Advisory 

Circular

Subject: SURVIVABILITY OF 

SYSTEMS 

Date: 10/24/08 

Initiated By: ANM-100 

AC No: 25.795-7 

1. PURPOSE. This advisory circular (AC) describes an acceptable means for showing 

compliance with the requirements of Title 14, Code of Federal Regulations (CFR), part 25, 

§ 25.795(c)(2), “Survivability of systems.” This section requires that, except where 

impracticable, redundant airplane systems necessary for continued safe flight and landing must 

be physically separated by certain minimum distances, as defined by the sphere described in 

§ 25.795(c)(2)(i). The means of compliance described in this document provides guidance to 

supplement the engineering and operational judgment that must form the basis of any 

compliance findings relative to separation of redundant airplane systems, which are necessary for 

continued safe flight and landing. 

2. APPLICABILITY. 

a. The guidance provided in this document is directed to manufacturers and modifiers of 

large passenger transport airplanes and repair facilities for such airplanes. 

b. The material in this AC is neither mandatory nor regulatory in nature and does not 

constitute a regulation. It describes acceptable means, but not the only means, for demonstrating 

compliance with the applicable regulations. The FAA will consider other methods of 

demonstrating compliance that an applicant may elect to present. Furthermore, if we become 

aware of circumstances that convince us that following this AC would not result in compliance 

with the applicable regulations, we will not be bound by the terms of this AC, and we may 

require additional substantiation or design changes as a basis for finding compliance. 

c. The material in this AC does not change, create any additional, authorize changes in, or 

permit deviations from, regulatory requirements. 

3. RELATED SECTIONS OF 14 CFR. Part 25, §§ 25.365, 25.1309, and 25.1707. 

4. BACKGROUND. 

a. The International Civil Aviation Organization (ICAO) adopted certain Standards and 

Recommended Practices related to security aspects of airplane design in Amendment 97 to 
10/24/08 AC 25.795-7 

Annex 8. Included is a standard that manufacturers design and separate flight-critical systems to 

maximize airplane survival for any event—such as detonation of an explosive or incendiary 

device—that damages such systems. This requirement addresses only damage to flight-critical 

systems and the effect of that damage on continued safe flight and landing. Manufacturers must 

identify flight-critical systems. 

b. A draft of this AC was harmonized with the European Joint Aviation Authorities (JAA). 

The draft provided a method of compliance that both the Federal Aviation Administration (FAA) 

and JAA have found acceptable. Subsequently, the European Aviation Safety Agency (EASA) 

was formed as the principal aviation regulatory agency in Europe. The FAA will work with 

EASA to ensure that this proposed AC is harmonized with ACs referred to in EASA’s 

Certification Specifications. 

5. DISCUSSION. 

a. There are at least two approaches that will satisfy the requirement for systems 

survivability: (1) system separation and, when separation is not practicable, (2) system 

protection. The concept behind system separation is that the designer can separate any 

flight-critical system and its redundant system sufficiently to create a high probability that no 

single event will damage both systems. Systems protection involves shielding flight-critical 

systems from a harmful event. One should rely on designing for systems protection only if 

system separation is impracticable. This requirement addresses only the loss of system 

functionality that can result from events (such as activation of an explosive or incendiary 

device). Compliance with § 25.795(c)(2) does not require an assessment of potential airframe 

structural damage or its consequences, except as it relates to system function when protective 

measures are utilized as discussed in paragraph 6b. Design of a “least risk bomb location” can 

also affect system architecture locally. (See AC 25.795-6.) 

b. Other sections of 14 CFR part 25 contain requirements that either dictate system 

separation or are most effectively met with system separation. These include § 25.729(f) for 

protection of equipment in wheel wells, § 25.903(d) for protection against engine rotor failure, 

and § 25.1707 for protection of, and failure by, electrical wiring interconnection systems. These 

are all separate and independent requirements. Showing compliance with one of them does not 

ensure compliance with the others. Should a conflict occur such that compliance with 

§ 25.795(c)(2) would preclude compliance with one of the above sections, compliance with 

§ 25.795(c)(2) would be “impracticable” in accordance with the regulatory provisions of 

§ 25.795(c)(2)(ii), and the applicant should use other measures to maximize survivability. The 

applicant must, of course, show direct compliance with the other relevant sections. In reviewing 

the various requirements, the FAA has not identified any situations where such a conflict exists. 

6. DEMONSTRATION OF COMPLIANCE. 

a. System Separation. 

(1) Although airplane fuselage diameters vary widely, the percentage of space devoted 

to systems installations generally decreases in larger airplanes. In part, this is true because the 

2 
10/24/08 AC 25.795-7 

size of systems is driven more by their function than by the size of the airplane. In other words, 

the space needed for individual systems does not vary significantly with the size of the airplane. 

