AC.

**[Pilot Compartment Doors]{.underline}:**

**Background:** In part, § 25.772 requires that a means be provided for
the flight crew members to directly enter the passenger compartment from
the pilot compartment if the cockpit door becomes jammed. Compliance
with this requirement is usually accomplished by way of frangible access
panels in the door, removable panels in the door, or quick release
hinges. Strengthening of the door may involve removing or covering
frangible panels to prevent forced entry, and reducing clearances for
ballistic resistance. A possible acceptable design approach would be
removable panels in the door, or surrounding structure, that are
openable from the flightdeck, but do not allow access from the passenger
compartment.

**FAQ:**

**Q:** Are the performance tests for ballistic and intrusion protection
independent of the requirements of § 25.772?

**A:** Any performance tests for ballistic and intrusion protection
would be independent of the requirements of § 25.772. That is,
evaluation of the door design for egress from the flightdeck is
accomplished without taking into consideration damage resulting from the
intrusion or ballistic testing.

**Q:** What is the applicability of § 25.772(b) to strengthened
flightdeck door certification programs?

**A:** The requirement that the flightcrew be able to enter the
passenger cabin in the event that the flightdeck door becomes jammed was
adopted by amendment 25-47 to § 25.772. This rule is not in the
certification basis of many airplanes currently in the fleet. While it
might seem that this requirement would be adopted for strengthened
flightdeck door certification programs under the provisions of § 21.101,
this was not clearly delineated in this original guidance memo, and
there are some projects that have not added this requirement to the
certification basis. The FAA has determined that, for airplanes that
have exits on the flightdeck, it is not necessary to add Amendment 25-47
to the certification basis for strengthened flightdeck door projects to
retain the level of safety intended. For airplanes that do not have
exits on the flightdeck, Amendment 25-47 should be included in the
certification basis for strengthened flightdeck door projects.

**Q:** The original type certificate evaluation for demonstrating
compliance to § 25.772 allowed overcoming the jam (i.e., pushing on the
door to remove the jam). Based on the above guidance, can I use this
same approach?

**A:** The following explanation for addressing egress out of a jammed
flightdeck door is provided in the preamble of the notice of proposed
rulemaking for § 25.772, at amendment 25‑47: "The National
Transportation Safety Board Recommendation A-74-102 cites cases where,
in an emergency situation, flight crewmembers had to exit through
cockpit sliding windows because the pilot compartment to passenger
compartment door was jammed. As a result, the flight crew was not in a
position to assist in the evacuation of the passengers from the
airplane."

Further, the preamble to the final rule at Amendment 25-47 responded to
several commenters objections that (1) the possibility of door jamming
is remote due to aircraft design, (2) cockpit crash axes offer an
equivalent method, and (3) cockpit security would be adversely affected.
The preamble states: "Some airplanes are designed to preclude floor
deformation and subsequent door jamming; however, this proposal provides
for any door jamming condition which could occur regardless of aircraft
design. The use of a crash axe does not provide the same degree of
access to the passenger compartment from the cockpit. Under certain
conditions, the crash axe may not provide access until a considerable
period of time has elapsed. Cockpit security would not be compromised
since the requirement applies to new designs and allows sufficient
design flexibility."

As noted above, it is clear that § 25.772 intends to address a situation
where a door is jammed, irrespective of design features that are
intended to preclude such jamming. It is not clear that past compliance
findings have approached the requirement in this way, although it is
clear that features have been incorporated to enable the crew to
mitigate a jammed door. However, in some cases, the features appear to
have been intended to *overcome* the jammed condition, i.e., the door is
forcibly unjammed, rather than providing means of entry into the cabin,
even though the door remains jammed. For the purposes of addressing
reinforced flightdeck door approvals, previous test methods to show
compliance are considered acceptable for a given airplane type. However,
we intend to revisit this subject with respect to the methods of
compliance intended by the regulation and, if necessary, publish a
policy statement for future approvals. Methods of compliance that depend
on features intended to overcome a jammed door should be documented in
an issue paper.

**[Emergency Exits and Emergency Exit Arrangement]{.underline}:**

**Background:** Current regulations require that exits be openable from
both the inside and outside (Ref. § 25.809). Additionally, the
flightdeck requires access to two emergency exits (one on each side of
the airplane) or a single top hatch (Ref. § 25.807). For airplanes with
flightdeck windows, or a top hatch, where each are openable from the
inside and outside, there is no requirement for the flightdeck door to
have provisions for egress from the flightdeck or entry by rescue
personnel. On some aircraft, one or both of the window exits are not
openable from the outside; access for rescue personnel to the flight
crew area in this case is provided from nearby passenger exit(s) through
the flightdeck door. The regulations allow flightdeck window exits to
**not** be openable from the outside if other approved exits are
convenient and *readily accessible to* the flight crew area.

For airplanes that use other approved exits, which are convenient and
*readily accessible to* the flight crew area (i.e., forward passenger
exits), the flightdeck door design must have provisions for entry by
rescue personnel to meet the "readily accessible" requirement.
Previously, the frangible nature of the flightdeck door provided ready
access to the flightdeck for rescue personnel. Flightdeck doors designed
to resist intrusion will not provide access as readily as previous
doors. Two design approaches that may be employed to demonstrate that
airplanes with strengthened door designs continue to meet § 25.809(b)
are: (1) providing two exits or one hatch in the flightdeck, each
openable from the outside, or (2) showing that the door in the closed
and locked position can be entered by rescue personnel using normally
available non-powered hand carried rescue tools (e.g., crowbar, ax, etc)
in a reasonable time. The FAA expects that most, if not all, rescue
personnel would have axes or crowbars at their disposal to gain access
to the flightdeck, but not necessarily more sophisticated devices such
as the "jaws of life". Provided rescue personnel can be shown to be able
to enter the flightdeck as described above, there is no need to consider
structural deformation (jamming) for § 25.809. It should be noted that
what may be considered "readily accessible" regarding entry into the
flightdeck through strengthened doors by rescue personnel, is likely to
be beyond the limits of what is acceptable for "readily accessible" or
similar terms used in other sections of part 25.

**FAQ:**

**Q:** Are the performance tests for ballistic and intrusion protection
independent of the requirements of § 25.809?

**A:** Any performance tests for ballistic and intrusion protection
would be independent of the requirements of § 25.809. That is,
evaluation of the door design for ingress and egress from the flightdeck
is accomplished without taking into consideration damage resulting from
the intrusion or ballistic testing.

**Q:** In the event that the crew is trapped in the cockpit, what is the
maximum amount of time allotted for rescue personnel to gain access to
the cockpit through the improved flightdeck doors?

**A:** It is expected that with the improvements that are being
incorporated into the flightdeck doors that the time needed by rescue
personnel to gain access to the cockpit will be increased over that of
the existing doors. The existing doors are considered frangible,
therefore access by rescue personnel was not previously deemed a
critical issue, but with the introduction of the intrusion and ballistic
resistance requirements, the door can no longer be considered frangible
and therefore the access time must be re-evaluated. Based on information
gathered from various sources, the FAA has determined that a maximum of
10 minutes is a reasonable and achievable goal for rescue personnel to
gain access to the flightdeck through the strengthened flightdeck door.
The FAA will evaluate any demonstrated time over the limit of 10 minutes
on a case-by-case basis in order to determine its acceptability.

**Q:** How does an applicant show compliance with flightdeck
accessibility by rescue personnel and is a compliance test required?

**A:** Since the doors were previously considered frangible, no known
test data exist at this time that could be used as a basis for an
analytical analysis Therefore, it is expected that a compliance test
will be required. Subsequent certification programs may be candidates
for an analytical approach provided they can be shown to be suitably
similar to the previously certified doors. Other considerations that
need to be addressed are the test parameters. It is expected that the
test be conducted using trained rescue personnel, who are naive about
the door design, using axes and/or crowbars, or other normally available
non-powered hand carried tools. The timing for rescue personnel to gain
access into the flightdeck should start with the first contact on the
door.

**[Ventilation and Smoke]{.underline}:**

**Background:** The previously mentioned decompression venting changes
could negatively impact compliance with § 25.831. Venting changes should
allow a sufficient amount of uncontaminated air to enter the flight crew
environment in order to provide a comfortable working environment and
exclude harmful or hazardous concentrations of gases or vapors.

The ability of the ventilation system to evacuate hazardous quantities
of smoke in the flight

deck must also be maintained.

Venting changes must also not affect the ability to exclude hazardous
quantities of smoke or extinguishing agent from the cargo compartments
in compliance with §§ 25.855 and 25.857. Previous certification tests
have demonstrated that smoke can migrate from a cargo compartment to the
flightdeck unless the proper ventilation balance and compartment sealing
are provided. Hazardous quantities of smoke or extinguishing agent could
also enter other occupied areas (e.g., the main cabin) from the cargo
compartment due to changes in the ventilation balance.