This fact means that larger airplanes can separate flight-critical systems to a greater extent than 

can small airplanes. Even if systems were scaled to the size of the airplane, the allowable 

separation distances would naturally increase with the size of the airplane. The separation 

requirement provided below recognizes this physical relationship. 

(2) To provide a reasonable and practical method for establishing a minimum 

separation between redundant systems, § 25.795(c)(2)(i) defines the following formula, which is 

derived from § 25.365(e), governing hole size for consideration of rapid decompression: 

ππ

0 PA3 2 H 2D ==

Where: 

H0 = PAs = the hole size from § 25.365(e); 

D = the diameter of a sphere that represents minimum separation distance 

between redundant systems in feet; 

As = maximum cross-sectional area of pressurized shell normal to the longitudinal 

axis in square feet; and 

024.0

6240

A P s +=

(3) The separation distance, D, need not exceed 5.05 feet. The designer should use this 

formula anywhere within the pressurized fuselage. The actual separation between systems 

should be such that the sphere derived above can pass between any parts of the systems. The 

FAA does not intend to apply the requirement to maintain system separation distances—based 

on this formula—to areas outside the fuselage inner mold line (IML), such as the wing root or 

empennage. 

(4) The designer may exclude certain areas within the fuselage from strict application 

of the separation criteria, but is expected to achieve the best separation distances possible. 

Specific areas that meet this limited exclusion include: 

(a) Fuel tanks. They are not a system that the designer can separate (fuel lines, 

on the other hand, would be included). 

(b) Flightdeck. Airplane geometry and convergence of systems in this area 

preclude full system separation. 

(c) Electronic and equipment bays. The concentration of many systems in a 

confined area prevents full separation. These areas should receive special consideration, since 

3 
10/24/08 AC 25.795-7 

they contain a large number of flight-critical systems. In this case, the designer should separate 

redundant systems within the compartment to maximize the potential for continued function after 

an event. This could be achieved, for example, by locating one of the redundant flight-critical 

systems in the portion of an electronic and equipment bay furthest from the passenger or cargo 

compartments, and other as far away as practicable. Blast shielding is not a substitute for system 

separation, but may be a useful approach for an electronic and equipment bay. 

(d) Other areas. Areas where physical separation is impractical due to airplane 

geometry or other constraints. An example is the aft fuselage area where the fuselage diameter 

tapers, preventing full separation. 

(5) Figure 1 shows the regions where the designer must separate critical systems. 

Compliance should be shown by design and analysis for each affected zone and flight-critical 

system. The sphere diameter represents the acceptable minimum separation. Although it is not 

required, we encourage greater separation where it is practicable. 

Figure 1. Regions Requiring Separation of Critical Redundant Systems 

(6) For areas that are within the fuselage but outside the pressurized area, one-half the 

sphere should be applied beyond the cabin boundary, e.g., aft of the aft pressure bulkhead. 

b. System Protection. 

(1) If separation of redundant systems is unattainable (i.e., impracticable) in a specific 

area required to be addressed, then one of the redundant systems and its vital components should 

be protected in that area. For system pairs that are not 100% redundant, the system providing the 

greater functionality should be the one that is protected. 

4 
10/24/08 AC 25.795-7 

(2) Acceptable systems shielding and/or inherent protection should be able to 

withstand fragment impacts from 0.5-inch diameter 2024-T3 aluminum spheres traveling 

430 feet per second without disabling the system. The ballistic resistance of 0.09-inch thick 

2024-T3 aluminum plate offers an equivalent level of protection. The manufacturer may take 

credit for any permanent barriers between the system and a potential explosive device location 

that can be shown to offer fragment protection. Any specific point on the barrier need only 

withstand one such impact. 

(3) In addition, the system design should incorporate features that minimize the risk of 

its failure due to relative displacement of the structure to which it is attached. These features 

may include flexibility in the system and/or in its mountings. Without test evidence, alleviating 

rationale, or special circumstances, the designer should provide for a minimum 6-inch relative 

displacement capability (except where such displacement would go beyond the fuselage contour) 

in any direction from a single-point force applied anywhere within the protected region. The 

designer may also incorporate frangible attachments or other features that would preclude system 

failure. 

(4) The designer should provide shielding to protect the systems against ballistic 

threats described in paragraph 6b(2), but not against blast pressures. Tests conducted by the 

FAA have shown that blast pressures do not affect the systems, and that efforts to defend the 

system against blast pressures will likely increase damage rather than mitigate it. Therefore, 

ballistic shielding should be no larger than absolutely necessary to allow the blast pressures to 

pass without resistance. 

Ali Bahrami 

Manager, Transport Airplane Directorate 

Aircraft Certification Service 

5