**FAQ:**

None at this time.

**[Compartment Interiors]{.underline}:**

**Background:** All materials in the cabin, including the flightdeck
door, are subject to the flammability requirements of § 25.853.
Strengthening of the flightdeck doors may introduce materials that have
not been traditionally used in Transport Category aircraft construction.
In particular, material used to provide ballistic and shrapnel
protection to the flightdeck should be evaluated for compliance to the
flammability requirements of § 25.853.

**FAQ:**

None at this time.

**[Access into Flightdeck During Flight for §121.313(j):]{.underline}**

**Background:** The effect of strengthening the flightdeck doors to
enhance intrusion resistance, and removing access to the flightdeck for
the cabin crew could result in a new unsafe design feature with respect
to § 21.21(b)(2). In addition, § 121.313(j)(2), at Amendment 121-288,
requires that each operator establish methods to enable a flight
attendant to enter the pilot compartment in the event that a member of
the flight crew becomes incapacitated. Consideration should be given to
the following two situations that result in the crew not being able to
access the flightdeck: (1) A pilot leaves the flightdeck, and the
remaining pilot becomes incapacitated. The able-bodied pilot in this
case may be effectively "locked out" of the flightdeck; or, (2) One
pilot becomes incapacitated and the remaining pilot requires assistance
to continue flying the airplane. Previously, crew members were able to
access the flightdeck via a common key to the flightdeck door, and
provide any necessary assistance. Without a key, and behind a
strengthened door, assistance may not be available from crew members.
One acceptable approach to address both situations would be to (a) add
an Airplane Flight Manual (AFM) limitation requiring another crew member
to be present in the flightdeck when one of the required flight crew
leaves the flightdeck, and (b) providing a method to unlock the door
from each pilot seat. Other proposed methods should be agreed upon using
the issue paper process.

**[Access into Flightdeck During Flight for §25.772(c):]{.underline}**

**Background:** As stated above, §121.313(j) requires that operators
establish methods for a flight attendant to enter the flightdeck in the
event that *a member* of the flight crew becomes incapacitated. This
requirement differs from that of the new §25.772(c), in that the latter
rule requires consideration of incapacitation of the entire flight crew.
Nonetheless, many manufacturers and modifiers have elected to design
systems that comply with §25.772(c), even though this is not required
for retrofit applications and is more stringent. The following guidance
addresses systems designed to meet §25.772(c). This guidance assumes
that (1) the immediate response of a flight crewmember to an entry
system alert will be to deny entry, and (2) the cabin crew will be
instructed to use this system's entry method only in the case of
suspected incapacitation of the flight crew.

For the purposes of illustration only, a typical design and associated
scenario would consist of the following:

1.  Cabin crew attempts to contact flight crew using inter-phone system,
    knocking on flightdeck door, and any other available means.

2.  If contact with the flight crew cannot be established and the cabin
    crew suspects that the flight crew may be incapacitated, the flight
    attendant requests emergency access to the flightdeck by entering a
    code using a numeric keypad or by some other method.

3.  An alert is generated in the flightdeck to notify the flight crew
    that the emergency door unlocking sequence has been initiated from
    the cabin.

4.  If the flight crew is capable of doing so (i.e., they are not
    incapacitated), one flight crew member will immediately respond to
    the alert by inhibiting the system, so that the door will not
    unlock. Then the flight crew will assess the situation to determine
    whether or not someone is attempting unauthorized access to the
    flightdeck.

5.  If the flight crew is incapacitated, and as a result the system is
    not inhibited, after some period of time (time delay) the door will
    be automatically unlocked.

**Time delay:** The time delay for the emergency unlock feature is used
to give the flight crew a reasonable amount of time to inhibit the alert
while at the same time allowing flight attendants access to the
flightdeck in the case of an incapacitated flight crew. The flight
attendant would only activate this emergency door unlocking sequence if
s/he believes the flight crew is incapacitated, and thus needs access to
the flightdeck. If the airplane is near the ground (especially while
descending), and/or seriously out of control, the ability of the cabin
crew to successfully intervene is very unlikely. Therefore, it is
unnecessary to require the time delay to be short enough to allow cabin
crew intervention in such situations. If the airplane is in stable
flight, it may be possible for the cabin crew to successfully intervene.
However, in such cases, access should be timely, but a reasonable delay
is acceptable. The flight crew needs a reasonable amount of time to
inhibit the alert (to ensure intruders do not gain access before the
flight crew responds to the alert), since they may be attending to other
high priority tasks. This time delay should be consistent with the
selected level of alert. Based on the above rationale, **the FAA
considers the appropriate time delay for the emergency unlock function
to be between 30 and 60 seconds**.

If applicants (the manufacturer and/or operator) desire time delays
shorter than 30 seconds, they should provide specific rationale for a
shorter time period. This rationale should be weighed against the need
to prevent access to the flightdeck by unauthorized persons (if pilots
fail to inhibit the unlock sequence within the time delay period). In
addition, the applicant should provide information on the design
features and/or procedures that will ensure that the pilots will respond
to the alert by denying access within the time delay period (i.e., prior
to automatic unlocking of the door). These features and/or procedures
should account for other potential high priority tasks or high workload
phases of flight. Notwithstanding the above, the FAA does not envision
approving time delays shorter than 15 seconds.

If applicants desire time delays longer than the 60 seconds, they should
provide specific rationale for a longer time period. This rationale
should be weighed against the need to allow timely access to the
flightdeck in case of incapacitation of the flight crew. Notwithstanding
the above, the FAA does not envision approving time delays longer than
120 seconds.

If manufacturers develop systems that allow operators to reprogram the
time delay after delivery, the approval of the selected time delay for
each operator will be managed by the FAA Flight Standards Service, using
the guidance provided above. However, the range of programmable time
delays allowed by the design should not exceed the maximum range
specified above (15-120 seconds). The approved time delay should be
identified on the type design.

When the flight crew inhibits the system (i.e. denies entry) after
responding to an emergency access alert, the duration time of the system
in a disabled mode (i.e. unable to make an access request) should not be
more than 30 minutes. Any longer duration needs to be substantiated by
the applicant and documented in an issue paper. Once the door is
unlocked using the emergency access system due to flight crew
incapacitation, the door should remain unlocked for a minimum of 5
seconds after the specified time delay.

**Level of alert:** If the flight crew is in fact incapacitated, the
level of alert is irrelevant. If the flight crew is not incapacitated,
they must assume one of the two conditions: (1) the cabin crew has
already tried to contact the flight crew by other means which were
unsuccessful. In this case, the cabin crew believes there may be an
emergency, or (2) an intruder is attempting to gain access to the
flightdeck. This represents an immediate threat to safety of flight.

A crew procedure should be associated with this alert, including an
action to immediately inhibit the emergency unlock system. If the pilots
do not respond to the unlock alert within the specified time period, the
system will unlock the door and could allow an intruder access to the
flightdeck. This is considered to be a potentially catastrophic event.
This alert most closely fits the warning category (reference § 25.1322
and AC 25-11, Section 10). It may be possible for an applicant to
substantiate using the caution category, based on the design philosophy
for the existing caution and warning system and the time period within
which the pilot must respond. The delay time is important because the
shorter the time delay, the more urgent the alert, and the more quickly
pilots must take action to deny entry.

Visual and aural alerts should be consistent with the existing
flightdeck design of the airplane's caution and warning system. If the
airplane has master alerts for warnings and/or cautions, it is desirable
that the appropriate master alert be triggered in response to the
emergency request for flightdeck access. It would also be desirable to
integrate the alert into the crew alerting system display, if one is
installed. However, the FAA recognizes that it may not be practicable
(due to cost and schedule constraints) to fully incorporate the alerts
into a centralized alerting system, especially in retrofit designs.
However, even if not fully integrated, the emergency access request
alert should provide a level of awareness and urgency that is
appropriate for the identified alert level (caution or warning). In
general, the alert for emergency flightdeck access requests should
include an aural alert, unless other suitable attention-getting features
are incorporated.

**Verification of Alerting System Functionality:** While specific
designs for flightdeck door access systems may allow for alternate
approaches to ensure proper system functioning, the following generic
policy is applicable: (1) proper functioning of visual and aural alerts
must be verified at least daily, and (2) if power can be removed from
the flightdeck door system via means other than by pulling a circuit
breaker, a preflight verification must be accomplished to ensure that
the system is powered. The system should either have visual indication
of the system state or flightcrew procedures should incorporate a
preflight verification of the system state. It is recommended that the
requirements to check the system be implemented to provide maximum
flexibility in how they are carried out. With respect to verification of
the alerting system, for those systems that include a "doorbell"
function (as discussed below under "multi-function designs"), where the
same device is used to generate the routine and emergency access
signals, use of the doorbell would be sufficient to verify functioning
of the aural alert.

**Multi-function designs:** Some proposed designs are intended to
provide functionality for the cabin crew to request routine access to
the flightdeck (i.e. "doorbell" function) as well as provide emergency
access to the flightdeck. In order to be compliant with the requirement
of § 25.772(c) the system must be designed so that the means by which
routine access is requested cannot activate the automatic lock release
mechanism.

In addition, the routine and emergency entry functions should be
distinctive in the method of activation. The intent is to ensure that
the undesired mode will not be activated. While not all possible designs
can be described here, the following examples are intended to provide
additional insight: (1) using one dedicated key (e.g., the number "1")
for routine access and a three-digit code for emergency access would be
considered distinctive methods of activation,  (2) using a guarded
button for one function and a keypad entry for the other would be
considered distinctive methods of activation, (3) if a keypad were used,
having different three- digit codes for routine and emergency access
would not be considered distinctive in the method of activation, and (4)
if dedicated pushbuttons were used, having two unguarded buttons for the
two modes would not be considered distinctive in the method of
activation.

The flightdeck alerts (aural and visual) for routine and emergency
access functions should be distinctly different from each other. While
the emergency access request should result in a caution or warning level
alert (due to consequences of failing to respond to the alert), this
level of alert is not appropriate for the routine access request, which
will not automatically unlock the door. Distinctly different alerts will
help ensure that there is never any momentary confusion between the two
alerts.

The crew response to an emergency access request should be distinct from
the response to a routine access request. This is because routine access
requests will be orders of magnitude more frequent than emergency access
requests, so the most habitual response of the pilot will be to unlock
the door. In the rare event of an emergency access request, that
habitual response (unlocking the door) is a foreseeable error that would
defeat the purpose of the new security measures for the flightdeck
doors.

If a proposed design has similarities between the routine and emergency
access alerts (similar sounds or sound sources) or if the pilot response
to the emergency access request is similar to the response to a routine
access request (e.g., activating the same switch in a different
direction), an alternative method of compliance would be to inhibit the
unlock function during the emergency unlock time delay period, to
prevent inadvertent activation. In such cases, the time delay should not
be less than 30 seconds.

Flight crew and cabin crew procedures should clearly distinguish between
the two functions, when they are to be used, and the response to the
alerts.

Irrespective of the system design, there are issues with obtaining
positive verification of the personnel requesting entry. FAA Flight
Standards is currently in the process of developing guidance on positive
verification.

**Multi-function designs** **(revised May 24, 2002):** The above
guidance identifies the potential for a specific pilot error if there
are similarities between the alerts and the controls for routine and
emergency access requests (i.e., they are not "distinctly different").
This potential error would involve the inadvertent selection of the
\"unlock\" function, rather than the \"inhibit unlock\" function, and
could thus allow an unauthorized person access to the flightdeck. In
order to prevent this foreseeable error and its consequences, the FAA
suggested two methods of compliance: 1) make the alerts for routine
access and emergency distinctly different and also make the control
actions distinctly different, or 2) inhibit the unlock function during
an emergency access request. Other methods of compliance could also be
acceptable. The FAA has revisited the above guidance and, while it is
still considered valid and prudent, the FAA has concluded that strict
adherence to this guidance may not be required.

If unauthorized persons were to use the system in an attempt to gain
access, they could choose either the routine access function or the
emergency access function. The FAA has considered which function would
be the most likely to be used. Routine access is activated using a
single button press, which could be determined by watching flight
attendants or by looking at fairly accessible manuals; the button to use
does not change over time; use of this function by cabin crew is routine
and would raise no special alarms in the flightdeck. Emergency access is
activated using a coded entry which must be retrieved from somewhat
obscure sources or forcibly extracted from a flight attendant (if they
are required to commit it to memory); the code is programmable and is
subject to change; use of this function will produce an alarm in the
flightdeck that is likely to raise pilot alertness and signifies a
non-normal situation; access would only be granted if, in addition to
not following procedures, the pilot makes the error at issue.

The FAA has concluded that while error potential still exists, it is
much more likely that an unauthorized person would use the routine
access function, if they were trying to use the system to gain access to
the flightdeck. In such situations, the pilot does nothing (i.e. does
not touch the door switch) and the door stays locked. The error
potential only exists if the emergency access function is used, which we
judge to be much less likely because the intruder would correctly
determine that it is much less likely to succeed. Therefore, the
potential for the pilot error represents a lesser risk than originally
assumed.

In the interest of furthering timely design and installation of the new
flightdeck doors, the FAA has concluded that the pilot error discussed
above, while still possible, represents a small enough risk to justify a
more relaxed interpretation of the earlier policy with respect to
\"distinctly different\" alerts and controls. However, it is still
important that the pilots be able to reliably discriminate between the
alerts for routine and emergency access. That is because, if the pilot
determines that an unauthorized person is attempting to gain access, the
action that must be taken differs based on the type of alert: (1) For
routine access alerts, the pilot does not move the switch and the door
remains locked, and (2) For emergency access alerts, the pilot MUST move
the switch to the "inhibit unlock" position or the door will
automatically unlock.

Therefore, even if the alerts are not "distinctly different," they must
be sufficiently different to allow the pilot to readily discriminate
between these two conditions. The FAA recommends that the alert sound
continuously for all emergency access requests. The procedures which
detail the pilot procedures in response to both routine and emergency
access requests should be included in the Airplane Flight Manual (AFM).

**Airplane Flight Manual (AFM):** For flightdeck doors with remote
access systems, the functional check of the remote access system should
be identified in the AFM as a limitation (reference section on
"Verification of Alerting System Functionality"). It is recommended, but
not required to have a cross-reference to the operating procedure for
conducting the functional check. There may be other items that should
also be contained in the AFM limitations depending on the peculiarities
of individual door designs.

Emergency procedures should note that the automated remote access system
will not perform its intended function in the event of a loss of
electrical power and explain the use of any other alternative methods
for locking the door (e.g., deadbolts). Emergency procedures should also
include instructions for emergency egress (e.g., removal of
decompression blowout panels).

The normal operating procedures should provide the instructions for
performing the daily functional check and an explanation of the various
functions of the remote access system. Detailed operating procedures may
be provided for operators to use "as is" or reformat to standardize with
their company manuals.

**[Indication of Unlocked Flightdeck Door (FAR
25.1309(c))]{.underline}**

Since September 11, 2001, an unlocked flightdeck door has been
considered a potential hazard. This *is* a different characterization
than existed prior to September 11, but one that is both appropriate and
applicable, given the potential consequences of unrestricted access to
the flightdeck.

Section 14 CFR 25.1309(c) requires that, "Systems, controls, and
associated monitoring and warning means must be designed to minimize
crew errors which could create additional hazards." The door locking
mechanism is a system (whether mechanical or electro-mechanical) under
the terms of § 25.1309(c) and, as noted above, a door that is unlocked
is considered a potential hazard.

During flight, it is expected that the door may be opened for various
reasons (e.g., pilot use of restroom or meal/refreshment service for the
flightcrew). For the designs that incorporate a manual locking/unlocking
mechanism, it is considered likely that the door will be closed in many
cases by persons other than the pilots (e.g., cabin crew or observers'
seat occupant). In such situations, that person may be unable to lock
the door or may fail to lock the door. Pilots, who may be occupied with
other tasks, may fail to ensure that the door is locked. Therefore,
flightdeck door designs should include features that will reduce the
likelihood of this foreseeable crew error, which would result in
unrestricted access to the flightdeck.

There are a number of possible and feasible design modifications and/or
operational procedures that would satisfy this requirement, including,
but not limited to:

-   Provide indications to the flight crew that will remind them that
    the door is not locked. If a visual indication is used, it should be
    in the pilot's normal field of view.

-   Designing the latch/lock mechanism so that it automatically locks
    when the door is closed. This would minimize the potential for crew
    error to result in an unlocked door.

-   Incorporate a partial hardware solution (e.g., spring load the bolt
    to prop the door open or spring load the door open) along with
    appropriate operational procedures to ensure the door is not
    inadvertently left unlocked. For this situation, the following
    limitation should be added to the AFM:

> The flightdeck door must be kept closed and locked at all times during
> flight except to permit access and egress in accordance with the FAA
> approved procedures for opening, closing, and locking the door.

-   Address the issue entirely through required operational procedures.
    In addition to the above AFM limitation, incorporate operational
    procedures to include the following [challenge and response
    procedure]{.underline} as an AFM limitation:

> The flightdeck door must be kept closed and locked at all times during
> flight except to permit access and egress in accordance with the FAA
> approved procedures for opening, closing, and locking the door.\
> \
> Any time the flightdeck door is opened in flight, a challenge and
> response closing and locking verification procedure must be used to
> verify that the door is closed and locked.
>
> This approach necessitates an equivalent level of safety finding and
> is expected to be utilized on smaller transport category airplanes
> with shorter average flight segments.

**[Electromagnetic Compatibility and Lightning]{.underline}**

The strengthened flightdeck doors may include electrical and electronic
equipment and associated wiring. This equipment may cause unwanted
electromagnetic interference (EMI) to other airplane systems,
particularly airplane radio receivers. In addition, the flightdeck door
electrical and electronic equipment may be susceptible to radio
frequency fields from airplane systems, external high intensity radiated
fields (HIRF), and lightning-induced transients.

The flightdeck door electrical and electronic equipment must comply with
FAA regulations regarding equipment installation compatibility,
specifically §§ 25.1353(a) and 25.1431(c). The flightdeck door
electrical and electronic equipment should be tested and meet the
requirements of RTCA/DO-160D Section 21. Category M is recommended. If
the flightdeck door electrical and electronic equipment meet the
requirements of RTCA/DO-160D Section 21 Category M, then airplane ground
testing to ensure no adverse interference with existing systems on the
airplane is adequate, and no flight tests to demonstrate electromagnetic
compatibility are required. Flight tests to demonstrate compatibility
with other systems on the airplane would only be necessary if, a) the
ground test demonstrates unresolved electromagnetic interference from
the flightdeck door electrical and electronic equipment that may be due
to the ground specific test configuration and not representative of
in-flight conditions, or b) the RTCA/DO-160D Section 21 test results
show significant RF emissions that exceed Category L within airplane
communication, navigation or surveillance radio frequency bands. In
these cases, the flight tests should assess any possible interference
with radio systems required for continued safe flight and landing, such
as auto-land, and Instrument Landing Systems during flightdeck door
operations which potentially cause the most interference.

In general, flightdeck door systems have not been categorized as having
catastrophic, hazardous or major failure conditions with respect to HIRF
and lightning-induced transients. This must be confirmed by the specific
flightdeck door installation applicant. If confirmed by the applicant,
then § 25.1316 for system lightning protection and the HIRF special
condition do not apply to the flightdeck door system.

Although the HIRF special condition generally will not be applied to the
flightdeck door system, RF susceptibility tests for the flightdeck door
electrical and electronic equipment are recommended as part of the
compliance with §§ 25.1353(a) and 25.1431(c). Tests performed according
to RTCA/DO-160D Section 20 Category T are acceptable.

All airplane wiring associated with the installation of the strengthened
flightdeck door should comply with FAA policy statement, ANM-01-04,
System Wiring Policy for Certification of Part 25 Airplanes, published
in the Federal Register, February 5, 2002. The policy statement
addresses wiring installation drawings, safety analysis and instructions
for continued airworthiness. The safety analysis should specifically
address interference on adjacent wiring and wire bundles in the
airplane, especially any wire associated with systems required for safe
flight and landing. For example, any potential interference with
auto-land systems needs to be specifically addressed.

Although not specifically addressed in this memorandum, the following
information is provided for reference and consideration on flightdeck
door certification projects.

**[Video Camera Monitoring Systems]{.underline}:** As part of the
flightdeck door modification, applicants may choose to incorporate a
video camera monitoring system in the door design. Policy and guidance
relating to video systems used to view the cabin from the flightdeck is
not addressed

by this Memorandum, but is available in FAA Memorandum 01-111-196, dated
October 5, 2001, "Interim Summary of Policy and Advisory Material
Available for Use In the Certification of Cabin Mounted Video Cameras
Systems with Flightdeck Displays on Title 14 CFR Part 25 Aircraft."

For questions regarding the guidance in this memo, please contact Jeff
Gardlin at (425) 227-2136, or via email at <jeff.gardlin@faa.gov>.

/s/ Vi Lipski

Vi Lipski

DISTRIBUTION

All Managers, Aircraft Certification Offices

Manager, Aircraft Engineering Division, AIR-100

Manager, Transport Standards Staff, ANM-113

Manager, International Branch, ANM-116

Manager, SEA-AEG

Manager, LGB-AEG

H:/home/113/anm113mg/cockpit/guidance/memorevh.doc